CS 4404: Tools and Techniques - Computer Network Security
Term: D-Term, 2015
Time: 1:00pm to 2:50pm
Days: Mondays and Thursdays
Location: Fuller Labs 320
Course Catalog Description
This course introduces students to modern network security concepts, tools, and techniques. The course covers security threats, attacks and mitigations at the operating system and network levels (as opposed to the software level). Topics include: authentication, authorization, confidentiality, integrity, anonymity, privacy, intrusion detection and response, and cryptographic applications. Students will become familiar with modern security protocols and tools. Assignments will involve using security testing software to uncover vulnerabilities, network packet analyzers, and existing security applications to create secure network implementations. The course requires enough programming and systems background to understand attacks and use systems tools, but does not involve significant programming projects. Assignments and projects will use a Linux base for implementation. Students who have credit for CS 558 may not earn subsequent credit for this course. Recommended Background: Knowledge of operating systems (CS3013 or equivalent) and computer networks (CS3516 or equivalent). Familiarity with Linux or Unix is essential.
Teaching Assistant: McIntyre Watts
Office: Fuller Zoo Lab
Office Hours: Mondays: 12pm-1pm, 3pm-4pm; Tuesdays: 2pm-4pm
Student Assistant: Steven Malis
Office: Fuller Zoo Lab
Office Hours: Thursdays: 10am-12pm; Fridays: 11am-1pm
Schedule and Readings
Below are a list of readings for the class, along with deadlines for the Missions and Projects. All students are expected to have read the readings prior to arriving for class on the indicated date.
|Due Date||Topic Area||Readings||Link|
|March 16||Security Overview||Chapter 1.1 to 1.5: Pfleeger and Pfleeger, "Is there a security problem in computing?", Security in Computing, 4th edition.||[Paper 0]|
|March 16||MISSION||Mission 1 Issued||[List]|
|March 19||Legality/Ethics||David Dittrich, Michael Bailey, Sven Dietrich. "Towards Community
Standards for Ethical Behavior in Computer Security Research." Stevens
CS Technical Report 2009-1, 20 April
A. Burstein, "Conducting cybersecurity research legally and ethically," in USENIX Workshop on Large- Scale Exploits and Emergent Threats (LEET), 2008.
|[Papers 1]||March 23||Authorization: Capabilities||K. Argyraki and D. Cheriton, "Active Internet traffic filtering: Real-time response to denial-of-service attacks," USENIX 2005.||[Paper 2]|
|March 23||MISSION||Mission 1 Due, Mission 2 Issued||[List]|
|March 26||Cryptography||Chapter 1.1, 1.2, 1.4, 1.5, 1.6-1.9: A. Menezes, P. Van Oorschot, S. Vanstone. "Handbook of Applied Cryptography," CRC Press ISBN: 0-8493-8523-7, October 1996.||[PDF]|
|March 30||Integrity||Robert Topolski. "NebuAd
and partner ISPs: Wiretapping, forgery and browser
hijacking," Washington DC: FreePress, 2008.
Giuseppe Ateniese and Stefan Mangard. "A new approach to DNS security (DNSSEC)," ACM Conference on Computer and Communications Security, 2001.
|March 30||PROJECT||Design Document Due||[List]|
|April 2||Authenication||M. Weir, S. Aggarwal, M. Collins, and H. Stern, "Testing metrics for password creation policies by attacking large sets of revealed passwords," in Proceedings of the 17th ACM Conference on Computer and Communications Security, 2010, pp. 162 - 175.||[Papers 5]|
|April 6||Authenication||J. Steiner, C. Nouman, J. Schiller, "Kerberos: An
Authentication Service for Open Network Systems," USENIX
conference proceedings, 1988. [ Moved from April 2 ]
C. Shue, M. Gupta, M. Davy, "Packet Forwarding with Source Verification," Computer Networks, vol. 52, issue 8, pages 1567-1582, Jun. 2008.
|April 6||MISSION||Mission 2 Due, Mission 3 Issued||[List]|
|April 6||PROJECT||Design Document Peer Review Due||[List]|
|April 9||Authenication: BGP||K. Butler, T. Farley, P. McDaniel, J. Rexford. "A Survey of BGP Security Issues and Solutions," Technical Report, AT&T Labs - Research, 2004.||[Paper 7]|
|April 13||Authorization: IDS||V. Paxson, "Bro: A system for detecting network intruders in real-time," Computer Networks, vol. 31, no. 23-24, pp. 2435 - 2463, 1999.||[Paper 8]|
|April 13||PROJECT||Evaluation Criteria Due||[List]|
|April 16||Availability: Botnets||S. Staniford, V. Paxson, and N. Weaver, "How to 0wn the Internet in your spare time," in Proceedings of the 11th USENIX Security Symposium, vol. 8, 2002, pp. 149 - 167.||[Paper 9]|
|April 21||VPN: IPSec||C. Shue, Y. Shin, M. Gupta, J. Choi, "Analysis of IPSec Overheads for VPN Servers," IEEE International Conference on Network Protocols (ICNP) Network Protocol Security (NPSec) Workshop, Boston, MA, Nov. 2005.||[Paper 10]|
|April 21||MISSION||Mission 3 Due||[List]|
|April 21||PROJECT||Results Section Due, Evaluation Criteria Peer Review Due||[List]|
|April 27||Misc.: Privacy||B. Greenstein, R. Gummadi, J. Pang, M. Chen, T. Kohno, S. Seshan, and D. Wetherall, "Can Ferris Bueller still have his day off? Protecting privacy in the wireless era," in Proceedings of the 11th USENIX Workshop on Hot Topics in Operating Systems. USENIX Association, 2007, p. 10.||[Paper 11]|
|April 27||PROJECT||Peer Review of Results Section Due||[List]|
|April 30||Misc.: Phishing||C. Herley and D. Florencio, "A profitless endeavor: phishing as tragedy of the commons," in Proceedings of the 2008 ACM Workshop on New Security Paradigms, 2009, pp. 59 - 70.||[Paper 12]|
|April 30||PROJECT||Implementation and Final Report Due||[List]|
|May 4||Misc.: Web Security||S. Stamm, Z. Ramzan, M. Jakobsson, "Drive-by Pharming," in Information and Communications Security, 2007.||[Paper 13]|
Course Policies and Procedures
The following represent the official policies and procedures for the course. Please review this information and, if you have questions, discuss them with the professor as soon as possible.
Ethical Hacking Agreement
In this course, students will learn about security, both from a defender and an attacker's perspective. If these tools or techniques were misued, it could have negative ramifications for the student and university. To avoid any potential misunderstanding, students must submit an electronically signed Ethical Hacking Agreement form in the first week of class.
Students that do not sign an Ethical Hacking Agreement in the first week of class will effectively be dismissed from the class. These students will receive an NR grade for the course and will be unable to participate in the practical activities.
Class discussion, class hand-outs, emails to the student's WPI email account, the class discussion board, and the course Web pages are avenues for official course communication. Students are responsible for any information posted through these venues.
We will not be using an assigned textbook in this course. Students will be responsible for obtaining the reading from the links provided by the instructor and, if needed, printing it out for reading.
The Blackboard system that powers myWPI is poorly equipped to support the instruction for this course. Accordingly, we will not be using it. Fortunately, better options are available.
This course will use the InstructAssist system which has been developed for interactive instruction. This system features in-class components, including Quiz Bowls and Activities, as well as out-of-class components, such as assignment submission and grading feedback.
This course will use the ScoreKeeper module in InstructAssist. This module allows automatic evaluation and testing of student work, allowing students to rapidly learn about and address any errors.
You can access the InstructAssist system for this class at https://ia.wpi.edu/classes/2015/d/cs4404/. You will be required to log in through WPI's Central Authentication Service with your WPI credentials to access the system.
This course will make extensive use of out-of-class assignments called "Missions." Each mission will have a series of objectives that must be met by students in order to earn credit. There will be three missions, each with smaller phases. These missions may include a small programming or scripting component, though the focus will be on mastery of tools and techniques.
All missions must be performed independently, unless otherwise indicated. Students may discuss high-level ideas and provide advice to each other to help each other. However, all submitted work must be the result of the student's own efforts and should not include files or systems used by other students. If students have questions about the appropriate about of collaboration, they should contact their instructor.
These missions are designed to allow students to apply the network security concepts learned in class. Many, if not all, of these missions will make use of an isolated computer network to allow students to experiment without introducing risk to the WPI network. Students will be required to use this physically isolated network using a portable computer in which they have administrative access. A virtual machine will be provided to help students with their experiments.
The InstructAssist ScoreKeeper module will be used to test the student assignments and provide immediate feedback on the configuration. This module will also be used for course grading. This system is provided to make the course more productive and beneficial to the students. Any attempts to alter or otherwise falsify test results will be considered "cheating," an instance of academic misconduct, and will be subject to university penalties, including an NR grade in this course.
The ScoreKeeper module may provide feedback in the form of Achievement awards. This feedback will not be included in grading and is merely additional information that students may choose to use or disregard.
Some missions may be completely satisfied by using the ScoreKeeper system, while others may additionally require students to submit documentation, configuration files, or source code. Please check each mission specification to confirm what is required.
Each mission may have a different score weight associated with it. Students should not assume that all missions are of equal weight.
Each student will work on a term-long programming project, optionally with a partner. This project will re-examine a previously-created research project. The students will design the project, implement it, empirically evaluate it, and issue a report on their findings. A significant focus of the project will be on evaluating whether the system is effective at achieving its security goals and whether it perform acceptably in a variety of scenarios. Accordingly, the students would be advised that the implementation will be a relatively small portion of the exercise.
A rubric for the project describes each of these criteria in greater detail and assigns points to each deliverable and aspect of the project.
Peer Review for Project Deliverables
The project will be divided into deliverables with individual deadlines. For several components, the students will be expected to perform a "peer review" of other students' submissions. After the initial submission for peer-review components, the students will be randomly assigned to review the submissions from two other teams. The peer review will be a "double-blind" process: the author will not see the names of the reviewers, nor will the reviewers learn the authors's name. This both eliminates bias and protects student privacy. Naturally, the teaching staff will see all student names when grading. The peer review process is meant to be a learning experience.
While reviewing other students' work, a student is likely to get ideas that could help with their own project. All students are encouraged to revise their work based on the peer review feedback, and ideas from other students' projects, prior to final submission. However, while the peer review is to inspire revisions, the actual revisions must be the team's own work. Teams cannot simply copy the work of others and earn credit. As they revise their assignments, the teams must specifically indicate what alterations were made based on the peer review feedback. The grading process will evaluate both the team's original submission and the final one, with roughly equal credit assigned to both. Accordingly, teams have incentives to write a strong initial deliverable and to strengthen the final deliverable based on peer feedback.
In this course, the relevant tools students use may impose programming languages constraints. Since this is a 4000-level Computer Science, students are expected to learn a new programming language on-the-fly as needed to complete their tasks. However, students often may select the tool they use, often allowing them to work with tools that use languages the students have mastered.
Since this course is focused on tools and techniques, we recommend students use higher-level languages, such as scripting languages, where possible.
Course Participation and Professionalism
During lectures, students are to be focused on the course. Students should not use materials or electronic devices that would inhibit their attention to the course lecture and discussion. Laptops may only be used for note-taking purposes; transmission capabilities on these devices must be disabled and only appropriate note-taking applications may be used in class.
Students must treat each other and the teaching staff with respect at all times. Disagreement, debates, and criticism of ideas are healthy aspects of academic environments; however, students be careful to avoid demeaning language or comments which can be taken personally. The ability to handle conflict professionally and work with a variety of people is an acquired skill, yet it is increasingly important in technical careers.
No quizzes may be submitted late. No make-up quizzes will be available.
Missions and projects may be submitted late, but with significant penalties. Missions that are late, where t represents the amount of time late, will have the following penalties:
|0 minutes < t ≤ 1 day||10% deduction from maximum grade before the rest of the grading begins|
|1 day < t ≤ 3 days||30% deduction from maximum grade before the rest of the grading begins|
|3 days < t ≤ 5 days||50% deduction from maximum grade before the rest of the grading begins|
|5 days < t||no credit will be awarded|
Missions and projects are due at the exact minute specified, with all times rounded down to the nearest minute. The submission system is synchronized via NTP with the CS department servers. This time will be considered official.
A project that is submitted late may not be included in the peer review process. As a result, students may not have feedback or guidance from their peers for sections where they submit late.
Any missions or projects submitted after 4pm on Monday, May 4, 2015 will not be graded.
A total of 80% of the course grade will be determined by grades on the assigned Missions and in-class quizzes. The remaining 20% of the course grade will be attributed to in class participation and professionalism associated with the course. Details on each of these components are as follows:
- Quizzes (40%): The will be thirteen quizzes, each 10-15
minutes long, at the beginning of each class. The two lowest quiz scores will automatically be dropped, allowing for absences,
illnesses, or simply "bad days". The quizzes will
be short, typically only two questions long. The first question will
cover material from reading due before class and will be more
factual (and simplistic) in nature. The second question will be more
application-oriented, requiring students to apply
concepts from prior class discussions to new
- Missions (20%): There will be multiple missions in the
course where students will apply concepts. These missions may have
different point values and may
have "checkpoint" deliverables in which students must show
substantial progress towards completing the assignment.
- Project (35%): There will be one term-long project that students may pursue in teams of up to two people. The project is described in greater detail above.
- Participation and Professionalism (5%): Students are
expected to be engaged in class, answering questions from the
instructor and asking questions when needed. Students must regularly
attend classes and show up to demonstration times they
schedule. Disregard for course policies or unprofessional conduct
with students or the teaching staff will be penalized. This grading
component is a signed value, allowing students to earn a negative
score for abusive behavior. Students that simply attend class each
day and participate adequately in Quiz Bowls and Activities should
expect to earn around an 85% in participation. Voluntary
participation in discussion or the discussion board, via questions or comments, is required
to earn full credit in this category.
BS/MS Graduate Credit
Students may take this course for graduate credit by students in the BS/MS Computer Science program. Students that are interested in obtaining graduate credit (equivalent to 2 graduate credits) will need to make the appropriate arrangements with the professor at the beginning of the class. Students should expect to make an in-class presentation and paper critique, as well as a minimum final course grade requirement, to obtain such credit.
If you need course adaptations or accommodations because of a disability, or if you have medical information to share with me, please make an appointment with me as soon as possible. If you have not already done so, students with disabilities who believe that they may need accommodations in this class are encouraged to contact the Office of Disability Services (ODS) as soon as possible to ensure that such accommodations are implemented in a timely fashion. This office is located in the West St. House (157 West St) and their phone number is 508.831.4908.
The WPI Academic Honesty Policy describes types of academic dishonesty and requirements in documentation. In the case of academic dishonesty, I am required to report the incident to the Dean of Student Affairs. Further, my penalty for academic dishonesty is to assign a NR grade for the course.