We introduce a new simulation platform called Insight, created to design and simulate cyber-attacks against large arbitrary target scenarios. Insight has surprisingly low hardware and configuration requirements, while making the simulation a realistic experience from the attacker's standpoint. The scenarios include a crowd of simulated actors: network devices, hardware devices, software applications, protocols, users, etc. A novel characteristic of this tool is to simulate vulnerabilities (including 0-days) and exploits, allowing an attacker to compromise machines and use them as pivoting stones to continue the attack. A user can test and modify complex scenarios, with several interconnected networks, where the attacker has no initial connectivity with the objective of the attack. We give a concise description of this new technology, and its possible uses in the security research field, such as pentesting training, study of the impact of 0-days vulnerabilities, evaluation of security countermeasures, and risk assessment tool.
Other interesting approaches to solve these problems include the framework developed by @cite_20 . While they focus on distributed denial of service attacks (DDoS) and defensive IDS analysis, we focus on offensive strategies to understand the scenarios and develop countermeasures. Also @cite_8 have integrated @cite_13 and @cite_16 to create a flexible and very detailed network laboratory and simulation tool. The latter project has privileged accuracy and virtualization over scalability and performance.
@cite_16 @cite_13 @cite_20 @cite_8
2130171629 1591055603 1532313454
Distributed Denial of Service (DDoS) flooding attacks are one of the biggest concerns for security professionals. DDoS flooding attacks are typically explicit attempts to disrupt legitimate users' access to services. Attackers usually gain access to a large number of computers by exploiting their vulnerabilities to set up attack armies (i.e., Botnets). Once an attack army has been set up, an attacker can invoke a coordinated, large-scale attack against one or more targets. Developing a comprehensive defense mechanism against identified and anticipated DDoS flooding attacks is a desired goal of the intrusion detection and prevention research community. However, the development of such a mechanism requires a comprehensive understanding of the problem and the techniques that have been used thus far in preventing, detecting, and responding to various DDoS flooding attacks. In this paper, we explore the scope of the DDoS flooding attack problem and attempts to combat it. We categorize the DDoS flooding attacks and classify existing countermeasures based on where and when they prevent, detect, and respond to the DDoS flooding attacks. Moreover, we highlight the need for a comprehensive distributed and collaborative defense approach. Our primary intention for this work is to stimulate the research community into developing creative, effective, efficient, and comprehensive prevention, detection, and response mechanisms that address the DDoS flooding problem before, during and after an actual attack. Distributed denial of service (DDoS) is one of the most persecution network attack techniques to be confronted in recent years. From the definition of DDoS, thousands of network attacks must initiate simultaneously and continuously to achieve a successful DDoS attacking. Therefore, almost all of the information system cannot survive as they confront the DDoS attacks. Although there are a lot of intrusion detection system (IDS) developed, preventing DDoS attack is still difficult and perplexing. In this paper, an early warning system for detecting DDoS attacking has been mounted to a traditional IDS to form a completely system. This early warning system is developed based on the rationale of time delay neural network. In the networking topology, each node is monitored with the deployment of detectors to establish a multilayer architecture. In addition, the activities of each node will be monitored by their neighboring nodes to check whether it is still survival or not mutually. After then, all of the attacking information will be collected and transferred to the expert module for integrating analysis. As those nodes dispatched on the DMZ or between the first and second layer of firewall face some attacking similar as the pattern of DDoS, the kernel expert module which dispatched behind the second firewall will take some feasible actions and initiate the defense strategies to protect the kernel information system. In the meanwhile, those failed nodes will be restarted and act as the role of vanguard to assure the networking under normal operation. In a document network such as a citation network of scientific documents, web-logs, etc., the content produced by authors exhibits their interest in certain topics. In addition some authors influence other authors' interests. In this work, we propose to model the influence of cited authors along with the interests of citing authors. Moreover, we hypothesize that apart from the citations present in documents, the context surrounding the citation mention provides extra topical information about the cited authors. However, associating terms in the context to the cited authors remains an open problem. We propose novel document generation schemes that incorporate the context while simultaneously modeling the interests of citing authors and influence of the cited authors. Our experiments show significant improvements over baseline models for various evaluation criteria such as link prediction between document and cited author, and quantitatively explaining unseen text. Abstract Documents in computer-readable form can be used to provide information about other documents, i.e. those they cite. To do this efficiently requires procedures for computer recognition of citing statements. This is not easy, especially for multi-sentence citing statements. Computer recognition procedures have been developed which are accurate to the following extent: 73 of the words in statements selected by computer procedures as being citing statements are words which are correctly attributable to the corresponding documents. The retrieval effectiveness of computer-recognized citing statements was tested in the following way. First, for eight retrieval requests in inorganiic chemistry, average recall by search of Chemical Abstracts Service indexing and Chemical Abstracts abstract text words was found to be 50 . Words from citing statements referring to the papers to be retrieved were then added to the index terms and abstract words as additional access points, and searching was repeated. Average recall increased to 70 . Only words from citing statements published within a year of the cited papers were used. The retrieval effect of citing statement words alone (published within a year) without index or abstract terms was the following: average recall was 40 . When just the words of the titles of the cited papers were added to those citing statement words, average recall increased to 50 .