Slashdot Mirror
Modeling Security Software To Mimic Ant Behavior
wiredmikey writes "Researchers from universities and national laboratories in the United States are developing software that mimics ant behavior, as a new approach to network security."
The concept has been around for a while, but this summer researchers are working to train the "digital ants" well enough that they can turn them loose into the power grid to seek out computer viruses trying to wreak havoc on the system.
Will McAfee come out with Ant Trap 1.0?
Turn them loose? Sounds like skynet. What could possibly go wrong?
That swallowed a fly...
Nullius in verba
"I, for one, welcome our new insect overlords." Sorry, but the perfect oportunity to use the original quote doesn't come up every day...
So, in order for these "ant-like" software agents to "roam" around a network, presumably all the machines on the net will have to keep a port open to accept random downloads of software to run locally?
Sure, that'll work.
I'd like my security software to stay resident at all times, thank you very much.
And "swarming"? I suppose that is an effective response, sucking up CPU by making meaningless copies of itself will keep the virus from doing much. But I'd rather remove the malware.
"In nature, we know that ants defend against threats very successfully," Fulp said. "They can ramp up their defense rapidly, and then resume routine behavior quickly after an intruder has been stopped. We're trying to achieve that same framework in a computer system."
Yeah, that's what we need. One Symantec AV can't stop a virus it doesn't know about, so we need TEN SYMANTEC AVS on the job.
The problem in computer security is one of DISCERNING INTENT. Good code and bad code look the same. The call the same functions, perform mostly the same tasks.
Think of VNC or Windows Remote Help vs a backdoor trojan. Same basic thing, just different intent.
FTP, Dropbox or other file transfer vs a trojan that uploads your files. Intent again.
Ants don't do any better at recognizing bad guys than AV software does. Faced with an enemy that is TRYING to disguise itself, they are fooled or sidelined. http://www.securityweek.com/researchers-model-security-software-mimic-behavior-ants
On the bight side, I'll be they can squeeze a few research grants out of it.
Learning HOW to think is more important than learning WHAT to think.
...but the power of such a system is in interpreting the data. It sounds as if the 'ants' themselves wander about the network observing specific attributes, then leaving behind a few notes on anomalies found. Other ants come along, attracted by the 'scent' of the data, and add their own observations. This is all well and good, but my skepticism comes in when we try to interpret the 'odors'. The ants have a chance of observing an event they or another ant caused to happen, which introduces false positives. Other ants arrive, further interfering with the results and pointing virtual fingers at what could be an illusionary culprit. Therefore, the trouble with this approach is that there always exists a possibility of that which 'smelt' it, 'dealt' it.
"this summer researchers are working to train the "digital ants" well enough that they can turn them loose into the power grid to seek out computer viruses trying to wreak havoc on the system".
The only way 'computer viruses` could get into the power grid is if you run your SCADA units on Microsoft Windows and connect them directly to the Internet. Designing a system that allows 'digital ants` to scurry about and be secure at the same time is a contradiction in terms. What happens if the 'digital ants` are hijacked by the .cyber->terrorists :)
“The power grid is probably more vulnerable to cyber attacks than security experts would like to admit,” said Fulp.,
What part of don't connect your SCADA units to the Internet don't these 'security experts' understand?
“As the grid becomes more and more interconnected, it offers hackers more points to enter the system; for instance, inserting a virus or computer worm into a low security site, such as in your home's smart grid, to gain access to more secure systems up the line,”
Anyone who designs such a system should be arrested immediately and shifted off to Guantanamo Bay as a threat to national security.
Hahahahawhawhaw.
Carry on.
I am very small, utmostly microscopic.
Exit the age of the computer virus. Enter the age of the computer fungus!
"In nature, we know that ants defend against threats very successfully," Fulp said. "They can ramp up their defense rapidly, and then resume routine behavior quickly after an intruder has been stopped. We're trying to achieve that same framework in a computer system." link
Except computer viruses are no way near analogous to the biological kind. In nature the virus first has to latch onto the outside of the cell before injecting its genetic payload. It does this by hijacking biological processes necessary the cell to survive and propagate in the host fluid. There is no such analogous process in computer systems. A computer system can still function without ever having to download external code. The root cause of the current virus/spam/phishing infestation being the inability of the local system to differentiate between code and data and not allowing remote code to be run.
Invented years ago by TP
http://www.paulkidby.com/stickers/index.html/
...to honeypots?
I8-D
...crispy ant jerky
With apologies to Scott Adams, whomever he is signed in as today
Nullius in verba
Well, I was wrong. The DigiAnts are a godsend.
But isn’t that a bit short-sighted? What happens when we’re overrun by DigiAnts?
No problem. We simply release wave after wave of Chinese DigiAnteater. They’ll wipe out the DigiAnts.
But aren’t the DigiAnteaters even worse?
Yes, but we’re prepared for that. We’ve lined up a fabulous type of DigiGorilla that thrives on DigiAnteater bits.
But then we’re stuck with DigiGorillas!
No, that’s the beautiful part. When IPv6 rolls around, the DigiGorillas simply get null routed.
Is it me, or is it getting a bit warm on such a fine, sunny day?
the growth in cynicism and rebellion has not been without cause
I see no potential problems with this idea at all
I mean, its not as if the solution has ever been worse than the problem it was to fix before, right?
my magnifying glass...
... why don't they just build a system that mimics a secure network!
It doesn't require an Internet connection to get infected. The most useful approach I've seen so far in power plants is 2 separated networks. One reserved for control with no external media or Internetconnection and one with internet and functioning drives, USB ports and all that. People are going to try to use the computer on their desk to do stuff they want, unless you provide them with an alternative. Lock the control computer down as best as you can, and leave the other one as open as possible.
I was promised a flying car. Where is my flying car?
nuff'said
From TFA:
Berenhaut and Hilton are working to answer man questions: How do the ants migrate across different computer platforms and systems operating at different speeds?
I'm not entirely sure how that's a "man question", and I certainly don't want MANswers to attempt to answer it.
Don't thank God, thank a doctor!
All it takes is a 10 year old with a magnifying glass to wipe out your entire security system.
Who would win this election: Andrew Weiner vs Andrew Weiner's weiner.
"In nature, we know that ants defend against threats very successfully," Fulp said.
Yeah, I'd say lions defend against threats even better. Why not model our security software to mimic lion behavior?
First it would conceal among other packets until the virus gets distracted. Then it will run at it in an angle so that the virus will run straight into an ambush mounted by other lions. Then they will bite the virus neck until it dies. Done! No more virus!
You may be vulnerable while your security software is napping though...
Wasn't it the writer of Melissa that has had original intent of searching for other virii and removing them? I am no cracker, but from what I know AV software is common initial target of any decent virus; why would ants be immune to such attacks and who could guarantee that they are impermeable? This scenario sounds more like "once you get infected, can't get help by being insected" or whatever. Adding more possible holes that have mind of their own isn't really a security way to go...
.Play.Open.Minded.
how do the ants gain access to the systems they are protecting? if this works anything like lawful intercept these ants really will be bugs in the system.
"researchers are working to train the digital ants well enough that they can turn them loose" ...
100 years later:
Agent Smith: I'd like to share a revelation that I've had during my time here. It came to me when I tried to classify your species and I realized that you're not actually mammals. Every mammal on this planet instinctively develops a natural equilibrium with the surrounding environment but you humans do not. You move to an area and you multiply and multiply until every natural resource is consumed and the only way you can survive is to spread to another area. There is another organism on this planet that follows the same pattern. Do you know what it is? A virus. Human beings are a disease, a cancer of this planet. You're a plague and we are the cure.
is going to be full of bugs
Seems like a great idea, as long as it's released on an electrical network that I'm not using!
"Human Readable" in his short story collection "With a Little Help". :-)
Really enjoyable read, as are all his books. And you can read 'em for free if you like (most, if not all, are under creative commons), so there's no harm in checking it out
I'd love to explain the story, cause it's really great, but that'd give away too much.
This is obviously an excuse to make a virus who is an antivirus. No pun intended.
I have read information on ant behavior software application posted at mightystudent.com, it mentioned that once successfully created it will lessen or eliminate computer viruses. Best luck to all those researchers and IT people.