Ph.D. Dissertation Defense

A Security Framework to Cope With
Node Misbehaviors in Mobile Ad Hoc Networks

Wenjia Li

11:00am Tuesday, 14 June 2011, ITE 325b

A Mobile Ad-hoc NETwork (MANET) has no fixed infrastructure, and is generally composed of a dynamic set of cooperative peers. These peers share their wireless transmission power with other peers so that indirect communication can be possible between nodes that are not in the radio range of each other . The nature of MANETs, such as node mobility, unreliable transmission medium and restricted battery power, makes them extremely vulnerable to a variety of node misbehaviors. Wireless links, for instance, are generally prone to both passive eavesdropping and active intrusion. Another security concern in ad hoc networks is caused by the cooperative nature of the nodes. Attacks from external adversaries may disturb communications, but the external intruder generally cannot directly participate in the cooperative activities among the nodes because they do not possess the proper secure credentials, such as shared keys. However, compromised nodes, which are taken over by an adversary, are capable of presenting the proper secure credentials, and consequently can interfere with almost all of the network operations, including route discovery, key management and distribution, and packet forwarding. Hence, it is essential to cope with node misbehaviors so as to secure mobile ad hoc networks.

In this dissertation, we address the question of how to ensure that a MANET will properly operate despite the presence of various node misbehaviors by building a holistic framework that can cope with various node misbehaviors in an intelligent and adaptive manner. The main purpose of this framework is to provide a platform so that the components that identify and respond to misbehaviors can better cooperate with each other and quickly adapt to the changes of network context. Therefore, policies are utilized in our framework in order to make those components correctly function in different network contexts. Besides the policy component, there are three other components, which fulfill the tasks of misbehavior detection, trust management, and context awareness, respectively. To validate and evaluate our proposed framework, we implement our framework based on a simulator.

The specific contributions of this dissertation are: (i) Develop a framework to combine the functionalities of surveillance and detection of misbehavior, trust management, context awareness, and policy management to provide a high-level solution to cope with various misbehaviors in MANETs in an intelligent and adaptive manner; (ii) Utilize the outlier detection technique as well as the Support Vector Machine (SVM) algorithm to detect node misbehaviors, and both techniques do not require a pre-defined fix threshold for misbehavior detection; (iii) Trust is modeled in a vector instead of a single scalar so that it can reflect the trustworthiness of a node in a more accurate manner; (iv) Sense and record various contextual information, such as network status (channel busy/idle, etc.), node status (transmission buffer full/empty, battery full/low, etc.) and environmental factors (altitude, velocity, temperature, weather condition, etc.), so that we can distinguish truly malicious behaviors from faulty behaviors and also more accurately evaluate nodes' trust; (v) Specify and enforce policies in the proposed framework, which makes the framework promptly adapt to the rapidly changing network context.

Committee:

• Dr. Anupam Joshi (Chair)
• Dr. Tim Finin
• Dr. Yelena Yesha
• Dr. Yun Peng
• Dr. Lalana Kagal (MIT CSAIL)

Dr. Rick Forno will discuss UMBC’s Cybersecurity programs and give updated details about the upcoming Maryland Cyber Challenge at a UMBC Cybersecurity Webinar at 1:00pm on Thursday June 9.

The webinar will describe the UMBC Cybersecurity programs, covering:

• Master of Professional Studies and graduate certificate program details
• Innovative curriculum highlights
• Convenient and flexible class schedules
• Opportunities for career development and professional advancement

Dr. Forno will also discuss the Maryland Cyber Challenge and Conference:

• Participate in a competition to find Maryland’s best minds in Cybersecurity
• Details will be given about the October 2011 Baltimore Conference
• How to get involved as a sponsor or partner and promote cybersecurity in Maryland!

The webinar is free but requires registration.

The Maryland Cyber Challenge and Conference site is up and student teams can now register for the competition, with the first qualifying round early in September. It is a chance to demonstrate your ability to work in a team and your cybersecurity and problem solving skills.

MDC3 is a joint effort between SAIC, UMBC, DBED, TCM and NCSA to bring people together to promote Maryland's commitment to cybersecurity and STEM education. The competition includes three levels: high school, collegiate and professionals from industry/government, providing opportunities to network with cybersecurity professionals, researchers, and scholars.

There will be orientation sessions at the UMBC Technology Center (1450 South Rolling Rd., 21224) on May 2, May 18 and June 21 at 4:30pm for professionals and 6:00pm for students.

The Threat is Real

Sherri Ramsay
Director, NSA/CSS Threat Operations Center

10:00am Friday 22 April 2011, 229 ITE

Sherri Ramsay, the Director of the National Security Agency's National Threat Operations Center, will present an overview of contemporary issues in cybersecurity entitled "The Threat is Real". The NSA Threat Operations Center monitors the operations of the global network to identify network-based threats and protect U.S. and allied networks.

Sherri Ramsay serves as the Director of the National Security Agency/Central Security Service Threat Operations Center, an organization operating under Signals Intelligence and Information Assurance authorities simultaneously to establish real-time global network awareness and threat characterization. Ms. Ramsay most recently served in the Information Assurance Directorate as Deputy Chief of the Vulnerability Analysis and Operations Group. She began her career at NSA as a computer programmer and served as a Software Acquisition Manager, System Acquisition Manager, and Program Manager for several large-scale programs. She spend a year of extensive leadership training, research and developmental assignments while participating in OPM’s Executive Potential Program.

Ms. Ramsay graduated Magna Cum Laude with General Honors from the University of Georgia in 1977 with a Bachelor of Science degree majoring in Mathematics and Education. She graduated with Honors from the Johns Hopkins University in 1984 with a Masters Degree in Computer Science. In 1992, she graduated from OPM’s Executive Potential Program. She graduated in 1998 form the Industrial College of the Armed Forces, National Defense University, Ft. McNair, with a Mater’s Degree in National Resource Strategy. Prior to joining NSA, Ms. Ramsay taught high school mathematics. She received the NSA Meritorious Civilian Service Award in 1998 and 2000, the National Intelligence Meritorious Unit Citation in 1998, the Louis Tordella Award in 2003, and the Presidential Meritorious Executive Award in 2009.

· directions · talks · events ·

The UMBC Cyber Defense Team, aka the Cyberdawgs, will host a technical briefing on Monday April 4 featuring two guest speakers from the DoD. The topic will be the cyber competitions between the service academies, and other cyber-related topics may come up as well. The meeting will be held in the CSEE conference room, ITE 325b, from Noon to 2:00pm.

The Cyber Defense Team is a SGA recognized student organization whose members share a common interest in computer and network security and participating in cybersecurity competitions and events. It is open to everyone regardless of your major or current knowledge level. If you are interested in joining come to this meeting or any of the weekly meetings held on Monday's from Noon to 2:00pm. You can also subscribe to its mailing list by sending a message to Sorry, you need javascript to view this email address.

UMBC Linux Users Group

SELinux Talk and Tutorial

David Quigley
Advanced Engineering & Development, Keyw Corporation

4:00pm Friday, 1 April 2011
Room 229 ITE, UMBC

Over a decade ago researchers at the National Information Assurance Research Lab at the NSA identified a need for flexible mandatory access controls to help provide a solid foundation for secure systems. This resulted in the development of the FLASK architecture, which has seen implementation in a number of operating systems. The most prominent implementation of FLASK is in the form of SELinux. Since the early days of SELinux adoption much work as been done to improve the utility and usability of SELinux. These enhancement have turned SELinux from a prototype research implementation into a robust access control mechanism that is used by a variety of customers world wide.

This talk is a from the ground up journey through SELinux. It starts with why do we need this technology and then moves through where to obtain it, how it works, and how to identify and solve problems associated with SELinux. In addition to these basics the talk also covers slightly more advanced topics such as hot to construct policy for new applications and hot to address customizations particular to your deployments.

David Quigley started his career as a Computer Systems Researcher for the National Information Assurance Research Lab at the NSA where he worked as a member of the SELinux team but has since left that position. David leads the design and implementation efforts to provide Labeled-NFS support for SELinux. David has previously contributed to the open source community through maintaining the Unionfs 1.0 code base and through code contributions to various other projects. David has presented at conferences such as the Ottawa Linux Symposium, the StorageSS workshop, LinuxCon and several local Linux User Group meetings where presentation topics have included storage, file systems, and security. David currently works as a Computer Science Professional for the Advanced Engineering and Development division at Keyw Corporation.

This talk is sponsored by the UMBC Linux Users' Group.

· directions · talks · events ·

The UMBC cybersecurity graduate MPS program will host an informal information session from Noon to 1:00pm on Wednesday, April 6 in ITE Lecture Hall 7. Attend to hear the benefits and practical applications of the program and meet staff members who will be available to answer questions.

The program allows students to:

• Learn from both research faculty and industry practitioners
• Acquire the latest knowledge and skills and get the preparation you need to make meaningful contributions to the fieldDevelop a network of fellow students and faculty that will benefit you throughout your career
• Choose either a post graduate certificate or master's degree

UMBC is designated as a Center for Academic Excellence in Information Assurance Education (CAE) as well as a Center of Academic Excellence in Research (CAE-R) by the National Security Agency and Department of Homeland Security.

The program is now accepting applications for Fall 2011. See the Cybersecurity program Web site more information.

Telcordia and Ross Technologies will open offices in the bwtech@UMBC Research and Technology Park this spring with a focus on cybersecurity. Both companies will share space in the research park's newest building with Northrop Grumman’s Cync program, a new incubator that will nurture high-potential, early-stage companies as they develop tools to secure and protect the computer hardware, software and networks vital to national defense. The companies will join a growing cluster of businesses drawing on UMBC's resources and information technology expertise and the region’s strengths in security technology.

Telcordia, a global leader in communications software, will open an office to develop tools to support and protect vital communications networks. According to a UMBC News release:

“Telcordia has been heavily engaged with the cybersecurity community by ensuring and advancing the protection of critical infrastructure elements,” said Brent Greene, President, Advanced Technology Solutions, Telcordia. “bwtech with its cybersecurity focused programs and its local talent pool of highly qualified engineers, scientists and professors made our decision easy.”

Ross Technologies (RTGX) is a growing Maryland company that helps businesses and government agencies take a system-wide approach to securing computer systems. C-Volve, an cyber intelligence company focused cyber network defense and data breach security and risk mitigation that is being mentored by RTGX will also be based at bwtech. UMBC news release notes that

Armando Seay, who founded RTGX with Kathy Adams in 1997, said he is excited that the new location will put the company adjacent to the campus of the University of Maryland, Baltimore County (UMBC), and within a short drive of national intelligence and cybersecurity resources at Fort Meade. “We are thrilled to be moving our headquarters to bwtech,” Seay said. “This location will help us find fresh talent coming out of UMBC and further our goal of innovating in the field of cybersecurity.”

UMBC, SAIC, the National Cyber Security Alliance, the Tech Council of Maryland, and the Maryland Department of Business and Economic Development have joined to hold the Maryland Cyber Challenge and Conference on October 21-22, 2001. The event is designed to increase cyber awareness as a career choice in Maryland, improve the appreciation for cyber oriented curriculum in college and high schools, and convey cyber defense as a sport to increase interest in careers involving cyber security.

The competition will be divided into high school, collegiate and professional divisions. Qualifying rounds take place over the Internet between April and August 2011 using SAIC's Cyber Network Exercise System (CyberNEXS), a scalable training, exercise and certification system.  The top eight teams in each division will meet at the MDC3 event in October for the final round followed by an award ceremony at UMBC. MDC3 participants will also be able to learn from and network with other cybersecurity professionals, researchers, and scholars at the conference, which will include presentations, a career fair and a vendor exhibition.

For more information see this press release and the SAIC MDC3 site.

The North American electric power system has been called the world's largest interconnected machine and is a key part of our national infrastructure. The power grid is evolving to better exploit modern information technology and become more integrated with our cyber infrastructure. This presents unprecedented opportunities for enhanced management and efficiency but also introduces vulnerabilities for intrusions, cascading disruptions, malicious attacks, inappropriate manipulations and other threats. Similar issues are foreseen for other cyber-physical infrastructure systems including industrial control systems, transportation, water, natural gas and waste disposal.

A one-day Smart Grid Cyber Security Conference will be held at UMBC on February 15, hosted by the UMBC Computer Science and Electrical Engineering Department and Maryland Clean Energy Technology Incubator. The conference will be a comprehensive presentation by the National Institute of Standards and Technology regarding an Inter-agency Report 7628 (NISTIR 7628) named Guidelines for Smart Grid Cyber Security which is a critically important document for guiding government, regulatory organizations, industry and academia on Smart Grid cybersecurity. This regional outreach conference is valuable to any organization that is planning, integrating, executing or developing cyber technology for the Smart Grid.

The conference is free, but participants are asked to register in advance to help us organize for the correct number of participants.

A full copy of the 600 page report is available here.