Skip to main content
SpringerLink
Log in

Towards Scientific Incident Response

  • Conference paper
  • First Online:
Decision and Game Theory for Security (GameSec 2018)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 11199))

Included in the following conference series:

Abstract

A scientific incident analysis is one with a methodical, justifiable approach to the human decision-making process. Incident analysis is a good target for additional rigor because it is the most human-intensive part of incident response. Our goal is to provide the tools necessary for specifying precisely the reasoning process in incident analysis. Such tools are lacking, and are a necessary (though not sufficient) component of a more scientific analysis process. To reach this goal, we adapt tools from program verification that can capture and test abductive reasoning. As Charles Peirce coined the term in 1900, “Abduction is the process of forming an explanatory hypothesis. It is the only logical operation which introduces any new idea.” We reference canonical examples as paradigms of decision-making during analysis. With these examples in mind, we design a logic capable of expressing decision-making during incident analysis. The result is that we can express, in machine-readable and precise language, the abductive hypotheses than an analyst makes, and the results of evaluating them. This result is beneficial because it opens up the opportunity of genuinely comparing analyst processes without revealing sensitive system details, as well as opening an opportunity towards improved decision-support via limited automation.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    Any given \(\left\{ \phi \right\} \mathcal {C}\left\{ \psi \right\} \) for a program will be treated as a hypothesis, and one that given sufficient evidence might be overturned and modified.

References

  1. Alberts, C., Dorofee, A., Killcrece, G., Ruefle, R., Zajicek, M.: Defining incident management processes for CSIRTS: a work in progress. Technical report. CMU/SEI-2004-TR-015, Software Engineering Institute, CMU 2004 (2004)

    Google Scholar 

  2. Bergman, M., Paavola, S.: ‘Abduction’: Term in The Commens Dictionary: Peirce’s Terms in His Own Words. New Edition, 14 July 2016. http://www.commens.org/dictionary/term/abduction

  3. Brotherston, J., Villard, J.: Sub-classical Boolean bunched logics and the meaning of par. In: Proceedings of CSL, vol. 24, pp. 325–342. LIPIcs (2015)

    Google Scholar 

  4. Calcagno, C., Distefano, D., O’Hearn, P.W., Yang, H.: Compositional shape analysis by means of bi-abduction. J. ACM 58(6), 26:1–26:66 (2011)

    Article  MathSciNet  Google Scholar 

  5. Caltagirone, S., Pendergast, A., Betz, C.: The diamond model of intrusion analysis. Technical report, Center for Cyber Intelligence Analysis and Threat Research (2013). http://www.threatconnect.com/methodology/diamond_model_of_intrusion_analysis

  6. Casey, E.: Digital Evidence and Computer Crime: Forensic Science, Computers, and The Internet. Academic press, Cambridge (2000)

    Google Scholar 

  7. Dear, P.: The Intelligibility of Nature: How Science Makes Sense of the World. University of Chicago Press, Chicago (2006)

    Book  Google Scholar 

  8. Galmiche, D., Méry, D., Pym, D.: The semantics of BI and resource tableaux. Math. Struct. Comp. Sci. 15(06), 1033–1088 (2005)

    Article  MathSciNet  Google Scholar 

  9. Henderson, L.: The problem of induction. In: Zalta, E.N. (ed.) The Stanford Encyclopedia of Philosophy. Metaphysics Research Lab, Stanford University, Summer 2018 edn. (2018)

    Google Scholar 

  10. Heuer, R.J.: Psychology of Intelligence Analysis. US Central Intelligence Agency (1999)

    Google Scholar 

  11. Horneman, A.: How to think like an analyst, 17 July 2017. https://insights.sei.cmu.edu/sei_blog/2017/07/how-to-think-like-an-analyst.html

  12. Hutchins, E.M., Cloppert, M.J., Amin, R.M.: Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains. Lead. Issues Inform. Warfare Secur. Res. 1, 80 (2011)

    Google Scholar 

  13. Ishtiaq, S.S., O’Hearn, P.W.: BI as an assertion language for mutable data structures. In: Principles of Programming Languages, pp. 14–26. ACM, London (2001). https://doi.org/10.1145/360204.375719

  14. Kent, K., Chevalier, S., Grance, T., Dang, H.: Guide to integrating forensic techniques into incident response. Technical report, SP 800–86, National Institute of Standards and Technology, August 2006

    Google Scholar 

  15. Lamport, L.: What good is temporal logic? In: Mason, R. (ed.) IFIP Congress, pp. 657–668. Elsevier (1983)

    Google Scholar 

  16. Lamport, L.: Specifying Systems: The TLA+ Language and Tools for Hardware and Software Engineers. Wesley, Boston (2002)

    Google Scholar 

  17. Manna, Z., Pnueli, A.: The Temporal Logic of Reactive and Concurrent Systems. Springer, New York (1992). https://doi.org/10.1007/978-1-4612-0931-7

    Book  MATH  Google Scholar 

  18. O’Hearn, P.W.: From categorical logic to Facebook engineering. In: Logic in Computer Science (LICS), pp. 17–20. IEEE (2015)

    Google Scholar 

  19. O’Hearn, P.W., Pym, D.J.: The logic of bunched implications. Bull. Symbolic Logic 5(2), 215–244 (1999)

    Article  MathSciNet  Google Scholar 

  20. Ou, X., Govindavajhala, S., Appel, A.W.: MulVAL: a logic-based network security analyzer. In: USENIX Security Symposium, pp. 113–128 (2005)

    Google Scholar 

  21. von Plato, J.: The development of proof theory. In: Zalta, E.N. (ed.) The Stanford Encyclopedia of Philosophy. Metaphysics Research Lab, Stanford University, Winter 2016 edn. (2016)

    Google Scholar 

  22. Pym, D., Spring, J.M., O’Hearn, P.: Why separation logic works. Philosophy and Technology (2018). https://doi.org/10.1007/s13347-018-0312-8

  23. Pym, D.J., O’Hearn, P.W., Yang, H.: Possible worlds and resources: the semantics of BI. Theor. Comput. Sci. 315(1), 257–305 (2004)

    Article  MathSciNet  Google Scholar 

  24. Reynolds, J.C.: Separation logic: a logic for shared mutable data structures. In: Logic in Computer Science, pp. 55–74. IEEE (2002)

    Google Scholar 

  25. Roesch, M.: Snort: lightweight intrusion detection for networks. In: Large Installation Systems Admin, pp. 229–238. USENIX, Seattle, November 1999

    Google Scholar 

  26. Shirey, R.: Internet Security Glossary, Version 2. RFC 4949, August 2007

    Google Scholar 

  27. Spring, J.M., Hatleback, E.: Thinking about intrusion kill chains as mechanisms. J. Cybersecur. 3(3), 185–197 (2017)

    Google Scholar 

  28. Spring, J.M., Illari, P.: Review of human decision-making during incident analysis. Under review (2018)

    Google Scholar 

  29. Spring, J.M., Moore, T., Pym, D.: Practicing a science of security: a philosophy of science perspective. In: New Security Paradigms Workshop, Santa Cruz, 1–4 October 2017

    Google Scholar 

  30. Stoll, C.: The Cuckoo’s Egg: Tracking a Spy Through the Maze of Computer Espionage. Pan Books, London (1989)

    Google Scholar 

  31. Tambe, M.: Security and Game Theory: Algorithms, Deployed Systems, Lessons Learned. Cambridge University Press, Cambridge (2011)

    Book  Google Scholar 

Download references

Acknowledgements

Spring is supported by University College London’s Overseas Research Scholarship and Graduate Research Scholarship. Thanks to Simon Docherty for discussion and constructive comments.

Author information

Authors and Affiliations

  1. University College London, Gower Street, London, UK

    Jonathan M. Spring & David Pym

  2. Alan Turing Institute, 96 Euston Road, London, UK

    David Pym

Authors
  1. Jonathan M. Spring
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. David Pym
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Jonathan M. Spring .

Editor information

Editors and Affiliations

  1. University of Washington, Seattle, WA, USA

    Linda Bushnell

  2. University of Washington, Seattle, WA, USA

    Radha Poovendran

  3. University of Illinois at Urbana–Champaign, Urbana, IL, USA

    Tamer Başar

Rights and permissions

Reprints and permissions

Copyright information

© 2018 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Spring, J.M., Pym, D. (2018). Towards Scientific Incident Response. In: Bushnell, L., Poovendran, R., Başar, T. (eds) Decision and Game Theory for Security. GameSec 2018. Lecture Notes in Computer Science(), vol 11199. Springer, Cham. https://doi.org/10.1007/978-3-030-01554-1_23

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-01554-1_23

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-01553-4

  • Online ISBN: 978-3-030-01554-1

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation