Choosing a Detection Method

A detection system can work in one of two ways. It can look for things it already knows are attacks, or it can learn what normal looks like and watch for what doesn't fit.

A small antivirus company in Belarus, VirusBlokAda, was asked in June 2010 to look at computers in Iran that kept restarting. Its researcher, Sergey Ulasen, found a program no one had seen before. It spread on USB drives and through networks, and it used four flaws in Windows that weren't yet publicly known. Its drivers were signed with a certificate stolen from a real hardware company, Realtek, so Windows treated them as trustworthy software. It had been loose for at least a year. Explain why antivirus programs, which mostly worked by signatures, hadn't flagged it in all that time.

A signature is a description of an attack someone has already caught and studied, and no one had caught this one, so there was nothing to match. Every file looked new, and the stolen certificates made it look legitimate too.

Researchers who took the program apart over the following months found its target. It was built to reach Siemens industrial controllers like the one in the photo below, running the centrifuges that enrich uranium at Iran's Natanz plant. The plant was guarded by fences and anti-aircraft guns, and its control network wasn't connected to the internet, so the program had to be carried in, most likely on a USB drive.

A controller like this is a rugged small computer that runs machinery. It reads the machines' sensors, sends commands to their motors and valves, and passes its readings on to the operators' screens. Stuxnet rewrote the controllers' programs. The version found in 2010 sped the centrifuges up and slowed them down to wear them out. An earlier version went after the controllers that ran the valves: it recorded 21 seconds of normal sensor readings and played them to the operators' screens over and over while it raised the pressure inside the centrifuges. That is a weakness of anomaly-based detection too: a comparison only helps if the readings fed to it are real. Reporters and researchers later said Stuxnet was built by the United States and Israel, which have never confirmed it.

The bus agency is choosing how to watch its dispatch segment. Traffic there follows the schedule: every bus on the road sends a location report every 30 seconds, so the expected count in any minute is twice the number of buses scheduled to be out. On a weekday at noon, with 230 buses out, the segment carries about 460 reports a minute, and the agency's tolerance is 10 percent either way. Find the range a reading has to stay inside, the shaded band on the chart.

Ten percent of 460 is 46, so a reading has to stay between 414 and 506 reports a minute. The jump to 910 at 12:03 is far outside it, and an anomaly-based system would raise an alert, whatever caused it: a flood of forged reports, a device gone wrong, or something no signature describes.

A few hundred reports a minute is light traffic, so signature-based detection's efficiency buys little there.

Because every bus reports on the same 30-second clock, the traffic follows the schedule closely.

Dispatch's job is critical. Its radios and software come from one small vendor, and few signature databases cover them, so an attack on them would likely be new to a signature-based tool. All of that points to anomaly-based detection, or hybrid if the agency can pay for it. Before deciding, the agency weighs what each choice would cost: in speed, in money, in alarms raised for nothing, and in attacks that raise none.

On dispatch, an alert that comes later does less harm than an attack no one ever sees, so speed counts for less than coverage. Money is the harder limit. Hybrid means buying and running the equipment for both methods. False alarms are a cost too: the spike to 910 might turn out to be one faulty radio, and someone still has to check it.

If the spike to 910 was a flood of forged reports that matched no known signature, a signature-based tool would have stayed quiet through it.

The agency chooses hybrid detection for dispatch and pays for it by putting off new computers for the office until the next budget year. It also decides who on the team reads dispatch's alerts each day, so that the tenth false alarm of the week still gets read.