Sandra Steinbrecher
email: steinbrecher@acm.org

The Need for Interoperable Reputation Systems

Nowadays more and more Internet applications install reputation systems to collect opinions users have about some reputation objects. The opinions are usually formalized in the form of ratings the reputation system can use to build overall reputation profiles of the reputation objects. Reputation objects might be other users, products, web content and anything else that can be rated. Users may investigate the reputation object's reputation profile to estimate its quality resp. trustworthiness. As there are currently many providers of reputation systems it would be desirable to make reputation information in different systems interoperable or to establish meta reputation systems that collect information from various applications resp. their reputation systems. This process should consider both interoperability of reputation systems themselves and their interoperability with applications, trust and identity management systems as we will discuss in this paper.

Introduction

The experiences of an individual's environment influence his own interactions with others. When a friend made bad experiences with a shop the individual might become skeptical as well or even resist to buy there. The Internet offers its users the possibility to exchange knowledge and experiences regarding the online and offline world not only with others in their near environment, but with nearly everyone: Many users inform themselves about others' experiences with sellers before buying from them in a marketplace like eBay 1 . Many users inform themselves about hotels before booking a room in travel portals like tripadvisor 2 . Also many users make use of the book reviews collected in a store like amazon 3 before buying a book. These three examples of eBay, tripadvisor and amazon have in common that the respective providers installed a reputation system that allows users to rate reputation objects of a certain category: in eBay other users, in tripadvisor objects related to traveling like hotels and restaurants, in amazon products like books the store sells. Reputation systems can collect the experiences users make with reputation objects in a technically efficient way. These experiences may help other users to estimate the future trustworthiness resp. quality of reputation objects they have no personal experience with. But informing himself about a reputation object does not prevent any user from making bad experiences with it because e.g., reputation usually is contextdependent and subjective. Although 'social attacks' (e.g., users may lie [START_REF] Dellarocas | Immunizing online reputation reporting systems against unfair ratings and discriminatory behavior[END_REF] or reputation objects may change) are possible, a usually large number of ratings and an honest majority of users will hopefully achieve that dissatisfied users are the exception. So reputation systems do not make other technical security measures (like digital signatures or certifications by independent institutions) obsolete, but hopefully reduce the cases where expensive legal enforceability might become necessary. 4 Many users do not only use one, but several reputation systems, typically they might even be reputation objects in several reputation systems. E.g., both eBay and Amazon are providers of marketplaces and many people use both. For this reason there is an interest of users in using reputation they earned in one application as reputation object also in the other application. The same holds also for the author of a book: If he got good ratings on amazon, he might want to transfer these ratings also to the reputation system of another book store that sells his book. Also the respective store is interested in getting this reputation information from another store as it will typically increase its profit to provide large reputation profiles of the products it sells. Reputation systems are now evolving into reputation-as-service applications like epinion 5 for products or iKarma 6 for companies/individuals independent from a concrete application, but still mostly have a singleprovider model. There is the vision to establish stand-alone reputation systems that collect information from various interactions and in various contexts and also to make reputation information in different systems interoperable [START_REF]Position paper. reputation-based systems: a security analysis[END_REF]. This process should consider both interoperability of reputation systems themselves and their interoperability with various other systems as we will discuss in this paper in Sect. 3-6 after explaining the preliminaries in Sect. 2.

Preliminaries

For our system environment as shown in Figure 1 7 , we assume applications that allow users to make experiences with a so-called reputation object. Such an application might be, e. g., a marketplace where users make experiences with sellers or a wiki where users make experiences with content and authors. Further reputation systems are provided that collect positive and negative experiences the users report to it about reputation objects in the form of ratings given with a rating function. The reputation system updates the reputation of the reputation object from Please note that the social and legal aspects cannot be discussed in further detail. http://www.epinion.com (last visited April 2010) http://www.ikarma.com/ (last visited April 2010) Please note that we assume a user as reputation object in this Figure, but it can also be any arbitrary reputation object.

the ratings received with a reputation function. The reputation systems may exchange reputation between the reputation objects with the help of a reputation exchange function. Reputation in a reputation system might be stored centralized at reputation servers designated for this purpose, locally with the reputation object itself, or distributed with other users. If a user (the so-called evaluator) becomes interested in a reputation object, the reputation system provides him with an evaluation function to learn a reputation object's reputation following specific rules. The selection of ratings used by the evaluation function depends on both the information flow of ratings the system provides between the users and the trust structure between the users, i.e. how users trust in others' ratings. The information flow is organized by the reputation system while the trust structure is determined by a trust management system that allows to assign trust values to other users. Depending on these two aspects the reputation selection for the evaluation function might be:

-Global: This means the information flow within the reputation network is complete and every evaluator gets the same reputation of a reputation object. -Individual: This means an evaluator only gets a partial view on the reputation available. Here possibly every evaluator might receive a different reputation of the reputation object.

For interacting with any system users make use of an identity management system to possibly separate different partial identities they have. From this architecture four interoperability issues arise that will be outlined in the following sections. First there is the aspect of interoperability between reputation systems that will be discussed in Sect. 3. This needs interoperability of the corresponding applications to either make reputation systems interoperable or to install a common reputation system that collects ratings from several applications as will be outlined in Sect. 4. In Sect. 5 we further discuss that for the evaluation function interoperability with trust management systems should become important. Finally in Sect. 6 the possibilities for interoperability with identity management systems for the reasons of privacy and security are explained. For further issues of reputation systems' privacy and security we refer to [START_REF] Steinbrecher | Enhancing multilateral security in and by reputation systems[END_REF][START_REF]Position paper. reputation-based systems: a security analysis[END_REF].

Interoperability of reputation systems

Typically users interact in manifold ways on the Internet. They might play, sell, post product ratings, discuss with friends on different topics and so on. As they might collect reputation in many applications, making existing reputation system(s) for these applications interoperable becomes of interest. The problem of interoperability that is represented by the reputation exchange function in our model is twofold:

-Format: First formats for common exchange and possibly also internal representation of reputation are needed. An OASIS group8 works on a possible portable format using XML. But currently we still lack such a standard that could be implemented. Here is the need for solutions that can be easily integrated in the existing web technologies. The suggestion we implemented in [START_REF] Steinbrecher | Jason: A scalable reputation system for the semantic web[END_REF] was to use the Resource Description Framework (RDF) [START_REF] Manola | RDF Primer. W3C Recommendation, W3C[END_REF] common for the Web 2.0 and allowing to add reputation information as meta-information to arbitrary web content. -Algorithm: In every reputation system different implementations of rating function, evaluation function and reputation function are defined depending on the system designer. An overview of possible functions is for example given in [START_REF] Mui | Computational Models of Trust and Reputation: Agents, Evolutionary Games, and Social Networks[END_REF]. For an economic introduction of possible advantages and disadvantages certain choices have we refer to [START_REF] Dellarocas | The digitization of word-of-mouth: Promise and challenges of online feedback mechanisms[END_REF]. An algorithm how to transfer reputations received from another reputation system to the own reputation system is needed. This algorithm needs to comprise inheritance rules for reputation to decide on interoperability of reputation or ratings from different reputation systems. The OpenPrivacy Initiative 9 presented Sierra, a reference implementation of a reputation management framework comprising several components representing the functions of the reputation system as well as an identity management system. They also define reputation exchange functions, whose actual implementation can be determined by the system designer in terms of exchange rates between reputations calculated from different reputation functions. However, there are other issues of interoperability between reputation systems so far neglected by the technical literature:

-Several reputation exchanges: For several executions of the reputation exchange functions between two reputation systems it has to be secured that it is clear which part of reputation has already been exchanged. -Related reputation objects: So far we assumed that the reputation object is well determined. Another issue interoperability of reputation systems has to deal with is the possible relation between distinct reputation objects. For example a reputation system collecting reputation of content might need to exchange reputation with a reputation system collecting reputation of authors. Certainly there is some relation between a content and its authors, but it might not be advisable to transfer reputation of one content directly to its authors and vice versa. Thus reputation systems need to define the transfer of reputation between related objects by a reputation object exchange function.

Interoperability with applications

Currently the vision arises to establish stand-alone reputation systems that collect information from various interactions in different applications.

Social scientists and theoretical economists model the problem whether two users, who want to interact, should place trust in each other as a so-called trust game [START_REF] Camerer | Experimental tests of a sequential equilibrium reputation model[END_REF][START_REF] Dasgupta | Trust as a commodity[END_REF] that needs inter-personal context-specific trust.

The reputation system tries to assist users in this game by implementing a social network that allows users to exchange information with each other. By the evaluation function users can learn others' reputation. In social sciences this is called the learning mechanism of the social network [START_REF] Buskens | Embedded trust: Control and learning[END_REF]. On the other hand users may control other users by spreading information about the users in the social network. In social sciences this is called the control mechanism of the social network [START_REF] Buskens | Embedded trust: Control and learning[END_REF] as implemented with the rating function of the reputation system. Thus, he applications, where the interactions rated took place, have to provide the reputation system with as much information as possible on the following aspects:

-Model of Trust Game: Only users, who gave a leap of faith to reputation objects should be able to rate them. Applications have to make a clear model, who gave a leap of faith and specify this for the reputation system. -Interaction information: As reputation is context-dependent information on the interaction rated is needed, e.g., time, value for the interaction partners. -Rater information: As reputation needs to build on inter-personal trust also information on the raters is needed as will be outlined in Sect. 5

Beneath the OpenPrivacy Initiative mentioned in Sect. 3 there are commercial stand-alone systems like iKarma as 'third-party service for collecting, managing and promoting [your] reputation among [your] customers and contacts.' 10 or portals like Trivago 11 that comprises reputation information from various other reputation systems.

The scientific approaches, that outline reputation infrastructures independent from concrete applications (e.g., [START_REF] Voss | Privacy preserving online reputation systems[END_REF][START_REF] Pingel | Multilateral secure crosscommunity reputation systems[END_REF][START_REF] Sandeep | Portable reputation: Proving ownership across portals[END_REF][START_REF] Schiffner | Privacy and liveliness for reputation systems[END_REF], do not follow the centralised approach of the commercial solutions, but use local storage of reputation information to enable users to show the reputation they collected to others themselves. All of these suggestions need some external infrastructure to prevent reputation manipulation by the reputation object.

In the mentioned scientific approaches the trust model is implicitly clear, but as all of them aim for a privacy-respecting reputation system neither interaction nor rater information is provided. For the commercial solutions users can provide as much information as they want on themselves and their interactions.

Interoperability with trust management

As outlined in Sect. 2 reputation networks need to have some kind of inherent trust structure. When a user wants to determine a reputation object's credibility resp. trustworthiness he has to determine his trust in two other sources as well:

-Raters: The ratings given by raters can be:

• subjective ratings, that are influenced by the raters' subjective estimation of the reputation object, or • objective ratings, that can be verified by all other users than the rater at some point in time and that would have come to the same ratings. An example for the first type of ratings is eBay while examples for the second type can be found in P2P systems, e.g. GNUnet 12 , where the reply to a query leads to a positive reputation, and a reply can be proved or verified at least at the time it is sent. If the raters are humans as in our model from Sect. 2, subjective ratings will be given. Then the rater needs to decide whether he would have come to the same rating; this means their views on the reputation object is interoperable. For this reason a trust management system to determine the inter-personal trust in raters is needed. It can be realized by an additional reputation system for raters.

-Reputation systems: Evaluators need to have system trust in all reputation systems that collected the ratings and calculated the reputation the user evaluates. Technically trust management is often associated with PKI structures [START_REF] Maurer | Modelling a public-key infrastructure[END_REF] (beneath other approaches). PKI structures allow to bind keys to pseudonyms. Others can use their key to sign this binding. Thereby chains to other users, who want to trust in this binding can be built. These chains can be done hierarchically with certification authorities or in the form of the web of trust (e.g., GPG/PGP). Both structures could and should also be used for the broader deployment of reputation systems. Hierarchies and chains as they work for trust management could be applied to reputation management to express which experiences from others can be trusted. However, the straightforward approach to implement ratings as signatures and use existing PKI structures only assures accountability of keys and linkage to their holder. But if a user or certification authority signs someone's key in a PKI structure that does not say anything about the credibility/ competence they assume the key holders to have as reputation objects. For this reason different key(s) than for accountability are needed and eexisting certificate structures have to be extended appropriately.

Interoperability with identity management

For the evaluation function of reputation systems not only the overall reputation, but also the single ratings and the raters, who gave them might be important. If raters misbehave maliciously by giving ratings, that do not reflect the concrete experience they made with reputation objects, there should be a possibility to detect this and probably to make them accountable for that. But for the collection of large reputation profiles about users (both reputation objects and raters) privacy also becomes an important issue. Reputation systems often collect information about who interacted with whom in which context. Such information should be protected by means of technical data protection to ensure users' right of informational selfdetermination [START_REF] Mahler | Reputation systems and data protection law[END_REF]. For managing this a reputation system should be interoperable with privacy-enhancing user-controlled identity management systems (PE-IMS). An IMS in general is able to certify users and grant rights to them for applications. Additionally a PE-IMS [START_REF] Clauß | Privacy-enhancing identity management[END_REF][START_REF] Clauß | Identity management and its support of multilateral security[END_REF] like PRIME13 assist users platform-independent in controlling their personal data in various applications and selecting pseudonyms appropriately depending on their wish for pseudonymity and unlinkability of actions. The interoperability of a reputation system with a PE-IMS needs a privacy-respecting design of reputation systems while keeping the level of trust provided by the use of reputations as outlined in [START_REF] Steinbrecher | Enhancing multilateral security in and by reputation systems[END_REF]. When a reputation system interoperates with a PE-IMS it is possible and intended that users have several partial identities (pIDs) which cannot be linked, neither by other users using the systems nor by the underlying system (as long as the user does not permit this). Both raters and reputation objects might only be known by pseudonyms to each other.

If there would exist only one reputation per user, all pIDs of this user would have the same reputation. This would ease the linking of the pIDs of one user because of the same reputation value. Thus, having separated reputations per pID and not only one per user is a fundamental condition for a reputation system in the context of identity management. The use of pIDs arises the problem that a malicious user may rate himself a lot of times using new self created pID for every rating in order to improve his own reputation. This kind of attack is also known as Sybil attack [START_REF] Douceur | The sybil attack[END_REF]. If the reputation system is not defined carefully, it would be easy for such an attacker to improve the own reputation unwarranted. This can be limited/prevented by entrance fees or the use of once-in-alifetime credentials as suggested in [START_REF] Friedman | The social cost of cheap pseudonyms[END_REF]. When using PRIME as IMS the latter can be implemented by its identity provider issuing such credentials. Alternatively or additionally also fees could be collected.

Resulting infrastructure

For users as reputation objects we outline in the following a possibly resulting secure reputation system interoperable with an application, an identity and trust management. Our design description is independent from concrete rating, reputation and evaluation functions. We assume all communication to be secured by encryption to reach confidentiality of all ratings and actions performed. Also all messages should be transferred in an anonymous way with an anonymous communication network. All actions and ratings have to be secured by digital signatures (given under a pseudonym) for integrity reasons. For the identity management a user registers himself with an identity management system (provider) by declaration of his identity data (step 1 in Fig. 2). After verifying the data the identity provider issues a credential or certification on (part of) these data (step 2 in Fig. 2). By the use of an identity management system (provider) accountability of the pseudonym can be given. When the user wants to register with a reputation system (provider) he sends it the certification/credential he got from the identity management system (provider) (step 3 in Fig. 2). This should guarantee that no user is able to build up reputation under multiple pseudonyms within the same context and every user can be identified in the case of misbehavior. The reputation system (provider) creates a reputation certificate/credential based on the certificate/credential from the identity management system (provider) and sends it back to the user (step 4 in Fig. 2). The reputation credential contains the user's reputation pseudonym, its initial reputation and possibly other attributes like the applications it can be used in or an expiration date. Based on the reputation credential the user can register himself with an application by showing his reputation certificate/credential (step 5 in Fig. 2). Thereby he agrees that he will collect reputation for his interactions within the application (e.g., a marketplace or a wiki) with the reputation system he registered with. Based on this he gets an application credential to use the application (step 6 in Fig. 2). Additionally the user might interact with other users to exchange additional information, e.g. via a trust management system to inform himself about this user (possibly as a rater) and other users in the reputation network (step 7 in Fig. 2).

Every action the user performs above can be done under distinct pseudonyms if convertible credentials are issued by the respective providers. We implemented this infrastructure for phpBB as application and the usercontrolled privacy-enhancing identity management PRIME as outlined in [START_REF] Pingel | Multilateral secure crosscommunity reputation systems[END_REF]. Currently we lack a trust management in our implementation.

Conclusion

In this paper we gave a first impression which aspects of interoperability should be considered for reputation systems. We also described a possible infrastructure for interoperability between applications, reputation, trust and identity management systems from a technical perspective. For interoperability of reputation systems themselves and implementing corresponding rating, reputation and evaluation functions an overall treatment from various scientific disciplines will be needed to come to suitable solutions usable in practice.

Fig. 1 .

 1 Fig. 1. System environment and arising interoperability issues

Fig. 2 .

 2 Fig. 2. Infrastructure for users as reputation objects

http://www.ebay.com/ (last visited April

2010) 2 http://www.tripadvisor.com/ (last visited April 2010) 3 http://www.amazon.com/ (last visited April 2010)

http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=orms (last visited April 2010)

[START_REF]Position paper. reputation-based systems: a security analysis[END_REF] http://openprivacy.org/ (last visited April 2010)

http://ikarma.com/support/faq/#1 (last visited April 2010) http://www.trivago.com/ (last visited April 2010) www.gnunet.org (last visited April 2010)

Privacy and Identity Management for Europe (http://www.prime-project.eu/), funded by the European Union in the 6. FrameworkProgram, 2004Program, -2008. .

Acknowledgements

The research leading to these results has received funding from the European Communitys Seventh Framework Programme (FP7/2007-2013) for the project PrimeLife. The information in this document is provided as is, and no guarantee or warranty is given that the information is fit for any particular purpose. The PrimeLife consortium members shall have no liability for damages of any kind including without limitation direct, special, indirect, or consequential damages that may result from the use of these materials subject to any liability which is mandatory due to applicable law. For comments on preliminary versions of this papers I would like to thank the anonymous reviewers. Additionally Stephan Groß and Vashek Matyas provided valuable comments.


-W Phan
email: r.phan@lboro.ac.uk

John N Whitley
email: j.n.whitley@lboro.ac.uk

David J Parish
email: d.j.parish@lboro.ac.uk

Adversarial Security: Getting to the Root of the Problem

This paper revisits the conventional notion of security, and champions a paradigm shift in the way that security should be viewed: we argue that the fundamental notion of security should naturally be one that actively aims for the root of the security problem: the malicious (human-terminated) adversary. To that end, we propose the notion of adversarial security where non-malicious parties and the security mechanism are allowed more activeness; we discuss framework ideas based on factors affecting the (human) adversary, and motivate approaches to designing adversarial security systems. Indeed, while security research has in recent years begun to focus on human elements of the legitimate user as part of the security system's design e.g. the notion of ceremonies; our adversarial security notion approaches general security design by considering the human elements of the malicious adversary.

Part of this work adversarially motivated by coffee.

The General Security Problem

This paper sets out to revisit the conventional notion of security. In essence, conventional security represents the security advocate as a boxed-in non-initiator, in that (technical) security mechanisms therein aim to protect the good guy against or cope with, anticipated attacks. Quoting from [START_REF] Schneier | How the Human Brain Buys Security[END_REF], the general view is that "security is inherently about avoiding a negative". By design, the advocate is not equipped with the ability to initiate actions in the reverse direction towards the malicious adversary.

In that light, cryptographic techniques and network security techniques are traditionally defensive mechanisms in face of the malicious adversary. More precisely, confidentiality (encryption), integrity (message authentication codes, hash+signatures), authentication (signatures), non-repudiation (signatures) ensure that in the event of attacks, either data or identities are protected from unauthorized adversarial (read and/or write) access or at the very least that any attack is discovered by the victim parties; while intrusion detection or firewalls detect or block adversarial access.

Intrusion tolerance, network resilience and proactive cryptography [START_REF] Barak | The Proactive Security Toolkit and Applications[END_REF] (including forward security [START_REF] Bellare | A Forward-Secure Digital Signature Scheme[END_REF], key insulation [START_REF] Dodis | Key-Insulated Public-Key Cryptosystems[END_REF], intrusion resilience [START_REF] Dodis | Intrusion-Resilient Public-Key Encryption[END_REF], leakage resilience [START_REF] Shin | Leakage-Resilient Authenticated Key Establishment Protocols[END_REF][START_REF] -W. Phan | Security of a Leakage-Resilient Protocol for Key Establishment and Mutual Authentication[END_REF]) techniques are of similar nature, emphasizing on being able to cope with or survive adversarial attacks.

While it must be said here that the network forensics approach does to some extent provide a channel to get back at the malicious adversary, this is via nontechnical means, i.e. legal actions. Another emerging approach, non-technical as well, is that of security economics [START_REF] Anderson | The Economics of Information Security[END_REF] that can also be seen as more proactive rather than simply defensive.

Taking a holistic view of the security problem, we would like to champion a paradigm shift in the way that security should be viewed, by arguing that the fundamental notion of security should naturally be one that actively aims to tackle the root of the security problem: the malicious adversary.

We also champion in this paper the fact that security should fully exploit the fact that the adversary is human-terminated; thus in terms of proactively addressing this root of the security problem, one should bear in mind that the human adversary lives in the real world and is thus influenced by real world factors aside from technical ones. Essentially, security pits human ingenuity (designer) against human ingenuity (adversary). While security research in recent years has begun to consider human factors within security designs in view that legitimate security users are often human (this makes a lot of sense since attackers have long been exploiting this weakness, e.g. social engineering), less research has concentrated on designing security by considering that adversaries are also human-initiated, although to some extent the research direction popularized by CAPTCHA [START_REF] Von Ahn | CAPTCHA: Using Hard AI Problems for Security[END_REF] in considering how to identify if a human is present during web based authentication dates back to the work of Naor [START_REF] Naor | Verification of a Human in the Loop, or Identification via the Turing Test[END_REF] in 1996.

Adversarial Security Design

We propose the notion of adversarial security. The adversarial angle of this notion is twofold.

First, it emphasizes on the ideal that security should be the resultant equilibrium established after fair play (to some extent) among all parties, whether honest or malicious. This is akin to the adversarial process e.g. in adversarial legal systems or adversarial politics which is game-like in nature. In contrast, the conventional notion of security does not really capture this since techniques therein are less symmetric in terms of the activeness, i.e. the malicious adversary is the active initiating party while the attacked party is the non-active defending or coping party. What is worse, the adversary bears no consequences from his/her actions nor from actions of the other non-malicious parties, while the non-adversarial parties bear the consequences of their own actions (e.g. lack of emphasis on security increases risk of being attacked) and even those of the adversary. Furthermore, although the provable security paradigm also adopts a game-like approach to defining security, it resembles less the fair play element between opposing sides that should be the nature of an adversarial process.

Second, our notion is so-called adversarial in the sense it aims to emphasize on and get to the root of security problems, i.e. the malicious human-terminated adversary.

Framework

We start by thrashing out the framework that should influence the design of adversarial security mechanisms.

The root of the problem is the adversary, and the initiator at the adversarial side is a human (indeed, in our present times unlike science fiction where AI machines can be as malicious as humans, behind every adversary is a malicious human). Designing the human adversary in, rather than leaving this out as a nontechnical social engineering issue, ties in well to the concept of ceremonial design [START_REF] Ellison | UPnP Security Ceremonies: Design Document[END_REF] that is recently gaining popularity e.g. Bluetooth's pairing and schemes based on short authenticated strings [START_REF] Vaudenay | Secure Communications over Insecure Channels based on Short Authenticated Strings[END_REF], where humans are included in the security mechanism design.

Including non-technical issues into the design, including human factors, is also the approach taken by the discipline of systems engineering, which provides techniques to bring different areas of expertise, including both technical and non-technical, into a cross-disciplinary approach, or set of approaches, to solve problems. Using system engineering techniques to solve security problems is likely to provide more robust solutions. Typically the sectors included within a systems engineering brief are categorised into lines-of-development. The lines of development are classified by the acronym TEPID OIL -standing for: Training; Equipment; Personnel; Infrastructure; Doctrine and concepts; Organization; Information; and Logistics [START_REF] Kerr | A Framework for Strategic Military Capabilities in Defense Transformation[END_REF]. Taking a systems engineering approach to security means taking into account factors that are not just technical, so would include human factors like motivation and cost.

We can holistically model the adversarial side by classifying the factors that affect this human-involved adversary into differing layers of abstraction in topdown manner:

-Top layer: Psychological (human element)

• motivation (to mount the attack) * benefit (derived from the attack) * cost (of attack actions) * risk (of being held responsible) • social implications * reputation (peer status) -Middle layer: Real World

• physical consequence to the human adversary • legal implications -Bottom layer: Technical

• hardness (of attack actions)

• cost (of attack actions)

• time (taken by attack actions)

Each of the layers need to be defined as time-varying. Indeed, it is easy to see that technology advances over time, and currently infeasible technical actions may not necessarily be so in the future. Real world factors may also vary with time, e.g. changes in cyberlaws. While motivational factors do tend to be timeinvariant, yet for generality the top layer can also be defined as time-varying, to capture for instance the dwindling in value of the protected data e.g. stock market information is no longer useful when it becomes obsolete; thus there is no longer any motivation to mount attacks to acquire obsoleted market info. Most of the conventional security techniques aim to tackle the security problem by targetting the bottom abstraction layer i.e. the technical layer. For instance, provably secure cryptographic constructions rely on the assumption that it is computationally infeasible (in terms of hardness, cost and/or time) for an adversary to mount technical attack actions.

In contrast, we can use the above listed layer abstractions to define a framework that is adversarial in the sense that the non-malicious parties in their interactions with the adversary are also provided the capability to mount active responses aimed at affecting the factors within those abstraction layers. This interaction can be modelled as an adversarial game. For instance, an adversarial security notion capturing the psychological factor is as follows. Let state x 0 denote the initial value assigned by the adversary to the motivation factor x, and state x 1 denote the state of this at the conclusion of the adversarial game. Then the adversarial advantage can be defined as the difference between state x 0 and state x 1 . The security mechanisms are deemed successful if state x 1 << state x 0 ; i.e. the adversary's motivation is significantly reduced as a consequence of being involved in the attack.

Aside from influencing the design and redesign of security systems, this framework can also be used to create adversarial profiles, e.g. for network forensics and evidence construction.

Approaches

To understand this holistic, systems engineering-like approach to security systems, here we propose the following approaches be included in the overall view of solving security: Approach 1: getting nearer to the adversarial source. We can do this in two ways.

by abstraction: with reference to the abstraction layers, mechanisms can be designed to target factors nearest to the human adversary's mind, i.e. psychological factors. The lower down the abstraction layers, the more external and less attached it is to the adversary; e.g. if a security mechanism complicates the adversary's attack technically, then s/he can retry with another technical one. In contrast, if we design a mechanism that increases the adversary's risk of being caught for attacks s/he had mounted independent of the specific technicalities, this factor remains to internally affect the adversary's motivation. At the same time, different adversarial groups are presenting themselves, and as their motives are removed from previous adversaries, the technical implementation of their attacks are different too [START_REF]Political Hacktivists Turn To Web Attacks[END_REF]. We suggest that involving social understanding and prevention of the motivation of an attack will lead to a stronger system. This is also an appropriate approach when attempting to prosecute suspects of network attacks: the gathered evidences are considered not only with respect to the technical layer, e.g. packet headers, but evidences are also considered at the psychological layer e.g. the suspect's intent. spatially: alternatively, approach 1 could mean getting nearer to the adversary's location, e.g. rather than having firewalls essentially boxing in the attacked machine, to instead have the adversary's network provider or nearby intermediaries boxing in the adversary at his machine. This is beneficial for the network security setting. More precisely, less inconvenience is caused to the attacked machine because it is not penalized for being attacked; instead, the adversary feels the consequences of his/her attack.

There is one caveat of this approach if only a technical solution is employed.

Trying to contain the adversary at the source would work for a conventional Denial of Service (DoS) attack, but is much harder to see effect if it is a Distributed Denial of Service (DDoS) attack where the adversary uses multiple distributed locations to launch the attack. In contrast, adopting approach 1 in the sense of abstraction would mean targeting a higher abstraction layer, i.e. the motivation of the adversary, and this will be equally effective to both DoS and DDoS attacks.

Approach 2: legitimate fightbacks. The idea of fighting back or striking back has been proposed in network security literature [START_REF] Gengler | Strikeback[END_REF][START_REF] Welch | Strike Back: Offensive Actions in Information Warfare[END_REF][START_REF] Jayawal | Internet Hack Back: Counter Attacks as Self-Defense or Vigilantism?[END_REF], albeit sparingly. Quoting [START_REF] Cohen | Managing Network Security: Returning Fire[END_REF]: "returning fire has a benefit in suppressing attack activity...a strong offense is a good defense". For instance, [START_REF] Gengler | Strikeback[END_REF] reports on how Fortune 500 companies have admitted that they have the capability (via installed software) of counter-attcking hackers. Such measures include flooding the hacker's system. The study also reported that many companies would rather trust their own strikeback capabilities than summon the enforcement authorities. The caveat is that there may be legal issues [START_REF] Matsuura | Digital Victim or "Vigilante": Legal and Ethical Limits to Online Self-Defense[END_REF], and furthermore one cannot always ascertain who the adversary is. [START_REF] Walfish | DoS: Fighting Fire with Fire[END_REF][START_REF] Walfish | DDoS Defense by Offense[END_REF] suggest to fight fire with fire, i.e. combat DoS attacks by having the legitimate users also launch a kind of DoS on the network resources. This is legitimate since the attack is not directly targeted at the adversary per se, although it causes the same kind of inconvenience to legitimate users as would a DoS attack since a lot of retransmissions are involved and thus wastage of network resources. There are network protocols to help the victim require the adversary to desist, for example IPCAF [START_REF] Wu | Using Identity-Based Privacy-Protected Access Control Filter (IPACF) to Against Denial Of Service Attacks and Protect User Privacy[END_REF], although an obvious problem with any such protocols is general take-up: it would require all Internet Service Providers (ISPs) to implement additional protocols within their networks.

Rather than actively 'fighting back' towards the adversary using the same weapon as the adversary, which may lead to indefinite vengeful cyber-warfare where the non-malicious parties will be no better than the adversary, we advocate instead to consider legitimate ways and fighting fire with non-fire. Essentially, this means that we use ways that are different from the ones used by the adversary; e.g. we do not launch DoS style responses to DoS attacks, or upon viral infection we do not attempt to propagate the virus back to the source. This sort of legitimate fightback is an interesting open research direction.

Some ways of legitimate fightback can be designed, with reference to the framework of abstraction layers:

de-motivation: we can design a system such that the benefit derived from an attack is much less than the attack cost. For instance, the business model used by Apple where third party developers build applications that sell for a song; malicious users are then no longer motivated to copy nor pirate these applications since the cost of doing so is not significantly less than actually buying the applications legitimately. social pressure: humans tend to bow down to peer pressure. As an analogy: rather than directly punish a misbehaving pupil, a class teacher could subtly get the class to frown on (e.g. laugh at) the pupil by making a cynical remark.

In similar vein, the social networking site Facebook.com retracted its new policy to retain user data online after public protest [START_REF] Johnson | Facebook Backtracks after Online Privacy Protest[END_REF]. removal of cheap resource: distributed attacks require a number of slave hosts in the network, commonly the owners of these machines would not intend their machines to be part of a distributed attack. The implementation of ingress firewalls to prevent attacks on a system is well understood and well used in many Internet sectors [START_REF] Chapman | Building Internet Firewalls[END_REF]. The implementation of ingress firewalls as part of a domestic and commercial Internet connection is now thought of as normal and expected. This has prevented many simple virus attacks on otherwise vulnerable machines. We suggest that egress firewall filtering, if implemented on the scale that ingress firewall filtering has been, will have a similar tide-changing effect in reducing adversarial network traffic.

Approach 3: human involvement. Keeping in mind our approach to design the human element of the adversary right into a security system, the human involvement approach advocates the following design strategies:

human-tractable but machine-intractable tasks: the strategy here is to have security-critical actions require human mediations; this means the human adversary cannot fully automate his/her attack steps since the tasks cannot be easily performed by machines, and therefore affects the cost and time subfactors as well as increases attack consequences on the adversary. Examples of security systems that use this approach are systems based on short authenticated strings, for example Bluetooth, which requires human-communication channels; and CAPTCHA to combat machine-automated spamming or DoS attacks. While the approach is nice, particular techniques to implement such an approach should be designed with care. For instance, it was recently shown that typical CAPTCHA techniques are known to be weak [START_REF] Hernandez-Castro | Remotely Telling Humans and Computers Apart: An Unsolved Problem[END_REF].

human-involved ceremonies: the strategy of designing systems to include the human terminals, so-called ceremonies [START_REF] Ellison | UPnP Security Ceremonies: Design Document[END_REF][START_REF] Karlof | Conditioned-safe Ceremonies and a User Study of an Application to Web Authentication[END_REF][START_REF] Karlof | Conditioned-safe Ceremonies and a User Study of an Application to Web Authentication[END_REF] allows to capture not just the technical issues but the human elements of users of such systems as well, and therefore relevant issues such as social engineering no longer need to be regarded as out of scope during the design stage.

Approach 4: every action has a reaction. This strategy is to design a system where every action by a party (irrespective of whether it is an honest party or a malicious one) causes a reaction i.e. leads to an effect on the party itself, e.g. each action costing monetarily or resource-wise. For instance, in some security systems for wireless networks [START_REF] Zhang | SIP: a Secure Incentive Protocol against Selfishness in Mobile Ad Hoc Networks[END_REF], incentive based schemes are designed where credit is globally distributed to all parties during setup or on enrollment into the system, and where credits are awarded to or deducted from a party based on its actions. In this setting, malicious parties will be penalized directly from their attack actions, even if an attack attempt is not successful. This is also particularly relevant in the network security scene, e.g. DoS attacks, spams or spits, where each generated traffic towards the target victim machine incurs a reaction back to the adversary. What is more, non-attacking parties who wrongly accuse others will want to think carefully because their accusing actions will also cause a reaction e.g. cost.

Approach 5: being stateful and bearing grudges. Related to approach 4, in the sense that each attack attempt should update the system state so that there is a reaction back to the adversary that affects the adversary's subsequent actions, the approach here tackles attacks of the exhaustive type, e.g. brute force password (or secrets of low entropy) guessing attacks. The gist is that the security system should remember each attack attempt (even if the attempt does not lead to a successful attack), and be stateful such that the subsequent attack attempt would require significantly more adversarial effort to mount. This idea is used by Bluetooth [START_REF] Bluetooth | Bluetooth Core Specifications v4[END_REF] to discourage bruteforce guessing, by having each repeated attempt lead to a waiting time that is exponentially increasing. On a related note, the idea of bearing grudges has also been applied to discourage misbehaviour by selfish parties rather than discourage attacks, e.g. [START_REF] Buchegger | Nodes Bearing Grudges: Towards Routing Security, Fairness, and Robustness in Mobile Ad Hoc Networks[END_REF].

Concluding Remarks

We have advocated a paradigm shift in the way we address the security problem, i.e. taking a holistics systems engineering-like approach and in doing so including an additional focus on the adversarial angle. Adversarial angle in the sense of fair play between the adversarial and attacked sides, and in the sense of getting right to the source of the problem i.e. the human-terminated adversary. We proposed to treat the factors affecting an adversary as time-varying layers of abstraction; and discussed five approaches with this in mind.

Security should not remain as a purely defensive strategy, quoting [START_REF] Welch | Strike Back: Offensive Actions in Information Warfare[END_REF]: "sitting back and waiting for attackers is a strategy doomed to failure. . . defensive wars are not winnable".

Acknowledgement

We thank the iNetSec 2010 anonymous reviewers and non-anonymous attendees for comments and interest in this research direction.


Anton Palazov
email: apalazov@rubella.bg

Some Technologies for Information Security Protection in Weak-Controlled Computer Systems and Their Applicability for eGovernment Services

Keywords: eGovermnemt services users, anti-theft, data leakage prevention, sensitive data type definitions

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

eGovernment users evolution and risks for their information security

In time, the users of eGovernment services get more experience and possibilities and start performing more complex tasks -exchange of documents with administrative authorities in electronic form which can have legal consequences for both sides, making ePayments for tax duties, receiving money from social funds etc.

In such more complex communucations the risks of confidential information disclosure and direct financial losses are growing up and information security protection system must mitigate them and counteract to the fault. Computer theft, data device losses and leakage of important user data are the events, which can transform these security risks to attacks against user privacy.

The survey of Ponemon institute [11] for endpoint security in 2009 shows that the loss of sensitive data is real event for about 50 percents of analyzed companies (respondents). The results for lost or stolen computing devices are almost the same. The interviewed security professionals give the opinion that these risks will be one of their main troubles in next 12 months. The users of eGovernment services interact with the administrative authorities mainly with their home computers thru the Internet. These computers are outside the protecion of information security based on well-defined from computer professionals, good supported and strongly enforced security policy as is the case of corporate information systems. From point of view of information security protection the computer system of typical eGovernment users are weak-controlled and in many cases there is no implementation of clear and reliable security rules [START_REF]State of Internet security: protecting the network[END_REF], [START_REF] Zeltser | Emerging Internet security threats in[END_REF].

So, the technologies for data protection in case of theft or loss of computers and data devices and in case of data leakage are very important for eGovernment services users and must have appropriate properties to be useful for their information security protection.

In this research the following steps are performed:

• Study and analysis of publications in magazines and in Internet and defining of criterias for estimating of technologies applicability in information security protection; • Specifying of main parameters and characteristics of analyzed technologies;

• Measuring and conclusions formulation about analyzed technologies applicability in information security protection of eGovernment services users.

2 Technologies for Client-side protection for lost or stolen computer systems and for stand-alone data leakage prevention

Endpoint computer systems (servers, desktops, laptops) and removable media (CD, DVD, USB memory) are especially vulnerable to security accidents like loss or theft, which makes them a weak spot in information systems infrastructure [START_REF]The evolution of endpoint security[END_REF]. Companies and citizens need security solutions that can protect their information systems against these threats and ensure that unauthorized persons have no access to their saved sensitive data.

Protection of lost or stolen computer systems and data devices

Loss or theft of computer systems, devices or data files is significant risk for information confidentiality. Security protection technologies must react on these events with registering of stolen systems, disabling them, sending a data-destructive commands to erase sensitive data and easily reactivating them if they are recovered.

The vendors of Endpoint protection platforms [START_REF]Symantec Endpoint Protection -value delivery research study[END_REF], [START_REF]Endpoint security and data protection[END_REF] offer different solutions for data protection in case of theft or loss of computer systems. The basic characteristics of these solutions can be summarized as:

• Protected user computers have internal timer (software module or hardware device) which try to communicate with Ownership Management Server via Internet. The duration of the interval between two connections can be set from the user or remotely from the server or administrator; • If the user computer can't connect to the Management server in the defined for the timer interval or communication schedule, the timer suppose that the computer was lost and activates the transparent service which disables user sensitive data and the computer system itself; • If the computer was lost, its user can call the Ownership Management Center help desk and can register the event. When the lost or stolen computers connect later to the server in their regular communications, the server can send to the workstation self-destructive signal. The internal timer on the lost computer system react to that signal and disables in some ways sensitive user data and probably the computer system itself; • The Ownership Management Server has possibilities to submit the one-time activation key, which can be used to enable the computer in case it was found and its owner can authenticate himself.

By adding this client-side intelligence the confidentiality of sensitive user data can be reliably protected in case of loss, theft or suspicious circumstancesthe internal timer on client computer systems or the signal from the server will automatically disable these data and will not allow the attacker to exploit them.

Standalone endpoint data leakage prevention

The technologies for endpoint data leakage protection can be divided in 2 general groups:

• First, technologies for control over the channels, which can lead to data leakage (data devices, ports, Internet services), and; • Second, technologies for control over the data, which leave the computer system in different directions.

Technologies for channel control [START_REF] Filkins | Data leakage landscape: Where data leaks and how to apply next generation tools[END_REF] protects data by whitelisting or blacklisting specific devices or ports, by prohibit and allow some actions and operations in available channels, or by transparent encryption of data that go out of information security protection system. In case of encryption users can apply existing PKI infrastructure or can define their own keys or passwords for removable media, file types or specific files and communication units which will be exchanged with their partners.

Endpoint users need to encrypt some removable media to protect data confidentiality and to allow access to them via some unlock mechanism (passwords, keys for decryption, etc), which is shared with other partners. They can protect the whole media, particular file types, or specific data files. Central management helps security administrators to create, implement, enforce and audit secirity policies for different groups, users or business partners.

Technologies for control over the leaving data offer possibilities for content detection, which, by example, can include SSN or VAT number identification in exchanged documents. Some solutions [START_REF] Mogull | Is DLP keeping your data where it should be?[END_REF] can detect in outbound flow other specific "registered" data elements such as database field values and aggregates, file names, register keys, etc. These tools use number of dictionaries where are defined, by example, financial items, legal term, trade marks. The dictionaries allow using of "wild card", operators and case-sensitivity indicators. Some of them have intelligence features which do more than just a formal search in data content.

Both groups of technologies provide decisions for data leak prevention by restricting unauthorized export of confidential data via certain communication ports or peripheral devices. Security policies define some read and write restrictions on ports and devices based on device type, data file types or even on individual peripheral devices or files. Additional software components apply and control compliance with defined security rules. Some vendors [START_REF]Endpoint security and data protection[END_REF] offer tools which include valuable set of sensitive data type definitions created by their security professionals. Those tools are integrated with threats detection engines and ensure immediate data leakage prevention after their installation. Pre-defined set of sensitive data type definitions contain ready-for-use rules for PII (Personal Identifiable Information), intellectual property elements and other data types like credit cards, bank accounts, national identification numbers, social security number, etc. Users can either select which data type definitions from this set to apply on their endpoints or customize some of them for their own conditions, regulations or needs.

Flexible security policies wizards allow them also to define objects for content scanning including endpoints and groups, email senders and recipients, file and device types. In these tools events that trigger them can be selected -content copying to a removable storage device, uploading content in browsers and IM clients, sending data via email. In such events DLP can log the event, warn the user, block the transaction, quarantine or encrypt the content before sending.

Some software tools try to analyze and assess former communications from historical archives in protected system and to generate additional security rules from that gather knowledge that, with such learning approach, counteract more reliably to sensitive data leakage.

information security protection

There are some basic requirements which must meet in phase of development and implementation of security policies for identified or universal users of eGovernment services [START_REF] Palazov | Policies and architectures for information security of citizens as users of the eGovernment[END_REF]:

• minimum need computer skills in eGovermnent users, which mainly will create and implement security policies with their own knowledge. The technologies they will use must be as transparent as is possible; • minimum need of financial resources for implementing the technologies which will make them available for more citizens who must become eGovernment services users; • possibilities for easy advance of implemented technologies with users experience and security needs evolution.

Based on information from international Endpoint Protection Platform vendors [4], [START_REF]Symantec Endpoint Protection -value delivery research study[END_REF], [START_REF]Endpoint security and data protection[END_REF] and from surveys for endpoint security state [3], [START_REF]Magic Quadrant for Endpoint protection platform[END_REF], [11] some conclusions about applicability of anti-theft and data leakage prevention technologies for protection of information security of eGovernment users can be done:

• To be applicable for eGovernment users, Ownership management services must be integrated in the eGovernment services themselves; • To be more useful for eGovernment users, internal timer protection tool must be implemented as a software module, which is automatically installed when the users register themself for the respective class of eGovernment services.

At this moment all protected user sensitive data must be automatically identified and the destructive routine must be transparently configured; • It would be an advantage if the users can automatically unlock their computer system in case it was found after deactivation and if the user can authenticate himself with eSignature, by example; • At this moment technologies for sensitive data leakage prevention are too complex for common eGovernment users and can be implemented only with gentle approach for DLP in protection of their information security. Tools who offer customizable set of pre-defined sensitive data type definitions are most suitable and perspective decisions in this direction; • Some of advantages of DLP technologies can be reached only in integration with automatic and transparent identification of sensitive user data in the process of user registration for eGovernment services and their future protection. Security policy configuration wizards can give the possibilities for selection and customization of embedded sensitive data type definitions to apply, for event and action settings. They can automatically put in protection data such as credit and debit card numbers, bank accounts. national identification numbers, social insurance numbers, fiscal code number, postal adresses, phone numbers, passport details, email adresses, etc;

• Integration of DLP technologies with other services like e-mail, instant messaging, Skype, social networking, etc would be a challenge and a big advantage for eGovernment services users.


Dimitrina Polimirova
email: polimira@nlcv.bas.bg

Eugene Nickolov
email: eugene@nlcv.bas.bg

Real-Time System for Assessing the Information Security of Computer Networks

Keywords: Data Security, Computer Security, Communication Security, Operating System Security, Web Security, Application Security

The report examines the possibility of establishing of realtime system for analysis and assessment of information security of computers, systems and networks in Internet/Intranet/Extranet environment, using TCP/IP protocols. In the paper are presented known information attacks. Separate classes of malicious software investigations are considered concerning different work platforms (produced by different Computing Systems), work environments (produced by different Browser Systems) and work places (produced by different Antimalware Systems). Methods that can be used to implement the systems are suggested. The capabilities of real-time systems are commented at the end of the paper.

The Problem

The modern information society requires the use of various types and configuration computers, systems and networks in TCP/IP environment. These computers, systems and networks are subject to permanent attacks with respect to their information security, which determines the need of investigation on methods and means for their protection.

A common strategy for protecting computers, systems and networks includes using of antivirus and security software. In addition the development of suitable for those computers, systems and networks security policy could be included.

Within the above research opportunities may apprise that it is appropriate to examine this problems of individual stages.

For the purpose of this paper can say that it is necessary to analyze the benefit of building of real-time system for assessment of information security of various types computers, systems and networks, exposed to one or more attacks, taking into account the impact of the protection methods in the face of various antivirus and security software.

Since the 70-th of century the problem for security and protection of computers, systems and networks has drawn developers' and constructors' attention in the area of information technology [START_REF] Denning | A lattice model of secure information flow[END_REF]. With the first malattack in the 60th of last century [2], a progress in the area of information security of computers, systems and networks is observed and requirements for their information security are increased. As a result for short time ideas significantly reducing the risk in the management of computers, systems and networks are realized.

Actuality

The main open problem, which can be placed within this paper, is related with the investigation of public known information attacks on one hand and most popular computing, browsers and antimalware systems on the other hand.

The main hypothesis will be linked with the ability to analyze and evaluate the effectiveness of a real-time system for assessing information security used as a means of determining the security policy with the lowest risk for individual computers, systems and networks.

Further analyses and investigations can be made towards precise planning of the economic costs of conducting a security policy for different configurations computers, systems and networks.

Goal and tasks of the investigation

The studies, which may be planned, should be linked with an analysis of the current state and development prospects of known information attacks, computing systems, browser systems and antimalware systems. Their scientific generalization in the form of real-time systems for assessing of information security is necessary because only in their mutual relations can be achieved the best analysis and therefore the best solutions for information security of computers, systems and networks.

The main goal

As a result of mentioned above the main goal of the paper can be specified: to analyze the effectiveness of the integration of the separate classes of malicious software investigations concerning different experimental work platforms, experimental work environments and experimental work places.

The integration is represented by a real-time system for presenting the obtained results with the help of which analysis and assessment of information security of computer systems and networks in the TCP/IP environment can be made.

Main tasks

The following main tasks are set in reaching the goal: 1. To identify and systematize information attacks known until the moment of investigation; 2. To identify and systematize investigated:

2.1 Operating Systems (OS), used by the Computing Systems; 2.2 Browsers, used by the Browser Systems; 2.3 Antivirus and security software, used by the Antimalware Systems.

Work definitions

For the goal of this paper the following work definitions are proposed [START_REF] Brotby | Information Security Management Metrics: A Definitive Guide to Effective Security Monitoring and Measurement[END_REF]:

1. As information security we will note the protection of the information in computers, systems and networks from a random or purposeful access of their resources aimed at reading, transferring (coping), modifying or destroying the information; 2. As information attack we will note any attempt to break the integrity of information objects that can be bit, byte, sector, file, directory system, browser systems, antimalware systems, operating systems, network systems, etc.; 3. As computing system we will note combination of hardware and software tools for solving specific application problems using preliminary prepared algorithmic solutions; 4. As browser system we will note software tools (programming tool), which is designed to perform requests for serving in client-server architecture and web functionality; 5. As antimalware systems we will note combination of different types of protecting system's components, which includes the following: anti-virus, antiadware, anti-spyware, anti-trojan horse, anti-downloader, etc.

Analysis of information attacks

The information attacks can be divided into two main categories: malware and malattacks (Fig. 1). The main difference between them lies in the fact that in case of malware the direct participation of a user at the moment of the attack is missing, while in case of malattack the user's presence is required [START_REF] Parsons | New Perspectives Computer Concepts 2010: Introductory[END_REF], [START_REF] Radhamani | Web Services Security and E-business[END_REF].

The following attacks can be collected from the current information base of National Laboratory of Computer Virology of Bulgarian Academy of Sciences [6]. It collects information for the information attacks, which were carried out to a separate personal and/or corporate computers, and/or networks, and/or systems for the 2009. This is a generalization of the attacks, implemented in Bulgaria, Balkan Peninsula and south-east Europe.

Fig. 1. Main categories information attacks

Table 1. Description of information attacks and their corresponding groups for the MALWARE category.

Malware

In the category MALWARE are included 64 different information attacks, divided into 20 groups (Table 1.).

Malattacks

In the category MALATTACKS are included 24 different information attacks, divided into 13 groups (Table 2.). Note: Roman numbers in are used later as identifiers of the names of the information attacks groups.

Work platforms, environments and places

Work platforms

Different experimental work platforms can be investigated for experimental study and analysis of malware for computing systems. The most popular currently using computing systems are based on the operating systems Windows, Linux and Mac. Therefore, for the purposes of this paper, they can be described as basic. On this basis, a reasonable mix of investigations into each one of them may seek and along with it to seek a reasonable summary of their mutual influence.

Fig. 2 shows a percentage distribution of accomplished attacks to Windows OS, Linux OS and Mac OS.

Experimental work places

With respect to the work environments for investigating and analyzing malware for Browser Systems may say that at the current state of information threats can be assessed that the main problem for the security of home, corporate, government networks is the type of the installed browser. Achievements in this area of the various developers are measured not by days, but by hours. With regard to this is sensibly to analyze some chosen from the top 10 classification browsers for the different operating systems.

Fig. 3 shows chosen top 10 the most popular browsers for Bulgaria, Balkan Peninsula and south-east Europe for the main operating systems.

Fig. 4, Fig. 5, and Fig. 6 show percentage distribution of information attacks, accomplished to the separate operating systems with respect to the separate Browser Systems.

Work places

With respect to the work places for investigating and analyzing malware based on Antimalware Systems may say that when assessing the information security of the endpoints in the information structure is necessary to report the presence/absent of specialized antivirus and security tools. Depending on the type and nature of the activity and depending on the available funds, different antivirus and security solutions with respect to their functionality and with respect to the end user competent can be chosen. Therefore it is extremely difficult to find a widely applicable antivirus and security solution. This necessitates creating of top 10 antivirus and security solutions classifications which can be used for different investigations.

Used methods

Methods which can be used for the realization of real-time system for assessment of information security of computer networks can include:

1. Creating a reference binary sequences describing the behavior of malware through which planned actions in different platforms, environments and locations are carried out; 2. Creating a data containers for cyclic accumulation, processing and archiving; 3. Creating a graphical environment for online visualization of the obtained results with respect to the selected parameters as a function of other selected parameters.

Possibilities of the real-time system

The real-time system for assessing the information security will be able to provide a possibility for:

1. Assessing the velocity propagation of malware, the kind of attacked objects and the methods for reducing the impact of malware over TCP/IP environment.

The methods for reducing the impact include: The assessment for approbation gives an opportunity for each selected place, which claimes a certain volume functionality applicable to a certain combination platform-environment, to be officially confirmed, that it has the announced functionality.

Conclusions and recommendations

The chosen formulation for investigations of malware for different computing systems (presented by operating systems), browser systems (presented by the top 10 most popular browsers) and antimalware systems (presented by the top 10 most popular antivirus and security software) contains the necessary potential for extensive research in this and other neighboring areas.

The results obtained by the real-time system for assessing the information security, give an opportunity for concrete planning of security policy of different configurations computers, systems and networks.

Conditions for precise planning of economic expenses, related to the performing of security policy for determinate configuration computer, system and networks, are created.

Fig. 2 .

 2 Fig. 2. Percentage distribution of accomplished attacks to Windows, Linux, and Mac

Fig. 3 .Fig. 4 .

 34 Fig. 3. Top 10 most popular browsers for Windows, Linux and Mac

Fig. 5 .Fig. 6 .

 56 Fig. 5. Percent distribution of accomplished attacks to Linux OS with respect to the separate Browser Systems

Fig. 7

 7 Fig. 7 shows chosen top 10 most popular Antimalware Systems for Bulgaria, Balkan Peninsula and south-east Europe for the main operating systems.

Fig. 7 .

 7 Fig. 7. Top 10 most popular Antimalware Systems for Windows, Linux and Mac

Fig. 8 .

 8 Fig. 8. Percentage distribution of successful accomplished attacks groups to the Windows OS with respect to the separate Antimalware Systems

Fig. 9 .

 9 Fig. 9. Percentage distribution of successful accomplished attacks groups to the Linux OS with respect to the separate Antimalware Systems

Fig. 10 .

 10 Fig. 10. Percentage distribution of successful accomplished attacks groups to the Mac OS with respect to the separate Antimalware Systems

Table 2 .

 2 Description of information attacks and their corresponding groups for the MALATTACK category.

	Malattacks Groups	Single Attacks
	XXI. Using accessible	(65) Audit Trail; (66) Traffic Analysis;
	information
	XXII. Overflow	(67) Buffer Overflow;
	XXIII. Vulnerabilities	(68) CGI (Common Gateway Interface)
		Vulnerabilities; (69) Hijacking;
		(70) Packet Attacks;
	XXIV. Content	(71) Content Attacks;
	XXV. Data Encapsulation	(72) Data Driven;
	XXVI. Denial of Service	(73) DDoS (Distributed Denial of Service);
		(74) Flooding;
	XXVII. Spoofing	(75) DNS Spoofing; (76) EFT Spoofing;
		(77) Ethernet Spoofing; (78) IP Spoofing;
		(79) Screen Spoofing; (80) SET Spoofing;
		(81) TCP Dump Spoofing;
		(82) Trace Route Spoofing;
		(83) Tunnel Spoofing;
	XXVIII. CrackPasswd	(84) HTCrackPasswd;
	XXIX. Wire/Wireless Phones	(85) Phreaking;
	XXX. Physical Analyze Devices	(86) Physical Perimeter Penetration;
	XXXI. Social Engineering	(87) Social Engineering;
	XXXII. EMI/RFI Intercepts	(88) Wireless Intercepts;
	XXXIII. Zombie Computers	(89) Zombies;

Malware Groups

Single Information Attacks I. Ads [START_REF] Denning | A lattice model of secure information flow[END_REF]


Dimiter Velev
email: dvelev@unwe.acad.bg

Plamena Zlateva
email: plamzlateva@abv.bg

Cloud Infrastructure Security

Keywords: cloud, service, infrastructure, IaaS, security, data

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction to Cloud Computing Basics

Currently one of the major topics of many information technology discussions is cloud computing and the key point in them is cloud computing security. Usually conversations focus on all standard security advantages, disadvantages and requirements. Nevertheless the fact the most common security measures protect data from loss, unauthorized access, integrity disruption, etc., there are other necessary and important characteristics of any IT infrastructure that must implemented in a much more serious way. One of those structures is the cloud infrastructure.

Cloud Computing Definition

Cloud computing is an on-demand service model for IT provision based on virtualization and distributed computing technologies [START_REF]Cloud Computing[END_REF], [START_REF] Reese | Cloud Application Architectures: Building Applications and Infrastructure in the Cloud[END_REF], [START_REF] Rittinghouse | Cloud Computing: Implementation, Management and Security[END_REF]. Typical cloud computing providers deliver common business applications online as services which are accessed from another web service or software like a web browser, while the software and data are stored on servers. The abstraction of computing, network and storage infrastructure is the foundation of cloud computing.

The infrastructure is a service, and its components must be readily accessible and available to the immediate needs of the application stacks it supports. Cloud computing removes the traditional application silos within the data center and introduces a new level of flexibility and scalability to the IT organization. This flexibility helps address challenges facing enterprises and IT service providers that include rapidly changing IT landscapes, cost reduction pressures, and focus on time to market. Cloud users are maybe identified as follows [START_REF]Cloud Computing[END_REF]:

• Individual consumers;

• Individual businesses;

• Start-ups;

• Small and medium-size businesses;

• Enterprise businesses Cloud computing architectures offer to its users numerous advantages that can be briefly summarized to [START_REF]Cloud Computing: Business Benefits With Security, Governance and Assurance Perspectives[END_REF]:

• reduced cost since services are provided on demand with pay-as-you-use billing system; • highly abstracted resources;

• instant scalability and flexibility; • instantaneous provisioning;

• shared resources, such as hardware, database, etc.;

• programmatic management through API of Web services; • increased mobility -information is accessed from any location.

Cloud Computing Categories

The following cloud computing categories have been identified and defined in the process of cloud development [START_REF]Cloud Computing[END_REF], [START_REF] Rittinghouse | Cloud Computing: Implementation, Management and Security[END_REF]:

• Infrastructure as Service (IaaS): provides virtual machines and other abstracted hardware and operating systems which may be controlled through a service Application Programming Interface (API). IaaS includes the entire infrastructure resource stack from the facilities to the hardware platforms that reside in them. It incorporates the capability to abstract resources as well as deliver physical and logical connectivity to those resources. IaaS provides a set of APIs which allow management and other forms of interaction with the infrastructure by consumers. • Platform as a Service (PaaS): allows customers to develop new applications using APIs, implemented and operated remotely. The platforms offered include development tools, configuration management and deployment platforms. PaaS is positioned over IaaS and adds an additional layer of integration with application development frameworks and functions such as database, messaging, and queuing that allow developers to build applications for the platform with programming languages and tools are supported by the stack.

• Software as a Service (SaaS): is software offered by a third party provider, available on demand, usually through a Web browser, operating in a remote manner. Examples include online word processing and spreadsheet tools, CRM services and Web content delivery services. SaaS in turn is built upon the underlying IaaS and PaaS stacks and provides a self-contained operating environment used to deliver the entire user experience including the content, its presentation, the applications and management capabilities. • Multi-Tenancy: the need for policy-driven enforcement, segmentation, isolation, governance, service levels and billing models for different consumer constituencies. Consumers might utilize a public cloud provider's service offerings or actually be from the same organization, but would still share infrastructure.

Cloud Deployment Models

The cloud services can be implemented in four deployment models [START_REF]Cloud Computing[END_REF], [START_REF] Rittinghouse | Cloud Computing: Implementation, Management and Security[END_REF]:

• Public Cloud. The cloud infrastructure is made available to the general public or large industry group and is owned by an organization selling cloud services. • Private Cloud. The cloud infrastructure is operated entirely for a single organization. It may be managed by the organization or a third party, and may exist on-premises or off-premises. • Community Cloud. The cloud infrastructure is shared by several organizations and supports a specific community. It may be managed by the organizations or a third party, and may exist on-premises or off-premises. • Hybrid Cloud. The cloud infrastructure is a composition of two or more clouds (private, community or public) that are bound together by standardized or proprietary technology that enables portability of data and application.

Risks and Security Concerns With Cloud Computing

Many of the cloud computing associated risks are not new and can be found in the computing environments. There are many companies and organizations that outsource significant parts of their business due to the globalization. It means not only using the services and technology of the cloud provider, but many questions dealing with the way the provider runs his security policy. After performing an analysis the top threats to cloud computing can be summarized as follows [START_REF] Dhanjani | acking: The Next Generation[END_REF], [START_REF] Mather | Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance[END_REF]:

• Abuse and Unallowed Use of Cloud Computing;

• Insecure Application Programming Interfaces;

• Malicious Insiders;

• Shared Technology Vulnerabilities;

• Data Loss and Leakage

• Account, Service and Traffic Hijacking;

• Unknown Risk Profile.

It has been established that the most common topics related with cloud computing risk at present include [START_REF] Lyong | How to Select a Cloud Computing Infrastructure Provider[END_REF], [START_REF]Secure Cloud Architecture[END_REF]:

• The cloud provider takes responsibility for information handling which is a critical part of the business. Failure to perform to agreed service levels can impact not only confidentiality but also availability. • The dynamic nature of cloud computing may result in confusion as to where information actually resides. This may create delays when information retrieval is required. • Third-party access to sensitive information creates a risk of compromise to confidential information. This can pose a significant threat to ensuring the protection of intellectual property and trade secrets. • Public clouds allow high-availability systems to be developed at service levels often impossible to create in private networks. Compliance to regulations and laws in different geographic regions can be a challenge for business. • Due to the dynamic nature of the cloud, information may not be located in the event of a disaster immediately. Business continuity and disaster recovery plans must be well documented and tested. Recovery time objectives should be stated in the contract. When faced with the paradigm change and nature of services provided through cloud computing, there are many challenges for cloud providers [START_REF] Lyong | How to Select a Cloud Computing Infrastructure Provider[END_REF]. Some of the major security issues that will need to be addressed are [START_REF]Cloud Computing: Information Assurance Framework[END_REF], [START_REF] Enisa | Cloud Computing: Benefits, risks and recommendations for information security[END_REF], [START_REF]Security Guidance for Critical Areas of Focus in Cloud Computing V2.1, Cloud Security Alliance[END_REF]: • Transparency -Service providers must provide for the existence of effective and robust security controls, assuring customers that their information is properly secured against unauthorized access, change and • Privacy -With privacy concerns growing across the globe it will be imperative for cloud computing service providers to prove to existing and prospective customers that privacy controls are in place and demonstrate their ability to prevent, detect and react to breaches in a proper manner. Information and reporting communication lines need to be organized and agreed before service provisioning starts. These communication channels should be tested periodically during operations. • Compliance -Most organizations must comply with a wide set of laws, regulations and standards. There are concerns with cloud computing that data may not be stored in one place and may not be easily retrievable. Audits completed by legal, standard and regulatory authorities demonstrate that there can be plenty of problems. When using cloud services there is no guarantee that a certain company can get its information when needed, and even some providers are reserving the right to withhold information from authorities. • Transborder information flow -When information can be stored anywhere in the cloud, the physical location of the information can become an issue. Physical location rules jurisdiction and legal obligation. Country laws governing personally identifiable information may vary significantly.

• Certification -Cloud computing service providers will need to provide their customers assurance that they operate surely. Independent assurance from third-party audits and/or service auditor reports should be a vital part of any assurance program.

Cloud Security Principles

Public cloud computing requires a security model that coordinates scalability and multi-tenancy with the requirement for trust. As enterprises move their computing environments with their identities, information and infrastructure to the cloud, they must be willing to give up some level of control. In order to do so they must be able to trust cloud systems and providers, as well as to verify cloud processes and events. Important building blocks of trust and verification relationships include access control, data security, compliance and event management -all security elements well understood by IT departments today, implemented with existing products and technologies, and extendable into the cloud. The cloud security principles comprise three categories: identity, information and infrastructure.

Identity security

End-to-end identity management, third-party authentication services and identity must become a key element of cloud security. Identity security keeps the integrity and confidentiality of data and applications while making access readily available to appropriate users. Support for these identity management capabilities for both users and infrastructure components will be a major requirement for cloud computing and identity will have to be managed in ways that build trust. It will require:

• Stronger authentication: Cloud computing must move beyond authentication of username and password, which means adopting methods and technologies that are IT standard IT such as strong authentication, coordination within and between enterprises, and risk-based authentication, measuring behavior history, current context and other factors to assess the risk level of a user request. • Stronger authorization: Authorization can be stronger within an enterprise or a private cloud, but in order to handle sensitive data and compliance requirements, public clouds will need stronger authorization capabilities that can be constant throughout the lifecycle of the cloud infrastructure and the data.

Information security

In the traditional data center, controls on physical access, access to hardware and software and identity controls all combine to protect the data. In the cloud, that protective barrier that secures infrastructure is diffused. The data needs its own security and will require [START_REF] Enisa | Cloud Computing: Benefits, risks and recommendations for information security[END_REF], [START_REF]The Role of Security in Trustworthy Cloud Computing[END_REF]:

• Data isolation: In multi-tenancy environment data must be held securely in order to protect it when multiple customers use shared resources. Virtualization, encryption and access control will be workhorses for enabling varying degrees of separation between corporations, communities of interest and users. • Stronger data security: In existing data center environments the role-based access control at the level of user groups is acceptable in most cases since the information remains within the control of the enterprise. However, sensitive data will require security at the file, field or block level to meet the demands of assurance and compliance for information in the cloud. • Effective data classification: Enterprises will need to know what type of data is important and where it is located as prerequisites to making performance cost-benefit decisions, as well as ensuring focus on the most critical areas for data loss prevention procedures. • Information rights management: it is often treated as a component of identity on which users have access to. The stronger data-centric security requires policies and control mechanisms on the storage and use of information to be associated directly with the information itself. • Governance and compliance: A major requirement of corporate information governance and compliance is the creation of management and validation information -monitoring and auditing the security state of the information with logging capabilities. The cloud computing infrastructures must be able to verify that data is being managed per the applicable local and international regulations with appropriate controls, log collection and reporting.

Security Compromises Between the Three Cloud Deployment Models

The following security compromises between the three cloud deployment models have been identified [START_REF] Mather | Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance[END_REF], [START_REF] Rittinghouse | Cloud Computing: Implementation, Management and Security[END_REF]:

• SaaS provides the most integrated functionality built directly into the offering, with the least consumer extensibility, and a relatively high level of integrated security since at the least the provider bears a responsibility for the security. • PaaS is intended to enable developers to build their own applications on top of the platform. As a result it tends to be more extensible than SaaS, at the expense of customer ready features. This tradeoff extends to security features and capabilities, where the built-in capabilities are less complete, but there is more flexibility to layer on additional security. • IaaS provides few if any application-like features, but enormous extensibility.

This generally means less integrated security capabilities and functionality beyond protecting the infrastructure itself. This model requires that operating systems, applications, and content be managed and secured by the cloud consumer.

IaaS application providers treat the applications within the customer virtual instance as a black box and therefore are completely indifferent to the operations and management of a applications of the customer [START_REF]Securing Microsoft's Cloud Infrastructure[END_REF]. The entire pack (customer application and run time application) is run on the customers' server on provider infrastructure and is managed by customers themselves. For this reason it is important to note that the customer must take full responsibility for securing their cloud deployed applications [START_REF] Mather | Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance[END_REF], [START_REF] Owens | Securing Virtual Compute Infrastructure in the Cloud[END_REF], [START_REF]Security Guidance for Critical Areas of Focus in Cloud Computing V2.1, Cloud Security Alliance[END_REF].

• Cloud deployed applications must be designed for the internet threat model.

• They must be designed with standard security countermeasures to guard against the common web vulnerabilities. • Customers are responsible for keeping their applications up to date -and must therefore ensure they have a patch strategy to ensure their applications are screened from malware and hackers scanning for vulnerabilities to gain unauthorized access to their data within the cloud. • Customers should not be tempted to use custom implementations of Authentication, Authorization and Accounting as these can become weak if not properly implemented.

The foundational infrastructure for a cloud must be inherently secure whether it is a private or public cloud or whether the service is SAAS, PAAS or IAAS. It will require [START_REF] Mather | Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance[END_REF], [START_REF] Reese | Cloud Application Architectures: Building Applications and Infrastructure in the Cloud[END_REF]:

• Inherent component-level security: The cloud needs to be architected to be secure, built with inherently secure components, deployed and provisioned securely with strong interfaces to other components and supported securely, with vulnerability-assessment and change-management processes that produce management information and service-level assurances that build trust. • Stronger interface security: The points in the system where interaction takes place (user-to-network, server-to application) require stronger security policies and controls that ensure consistency and accountability. • Resource lifecycle management: The economics of cloud computing are based on multi-tenancy and the sharing of resources. As the needs of the customers and requirements will change, a service provider must provision and decommission correspondingly those resources -bandwidth, servers, storage and security. This lifecycle process must be managed in order to build trust.

The infrastructure security can be viewed, assessed and implemented according its building levels -the network, host and application levels [START_REF] Mather | Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance[END_REF], [START_REF]Secure Cloud Architecture[END_REF].

Infrastructure Security -The Network Level

When looking at the network level of infrastructure security, it is important to distinguish between public clouds and private clouds. important to distinguish between public clouds and private clouds. With private clouds, there are no new attacks, vulnerabilities, or changes in risk specific to this topology that information security personnel need to consider. If public cloud services are chosen, changing security requirements will require changes to the network topology and the manner in which the existing network topology interacts with the cloud provider's network topology should be taken into account [START_REF] Mather | Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance[END_REF]. There are four significant risk factors in this use case:

• Ensuring the confidentiality and integrity of organization's data-in-transit to and from a public cloud provider; • Ensuring proper access control (authentication, authorization, and auditing) to whatever resources are used at the public cloud provider; • Ensuring the availability of the Internet-facing resources in a public cloud that are being used by an organization, or have been assigned to an organization by public cloud providers; • Replacing the established model of network zones and tiers with domains.

4.2

Infrastructure Security -The Host Level

When reviewing host security and assessing risks, the context of cloud services delivery models (SaaS, PaaS, and IaaS) and deployment models public, private, and hybrid) should be considered [START_REF] Mather | Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance[END_REF]. The host security responsibilities in SaaS and PaaS services are transferred to the provider of cloud services. IaaS customers are primarily responsible for securing the hosts provisioned in the cloud (virtualization software security, customer guest OS or virtual server security).

Infrastructure Security -The Application Level

Application or software security should be a critical element of a security program. Most enterprises with information security programs have yet to institute an application security program to address this realm. Designing and implementing applications aims at deployment on a cloud platform will require existing application security programs to reevaluate current practices and standards. The application security spectrum ranges from standalone single-user applications to sophisticated multiuser e-commerce applications used by many users. The level is responsible for managing [START_REF] Mather | Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance[END_REF], [START_REF] Reese | Cloud Application Architectures: Building Applications and Infrastructure in the Cloud[END_REF], [START_REF] Rittinghouse | Cloud Computing: Implementation, Management and Security[END_REF]:

• Application-level security threats; It can be summarized that the issues of infrastructure security and cloud computing lie in the area of definition and provision of security specified aspects each party delivers.

The cloud is a major challenge in how computing resources will be utilized since aim of the cloud computing is to change the economics of the data center, but before sensitive and regulated data move into the public cloud, issues of security standards and compatibility must be addressed including strong authentication, delegated authorization, key management for encrypted data, data loss protections and regulatory reporting. All are elements of a secure identity, information and infrastructure model and can be applied to private and public clouds as well as to IAAS, PAAS and SAAS services. In the development of public and private clouds the service providers will need to use these guiding principles to adopt and extend security tools and secure products to build and offer end-to-end trustworthy cloud computing and services.