Aiding Security Analytics -- From Dempster-Shafer Theory to Anthropology

Mar 04, 2015

Download: MP4 Video Size: 112.5MB  
Watch on YouTube

Abstract

Research on new technologies to help security analysts defend networks and systems from attacks has unique challenges --- the ad-hoc nature of attacks and their mitigation makes formal modeling elusive; the diverse threat scenarios of organizations makes a one-size-fit-all solution unlikely; and the lack of data and production deployment to test research prototypes makes evaluation extremely difficult.

In this talk I will describe the unique approaches we have been taking to address this problem. Since algorithms and tools that arise from this research are intended to help the tasks performed by human analysts, it becomes a pre-requisite for researchers to first understand how analysts do their jobs, and identify the key obstacles and bottlenecks for performance. I will explain how we designed/built the SnIPS system for intrusion analysis by eliciting expert knowledge through ad-hoc interviews, and the formulation of a customized Dempster-Shafer theory to capture how humans deal with the inherent uncertainty in this reasoning process. I then explain how this led us to eventually adopt an anthropological approach to address this research challenge.

Anthropology is a social science well known for its long-term participant observation method in which researchers spend substantial amounts of time living/working together with the subjects of study, as participant observers who take part in the daily lives and challenges of those they study, giving them a more empathic perspective understanding of their views, practices, and challenges. I will use the examples in my past eight years' research to explain why this type of ethnographic fieldwork is crucial and could be a very effective method to extract the "tacit knowledge" embodied in the practices of security analysts. Joining the "community of practice" of security operations will enable researchers to access the tacit knowledge, make it explicit, subject it to systematic analysis and modeling, and yield algorithms that execute the knowledge in an automated fashion. I will also talk about "unexpected findings" we are still deriving from on-going anthropological fieldwork at multiple
security operations centers.