Molehunt: near-line semantic activity tracing

Abstract

Abstract-This paper discusses threats posed by low granularity in access to confidential (classified) data typically found at lower protection levels, namely direct access beyond need to know and the correlation of materials yielding more sensitive aggregate data by both insider threats and malware, an area of particular concern for intelligence analysis. It is argued that while active security controls at both the procedural and technical level are currently not pragmatically feasible, near-line semantic monitoring particularly at the file system but also at the network level can provide capabilities to detect anomalous and also directed malicious activity. A mechanism for implementing the tracing and monitoring mechanism on an COTS operating system is described.

Automated extraction of behavioural profiles from document usage

“…The storage can be allocated on any file system, but to retain the invisibility of the system to the user, this is best achieved by allocating one or more separate file systems to it and hiding it (at the level of the file system filter driver) from the remainder of the operating system, and hence from both observation and manipulation by users and application programs. For reasons of performance (since the mechanism makes use of the VM architecture), it is desirable to locate these shadowing volumes on local storage (see Wolthusen [1] for a discussion of performance benchmarks).…”

“…The mechanisms for interposition of an interception mechanism (with additional transparent in-line proxying for HTTPS (TLS) connections) have been described elsewhere [5,6]; by inserting kernel modules and driver components at several locations within the Windows NT network protocol stack, all inbound and outbound network traffic can be observed transparently without affecting application programs -for a discussion of the specific adaptations required for extracting sensor data refer to Wolthusen [1].…”

“…Based on earlier research [1], we argue that in such cases it will often be acceptable and desirable to employ only minimal (or otherwise feasible) security controls, but to augment these controls with an audit mechanism which in turn is coupled both with a behavioural anomaly detection mechanism and with forensic capabilities. For legitimate usage that is typically clustered around a selected number of tasks with limited deviations, this can direct the attention of security administrators to anomalous behaviour without requiring excessive initial and ongoing policy definition and implementation efforts.…”

A capability-based transparent cryptographic file system

“…Core elements of the implementation mechanisms used on the Microsoft Windows NT/XP platform have been described in earlier publications [24,23]. In addition to administrative functions for generating and maintaining capability lists (which are beyond the scope of this paper), the implementation mechanism consists of two extensions to the base OS.…”