Abstract

Experimental cybersecurity research is inherently risky. An experiment may involve releasing live malware code, operating a botnet, or creating highly disruptive network conditions. Realism is required in replicating attacks so that proposed defenses can be thoroughly tested and future attacks anticipated. This proposal, in addressing intellectual merit, seeks to develop a unique model for risky experiment management; enabling researchers to carry out experiments that interact with their larger environment while retaining both control and safety. The model forwarded here is based on a very simple line of reasoning: If the behavior of an experiment is completely unconstrained, the behavior of the host environment must be completely constraining, because it can assume nothing about the experiment; but, if the behavior of the experiment is constrained in some particular and well-chosen way or ways, the behavior of …

Date

2008

Authors

John Wroclawski, Jelena Mirkovic

Journal

NSF Award

Volume

8

Issue

831491

Pages

31491