Char Sample

Army Research Laboratory | ALC · Computational and Information Sciences Directorate (CISD)

Cybersecurity analysts ingest and process significant amounts of data from diverse sources in order to acquire network situation awareness. Visualizations can enhance the efficiency of analysts' workflow by providing contextual information, various sets of cybersecurity related data, information regarding alerts, among others. However, textual disp...

Technical advances in cyber-attack attribution continues to show incremental improvement. A growing interest in the role of the human in perception management, and decision-making suggest that other aspects of human cognition may be able to help inform attribution, and other aspects of cyber security such as defending and training. Values shape beh...

Attribution relies largely on technology; however, experts who rely on technology may inadvertently inject their own biases when evaluating findings. Attackers are now deceiving the analysts, by misleading them through the use of deceptive data and exploiting defender and analyst biases. One set of biases that can be objectively measured is cultura...

The multiple types of culture (e.g. national, social, religious, ethnic, geographic, organizational) that influence human behavioral characteristics and interactions also affect how humans interact with technology and the Internet. In an effort to further understand (and measure) how human factors influence cybersecurity risk, we propose incorporat...

An advisory lecture for doctoral graduate students on whether and how to publish dissertation research. Provides options and suggested considerations to assist the decision process.

The Domain Name System (DNS) provides the mapping information that allows software to associate names to IP addresses. The DNS software acts as an infrastructure service on the Internet and because so many applications rely on properly functioning DNS service, the DNS software is a popular and potent attack vector. Many of the DNS attacks can be pr...

Culture, according to Hofstede, Hofstede and Minkov (2010) acts as "software of the mind". This mental software should logically extend into computer network attack (CNA) behaviours. Sample (2013), successfully inferred this relationship when examining the relationship between nationalistic, patriotic website defacements and Hofstede's cultural dim...

A console host and intrusion negation system (CHAINS) includes a host component and a console component. The host component monitors resources at a server. Resources that are becoming overloaded can be throttled back. Reports relating to resource usage may be transmitted to the console component. At the console component, resource reports from mult...

Security automation continues to depend on signature models, but vulnerability exploitation is exceeding the abilities of such models. The authors, in reviewing the different types of mathematical-based constructs in anomaly detection, reveal how anomaly detection can enhance network security by potentially solving problems that signature models ca...

Computer Network Attack (CNA) attribution presents on going challenges for information security professionals. The distributed nature of the Internet combined with various anonymizing technologies contributes to making the attribution problem more difficult, especially when traversing hostile networks. What is needed is a new way to assist in attri...

A few months ago the author (with a small dedicated team) had the opportunity to review the RealSecure product from ISS and the NetRanger product from Cisco (The WheelGroup, at the time). They were considering these products for a rather large network, which covered a rather large region. These monitoring or intrusion detection systems (IDSs) are d...