In this talk we highlight how Zeek can play a crucial role in enabling various tenets of Zero-Trust. We start with looking at fundamental design goals of Zeek itself from the time when Zero-trust was not even a buzzword. We further discuss Zero Trust security models – specifically the Networking Piller – and how Zeek can facilitate Zero Trust postures of visibility, automation and analytics. At the end of this talk we focus on Zeek’s challenges in optimal zero trust implementation and discuss possible solutions.

Hands-on Zeek Scripting training, Aashish Sharma will walk attendees through the fundamentals of Zeek Scripting along with some practical exercises. This training will cover scripting basics, and will then advance through various Zeek script frameworks. In the training, we will cover how to work with Zeek events and datatypes, how to create custom datatypes, how to create custom log-files and notices, how to use probabilistic datastructures, how to load data into Zeek. We also will talk about some clusterization techniques. The training will end by walking attendees through the process of developing a new heuristic and wrapping it into a package. This will be a hands-on training. There will be an introduction for each topic, followed by hands-on exercises.

Bro Exchange 2012, National Center for Atmospheric Research (NCAR), Boulder, Co, Aug 7-8, 2012

Challenges and Strategies for Network monitoring in an Open Research Network

DoE Network Security Monitoring Conference, Oct 2012, Idaho Falls, Idaho

2011 IT Security Symposium

19th Annual FIRST Conference

NSF Security Summit on AI and Cyber Defense

Impostors who have stolen a user’s SSH login credentials can inflict significant harm to the systems to which the user has remote access. We consider the problem of identifying such imposters when they conduct interactive SSH logins by detecting discrepancies in the timing and sizes of the client-side data packets, which generally reflect the typing dynamics of the person sending keystrokes over the connection. The problem of keystroke authentication using unknown freeform text has received limited-scale study to date. We develop a supervised approach based on using a transformer (a sequence model from the ML deep learning literature) and a custom “partition layer” that, once trained, takes as input the sequence of client packet timings and lengths, plus a purported user label, and outputs a decision regarding whether the sequence indeed corresponds to that user. We evaluate the model on 5 years of labeled SSH PCAPs (spanning 3,900 users) from a large research institute. While the performance specifics vary with training levels, we find that in all cases the model can catch over 95% of (injected) imposters within the first minutes of a connection, while incurring a manageable level of false positives per day.