Abstract: In an organization, the interactions users have with software leaves patterns or traces of the parts of the systems accessed. These interactions can be associated with the underlying software architecture. The first step in detecting problems like insider threat is to detect those traces that are anomalous. In this paper, we present a method to find anomalous users leveraging these interaction traces, categorized by user roles. We propose a model based approach to cluster user sequences and find outliers. Such a technique could be useful in finding potentially anomalous users, insiders, or compromised accounts.We show that the approach works on a simulation of a large scale system based on and Amazon Web application style.

Abstract: Security researchers do not have sufficient example systems for conducting research on advanced persistent threats, and companies and agencies that experience attacks in the wild are reluctant to release detailed information that can be examined. In this paper, we describe an Advanced Persistent Threat Exemplar that is intended to provide a real-world attack scenario with sufficient complexity for reasoning about defensive system adaptation, while not containing so much information as to be too complex. It draws from actual published attacks and experiences as a security engineer by the authors.

Abstract: While security is important to self-adaptive systems research, it is particularly difficult to simulate the characteristics of the most insidious adversary, the advanced persistent threat (APT). The research community requires an APT simulation environment that provides the realism and depth that is necessary for a sufficient simulation, but this should not be too complex, difficult, or expensive to use. Additionally, a successful simulation environment must ensure that malware does not escape into the wild. We present a cyber range for self-adaptive systems researchers to simulate APTs, complete with an example system under test and attack scenario.