Re: It is really critical that we get more technical review of this 'Patterning' approach before moving to a Committee Specification Draft (CSD)
“Our CTI lexicon MUST allow representation of events at the timescales/periodicity of the operational domain we (and our machines) are observing, measuring, and conveying to
others.”
This is particularly true of a CTI patterning language specifically tasked with describing and detecting temporal event relationships.
A sampling of citations:
10 Gigabit Ethernet Transmissions Technologies
Joe Lutz: Chief Cook and Bottle Washer
http://www.sonet.com/EDU/10ge.pdf
C5: Cross-Cores Cache Covert Channel
Cl´ementine Maurice , Christoph Neumann , Olivier Heen , and Aur´elien Francillon
http://www.s3.eurecom.fr/docs/dimva15_clementine.pdf
Cache Storage Attacks
Billy Bob Brumley
http://www.springer.com/cda/content/document/cda_downloaddocument/9783319167145-c2.pdf?SGWID=0-0-45-1496482-p177303495
Eliminating Cache-Based Timing Attacks with Instruction-Based Scheduling
Deian Stefan, Pablo Buiras , Edward Z. Yang , Amit Levy , David Terei , Alejandro Russo , and David Mazières
https://cseweb.ucsd.edu/~dstefan/pubs/stefan:2013:eliminating.pdf
Understanding Contention-Based Channels and Using Them for Defense
Casen Hunger, Mikhail Kazdagli, Ankit Rawat, Alex Dimakis, Sriram Vishwanath, Mohit Tiwari The University of Texas at Austin
http://users.ece.utexas.edu/~tiwari/pubs/HPCA-15-contention.pdf
Respectfully request that we add the following 3 words to the specification for those who need to express these periodicities:
PICOSECONDS
NANOSECONDS
MICROSECONDS
|
a
WITHIN x MILLISECONDS | SECONDS | MINUTES |
HOURS | DAYS | MONTHS | YEARS |
a
MUST be an Observation _expression_ or a preceding Qualifier. All Observations that match
a MUST occur, or have been observed, within the specified time window. If there is a set of two or more Observations matched by
a, the most recent Observation timestamp contained within that set MUST NOT be later than the delta of the earliest Observation timestamp within the set plus the specified time window.
Example: ([file:hash.SHA-256 = '13987239847'] ALONGWITH [win-registry-key.key = 'hkey']) WITHIN 2 MINUTES The above Pattern _expression_ looks for a filehash and a registry key that were observed within 2 minutes of each other. The parentheses are needed to apply the WITHIN Qualifier to both
Observation Expressions. |
Patrick Maroney
Office: (856)983-0001
Cell: (609)841-5104
President
Integrated Networking Technologies, Inc.
PO Box 569
Marlton, NJ 08053