Detection and Isolation of Anomalies for DETER Emulation of Abilene

The use of Internet has become the way of living for man today. However, with the use of internet requires safety and privacy. This is the reason why TRUST1 is pushing and working towards the quest of safety, privacy and cyber security of people using the internet for their day to day living. In this paper, the primary research goal is to study the interaction and strategies for attack and defense of control systems and (learning) detection systems in the emulated environment provided by the DETER Lab[9]2 cluster. This paper will be able explain for the reader to understand how to construct an emulation of a real Internet backbone and the control system behavior communicating over the Internet2 Abilene Network Topology built in DETER testbed using SEER3[8] . DETER[9] is a testbed used to conduct, run, and test experiments that sometimes involve malicious codes. DETER’s SEER is the Security Experimentation EnviRonment which has set of tools and agents for helping an experiment setup, script and performs experiments such as Denial of Service attack (DoS) or Distributed Denial of Service attack (DDoS) in the DETER[9] testbed environment. Moreover, SEER includes agents for traffic generation, attack generation, traffic collection and analysis. In this paper, there will be an algorithm script that detects and differentiates anomalies on the external and internal nodes. The network that is made will be used to emulate backbone network traffic and implement attacks throughout the rest of this project.