MilcordWiki - Recent changes [en]

Botnet Defense

2012-05-18T19:49:15Z

References:

Botnet Threat Intelligence

2012-05-18T18:57:49Z

Attack Graph Simulation Approach to Cyber Defense Training

2012-05-18T17:33:13Z

← Older revision		Revision as of 17:33, 18 May 2012
Line 1:		Line 1:
	__NOTOC__		__NOTOC__
	== Overview ==		== Overview ==
-	~~RealContext is our cyber defense training solution based on an attack graph simulation.~~	+	With the alarming escalation in the volume and sophistication of network attacks, the training of professionals who design, operate, maintain, and protect the networks becomes increasingly urgent. RealContext is our cyber defense training solution based on an attack graph simulation. Attack graphs depict ways in which an adversary can exploit vulnerabilities to break into a system.
-	With the alarming escalation in the volume~~, sophistication,~~ and ~~destruction~~ of network attacks, the training of professionals who design, operate, maintain, and protect the networks becomes increasingly urgent.	+
	== Need ==		== Need ==
-	With ~~increasing levels of vulnerabilities, exploits, worms, viruses, and~~ the increasing sophistication of the attacker profile, the training of security personnel is essential in the protection of DoD infrastructure and mission critical information assets. [http://www.defenselink.mil/cio-nii/infoassurance/diap/accessible/Index-a.html DIAP (Defense-wide Information Assurance Program)] notes some of the some of the ~~implications of implementing 8570:~~ the uncertain size (150,000) of the professional CNDO (Computer Network Defensive Operations), the costs of certification and testing, the quality of instructor knowledge and curriculum currency in training and education, the lack of training exercises, and the unknown effectiveness of training and education programs on user behavior and security posture.	+	With the increasing sophistication of the attacker profile, the training of security personnel is essential in the protection of DoD infrastructure and mission critical information assets. [http://www.defenselink.mil/cio-nii/infoassurance/diap/accessible/Index-a.html DIAP (Defense-wide Information Assurance Program)] notes some of the some of the issues associated with combating this challenge to include the uncertain size (150,000) of the professional CNDO (Computer Network Defensive Operations) staff, the costs of certification and testing, the quality of instructor knowledge and curriculum currency in training and education, the lack of training exercises, and the unknown effectiveness of training and education programs on user behavior and security posture.
	== Approach ==		== Approach ==
	[[Image:Skybox.jpg\|thumb\|left\|400px\|Attack Graph Simulation Analysis]] [[Image:ITS.jpg\|thumb\|right\|400px\|Intelligent Tutoring System]]		[[Image:Skybox.jpg\|thumb\|left\|400px\|Attack Graph Simulation Analysis]] [[Image:ITS.jpg\|thumb\|right\|400px\|Intelligent Tutoring System]]
-	In the vulnerability assessment area, attack graphs create a graphical structured model to describe the ways in which a system ~~may~~ be compromised. By using network topology based ~~graph~~ attack simulations that are ~~synched~~ with a vulnerability dictionary, students ~~will be~~ able to understand the ways in which computer networks ~~will~~ be ~~attacked~~, determine the likelihood and impact of these attacks and decide what action to take where the risks are unacceptable.	+	In the vulnerability assessment area, attack graphs create a graphical structured model to describe the ways in which a system can be compromised. By using network topology based attack graph simulations that are synced with a vulnerability dictionary, students are able to understand the ways in which computer networks are able to be comprised, determine the likelihood and impact of these attacks and decide what action to take where the risks are unacceptable.

-	RealContext - built on the [http://www.skyboxsecurity.com Skybox Security] attack graph simulation platform - captures attackers’ techniques and multi-stage decision processes to develop a vulnerability assessment picture for the student. Our approach displays the domain expert’s decisions both visually as attack maps and textually as reports to guide students towards achieving the same. Our research demonstrates the feasibility of an attack graph simulation approach to cyber defense training by developing student, teacher and curriculum models. The figures show the use of the use of the attack graph simulation platform within the intelligent tutoring system shell:	+	RealContext - built on the [http://www.skyboxsecurity.com Skybox Security] attack graph simulation platform - captures attackers’ techniques and multi-stage decision processes to develop a vulnerability assessment picture for the student. Our approach displays the domain expert’s decisions both visually as attack maps and textually as reports to guide students towards achieving the same. Our research demonstrates the feasibility of an attack graph simulation approach to cyber defense training by developing student, teacher, and curriculum models. The figures show the use of the use of the attack graph simulation platform within the intelligent tutoring system shell:

	What is the source of the highest risk attack on the Personnel Badge System?		What is the source of the highest risk attack on the Personnel Badge System?
Line 24:		Line 23:
	In contrast to synthetic simulation authoring environments, which generate shallow models, RealContext focuses on leveraging the COTS modeling and simulation tools that the students will use in an operational setting after training, thus coming closer to the vision of learning by doing with retention rates of about 80%. In addition, our application addresses a gap in security training courseware – information assurance security risk management.		In contrast to synthetic simulation authoring environments, which generate shallow models, RealContext focuses on leveraging the COTS modeling and simulation tools that the students will use in an operational setting after training, thus coming closer to the vision of learning by doing with retention rates of about 80%. In addition, our application addresses a gap in security training courseware – information assurance security risk management.
	== Applications ==		== Applications ==
-	Our product ~~will serve~~ Federal agencies that need to respond to the training compliance challenges of FISMA and DoD Directive 8570.1. Educational institutions serving the information assurance training market in the government and commercial sectors will be the early adopters of our technology. Another target segment would be the system integrators that provide training and assessment in the information assurance training market.	+	Our product serves Federal agencies that need to respond to the training compliance challenges of FISMA and DoD Directive 8570.1.
	== References ==		== References ==
-	* Caglayan, A., Thompson, P, and Bratus, S. ''[http://www.iwar.org.uk/infocon/dtic-ia/Vol6_No4.pdf A Graph Attack Simulation Approach to Vulnerability Management]'' IATAC IAnewsletter, Vol. 6, No. 4, Spring 2004.	+	* Caglayan, A., Thompson, P, and Bratus, S. '''[http://www.iwar.org.uk/infocon/dtic-ia/Vol6_No4.pdf A Graph Attack Simulation Approach to Vulnerability Management]''' IATAC IAnewsletter, Vol. 6, No. 4, Spring 2004.
-	* Caglayan, A., Hewlett, R., Taylor, H. and Lyle, M. (2006) “A Real Context Simulation Approach to Cyber Defense ~~Training”~~, Technical Report, [https://dtic-stinet.dtic.mil/stinet/jsp/docread.jsp?K2DocKey=https%3A%2F%2Fdtic-stinet.dtic.mil%2Fstinet%2FGetDataService%3FreqType%3DtrCitation%26docId%3DADB324372%40trB-search-v2&Format=1F&Custom=&querytext=milcord&AD=ADB324372&TI=Real+Context+Simulation DTIC AD Number ADB324372], Milcord LLC, Waltham, MA Jan. 2006.	+	* Caglayan, A., Hewlett, R., Taylor, H. and Lyle, M. (2006) '''A Real Context Simulation Approach to Cyber Defense Training''', Technical Report, [https://dtic-stinet.dtic.mil/stinet/jsp/docread.jsp?K2DocKey=https%3A%2F%2Fdtic-stinet.dtic.mil%2Fstinet%2FGetDataService%3FreqType%3DtrCitation%26docId%3DADB324372%40trB-search-v2&Format=1F&Custom=&querytext=milcord&AD=ADB324372&TI=Real+Context+Simulation DTIC AD Number ADB324372], Milcord LLC, Waltham, MA Jan. 2006.

	[[Category:Cyber Security]]		[[Category:Cyber Security]]
	[[Category:Intelligent Tutoring System]]		[[Category:Intelligent Tutoring System]]
	[[Category:Attack Graph Simulation]]		[[Category:Attack Graph Simulation]]

Open Innovation

2012-05-13T19:18:53Z

← Older revision		Revision as of 19:18, 13 May 2012
(One intermediate revision not shown)
Line 46:		Line 46:
	* [[Commercial Initiatives\| more commercial initiatives ...]]		* [[Commercial Initiatives\| more commercial initiatives ...]]

-	== [[Open Innovation software\|~~tools~~]] ==	+	== [[Open Innovation software\|software]] ==
		+	*[http://ushahidi.com/ Ushahidi] is an open source platform for information collection, visualization and interactive mapping of international political events.
	*[http://www.brightidea.com Brightidea] is a software platform that allows businesses to monitor the social process of innovation.		*[http://www.brightidea.com Brightidea] is a software platform that allows businesses to monitor the social process of innovation.
	*[http://www.spigit.com spigit] is a platform that enables organizations to tap into the collective intelligence of employees, customers, partners and fans to help tackle business objectives by incorporating game mechanics.		*[http://www.spigit.com spigit] is a platform that enables organizations to tap into the collective intelligence of employees, customers, partners and fans to help tackle business objectives by incorporating game mechanics.
Line 53:		Line 54:
	*[http://ideascale.com/ IdeaScale] enables an organization to build key relationships with its stakeholders by bringing the power of My Starbucks Idea type interaction to any organization.		*[http://ideascale.com/ IdeaScale] enables an organization to build key relationships with its stakeholders by bringing the power of My Starbucks Idea type interaction to any organization.
	* [[Open Innovation software\|more open innovation software ...]]		* [[Open Innovation software\|more open innovation software ...]]
-

	== [[Innovation Marketplace\|innovation marketplace]] ==		== [[Innovation Marketplace\|innovation marketplace]] ==

Open Innovation software

2012-05-13T18:29:13Z

Created page with "*[http://www.brightidea.com Brightidea] is a software platform that allows businesses to monitor the social process of innovation. *[http://www.spigit.com spigit] is a platform t..."

New page

*[http://www.brightidea.com Brightidea] is a software platform that allows businesses to monitor the social process of innovation.
*[http://www.spigit.com spigit] is a platform that enables organizations to tap into the collective intelligence of employees, customers, partners and fans to help tackle business objectives by incorporating game mechanics.
*[http://www.chaordix.com/ Chaordix] is a managed services platform for crowdsourcing.
*[http://www.consensuspoint.com Consensus Point] Huunu prediction market software enables an enterprise to tap into the knowledge of their community in order to accelerate innovation and decision-making.
*[http://ideascale.com/ IdeaScale] enables an organization to build key relationships with its stakeholders by bringing the power of My Starbucks Idea type interaction to any organization.

Open Innovation

2012-05-13T18:28:23Z

← Older revision		Revision as of 18:28, 13 May 2012
(20 intermediate revisions not shown)
Line 2:		Line 2:
	<meta name="keywords" content="open innovation,innovation,interviews,government,commercial,academic,research,blogs,books,events,innovation marketplace,marketplace,milcord,intelligent software,software development,software,IT,knowledge management,open source,collaborative,collaboration,social models,geospatial intelligence,information security,information management,stability operations,counterterrorism,COIN,counterinsurgency,insurgency,law enforcement,cyber defense,risk modeling,open source intelligence,OSINT,open source,intelligent video surveillance,motion imagery,geospatial,GIS,KM,COA,forecasting,modeling and simulation,modeling,simulation,software development,military consulting,government consulting,DOD,defense,DHS,homeland security,DOE,department of energy,Army AGC,Army,ONR,naval research,topographic engineering,AFRL,air force research labs,air force,NASA" />		<meta name="keywords" content="open innovation,innovation,interviews,government,commercial,academic,research,blogs,books,events,innovation marketplace,marketplace,milcord,intelligent software,software development,software,IT,knowledge management,open source,collaborative,collaboration,social models,geospatial intelligence,information security,information management,stability operations,counterterrorism,COIN,counterinsurgency,insurgency,law enforcement,cyber defense,risk modeling,open source intelligence,OSINT,open source,intelligent video surveillance,motion imagery,geospatial,GIS,KM,COA,forecasting,modeling and simulation,modeling,simulation,software development,military consulting,government consulting,DOD,defense,DHS,homeland security,DOE,department of energy,Army AGC,Army,ONR,naval research,topographic engineering,AFRL,air force research labs,air force,NASA" />
	__NOTOC__		__NOTOC__
-	[[Image:Open-Innovation.jpg\|thumb\|left\|300pix\|[[Open Innovation]] is a term coined by Henry Chesbrough, while he was at the Harvard Business School, that promotes distributed knowledge, where companies do not solely rely entirely on their own research, but leverage from their external networks. ]]	+	[[Image:Open-Innovation.jpg\|thumb\|left\|300pix\|[[Open Innovation]] is a term coined by Henry Chesbrough, while he was at the Harvard Business School, that promotes distributed knowledge, where companies do not solely rely entirely on their own research, but leverage from their external networks.Although innovation prizes have been around for centuries, the opening of closed R&D to external networks brought about a new era in managing innovation.]]

	Open Innovation is the corporate development of lower-cost, higher-quality ideas from the best sources in the world by collaborating with outsiders—including customers, vendors and even competitors. Milcord practices open innovation by [[Partners\|collaborating]] with university research labs, systems integrators, and venture backed technology startup companies to develop [[Solutions\|solutions]] for various Federal agencies.		Open Innovation is the corporate development of lower-cost, higher-quality ideas from the best sources in the world by collaborating with outsiders—including customers, vendors and even competitors. Milcord practices open innovation by [[Partners\|collaborating]] with university research labs, systems integrators, and venture backed technology startup companies to develop [[Solutions\|solutions]] for various Federal agencies.
Line 22:		Line 22:

	== [[Organization Initiatives\|.org]] ==		== [[Organization Initiatives\|.org]] ==
		+	The multi-organizational nature of solutions required for social problems fit naturally to the open innovation model.
		+	*[http://www.xprize.org X PRIZE Foundation] is an educational nonprofit organization addresses the world’s Grand Challenges by creating and managing large-scale, high-profile, incentivized prize competitions that stimulate investment in research and development.
	*[http://www.unglobalpulse.org UN Global Pulse] is a United Nations initiative to close the information gap between the onset of a global crisis and the availability of actionable information to protect vulnerable populations.		*[http://www.unglobalpulse.org UN Global Pulse] is a United Nations initiative to close the information gap between the onset of a global crisis and the availability of actionable information to protect vulnerable populations.
	*[http://www.healthmap.org HealthMap] , started at the Children's Hospital Boston in 2006, uses online informal sources for disease outbreak monitoring and real-time surveillance of emerging public health threats.		*[http://www.healthmap.org HealthMap] , started at the Children's Hospital Boston in 2006, uses online informal sources for disease outbreak monitoring and real-time surveillance of emerging public health threats.
Line 30:		Line 32:
	== [[Education Initiatives\|.edu]] ==		== [[Education Initiatives\|.edu]] ==
	[[File:All_Our_Ideas.jpg\|thumb\|right]]		[[File:All_Our_Ideas.jpg\|thumb\|right]]
-	Higher education is warming up to collaborative ~~wikis~~ as exemplified by some of the recent initiatives:	+	Higher education is warming up to collaborative educational applications as exemplified by some of the recent initiatives:
		+	*[http://tippie.uiowa.edu Iowa Electronic Marketplace], operated by University of Iowa Henry B. Tippie College of Business, is an online futures market where contract payoffs are based on real-world events such as political outcomes, companies' earnings per share (EPS), and stock price returns.
	*[http://www.allourideas.org All Our Ideas] is an open source website which allows groups all over the world to create and deploy wiki surveys, and visualize results.		*[http://www.allourideas.org All Our Ideas] is an open source website which allows groups all over the world to create and deploy wiki surveys, and visualize results.
	*[http://en.citizendium.org/wiki/Welcome_to_Citizendium Citizendium] is an encyclopedia project promoting expert-approved articles. The scalability of the model is yet to be proven as so far only 1% of the articles are approved. The site encourages university students work on wiki articles as part of their coursework assignments.		*[http://en.citizendium.org/wiki/Welcome_to_Citizendium Citizendium] is an encyclopedia project promoting expert-approved articles. The scalability of the model is yet to be proven as so far only 1% of the articles are approved. The site encourages university students work on wiki articles as part of their coursework assignments.
Line 43:		Line 46:
	* [[Commercial Initiatives\| more commercial initiatives ...]]		* [[Commercial Initiatives\| more commercial initiatives ...]]

-	== [[~~Interviews~~\|Interviews]] ==	+	== [[Open Innovation software\|tools]] ==
		+	*[http://www.brightidea.com Brightidea] is a software platform that allows businesses to monitor the social process of innovation.
		+	*[http://www.spigit.com spigit] is a platform that enables organizations to tap into the collective intelligence of employees, customers, partners and fans to help tackle business objectives by incorporating game mechanics.
		+	*[http://www.chaordix.com/ Chaordix] is a managed services platform for crowdsourcing.
		+	*[http://www.consensuspoint.com Consensus Point] Huunu prediction market software enables an enterprise to tap into the knowledge of their community in order to accelerate innovation and decision-making.
		+	*[http://ideascale.com/ IdeaScale] enables an organization to build key relationships with its stakeholders by bringing the power of My Starbucks Idea type interaction to any organization.
		+	* [[Open Innovation software\|more open innovation software ...]]
		+
		+
		+	== [[Innovation Marketplace\|innovation marketplace]] ==
		+	*[http://99designs.com/ 99 designs] is a crowdsourcing marketplace for graphics design.
		+	* [http://www.opinno.com Opinno] is an open innovation network of entrepreneurs, investors, and ideas.
		+	* [http://www.topcoder.com/ TopCoder] provides an outsourcing community for software development.
		+	* [[Innovation Marketplace\| more open innovation companies ...]]
		+
		+	== [[Interviews\|interviews]] ==
	[[Image:Globalbrain.jpg\|300 px\|left\|thumb]]		[[Image:Globalbrain.jpg\|300 px\|left\|thumb]]

Line 51:		Line 69:
	*[[Interviews\| more interviews ...]]		*[[Interviews\| more interviews ...]]

-	== [[Blogs]] ==	+	== [[Blogs\|blogs]] ==
	* [http://venture2.typepad.com/ innovation.net] Mike Docherty gives practical advice on implementing open innovation business models.		* [http://venture2.typepad.com/ innovation.net] Mike Docherty gives practical advice on implementing open innovation business models.
	* [http://www.openeur.com openeur] blogs on topics intersecting open innovation and entrepreneurship.		* [http://www.openeur.com openeur] blogs on topics intersecting open innovation and entrepreneurship.
Line 58:		Line 76:
	[[Category:Open Innovation]]		[[Category:Open Innovation]]

-	== ~~Community~~==	+	== community==
	* [http://www.ispim.org ISPIM] - International Society for Professional Innovation Management is an international network that promotes professional cooperation across nations and cultures through various events. ISPIM [http://www.facebook.com/pages/ISPIM-The-International-Society-for-Professional-Innovation-Management/93443115056? Facebook] and [http://www.linkedin.com/groupInvitation?gid=56751&sharedKey=4C01DB36AABF LinkedIn] networking sites		* [http://www.ispim.org ISPIM] - International Society for Professional Innovation Management is an international network that promotes professional cooperation across nations and cultures through various events. ISPIM [http://www.facebook.com/pages/ISPIM-The-International-Society-for-Professional-Innovation-Management/93443115056? Facebook] and [http://www.linkedin.com/groupInvitation?gid=56751&sharedKey=4C01DB36AABF LinkedIn] networking sites
	* [http://www.pdma.org/about_pdma.cfm PDMA] - The Product Development and Management Association (PDMA) connects innovators convolved in product development and management through annual CoDev conferences. [http://openinnovation.ning.com/ Co-Dev social networking site]		* [http://www.pdma.org/about_pdma.cfm PDMA] - The Product Development and Management Association (PDMA) connects innovators convolved in product development and management through annual CoDev conferences. [http://openinnovation.ning.com/ Co-Dev social networking site]
	* [http://www.mil-oss.org/ Military Open Source Software (Mil-OSS)] promotes the development and adoption of open source software for military applications. [http://groups.google.com/group/mil-oss?pli=1 Google groups]		* [http://www.mil-oss.org/ Military Open Source Software (Mil-OSS)] promotes the development and adoption of open source software for military applications. [http://groups.google.com/group/mil-oss?pli=1 Google groups]

-	== [[Books]] ==	+	== [[Books\|books]] ==
	[[File:Open_Services_Innovation.jpg\|right]]		[[File:Open_Services_Innovation.jpg\|right]]
	*Chesbrough, H., [http://www.josseybass.com/WileyCDA/WileyTitle/productCd-0470905743.html Open Services Innovation: Rethinking Your Business to Grow and Compete in a New Era], Jossey-Bass, 2011. Henry Chesbrough describes how Open Innovation can help service industry to co-create to avoid the commodity trap model.		*Chesbrough, H., [http://www.josseybass.com/WileyCDA/WileyTitle/productCd-0470905743.html Open Services Innovation: Rethinking Your Business to Grow and Compete in a New Era], Jossey-Bass, 2011. Henry Chesbrough describes how Open Innovation can help service industry to co-create to avoid the commodity trap model.
Line 70:		Line 88:
	* [[Books \| more books ...]]		* [[Books \| more books ...]]

-	== [[Academic Research]] ==	+	== [[Academic Research\|academic research]] ==
	* Drapeau, M. and Wells II, L. [http://www.ndu.edu/ctnsp/Def_Tech/DTP61_SocialSoftwareandNationalSecurity.pdf Social Software and National Security: An Initial Net Assessment] This report outlines four broad government functions of social software that contribute to the national security missions of defense, diplomacy, and development - inward , outward, inbound and outbound sharing, and articulate the fundamental obstacle in the adoption of social software within the government - security vs. sharing.		* Drapeau, M. and Wells II, L. [http://www.ndu.edu/ctnsp/Def_Tech/DTP61_SocialSoftwareandNationalSecurity.pdf Social Software and National Security: An Initial Net Assessment] This report outlines four broad government functions of social software that contribute to the national security missions of defense, diplomacy, and development - inward , outward, inbound and outbound sharing, and articulate the fundamental obstacle in the adoption of social software within the government - security vs. sharing.
	*[http://openinnovation.haas.berkeley.edu/ Center for Open Innovation at UC Berkeley Haas School of Business] conducts research in open innovation and open business models.		*[http://openinnovation.haas.berkeley.edu/ Center for Open Innovation at UC Berkeley Haas School of Business] conducts research in open innovation and open business models.
	*[http://cci.mit.edu/ MIT Center for Collective Intelligence] focuses on a multi-disciplinary approach collaboration with researchers from the MIT Sloan School of Management, CSAIL, Media Lab and Department of Brain and Cognitive Sciences.		*[http://cci.mit.edu/ MIT Center for Collective Intelligence] focuses on a multi-disciplinary approach collaboration with researchers from the MIT Sloan School of Management, CSAIL, Media Lab and Department of Brain and Cognitive Sciences.
	* [[Academic Research \| more academic research ...]]		* [[Academic Research \| more academic research ...]]
-
-	~~== [[Innovation Marketplace]] ==~~
-	* [http://ideascale.com IdeaScale] is an open innovation platform used by enterprises to set up and manage their innovation networks.
-	* [http://www.opinno.com Opinno] is an open innovation network of entrepreneurs, investors, and ideas.
-	* [http://www.topcoder.com/ TopCoder] provides an outsourcing community for software development.
-	* [[Innovation Marketplace\| more open innovation companies ...]]

Products

2012-05-13T16:09:27Z

BNA - Belief Network Analytics:

← Older revision		Revision as of 16:09, 13 May 2012
Line 5:		Line 5:
	==[[BNA - Belief Network Analytics \| BNA - Belief Network Analytics]]==		==[[BNA - Belief Network Analytics \| BNA - Belief Network Analytics]]==

-	BNA extracts the statistically significant rules encoded in a Belief network by evaluating the outputs under different evidence. BNA transforms the black box model of a Belief Network into a human understandable set of rules so that an analyst can gain insight into a data driven model, compare multiple versions of a model corresponding to different data sets to understand changes. [[Image:Arrow_right.gif]] [[BNA - Belief Network Analytics\| more...]]	+	BNA extracts the statistically significant rules encoded in a Belief network by evaluating the outputs under different combinations of evidence. BNA transforms the black box model of a Belief Network into a human understandable set of rules so that an analyst can gain insight into a data driven model, compare multiple versions of a model corresponding to different data sets to understand changes. [[Image:Arrow_right.gif]] [[BNA - Belief Network Analytics\| more...]]

	==[[CIM Wiki \| CIM Wiki - Semantic Civil Information Management]]==		==[[CIM Wiki \| CIM Wiki - Semantic Civil Information Management]]==

Open Innovation

2012-05-13T15:36:03Z

.com:

← Older revision		Revision as of 15:36, 13 May 2012
Line 41:		Line 41:
	* [https://www.collaborationjam.com/ IBM Jam] is a series of online brainstorming sessions for problem solving targeting business and social problems.		* [https://www.collaborationjam.com/ IBM Jam] is a series of online brainstorming sessions for problem solving targeting business and social problems.
	* [http://greenxchange.force.com/ GreenXChange] is a consortium launched by Nike and others dedicated to sharing patents and ideas that help companies reduce their carbon footprint.		* [http://greenxchange.force.com/ GreenXChange] is a consortium launched by Nike and others dedicated to sharing patents and ideas that help companies reduce their carbon footprint.
-	* [http://github.com/ GitHub] is a collaborative software development service for hosting source code projects using the [http://git-scm.com/ Git] open source distributed version control system.
	* [[Commercial Initiatives\| more commercial initiatives ...]]		* [[Commercial Initiatives\| more commercial initiatives ...]]

Commercial Initiatives

2012-05-13T15:35:34Z

← Older revision		Revision as of 15:35, 13 May 2012
Line 1:		Line 1:
	[[Image:AmazonMechanicalTurk.jpg\|right]]		[[Image:AmazonMechanicalTurk.jpg\|right]]
	* [http://opencompute.org/ Open Compute Project] is a Facebook initiative to build one of the most efficient computing infrastructures at the lowest possible cost by opening up hardware innovation.		* [http://opencompute.org/ Open Compute Project] is a Facebook initiative to build one of the most efficient computing infrastructures at the lowest possible cost by opening up hardware innovation.
		+	* [https://www.collaborationjam.com/ IBM Jam] is a series of online brainstorming sessions for problem solving targeting business and social problems.
	* [http://greenxchange.force.com/ GreenXChange] is a consortium launched by Nike and others dedicated to sharing patents and ideas that help companies reduce their carbon footprint.		* [http://greenxchange.force.com/ GreenXChange] is a consortium launched by Nike and others dedicated to sharing patents and ideas that help companies reduce their carbon footprint.
	* [http://github.com/ GitHub] is a collaborative software development service for hosting source code projects using the [http://git-scm.com/ Git] open source distributed version control system.		* [http://github.com/ GitHub] is a collaborative software development service for hosting source code projects using the [http://git-scm.com/ Git] open source distributed version control system.

Open Innovation

2012-05-13T15:34:52Z

.gov:

← Older revision		Revision as of 15:34, 13 May 2012
Line 19:		Line 19:
	* [http://www.state.gov/m/irm/ediplomacy/115847.htm Diplopedia], the Encyclopedia of the United States Department of State, captures tradecraft pertaining to diplomacy, international relations, and Department of State.		* [http://www.state.gov/m/irm/ediplomacy/115847.htm Diplopedia], the Encyclopedia of the United States Department of State, captures tradecraft pertaining to diplomacy, international relations, and Department of State.
	* [http://en.wikipedia.org/wiki/Bureaupedia Bureaupedia] is an FBI internal wiki that captures senior FBI agent knowledge.		* [http://en.wikipedia.org/wiki/Bureaupedia Bureaupedia] is an FBI internal wiki that captures senior FBI agent knowledge.
-	* [http://challenge.gov/ Challenge.gov] is an online platform to solicit public solutions to government's challenging problems using prizes.
-	* [http://tech.state.gov/ tech@state] connects technology innovators and diplomacy and development experts to enable 21st century statecraft by improving education, health and welfare of the world's population.
-	*[https://innovation.ed.gov/ Open Innovation Portal] The Education Department’s Open Innovation Portal crowdsources ideas for innovation in education
	* [[Government Initiatives\|more government initiatives ...]]		* [[Government Initiatives\|more government initiatives ...]]

Government Initiatives

2012-05-13T15:34:29Z

← Older revision		Revision as of 15:34, 13 May 2012
Line 1:		Line 1:
	Open innovation applications in the government has come a long way since the launch of the U.S. intelligence agencies' internal wiki Intellipedia in 2005. Collaborative applications now span several government agencies ...		Open innovation applications in the government has come a long way since the launch of the U.S. intelligence agencies' internal wiki Intellipedia in 2005. Collaborative applications now span several government agencies ...
	[[Image:OI_portal.png\|thumb\|right]]		[[Image:OI_portal.png\|thumb\|right]]
-	* [http://challenge.gov/ Challenge.gov] is an online platform to solicit ~~using prizes~~ public solutions to government's challenging problems.	+	* [http://www.betterbuyproject.com/ Better Buy Project] is a GSA project aimed at using collaboration and social media to make the federal acquisition process more efficient and effective.
		+	* [http://www.state.gov/m/irm/ediplomacy/115847.htm Diplopedia], the Encyclopedia of the United States Department of State, captures tradecraft pertaining to diplomacy, international relations, and Department of State.
		+	* [http://en.wikipedia.org/wiki/Bureaupedia Bureaupedia] is an FBI internal wiki that captures senior FBI agent knowledge.
		+	* [http://challenge.gov/ Challenge.gov] is an online platform to solicit public solutions to government's challenging problems using prizes.
	* [http://tech.state.gov/ tech@state] connects technology innovators and diplomacy and development experts to enable 21st century statecraft by improving education, health and welfare of the world's population.		* [http://tech.state.gov/ tech@state] connects technology innovators and diplomacy and development experts to enable 21st century statecraft by improving education, health and welfare of the world's population.
	*[https://innovation.ed.gov/ Open Innovation Portal] The Education Department’s Open Innovation Portal crowdsources ideas for innovation in education		*[https://innovation.ed.gov/ Open Innovation Portal] The Education Department’s Open Innovation Portal crowdsources ideas for innovation in education

Open Innovation

2012-05-13T15:33:37Z

.mil:

← Older revision		Revision as of 15:33, 13 May 2012
Line 12:		Line 12:
	* [https://storefront.mil/army Apps for the Army] is a rapid-acquisition process for software applications -- similar to the process employed for applications for both the iPhone and Android app stores.		* [https://storefront.mil/army Apps for the Army] is a rapid-acquisition process for software applications -- similar to the process employed for applications for both the iPhone and Android app stores.
	* [http://www.dtic.mil/dtic/annualconf/2010/DODCollaborativeTools.pdf Aristotle], a Web 2.0 social site with social networking features deployed across AFRL sites, provides situational awareness on people, projects, and topics in order to enable SME’s to work across technical boundaries, and provide management with better technical and programmatic situational awareness.		* [http://www.dtic.mil/dtic/annualconf/2010/DODCollaborativeTools.pdf Aristotle], a Web 2.0 social site with social networking features deployed across AFRL sites, provides situational awareness on people, projects, and topics in order to enable SME’s to work across technical boundaries, and provide management with better technical and programmatic situational awareness.
-	* [https://www.dodtechipedia.mil/ DoDTechipedia], a collaboratively-produced encyclopedia on DoD scientific and technical issues, aims to increase communication and collaboration among DoD scientists, engineers, and acquisition professionals, as well as operational warfighters, and academic and private sector partners.
	* [[Military Initiatives\|more military initiatives ...]]		* [[Military Initiatives\|more military initiatives ...]]

Military Initiatives

2012-05-13T15:33:08Z

← Older revision		Revision as of 15:33, 13 May 2012
Line 3:		Line 3:
	* ONR's Office of Innovation will use its [http://portal.mmowgli.nps.edu/ Massive Multiplayer Online Wargame Leveraging the Internet (MMOWGLI)] platform as a means to bring together players to reduce the U.S. Navy's heavy reliance on a finite, expensive and unreliable supply of fossil fuels.		* ONR's Office of Innovation will use its [http://portal.mmowgli.nps.edu/ Massive Multiplayer Online Wargame Leveraging the Internet (MMOWGLI)] platform as a means to bring together players to reduce the U.S. Navy's heavy reliance on a finite, expensive and unreliable supply of fossil fuels.
	* [https://storefront.mil/army Apps for the Army] is a rapid-acquisition process for software applications -- similar to the process employed for applications for both the iPhone and Android app stores.		* [https://storefront.mil/army Apps for the Army] is a rapid-acquisition process for software applications -- similar to the process employed for applications for both the iPhone and Android app stores.
		+	* [http://www.dtic.mil/dtic/annualconf/2010/DODCollaborativeTools.pdf Aristotle], a Web 2.0 social site with social networking features deployed across AFRL sites, provides situational awareness on people, projects, and topics in order to enable SME’s to work across technical boundaries, and provide management with better technical and programmatic situational awareness.
	* [https://www.dodtechipedia.mil/ DoDTechipedia], a collaboratively-produced encyclopedia on DoD scientific and technical issues, aims to increase communication and collaboration among DoD scientists, engineers, and acquisition professionals, as well as operational warfighters, and academic and private sector partners.		* [https://www.dodtechipedia.mil/ DoDTechipedia], a collaboratively-produced encyclopedia on DoD scientific and technical issues, aims to increase communication and collaboration among DoD scientists, engineers, and acquisition professionals, as well as operational warfighters, and academic and private sector partners.
	* DISA [http://www.disa.mil/forge/ Forge.mil] brings collaborative open source development to accelerate delivery of dependable software, services and systems for net-centric operations and warfare.		* DISA [http://www.disa.mil/forge/ Forge.mil] brings collaborative open source development to accelerate delivery of dependable software, services and systems for net-centric operations and warfare.

Open Innovation

2012-05-13T15:29:02Z

.mil:

← Older revision		Revision as of 15:29, 13 May 2012
(One intermediate revision not shown)
Line 11:		Line 11:
	* ONR's Office of Innovation will use its [http://portal.mmowgli.nps.edu/ Massive Multiplayer Online Wargame Leveraging the Internet (MMOWGLI)] platform as a means to bring together players to reduce the U.S. Navy's heavy reliance on a finite, expensive and unreliable supply of fossil fuels.		* ONR's Office of Innovation will use its [http://portal.mmowgli.nps.edu/ Massive Multiplayer Online Wargame Leveraging the Internet (MMOWGLI)] platform as a means to bring together players to reduce the U.S. Navy's heavy reliance on a finite, expensive and unreliable supply of fossil fuels.
	* [https://storefront.mil/army Apps for the Army] is a rapid-acquisition process for software applications -- similar to the process employed for applications for both the iPhone and Android app stores.		* [https://storefront.mil/army Apps for the Army] is a rapid-acquisition process for software applications -- similar to the process employed for applications for both the iPhone and Android app stores.
		+	* [http://www.dtic.mil/dtic/annualconf/2010/DODCollaborativeTools.pdf Aristotle], a Web 2.0 social site with social networking features deployed across AFRL sites, provides situational awareness on people, projects, and topics in order to enable SME’s to work across technical boundaries, and provide management with better technical and programmatic situational awareness.
	* [https://www.dodtechipedia.mil/ DoDTechipedia], a collaboratively-produced encyclopedia on DoD scientific and technical issues, aims to increase communication and collaboration among DoD scientists, engineers, and acquisition professionals, as well as operational warfighters, and academic and private sector partners.		* [https://www.dodtechipedia.mil/ DoDTechipedia], a collaboratively-produced encyclopedia on DoD scientific and technical issues, aims to increase communication and collaboration among DoD scientists, engineers, and acquisition professionals, as well as operational warfighters, and academic and private sector partners.
	* [[Military Initiatives\|more military initiatives ...]]		* [[Military Initiatives\|more military initiatives ...]]

Products

2012-05-13T12:42:00Z

BNA - Belief Network Analytics:

← Older revision		Revision as of 12:42, 13 May 2012
Line 5:		Line 5:
	==[[BNA - Belief Network Analytics \| BNA - Belief Network Analytics]]==		==[[BNA - Belief Network Analytics \| BNA - Belief Network Analytics]]==

-	BNA extracts the statistically significant rules encoded in a Belief network by ~~querying a Belief Network~~. BNA transforms the black box model of a Belief Network into a human understandable set of rules so that an analyst can gain insight into a data driven model, compare multiple versions of a model corresponding to different data sets to understand changes. [[Image:Arrow_right.gif]] [[BNA - Belief Network Analytics\| more...]]	+	BNA extracts the statistically significant rules encoded in a Belief network by evaluating the outputs under different evidence. BNA transforms the black box model of a Belief Network into a human understandable set of rules so that an analyst can gain insight into a data driven model, compare multiple versions of a model corresponding to different data sets to understand changes. [[Image:Arrow_right.gif]] [[BNA - Belief Network Analytics\| more...]]

	==[[CIM Wiki \| CIM Wiki - Semantic Civil Information Management]]==		==[[CIM Wiki \| CIM Wiki - Semantic Civil Information Management]]==

Open Innovation

2012-05-12T01:13:50Z

.com:

← Older revision		Revision as of 01:13, 12 May 2012
(7 intermediate revisions not shown)
Line 16:		Line 16:
	== [[Government Initiatives\|.gov]] ==		== [[Government Initiatives\|.gov]] ==
	Collaborative applications now span several government agencies spurred by crowdsourcing applications that tap into the wisdom of citizenry ...		Collaborative applications now span several government agencies spurred by crowdsourcing applications that tap into the wisdom of citizenry ...
		+	* [http://www.betterbuyproject.com/ Better Buy Project] is a GSA project aimed at using collaboration and social media to make the federal acquisition process more efficient and effective.
		+	* [http://www.state.gov/m/irm/ediplomacy/115847.htm Diplopedia], the Encyclopedia of the United States Department of State, captures tradecraft pertaining to diplomacy, international relations, and Department of State.
		+	* [http://en.wikipedia.org/wiki/Bureaupedia Bureaupedia] is an FBI internal wiki that captures senior FBI agent knowledge.
	* [http://challenge.gov/ Challenge.gov] is an online platform to solicit public solutions to government's challenging problems using prizes.		* [http://challenge.gov/ Challenge.gov] is an online platform to solicit public solutions to government's challenging problems using prizes.
	* [http://tech.state.gov/ tech@state] connects technology innovators and diplomacy and development experts to enable 21st century statecraft by improving education, health and welfare of the world's population.		* [http://tech.state.gov/ tech@state] connects technology innovators and diplomacy and development experts to enable 21st century statecraft by improving education, health and welfare of the world's population.
Line 39:		Line 42:
	[[File:Open_Compute_Project.jpg\|right\|thumb]]		[[File:Open_Compute_Project.jpg\|right\|thumb]]
	* [http://opencompute.org/ Open Compute Project] is a Facebook initiative to build one of the most efficient computing infrastructures at the lowest possible cost by opening up hardware innovation.		* [http://opencompute.org/ Open Compute Project] is a Facebook initiative to build one of the most efficient computing infrastructures at the lowest possible cost by opening up hardware innovation.
		+	* [https://www.collaborationjam.com/ IBM Jam] is a series of online brainstorming sessions for problem solving targeting business and social problems.
	* [http://greenxchange.force.com/ GreenXChange] is a consortium launched by Nike and others dedicated to sharing patents and ideas that help companies reduce their carbon footprint.		* [http://greenxchange.force.com/ GreenXChange] is a consortium launched by Nike and others dedicated to sharing patents and ideas that help companies reduce their carbon footprint.
	* [http://github.com/ GitHub] is a collaborative software development service for hosting source code projects using the [http://git-scm.com/ Git] open source distributed version control system.		* [http://github.com/ GitHub] is a collaborative software development service for hosting source code projects using the [http://git-scm.com/ Git] open source distributed version control system.
Line 80:		Line 84:
	* [http://www.opinno.com Opinno] is an open innovation network of entrepreneurs, investors, and ideas.		* [http://www.opinno.com Opinno] is an open innovation network of entrepreneurs, investors, and ideas.
	* [http://www.topcoder.com/ TopCoder] provides an outsourcing community for software development.		* [http://www.topcoder.com/ TopCoder] provides an outsourcing community for software development.
-	* [http://www.innocentive.com InnoCentive] brings together innovation seekers and problem solvers using a prize structure.
-	* [http://www.ninesigma.com NineSigma] is an innovation outsourcing firm serving Fortune 500 firms.
	* [[Innovation Marketplace\| more open innovation companies ...]]		* [[Innovation Marketplace\| more open innovation companies ...]]

Innovation Marketplace

2012-05-11T02:55:51Z

← Older revision		Revision as of 02:55, 11 May 2012
(One intermediate revision not shown)
Line 1:		Line 1:
		+	* [http://ideascale.com IdeaScale] is an open innovation platform used by enterprises to set up and manage their innovation networks.
	* [http://www.topcoder.com/ TopCoder] provides an outsourcing community for software development.		* [http://www.topcoder.com/ TopCoder] provides an outsourcing community for software development.
		+	* [http://www.opinno.com Opinno] is an open innovation network of entrepreneurs, investors, and ideas.
	* [http://www.innocentive.com InnoCentive] brings together innovation seekers and problem solvers using a prize structure.		* [http://www.innocentive.com InnoCentive] brings together innovation seekers and problem solvers using a prize structure.
	* [http://www.ninesigma.com NineSigma] is an innovation outsourcing firm serving Fortune 500 firms.		* [http://www.ninesigma.com NineSigma] is an innovation outsourcing firm serving Fortune 500 firms.

Open Innovation

2012-05-11T02:54:48Z

Innovation Marketplace:

← Older revision		Revision as of 02:54, 11 May 2012
(One intermediate revision not shown)
Line 20:		Line 20:
	*[https://innovation.ed.gov/ Open Innovation Portal] The Education Department’s Open Innovation Portal crowdsources ideas for innovation in education		*[https://innovation.ed.gov/ Open Innovation Portal] The Education Department’s Open Innovation Portal crowdsources ideas for innovation in education
	* [[Government Initiatives\|more government initiatives ...]]		* [[Government Initiatives\|more government initiatives ...]]
		+
		+	== [[Organization Initiatives\|.org]] ==
		+	*[http://www.unglobalpulse.org UN Global Pulse] is a United Nations initiative to close the information gap between the onset of a global crisis and the availability of actionable information to protect vulnerable populations.
		+	*[http://www.healthmap.org HealthMap] , started at the Children's Hospital Boston in 2006, uses online informal sources for disease outbreak monitoring and real-time surveillance of emerging public health threats.
		+	*[http://crisismappers.net/ Crisis Mappers] is a humanitarian technology network for early warning for rapid response to complex humanitarian emergencies.
		+
		+	*[[Organization Initiatives\| more organization initiatives ...]]

	== [[Education Initiatives\|.edu]] ==		== [[Education Initiatives\|.edu]] ==
Line 28:		Line 35:
	*[http://www.researchgate.net/ ResearchGATE] is a collaboration site for scientific researchers to enable file-sharing, publication database sharing, forums, methodology discussions, groups etc.		*[http://www.researchgate.net/ ResearchGATE] is a collaboration site for scientific researchers to enable file-sharing, publication database sharing, forums, methodology discussions, groups etc.
	*[[Education Initiatives \| more education initiatives ...]]		*[[Education Initiatives \| more education initiatives ...]]
-
-	~~== [[Organization Initiatives\|.org]] ==~~
-	*[http://www.unglobalpulse.org UN Global Pulse] is a United Nations initiative to close the information gap between the onset of a global crisis and the availability of actionable information to protect vulnerable populations.
-	*[http://www.healthmap.org HealthMap] , started at the Children's Hospital Boston in 2006, uses online informal sources for disease outbreak monitoring and real-time surveillance of emerging public health threats.
-	*[http://crisismappers.net/ Crisis Mappers] is a humanitarian technology network for early warning for rapid response to complex humanitarian emergencies.
-
-	*[[Organization Initiatives\| more organization initiatives ...]]

	== [[Commercial Initiatives\|.com]] ==		== [[Commercial Initiatives\|.com]] ==
Line 77:		Line 77:

	== [[Innovation Marketplace]] ==		== [[Innovation Marketplace]] ==
		+	* [http://ideascale.com IdeaScale] is an open innovation platform used by enterprises to set up and manage their innovation networks.
	* [http://www.opinno.com Opinno] is an open innovation network of entrepreneurs, investors, and ideas.		* [http://www.opinno.com Opinno] is an open innovation network of entrepreneurs, investors, and ideas.
	* [http://www.topcoder.com/ TopCoder] provides an outsourcing community for software development.		* [http://www.topcoder.com/ TopCoder] provides an outsourcing community for software development.

← Older revision		Revision as of 16:09, 13 May 2012
Line 5:		Line 5:
	==[[BNA - Belief Network Analytics \| BNA - Belief Network Analytics]]==		==[[BNA - Belief Network Analytics \| BNA - Belief Network Analytics]]==

-	BNA extracts the statistically significant rules encoded in a Belief network by evaluating the outputs under different evidence. BNA transforms the black box model of a Belief Network into a human understandable set of rules so that an analyst can gain insight into a data driven model, compare multiple versions of a model corresponding to different data sets to understand changes. [[Image:Arrow_right.gif]] [[BNA - Belief Network Analytics\| more...]]	+	BNA extracts the statistically significant rules encoded in a Belief network by evaluating the outputs under different combinations of evidence. BNA transforms the black box model of a Belief Network into a human understandable set of rules so that an analyst can gain insight into a data driven model, compare multiple versions of a model corresponding to different data sets to understand changes. [[Image:Arrow_right.gif]] [[BNA - Belief Network Analytics\| more...]]

	==[[CIM Wiki \| CIM Wiki - Semantic Civil Information Management]]==		==[[CIM Wiki \| CIM Wiki - Semantic Civil Information Management]]==

← Older revision		Revision as of 12:42, 13 May 2012
Line 5:		Line 5:
	==[[BNA - Belief Network Analytics \| BNA - Belief Network Analytics]]==		==[[BNA - Belief Network Analytics \| BNA - Belief Network Analytics]]==

-	BNA extracts the statistically significant rules encoded in a Belief network by ~~querying a Belief Network~~. BNA transforms the black box model of a Belief Network into a human understandable set of rules so that an analyst can gain insight into a data driven model, compare multiple versions of a model corresponding to different data sets to understand changes. [[Image:Arrow_right.gif]] [[BNA - Belief Network Analytics\| more...]]	+	BNA extracts the statistically significant rules encoded in a Belief network by evaluating the outputs under different evidence. BNA transforms the black box model of a Belief Network into a human understandable set of rules so that an analyst can gain insight into a data driven model, compare multiple versions of a model corresponding to different data sets to understand changes. [[Image:Arrow_right.gif]] [[BNA - Belief Network Analytics\| more...]]

	==[[CIM Wiki \| CIM Wiki - Semantic Civil Information Management]]==		==[[CIM Wiki \| CIM Wiki - Semantic Civil Information Management]]==

← Older revision		Revision as of 19:49, 18 May 2012
(One intermediate revision not shown)
Line 5:		Line 5:
	{{Nav}}		{{Nav}}

-	[[Image:Botnet.gif\|thumb\|300px\|Botnet Defense project researches real-time botnet intelligence situation awareness for the enterprise while contributing to the botnet community knowledge base to enhance DHS cyber security mission. <br>[[Image:Arrow_right.gif]] [http://fastfluxmonitor.com demo ~~...~~] <br> [[Image:Arrow_right.gif]] [http://milcord.com/blog/tag/fast-flux/ blog ~~...~~] <br>[[Image:Arrow_right.gif]] [[Botnet_Defense#References \| publications ~~...~~]] ]]	+	[[Image:Botnet.gif\|thumb\|300px\|Botnet Defense project researches real-time botnet intelligence situation awareness for the enterprise while contributing to the botnet community knowledge base to enhance DHS cyber security mission. <br>[[Image:Arrow_right.gif]] [http://fastfluxmonitor.com demo] <br> [[Image:Arrow_right.gif]] [http://milcord.com/blog/tag/fast-flux/ blog] <br>[[Image:Arrow_right.gif]] [[Botnet_Defense#References \| publications]] ]]

	== Overview ==		== Overview ==
-	Our botnet defense solution detects and classifies fast flux service networks (FFSNs) in real time. FFSNs exploit a network of compromised machines (zombies) for illegal activities such as spam, phishing and malware delivery using DNS record manipulation techniques.	+	Our botnet defense solution detects and classifies fast flux service networks (FFSNs) in real time. FFSNs exploit a network of compromised machines (zombies) for illegal activities such as spam, phishing, and malware delivery using DNS record manipulation techniques.

	== Need ==		== Need ==

-	*20 ~~Million~~ PCs infected with bots – 250,000 more infected each day ([http://www.ciphertrust.com/resources/statistics/zombie.php Zombie Statistics])	+	*20 million PCs are infected with bots – 250,000 more infected each day ([http://www.ciphertrust.com/resources/statistics/zombie.php Zombie Statistics])
-	*Botnets used for identity theft, spam, ad networks, pump and dump, malware distribution, DDoS	+	*Botnets are used for identity theft, spam delivery, ad networks, pump and dump, malware distribution, and DDoS
-	*A compliance and national security risk in the government sector	+	*Botnets pose a compliance and national security risk in the government sector and a threat to brand damage, financial loss, and legal risk in the commercial sector
-	*A brand damage, financial loss, and legal risk in the commercial sector	+

	== Approach ==		== Approach ==
-	Our botnet defense solution is a web service that detects and classifies fast flux service networks using both active and passive DNS monitoring. In addition, our approach is able to differentiate and classify all three fast-flux variants, including name server flux and double-flux. The primary components of our botnet defense solution include:	+	Our botnet defense solution is a web service that detects and classifies fast flux service networks using both active and passive DNS monitoring. In addition, our approach is able to differentiate and classify all three fast flux variants, including name server flux and double-flux. The primary components of our botnet defense solution include:

	[[Image:Image-FFM.jpg\|thumb\|left\|400px\|Fast Flux Monitor Architecture]]		[[Image:Image-FFM.jpg\|thumb\|left\|400px\|Fast Flux Monitor Architecture]]

-	* sensors which perform real-time detection of FF service networks using behavioral analysis that examine various indicators	+	* sensors which perform real-time detection of fast flux service networks using behavioral analysis that examine various indicators
-	* a database of known FF service networks – zombie IPs used for domain names, nameservers	+	* a database of known fast flux service networks – zombie IPs used for domain names, nameservers
	* analytical knowledge harvested from the database		* analytical knowledge harvested from the database

	The active sensors include Fast Flux Activity Index, Footprint Index, Time To Live (TTL), Guilt by Association Index, and others. Activity Index captures how aggressively the domain’s DNS information changes. The Footprint Index captures the global dispersion of the fast flux service network. TTL captures the low values of this parameter employed by fast flux service networks. The ‘Guilt by Association’ sensor examines if any of the current IP addresses of a domain have previously been associated with another fast flux domain. A Bayesian classifier fuses the multiple active and passive DNS sensors.		The active sensors include Fast Flux Activity Index, Footprint Index, Time To Live (TTL), Guilt by Association Index, and others. Activity Index captures how aggressively the domain’s DNS information changes. The Footprint Index captures the global dispersion of the fast flux service network. TTL captures the low values of this parameter employed by fast flux service networks. The ‘Guilt by Association’ sensor examines if any of the current IP addresses of a domain have previously been associated with another fast flux domain. A Bayesian classifier fuses the multiple active and passive DNS sensors.

-	Detailed reports for the domains and nameservers provide details for both current and historical behavior. Analytical reports include the fast flux service network’s size and growth rate estimates , the social network of a fast flux service network, the footprint of a fast flux service network for a given ASN, ISP, and country.	+	Detailed reports for the domains and nameservers provide details for both current and historical behavior. Analytical reports include the fast flux service network’s size and growth rate estimates, the social network of a fast flux service network, and the footprint of a fast flux service network for a given ASN, ISP, and country.

	[[Image:FFM_Dashboard.jpg\|thumb\|right\|600px\|Fast Flux Monitor Dashboard]]		[[Image:FFM_Dashboard.jpg\|thumb\|right\|600px\|Fast Flux Monitor Dashboard]]
Line 34:		Line 33:
	== Benefits ==		== Benefits ==

-	*'''Risk Aversion:''' Limits exposure to liability associated with identity theft	+	*'''Risk Aversion:''' Limits exposure to liability associated with identity theft
	*'''Performance:''' 97% accuracy in detecting fast flux domains		*'''Performance:''' 97% accuracy in detecting fast flux domains
-	*'''Adaptability:''' Real time detection enables fastest discovery of fast flux domains	+	*'''Adaptability:''' Real-time detection enables fastest discovery of fast flux domains

	== Applications ==		== Applications ==
Line 51:		Line 50:

	== References ==		== References ==
-	*Caglayan, A. and Toothaker, M. '''''FastFluxMonitor vs. Darknet traffic''''', [https://sie.isc.org/sie_workshop_agenda.html SIE Workshop], 3 October 2010, Atlanta, GA.	+	*Caglayan, A. and Toothaker, M. '''FastFluxMonitor vs. Darknet traffic''', [https://sie.isc.org/sie_workshop_agenda.html SIE Workshop], October 3, 2010, Atlanta, GA.
-	* Massey, D. and Caglayan, A. '''''Event Detection via DNS and Route Monitoring''''', [http://www.us-cert.gov/GFIRST/ 6th Annual GFIRST National Conference], GFIRST6: Building Today, Shaping Tomorrow – Ensuring an Effective Response Capability to Manage Risks in Cyberspace, 15-20 ~~August~~ 2010, San Antonio, TX. [[Image:Arrow_right.gif]] [[Fast_Flux_Botnet_Data_Service \| solution]]	+	*Massey, D. and Caglayan, A. '''Event Detection via DNS and Route Monitoring''', [http://www.us-cert.gov/GFIRST/ 6th Annual GFIRST National Conference], GFIRST6: Building Today, Shaping Tomorrow – Ensuring an Effective Response Capability to Manage Risks in Cyberspace, August 15-20, 2010, San Antonio, TX. [[Image:Arrow_right.gif]] [[Fast_Flux_Botnet_Data_Service \| solution]]
-	* Caglayan, A.~~, ''~~'''Improving Malware Situational Awareness by Monitoring the Relationships in DNS Infrastructure''''', [http://www.ll.mit.edu/mtem/2010/index.html Multiagency and Industry Malware and Bot Reverse Engineering Technical Exchange Meeting (MTEM 10)], MIT Lincoln Laboratory, 15-16 July 2010. [[Image:Arrow_right.gif]] [[Improving Malware Situational Awareness by Monitoring the Relationships in DNS Infrastructure \| abstract]] \| [[Fast_Flux_Botnet_Data_Service \| solution]]	+	*Caglayan, A. '''Improving Malware Situational Awareness by Monitoring the Relationships in DNS Infrastructure''', [http://www.ll.mit.edu/mtem/2010/index.html Multiagency and Industry Malware and Bot Reverse Engineering Technical Exchange Meeting (MTEM 10)], MIT Lincoln Laboratory, 15-16 July 2010. [[Image:Arrow_right.gif]] [[Improving Malware Situational Awareness by Monitoring the Relationships in DNS Infrastructure \| abstract]] \| [[Fast_Flux_Botnet_Data_Service \| solution]]
-	*''Caglayan, A., Toothaker, M., Drapeau, D., Burke, D. and Eaton, G. (2010)~~'' ''~~ '''Guilt by Association based Discovery of Botnet Footprints'' ''', NATO Research and Technology Organization Workshop on Information Security and Defense. Antalya, Turkey, ~~Apr.~~ 26-30, 2010. [[Image:Arrow_right.gif]] [[Guilt by Association based Discovery of Botnet Footprints \| abstract]] \| [http://ftp.rta.nato.int/public/PubFullText/RTO/MP/RTO-MP-IST-091/MP-IST-091-04.doc paper] \| [http://milcord.com/blog/2010/02/19/kneber-botnet-less-fluxy-but-more-stealthy/ blog] \| [[Fast_Flux_Botnet_Data_Service \| solution]]	+	*Caglayan, A., Toothaker, M., Drapeau, D., Burke, D. and Eaton, G. (2010) '''Guilt by Association based Discovery of Botnet Footprints''', NATO Research and Technology Organization Workshop on Information Security and Defense. Antalya, Turkey, April 26-30, 2010. [[Image:Arrow_right.gif]] [[Guilt by Association based Discovery of Botnet Footprints \| abstract]] \| [http://ftp.rta.nato.int/public/PubFullText/RTO/MP/RTO-MP-IST-091/MP-IST-091-04.doc paper] \| [http://milcord.com/blog/2010/02/19/kneber-botnet-less-fluxy-but-more-stealthy/ blog] \| [[Fast_Flux_Botnet_Data_Service \| solution]]
-	* ''Caglayan, A., Toothaker, M., Drapeau, D., Burke, D. and Eaton, G. (2010)~~'' ''~~'''Behavioral Patterns of Fast Flux Service Networks''''', Hawaii International Conference on System Sciences (HICSS-43) Cyber Security and Information Intelligence Research Minitrack. Koloa, Kauai, Hawaii, ~~Jan.~~ 5-8, 2010. [[Image:Arrow_right.gif]] [http://www.computer.org/portal/web/csdl/doi/10.1109/HICSS.2010.81 abstract] \| [http://csdl2.computer.org/comp/proceedings/hicss/2010/3869/00/02-02-05.pdf paper] \| [http://www.technologyreview.com/blog/editors/24252/ press] \| [[Fast_Flux_Botnet_Data_Service \| solution]]	+	*Caglayan, A., Toothaker, M., Drapeau, D., Burke, D. and Eaton, G. (2010) '''Behavioral Patterns of Fast Flux Service Networks''', Hawaii International Conference on System Sciences (HICSS-43) Cyber Security and Information Intelligence Research Minitrack, Koloa, Kauai, Hawaii, January 5-8, 2010. [[Image:Arrow_right.gif]] [http://www.computer.org/portal/web/csdl/doi/10.1109/HICSS.2010.81 abstract] \| [http://csdl2.computer.org/comp/proceedings/hicss/2010/3869/00/02-02-05.pdf paper] \| [http://www.technologyreview.com/blog/editors/24252/ press] \| [[Fast_Flux_Botnet_Data_Service \| solution]]
-	*Naone, E. [http://www.technologyreview.com/web/23747/?a=f Tracking Devious Phishing Websites] MIT Technology Review, ~~Oct.~~ 19, 2009.	+	*Naone, E. [http://www.technologyreview.com/web/23747/?a=f Tracking Devious Phishing Websites] MIT Technology Review, October 19, 2009.
-	*Naone, E. [http://www.technologyreview.com/blog/editors/24252/ Why Don't Spammers Get Shut Down Faster?] MIT Technology Review Blog, ~~Oct.~~ 19, 2009.	+	*Naone, E. [http://www.technologyreview.com/blog/editors/24252/ Why Don't Spammers Get Shut Down Faster?] MIT Technology Review Blog, October 19, 2009.
-	* McGrath, D. K., Kalafut, A., Gupta, M.~~, ''~~'''Phishing Infrastructure Fluxes All the ~~Wa''y~~''', IEEE Security and Privacy, pp. 21-28, September/October, 2009 [[Image:Arrow_right.gif]] [https://www.cs.indiana.edu/~minaxi/pubs/sANDp09.pdf paper]	+	* McGrath, D. K., Kalafut, A., Gupta, M. '''Phishing Infrastructure Fluxes All the Way''', IEEE Security and Privacy, pp. 21-28, September/October 2009. [[Image:Arrow_right.gif]] [https://www.cs.indiana.edu/~minaxi/pubs/sANDp09.pdf paper]
-	* ''Caglayan, A., Toothaker, M., Drapeau, D., Burke, D., Eaton, G., Van Randwyk, J., Lloyd, L., Proebstel, E., Burnett, D., Bayer, G., and Sanders, B. (2009)~~'' ''~~ '''Botnet Analytics Appliance'' ''', Final Report, Department of Homeland Security Cyber Security R&D Center Contract No. NBCHC070126, October, 2009. [[Image:Arrow_right.gif]] [[Abstract: Botnet Analytics Appliance \| abstract]] \| [[Fast_Flux_Botnet_Data_Service \| solution]]	+	*Caglayan, A., Toothaker, M., Drapeau, D., Burke, D., Eaton, G., Van Randwyk, J., Lloyd, L., Proebstel, E., Burnett, D., Bayer, G., and Sanders, B. (2009) '''Botnet Analytics Appliance''', Final Report, Department of Homeland Security Cyber Security R&D Center Contract No. NBCHC070126, October 2009. [[Image:Arrow_right.gif]] [[Abstract: Botnet Analytics Appliance \| abstract]] \| [[Fast_Flux_Botnet_Data_Service \| solution]]
-	* ''Caglayan, A., Toothaker, M., Drapeau, D., Burke, D. and Eaton, G. (2009)~~'' ''~~ '''Behavioral Analysis of Fast Flux Service Networks'' ''', Fifth Annual Cyber Security and Information Intelligence Research Workshop (CSIIRW 09), Oak Ridge, TN, April 13-15, 2009. [[Image:Arrow_right.gif]] [http://portal.acm.org/citation.cfm?doid=1558607.1558662 abstract] \| [http://www.csiir.ornl.gov/csiirw/09/CSIIRW09-Proceedings/Abstracts/Caglayan-abstract.pdf paper] \| [http://www.csiir.ornl.gov/csiirw/09/CSIIRW09-Proceedings/Slides/Caglayan-Slides.pdf presentation] \| [http://milcord.com/blog/2009/10/23/phishing-websites-flux-their-way/ blog] \| [http://www.technologyreview.com/web/23747/page1/ press~~] \| [[Botnet_Defense \| solution]~~]	+	*Caglayan, A., Toothaker, M., Drapeau, D., Burke, D. and Eaton, G. (2009) '''Behavioral Analysis of Fast Flux Service Networks''', Fifth Annual Cyber Security and Information Intelligence Research Workshop (CSIIRW 09), Oak Ridge, TN, April 13-15, 2009. [[Image:Arrow_right.gif]] [http://portal.acm.org/citation.cfm?doid=1558607.1558662 abstract] \| [http://www.csiir.ornl.gov/csiirw/09/CSIIRW09-Proceedings/Abstracts/Caglayan-abstract.pdf paper] \| [http://www.csiir.ornl.gov/csiirw/09/CSIIRW09-Proceedings/Slides/Caglayan-Slides.pdf presentation] \| [http://milcord.com/blog/2009/10/23/phishing-websites-flux-their-way/ blog] \| [http://www.technologyreview.com/web/23747/page1/ press]
-	* ''Caglayan, A., Toothaker, M., Drapeau, D., Burke, D. and Eaton, G. (2009)~~'' ''~~ '''Real Time Detection of Fast Flux Service Networks'' ''', Cybersecurity Applications and Technologies Conference for Homeland Security (CATCH 2009), Washington, DC, March 3-4, 2009. [[Image:Arrow_right.gif]] [http://www.computer.org/portal/web/csdl/doi/10.1109/CATCH.2009.44 abstract] \| [http://www.cyber.st.dhs.gov/public/CATCH/Caglayan.pdf presentation] \| [http://milcord.com/blog/2009/03/06/reflections-on-catch/ blog] \| [http://www.military-information-technology.com/mit-archives/32-mit-2008-volume-12-issue-7/213-battling-botnets.html press~~] \| [[Botnet_Defense \| solution]~~]	+	*Caglayan, A., Toothaker, M., Drapeau, D., Burke, D. and Eaton, G. (2009) '''Real Time Detection of Fast Flux Service Networks''', Cybersecurity Applications and Technologies Conference for Homeland Security (CATCH 2009), Washington, DC, March 3-4, 2009. [[Image:Arrow_right.gif]] [http://www.computer.org/portal/web/csdl/doi/10.1109/CATCH.2009.44 abstract] \| [http://www.cyber.st.dhs.gov/public/CATCH/Caglayan.pdf presentation] \| [http://milcord.com/blog/2009/03/06/reflections-on-catch/ blog] \| [http://www.military-information-technology.com/mit-archives/32-mit-2008-volume-12-issue-7/213-battling-botnets.html press]
-	* Buxbaum, P. A. [http://www.kmimediagroup.com/mit-archives/32-mit-2008-volume-12-issue-7/213-battling-botnets.html Battling Botnets] Military Information Technology~~, 2008~~, Vol. 12, No. 7.	+	*Buxbaum, P. A. [http://www.kmimediagroup.com/mit-archives/32-mit-2008-volume-12-issue-7/213-battling-botnets.html Battling Botnets] Military Information Technology, Vol. 12, No. 7., 2008.
-	* Caglayan, A., Toothaker, M. and Windholz, T. (2007) '''''A Bayesian Activity Monitor for Botnet Defense''''', 2007 Monterey Homeland Security Conference, Monterey, CA August 2007. [[Image:Arrow_right.gif]] [[:Image:Homeland_Security_Conference_2007.pdf\|presentation~~]] \| [[Automated_Image_Understanding \| solution~~]]	+	*Caglayan, A., Toothaker, M. and Windholz, T. (2007) '''A Bayesian Activity Monitor for Botnet Defense''', 2007 Monterey Homeland Security Conference, Monterey, CA, August 2007. [[Image:Arrow_right.gif]] [[:Image:Homeland_Security_Conference_2007.pdf\|presentation]]
-	* Caglayan, A., Toothaker, M. and Windholz, T. (2007) '''''A Bayesian Activity Monitor for Botnet Defense''''', Final Report, Department of Homeland Security Cyber Security R&D Center Contract No. NBCHC060135, March, 2007. : [[Image:Arrow_right.gif]] [[Abstract: A Bayesian Activity Monitor for Botnet Defense \| abstract]] \| [[Fast_Flux_Botnet_Data_Service \| solution]]	+	*Caglayan, A., Toothaker, M. and Windholz, T. (2007) '''A Bayesian Activity Monitor for Botnet Defense''', Final Report, Department of Homeland Security Cyber Security R&D Center Contract No. NBCHC060135, March 2007. [[Image:Arrow_right.gif]] [[Abstract: A Bayesian Activity Monitor for Botnet Defense \| abstract]] \| [[Fast_Flux_Botnet_Data_Service \| solution]]

	[[Category:Cyber Security]]		[[Category:Cyber Security]]

← Older revision		Revision as of 18:57, 18 May 2012
Line 1:		Line 1:
	__NOTOC__		__NOTOC__
-	[[Image:malwareandphishing.png\|right\|thumb\|400px\|Botnet Lifespan: Malware vs. Phishing vs. Spam. <br>[[Image:Arrow_right.gif]] [http://fastfluxmonitor.com/ demo] <br>[[Image:Arrow_right.gif]] [[Products\| product ~~...~~]] ]]	+	[[Image:malwareandphishing.png\|right\|thumb\|400px\|Botnet Lifespan: Malware vs. Phishing vs. Spam. <br>[[Image:Arrow_right.gif]] [http://fastfluxmonitor.com/ demo] <br>[[Image:Arrow_right.gif]] [[Products\| product]] ]]
	== What is a botnet?==		== What is a botnet?==
	[[Image:FF_Activity_.png\|left\|thumb\|400px\|Fast Flux Activity Index]]		[[Image:FF_Activity_.png\|left\|thumb\|400px\|Fast Flux Activity Index]]
	[[Image:phishingFFSN.png\|right\|thumb\|400px\|Social Network of Phishing Botnets]]		[[Image:phishingFFSN.png\|right\|thumb\|400px\|Social Network of Phishing Botnets]]
-	A botnet is a collection of compromised computers ("zombies") that have been set up as a malicious content distribution network without the knowledge of ~~their~~ owners. Zombies attack other computers, send spam, deliver malware and serve phishing content ~~under the control of~~ a Command and Control server operated by a criminal organization.	+	A botnet is a collection of compromised computers ("zombies") that have been set up as a malicious content distribution network without the knowledge of the computer's owners. Zombies attack other computers, send spam, deliver malware, and serve phishing content through a Command and Control server operated by a criminal organization.

	==What is fast flux? ==		==What is fast flux? ==
-	Fast flux is a method of making rapid and repeated changes to host and/or name server resource records, which result in rapidly changing the IP address to which the domain name of an Internet host or name server resolves. While fast flux methods do have a legitimate use as a load balancing technique for high availability and high volume Web sites, botnets use fast flux for concealment of their Command and Control servers. There are three main variants of fast flux hosting:	+	Fast flux is a method of making rapid and repeated changes to host and/or name server resource records, which result in rapidly changing the IP address to which the domain name of an Internet host or name server resolves. While fast flux methods do have a legitimate use as a load balancing technique for high availability and high volume Web sites, botnets use fast flux for concealment of their Command and Control (C&C) servers. There are three main variants of fast flux hosting:

	*Basic fast flux hosting where IP addresses of malicious web sites are fluxed		*Basic fast flux hosting where IP addresses of malicious web sites are fluxed
Line 14:		Line 14:

	==What is Dynamic DNS?==		==What is Dynamic DNS?==
-	Dynamic DNS is a service that ~~lets~~ a Domain Name System (DNS) name server to change, in real time, the active DNS configuration of its configured hostnames, addresses or other information. A popular application of dynamic DNS is to provide a residential user's Internet gateway that has a variable, often changing, IP address with a well known hostname resolvable through standard DNS queries. Botnets use dynamic DNS to assign a new C&C server when the current C&C is shut down by authorities. This DNS redirection behavior in response to bot queries is called herding. A botmaster will also periodically update the dynamic DNS entry to hide the locations of its ~~command and control~~ server.	+	Dynamic DNS is a service that enables a Domain Name System (DNS) name server to change, in real time, the active DNS configuration of its configured hostnames, addresses or other information. A popular application of dynamic DNS is to provide a residential user's Internet gateway that has a variable, often changing, IP address with a well known hostname resolvable through standard DNS queries. Botnets use dynamic DNS to assign a new C&C server when the current C&C is shut down by authorities. This DNS redirection behavior in response to bot queries is called herding. A botmaster will also periodically update the dynamic DNS entry to hide the locations of its C&C server.
	==What is Botnet Threat Intelligence?==		==What is Botnet Threat Intelligence?==
-	Botnet Threat Intelligence is a knowledge base that Milcord has built using state of the art technology that detects and classifies fast flux botnets using both active and passive DNS monitoring. In addition, our approach is able to differentiate and classify all three fast-flux variants, including name server flux and double-flux.	+	Botnet Threat Intelligence is a knowledge base that Milcord has built using state-of-the-art technology that detects and classifies fast flux botnets using both active and passive DNS monitoring. In addition, our approach is able to differentiate and classify all three fast-flux variants, including name server flux and double-flux.

	==What does Botnet Threat Intelligence provide?==		==What does Botnet Threat Intelligence provide?==
-	Botnet Threat Intelligence provides ~~newly discovered~~ domains, domain IPs, nameserver domains, nameserver domain IPs used in fast flux service networks for malicious activities ~~for~~ spam campaigns, phishing attacks, malware delivery. The data repository is available as a standalone database or through a Web service API.	+	Botnet Threat Intelligence provides domains, domain IPs, nameserver domains, and nameserver domain IPs used in fast flux service networks for malicious activities such as spam campaigns, phishing attacks, and malware delivery. The data repository is available as a standalone database or through a Web service API.

	==What are the applications of Botnet Threat Intelligence?==		==What are the applications of Botnet Threat Intelligence?==
-	Our data service can be used by ISPs to ~~find~~ the infected consumer machines on their networks, by university System Administrators to find ~~infected~~ student machines, by financial service companies to determine the client machines under the control of botnet operators, by CERTs to check outbound traffic record archives against ~~the data feed~~ to find bad ~~cyber~~ neighborhoods, by government agency and large enterprise Network Administrators to ~~check~~ outbound traffic against ~~the data feed~~ to prevent infection of enterprise computing resources.	+	Our data service can be used by ISPs to identify the infected consumer machines on their networks; by university System Administrators to find compromised student machines; by financial service companies to determine the client machines under the control of botnet operators; by CERTs to check outbound traffic record archives against our intelligence to find the "bad neighborhoods" in cyberspace; and by government agency and large enterprise Network Administrators to monitor outbound traffic against our intelligence to prevent infection of enterprise computing resources.

	==References==		==References==
-	*Caglayan, A., Toothaker, M., Drapeau, D., Burke, D. and Eaton, G., (2011) '''''Behavioral Analysis of Botnets for Threat Intelligence''''', [http://www.springerlink.com/content/6025317575386950/ SpringerLink], Information Systems and e-Business Management, DOI: 10.1007/s10257-011-0171-7. [[Image:Arrow_right.gif]] [http://milcord.com/blog/2010/09/08/gfirst-2010-social-malware-insider-threat-fast-flux-botnets/ blog~~] \| [[Fast_Flux_Botnet_Data_Service \| solution]~~]	+	*Caglayan, A., Toothaker, M., Drapeau, D., Burke, D. and Eaton, G. (2011) '''Behavioral Analysis of Botnets for Threat Intelligence''', [http://www.springerlink.com/content/6025317575386950/ SpringerLink], Information Systems and e-Business Management, DOI: 10.1007/s10257-011-0171-7. [[Image:Arrow_right.gif]] [http://milcord.com/blog/2010/09/08/gfirst-2010-social-malware-insider-threat-fast-flux-botnets/ blog]
-	*Caglayan, A. and Toothaker, M. '''''FastFluxMonitor vs. Darknet traffic''''', [https://sie.isc.org/sie_workshop_agenda.html SIE Workshop], 3 October 2010, Atlanta, GA. ~~[[Image:Arrow_right.gif]] [[Fast_Flux_Botnet_Data_Service \| solution]]~~	+	*Caglayan, A. and Toothaker, M. '''FastFluxMonitor vs. Darknet traffic''', [https://sie.isc.org/sie_workshop_agenda.html SIE Workshop], October 3, 2010, Atlanta, GA.
-	* Massey, D. and Caglayan, A. '''''Event Detection via DNS and Route Monitoring''''', [http://www.us-cert.gov/GFIRST/ 6th Annual GFIRST National Conference], GFIRST6: Building Today, Shaping Tomorrow – Ensuring an Effective Response Capability to Manage Risks in Cyberspace, 15-20 ~~August~~ 2010, San Antonio, TX. ~~[[Image:Arrow_right.gif]] [[Fast_Flux_Botnet_Data_Service \| solution]]~~	+	* Massey, D. and Caglayan, A. '''Event Detection via DNS and Route Monitoring''', [http://www.us-cert.gov/GFIRST/ 6th Annual GFIRST National Conference], GFIRST6: Building Today, Shaping Tomorrow – Ensuring an Effective Response Capability to Manage Risks in Cyberspace, August 15-20, 2010, San Antonio, TX.
-	* Caglayan, A.~~, ''~~'''Improving Malware Situational Awareness by Monitoring the Relationships in DNS Infrastructure''''', [http://www.ll.mit.edu/mtem/2010/index.html Multiagency and Industry Malware and Bot Reverse Engineering Technical Exchange Meeting (MTEM 10)], MIT Lincoln Laboratory, 15-16 ~~July~~ 2010. [[Image:Arrow_right.gif]] [[Improving Malware Situational Awareness by Monitoring the Relationships in DNS Infrastructure \| abstract~~]] \| [[Fast_Flux_Botnet_Data_Service \| solution~~]]	+	* Caglayan, A. '''Improving Malware Situational Awareness by Monitoring the Relationships in DNS Infrastructure''', [http://www.ll.mit.edu/mtem/2010/index.html Multiagency and Industry Malware and Bot Reverse Engineering Technical Exchange Meeting (MTEM 10)], MIT Lincoln Laboratory, July 15-16, 2010. [[Image:Arrow_right.gif]] [[Improving Malware Situational Awareness by Monitoring the Relationships in DNS Infrastructure \| abstract]]
-	*''Caglayan, A., Toothaker, M., Drapeau, D., Burke, D. and Eaton, G. (2010)~~'' ''~~ '''Guilt by Association based Discovery of Botnet Footprints'' ''', NATO Research and Technology Organization Workshop on Information Security and Defense. Antalya, Turkey, ~~Apr.~~ 26-30, 2010. [[Image:Arrow_right.gif]] [[Guilt by Association based Discovery of Botnet Footprints \| abstract]] \| [http://ftp.rta.nato.int/public/PubFullText/RTO/MP/RTO-MP-IST-091/MP-IST-091-04.doc paper] \| [http://milcord.com/blog/2010/02/19/kneber-botnet-less-fluxy-but-more-stealthy/ blog~~] \| [[Fast_Flux_Botnet_Data_Service \| solution]~~]	+	*Caglayan, A., Toothaker, M., Drapeau, D., Burke, D. and Eaton, G. (2010) '''Guilt by Association based Discovery of Botnet Footprints''', NATO Research and Technology Organization Workshop on Information Security and Defense. Antalya, Turkey, April 26-30, 2010. [[Image:Arrow_right.gif]] [[Guilt by Association based Discovery of Botnet Footprints \| abstract]] \| [http://ftp.rta.nato.int/public/PubFullText/RTO/MP/RTO-MP-IST-091/MP-IST-091-04.doc paper] \| [http://milcord.com/blog/2010/02/19/kneber-botnet-less-fluxy-but-more-stealthy/ blog]
-	* ''Caglayan, A., Toothaker, M., Drapeau, D., Burke, D. and Eaton, G. (2010)~~'' ''~~'''Behavioral Patterns of Fast Flux Service Networks''''', Hawaii International Conference on System Sciences (HICSS-43) Cyber Security and Information Intelligence Research Minitrack. Koloa, Kauai, Hawaii, ~~Jan.~~ 5-8, 2010. [[Image:Arrow_right.gif]] [http://www.computer.org/portal/web/csdl/doi/10.1109/HICSS.2010.81 abstract] \| [http://csdl2.computer.org/comp/proceedings/hicss/2010/3869/00/02-02-05.pdf paper] \| [http://www.technologyreview.com/blog/editors/24252/ press~~] \| [[Fast_Flux_Botnet_Data_Service \| solution]~~]	+	*Caglayan, A., Toothaker, M., Drapeau, D., Burke, D. and Eaton, G. (2010)'''Behavioral Patterns of Fast Flux Service Networks''', Hawaii International Conference on System Sciences (HICSS-43) Cyber Security and Information Intelligence Research Minitrack. Koloa, Kauai, Hawaii, January 5-8, 2010. [[Image:Arrow_right.gif]] [http://www.computer.org/portal/web/csdl/doi/10.1109/HICSS.2010.81 abstract] \| [http://csdl2.computer.org/comp/proceedings/hicss/2010/3869/00/02-02-05.pdf paper] \| [http://www.technologyreview.com/blog/editors/24252/ press]
-	*Naone, E. [http://www.technologyreview.com/web/23747/?a=f Tracking Devious Phishing Websites] MIT Technology Review, ~~Oct.~~ 19, 2009.	+	*Naone, E. [http://www.technologyreview.com/web/23747/?a=f Tracking Devious Phishing Websites] MIT Technology Review, October 19, 2009.
-	*Naone, E. [http://www.technologyreview.com/blog/editors/24252/ Why Don't Spammers Get Shut Down Faster?] MIT Technology Review Blog, ~~Oct.~~ 19, 2009.	+	*Naone, E. [http://www.technologyreview.com/blog/editors/24252/ Why Don't Spammers Get Shut Down Faster?] MIT Technology Review Blog, October 19, 2009.
-	* McGrath, D. K., Kalafut, A., Gupta, M.~~, ''~~'''Phishing Infrastructure Fluxes All the ~~Wa''y~~''', IEEE Security and Privacy, pp. 21-28, September/October, 2009 [[Image:Arrow_right.gif]] [https://www.cs.indiana.edu/~minaxi/pubs/sANDp09.pdf paper]	+	*McGrath, D. K., Kalafut, A., Gupta, M. '''Phishing Infrastructure Fluxes All the Way''', IEEE Security and Privacy, pp. 21-28, September/October, 2009 [[Image:Arrow_right.gif]] [https://www.cs.indiana.edu/~minaxi/pubs/sANDp09.pdf paper]
-	* ''Caglayan, A., Toothaker, M., Drapeau, D., Burke, D., Eaton, G., Van Randwyk, J., Lloyd, L., Proebstel, E., Burnett, D., Bayer, G., and Sanders, B. (2009)~~'' ''~~ '''Botnet Analytics Appliance'' ''', Final Report, Department of Homeland Security Cyber Security R&D Center Contract No. NBCHC070126, October, 2009. [[Image:Arrow_right.gif]] [[Abstract: Botnet Analytics Appliance \| abstract~~]] \| [[Fast_Flux_Botnet_Data_Service \| solution~~]]	+	*Caglayan, A., Toothaker, M., Drapeau, D., Burke, D., Eaton, G., Van Randwyk, J., Lloyd, L., Proebstel, E., Burnett, D., Bayer, G., and Sanders, B. (2009) '''Botnet Analytics Appliance''', Final Report, Department of Homeland Security Cyber Security R&D Center Contract No. NBCHC070126, October, 2009. [[Image:Arrow_right.gif]] [[Abstract: Botnet Analytics Appliance \| abstract]]
-	* ''Caglayan, A., Toothaker, M., Drapeau, D., Burke, D. and Eaton, G. (2009)~~'' ''~~ '''Behavioral Analysis of Fast Flux Service Networks'' ''', Fifth Annual Cyber Security and Information Intelligence Research Workshop (CSIIRW 09), Oak Ridge, TN, April 13-15, 2009. [[Image:Arrow_right.gif]] [http://portal.acm.org/citation.cfm?doid=1558607.1558662 abstract] \| [http://www.csiir.ornl.gov/csiirw/09/CSIIRW09-Proceedings/Abstracts/Caglayan-abstract.pdf paper] \| [http://www.csiir.ornl.gov/csiirw/09/CSIIRW09-Proceedings/Slides/Caglayan-Slides.pdf presentation] \| [http://milcord.com/blog/2009/10/23/phishing-websites-flux-their-way/ blog] \| [http://www.technologyreview.com/web/23747/page1/ press] \| [[Botnet_Defense \| solution]]	+	*Caglayan, A., Toothaker, M., Drapeau, D., Burke, D. and Eaton, G. (2009) '''Behavioral Analysis of Fast Flux Service Networks''', Fifth Annual Cyber Security and Information Intelligence Research Workshop (CSIIRW 09), Oak Ridge, TN, April 13-15, 2009. [[Image:Arrow_right.gif]] [http://portal.acm.org/citation.cfm?doid=1558607.1558662 abstract] \| [http://www.csiir.ornl.gov/csiirw/09/CSIIRW09-Proceedings/Abstracts/Caglayan-abstract.pdf paper] \| [http://www.csiir.ornl.gov/csiirw/09/CSIIRW09-Proceedings/Slides/Caglayan-Slides.pdf presentation] \| [http://milcord.com/blog/2009/10/23/phishing-websites-flux-their-way/ blog] \| [http://www.technologyreview.com/web/23747/page1/ press] \| [[Botnet_Defense \| solution]]
-	* ''Caglayan, A., Toothaker, M., Drapeau, D., Burke, D. and Eaton, G. (2009)~~'' ''~~ '''Real Time Detection of Fast Flux Service Networks'' ''', Cybersecurity Applications and Technologies Conference for Homeland Security (CATCH 2009), Washington, DC, March 3-4, 2009. [[Image:Arrow_right.gif]] [http://www.computer.org/portal/web/csdl/doi/10.1109/CATCH.2009.44 abstract] \| [http://www.cyber.st.dhs.gov/public/CATCH/Caglayan.pdf presentation] \| [http://milcord.com/blog/2009/03/06/reflections-on-catch/ blog] \| [http://www.military-information-technology.com/mit-archives/32-mit-2008-volume-12-issue-7/213-battling-botnets.html press] \| [[Botnet_Defense \| solution]]	+	*Caglayan, A., Toothaker, M., Drapeau, D., Burke, D. and Eaton, G. (2009) '''Real Time Detection of Fast Flux Service Networks''', Cybersecurity Applications and Technologies Conference for Homeland Security (CATCH 2009), Washington, DC, March 3-4, 2009. [[Image:Arrow_right.gif]] [http://www.computer.org/portal/web/csdl/doi/10.1109/CATCH.2009.44 abstract] \| [http://www.cyber.st.dhs.gov/public/CATCH/Caglayan.pdf presentation] \| [http://milcord.com/blog/2009/03/06/reflections-on-catch/ blog] \| [http://www.military-information-technology.com/mit-archives/32-mit-2008-volume-12-issue-7/213-battling-botnets.html press] \| [[Botnet_Defense \| solution]]
-	* Buxbaum, P. A. [http://www.kmimediagroup.com/mit-archives/32-mit-2008-volume-12-issue-7/213-battling-botnets.html Battling Botnets] Military Information Technology~~, 2008~~, Vol. 12, No. 7.	+	*Buxbaum, P. A. [http://www.kmimediagroup.com/mit-archives/32-mit-2008-volume-12-issue-7/213-battling-botnets.html Battling Botnets] Military Information Technology, Vol. 12, No. 7., 2008.
-	* Caglayan, A., Toothaker, M. and Windholz, T. (2007) '''''A Bayesian Activity Monitor for Botnet Defense''''', 2007 Monterey Homeland Security Conference, Monterey, CA August 2007. [[Image:Arrow_right.gif]] [[:Image:Homeland_Security_Conference_2007.pdf\|presentation~~]] \| [[Automated_Image_Understanding \| solution~~]]	+	*Caglayan, A., Toothaker, M. and Windholz, T. (2007) '''A Bayesian Activity Monitor for Botnet Defense''', 2007 Monterey Homeland Security Conference, Monterey, CA, August 2007. [[Image:Arrow_right.gif]] [[:Image:Homeland_Security_Conference_2007.pdf\|presentation]]
-	* Caglayan, A., Toothaker, M. and Windholz, T. (2007) '''''A Bayesian Activity Monitor for Botnet Defense''''', Final Report, Department of Homeland Security Cyber Security R&D Center Contract No. NBCHC060135, March, 2007. : [[Image:Arrow_right.gif]] [[Abstract: A Bayesian Activity Monitor for Botnet Defense \| abstract~~]] \| [[Fast_Flux_Botnet_Data_Service \| solution~~]]	+	* Caglayan, A., Toothaker, M. and Windholz, T. (2007) '''A Bayesian Activity Monitor for Botnet Defense''', Final Report, Department of Homeland Security Cyber Security R&D Center Contract No. NBCHC060135, March, 2007. [[Image:Arrow_right.gif]] [[Abstract: A Bayesian Activity Monitor for Botnet Defense \| abstract]]

	[[Category:Cyber Security]]		[[Category:Cyber Security]]