Glatter, Casey | Search NASA

DOE OSTI2023

phenix v. 7.0

SAND2021-6741 O phenix is Sandia's orchestration tool that allows users to quickly deploy, un-deploy, and interact with SCEPTRE ICS environments. phenix is an orchestration tool used for managing the creation, configuration, and deployment of modeling and simulation environments. As an abstraction layer on top of an underlying virtual machine manager called minimega, phenix organizes the network, application, and scenario information for a given deployment. It allows users to create, configure, and deploy experiments in a repeatable and rapid fashion. An application framework provides the flexibility to manipulate an experiment to suit various needs and requirements. phenix also includes a web-based graphical user interface (GUI) where experiments can be created, configured, and interacted with.

Sahakian, Meghan↗

DOE OSTI2023

Experimental Validation of a Command and Control Traffic Detection Model

Network intrusion detection systems (NIDS) are commonly used to detect malware communications, including command-and-control (C2) traffic from botnets. NIDS performance assessments have been studied for decades, but mathematical modeling has rarely been used to explore NIDS performance. This paper details a mathematical model that describes a NIDS performing packet inspection and its detection of malware's C2 traffic. Here, the paper further describes an emulation testbed and a set of cyber experiments that used the testbed to validate the model. These experiments included a commonly used NIDS (Snort) and traffic with contents from a pervasive malware (Emotet). Results are presented for two scenarios: a nominal scenario and a “stressed” scenario in which the NIDS cannot process all incoming packets. Model and experiment results match well, with model estimates mostly falling within 95 % confidence intervals on the experiment means. Model results were produced 70-3000 times faster than the experimental results. Consequently, the model's predictive capability could potentially be used to support decisions about NIDS configuration and effectiveness that require high confidence results, quantification of uncertainty, and exploration of large parameter spaces. Furthermore, the experiments provide an example for how emulation testbeds can be used to validate cyber models that include stochastic variability.

mathematical model↗