Cross-layer personalization as a first-class citizen for situation awareness and computer infrastructure security

Aokun Chen; Pratik Brahma; Dapeng Oliver Wu; Natalie Ebner; Brandon Matthews; Jedidiah Crandall; Xuetao Wei; Michalis Faloutsos; Daniela Oliveira

doi:10.1145/3011883.3011888

Cross-layer personalization as a first-class citizen for situation awareness and computer infrastructure security

Aokun Chen, Pratik Brahma, Dapeng Oliver Wu, Natalie Ebner, Brandon Matthews, Jedidiah Crandall, Xuetao Wei, Michalis Faloutsos, Daniela Oliveira

Research output: Chapters, Conference Papers, Creative and Literary Works › RGC 32 - Refereed conference paper (with host publication) › peer-review

Abstract

We propose a new security paradigm that makes cross-layer personalization a premier component in the design of security solutions for computer infrastructure and situational awareness. This paradigm is based on the observation that computer systems have a personalized usage profile that depends on the user and his activities. Further, it spans the various layers of abstraction that make up a computer system, as if the user embedded his own DNA into the computer system. To realize such a paradigm, we discuss the design of a comprehensive and cross-layer profiling approach, which can be adopted to boost the effectiveness of various security solutions, e.g., malware detection, insider attacker prevention and continuous authentication. The current state-of-the-art in computer infrastructure defense solutions focuses on one layer of operation with deployments coming in a "one size fits all" format, without taking into account the unique way people use their computers. The key novelty of our proposal is the cross-layer personalization, where we derive the distinguishable behaviors from the intelligence of three layers of abstraction. First, we combine intelligence from: a) the user layer, (e.g., mouse click patterns); b) the operating system layer; c) the network layer. Second, we develop cross-layer personalized profiles for system usage. We will limit our scope to companies and organizations, where computers are used in a more routine and one-on-one style, before we expand our research to personally owned computers. Our preliminary results show that just the time accesses in user web logs are already sufficient to distinguish users from each other, with users of the same demographics showing similarities in their profiles. Our goal is to challenge today's paradigm for anomaly detection that seems to follow a monoculture and treat each layer in isolation. We also discuss deployment, performance overhead, and privacy issues raised by our paradigm.

©2016 ACM.

Original language	English
Title of host publication	NSPW '16
Subtitle of host publication	Proceedings of the 2016 New Security Paradigms Workshop
Publisher	Association for Computing Machinery
Pages	23-35
ISBN (Print)	978-1-4503-4813-3
DOIs	https://doi.org/10.1145/3011883.3011888
Publication status	Published - Sept 2016
Externally published	Yes
Event	25th New Security Paradigms Workshop, NSPW 2016 - Granby, United States Duration: 26 Sept 2016 → 29 Sept 2016

Publication series

Name	ACM International Conference Proceeding Series
Volume	26-29-September-2016

Conference

Conference	25th New Security Paradigms Workshop, NSPW 2016
Country/Territory	United States
City	Granby
Period	26/09/16 → 29/09/16

Bibliographical note

Publication details (e.g. title, author(s), publication statuses and dates) are captured on an “AS IS” and “AS AVAILABLE” basis at the time of record harvesting from the data source. Suggestions for further amendments or supplementary information can be sent to [email protected].

Research Keywords

Cross-layer personalization
Intrusion detection system

Access Output

10.1145/3011883.3011888

Other Access Options

Check CityUHK Library

Permanent Link

Right click to copy link

Cite this

Chen, A., Brahma, P., Wu, D. O., Ebner, N., Matthews, B., Crandall, J., Wei, X., Faloutsos, M., & Oliveira, D. (2016). Cross-layer personalization as a first-class citizen for situation awareness and computer infrastructure security. In NSPW '16: Proceedings of the 2016 New Security Paradigms Workshop (pp. 23-35). (ACM International Conference Proceeding Series; Vol. 26-29-September-2016). Association for Computing Machinery. https://doi.org/10.1145/3011883.3011888

@inproceedings{05d6529856244f56880d6eee0a507baa,

title = "Cross-layer personalization as a first-class citizen for situation awareness and computer infrastructure security",

abstract = "We propose a new security paradigm that makes cross-layer personalization a premier component in the design of security solutions for computer infrastructure and situational awareness. This paradigm is based on the observation that computer systems have a personalized usage profile that depends on the user and his activities. Further, it spans the various layers of abstraction that make up a computer system, as if the user embedded his own DNA into the computer system. To realize such a paradigm, we discuss the design of a comprehensive and cross-layer profiling approach, which can be adopted to boost the effectiveness of various security solutions, e.g., malware detection, insider attacker prevention and continuous authentication. The current state-of-the-art in computer infrastructure defense solutions focuses on one layer of operation with deployments coming in a {"}one size fits all{"} format, without taking into account the unique way people use their computers. The key novelty of our proposal is the cross-layer personalization, where we derive the distinguishable behaviors from the intelligence of three layers of abstraction. First, we combine intelligence from: a) the user layer, (e.g., mouse click patterns); b) the operating system layer; c) the network layer. Second, we develop cross-layer personalized profiles for system usage. We will limit our scope to companies and organizations, where computers are used in a more routine and one-on-one style, before we expand our research to personally owned computers. Our preliminary results show that just the time accesses in user web logs are already sufficient to distinguish users from each other, with users of the same demographics showing similarities in their profiles. Our goal is to challenge today's paradigm for anomaly detection that seems to follow a monoculture and treat each layer in isolation. We also discuss deployment, performance overhead, and privacy issues raised by our paradigm. {\textcopyright}2016 ACM.",

keywords = "Cross-layer personalization, Intrusion detection system",

author = "Aokun Chen and Pratik Brahma and Wu, {Dapeng Oliver} and Natalie Ebner and Brandon Matthews and Jedidiah Crandall and Xuetao Wei and Michalis Faloutsos and Daniela Oliveira",

note = "Publication details (e.g. title, author(s), publication statuses and dates) are captured on an “AS IS” and “AS AVAILABLE” basis at the time of record harvesting from the data source. Suggestions for further amendments or supplementary information can be sent to [email protected]. ; 25th New Security Paradigms Workshop, NSPW 2016 ; Conference date: 26-09-2016 Through 29-09-2016",

year = "2016",

month = sep,

doi = "10.1145/3011883.3011888",

language = "English",

isbn = "978-1-4503-4813-3",

series = "ACM International Conference Proceeding Series",

publisher = "Association for Computing Machinery",

pages = "23--35",

booktitle = "NSPW '16",

address = "United States",

}

Chen, A, Brahma, P, Wu, DO, Ebner, N, Matthews, B, Crandall, J, Wei, X, Faloutsos, M & Oliveira, D 2016, Cross-layer personalization as a first-class citizen for situation awareness and computer infrastructure security. in NSPW '16: Proceedings of the 2016 New Security Paradigms Workshop. ACM International Conference Proceeding Series, vol. 26-29-September-2016, Association for Computing Machinery, pp. 23-35, 25th New Security Paradigms Workshop, NSPW 2016, Granby, United States, 26/09/16. https://doi.org/10.1145/3011883.3011888

Cross-layer personalization as a first-class citizen for situation awareness and computer infrastructure security. / Chen, Aokun; Brahma, Pratik; Wu, Dapeng Oliver et al.
NSPW '16: Proceedings of the 2016 New Security Paradigms Workshop. Association for Computing Machinery, 2016. p. 23-35 (ACM International Conference Proceeding Series; Vol. 26-29-September-2016).

Research output: Chapters, Conference Papers, Creative and Literary Works › RGC 32 - Refereed conference paper (with host publication) › peer-review

TY - GEN

T1 - Cross-layer personalization as a first-class citizen for situation awareness and computer infrastructure security

AU - Chen, Aokun

AU - Brahma, Pratik

AU - Wu, Dapeng Oliver

AU - Ebner, Natalie

AU - Matthews, Brandon

AU - Crandall, Jedidiah

AU - Wei, Xuetao

AU - Faloutsos, Michalis

AU - Oliveira, Daniela

N1 - Publication details (e.g. title, author(s), publication statuses and dates) are captured on an “AS IS” and “AS AVAILABLE” basis at the time of record harvesting from the data source. Suggestions for further amendments or supplementary information can be sent to [email protected].

PY - 2016/9

Y1 - 2016/9

N2 - We propose a new security paradigm that makes cross-layer personalization a premier component in the design of security solutions for computer infrastructure and situational awareness. This paradigm is based on the observation that computer systems have a personalized usage profile that depends on the user and his activities. Further, it spans the various layers of abstraction that make up a computer system, as if the user embedded his own DNA into the computer system. To realize such a paradigm, we discuss the design of a comprehensive and cross-layer profiling approach, which can be adopted to boost the effectiveness of various security solutions, e.g., malware detection, insider attacker prevention and continuous authentication. The current state-of-the-art in computer infrastructure defense solutions focuses on one layer of operation with deployments coming in a "one size fits all" format, without taking into account the unique way people use their computers. The key novelty of our proposal is the cross-layer personalization, where we derive the distinguishable behaviors from the intelligence of three layers of abstraction. First, we combine intelligence from: a) the user layer, (e.g., mouse click patterns); b) the operating system layer; c) the network layer. Second, we develop cross-layer personalized profiles for system usage. We will limit our scope to companies and organizations, where computers are used in a more routine and one-on-one style, before we expand our research to personally owned computers. Our preliminary results show that just the time accesses in user web logs are already sufficient to distinguish users from each other, with users of the same demographics showing similarities in their profiles. Our goal is to challenge today's paradigm for anomaly detection that seems to follow a monoculture and treat each layer in isolation. We also discuss deployment, performance overhead, and privacy issues raised by our paradigm. ©2016 ACM.

AB - We propose a new security paradigm that makes cross-layer personalization a premier component in the design of security solutions for computer infrastructure and situational awareness. This paradigm is based on the observation that computer systems have a personalized usage profile that depends on the user and his activities. Further, it spans the various layers of abstraction that make up a computer system, as if the user embedded his own DNA into the computer system. To realize such a paradigm, we discuss the design of a comprehensive and cross-layer profiling approach, which can be adopted to boost the effectiveness of various security solutions, e.g., malware detection, insider attacker prevention and continuous authentication. The current state-of-the-art in computer infrastructure defense solutions focuses on one layer of operation with deployments coming in a "one size fits all" format, without taking into account the unique way people use their computers. The key novelty of our proposal is the cross-layer personalization, where we derive the distinguishable behaviors from the intelligence of three layers of abstraction. First, we combine intelligence from: a) the user layer, (e.g., mouse click patterns); b) the operating system layer; c) the network layer. Second, we develop cross-layer personalized profiles for system usage. We will limit our scope to companies and organizations, where computers are used in a more routine and one-on-one style, before we expand our research to personally owned computers. Our preliminary results show that just the time accesses in user web logs are already sufficient to distinguish users from each other, with users of the same demographics showing similarities in their profiles. Our goal is to challenge today's paradigm for anomaly detection that seems to follow a monoculture and treat each layer in isolation. We also discuss deployment, performance overhead, and privacy issues raised by our paradigm. ©2016 ACM.

KW - Cross-layer personalization

KW - Intrusion detection system

UR - http://www.scopus.com/inward/record.url?scp=85009154261&partnerID=8YFLogxK

UR - https://www.scopus.com/record/pubmetrics.uri?eid=2-s2.0-85009154261&origin=recordpage

U2 - 10.1145/3011883.3011888

DO - 10.1145/3011883.3011888

M3 - RGC 32 - Refereed conference paper (with host publication)

SN - 978-1-4503-4813-3

T3 - ACM International Conference Proceeding Series

SP - 23

EP - 35

BT - NSPW '16

PB - Association for Computing Machinery

T2 - 25th New Security Paradigms Workshop, NSPW 2016

Y2 - 26 September 2016 through 29 September 2016

ER -

Chen A, Brahma P, Wu DO, Ebner N, Matthews B, Crandall J et al. Cross-layer personalization as a first-class citizen for situation awareness and computer infrastructure security. In NSPW '16: Proceedings of the 2016 New Security Paradigms Workshop. Association for Computing Machinery. 2016. p. 23-35. (ACM International Conference Proceeding Series). Epub 2016 Sept 26. doi: 10.1145/3011883.3011888

Cross-layer personalization as a first-class citizen for situation awareness and computer infrastructure security

Abstract

Publication series

Conference

Bibliographical note

Research Keywords

Access Output

Other Access Options

Permanent Link

Other Files and Links

Fingerprint

Cite this