So you have a... oh, I guess we're live.
Okay, welcome to the Computer Security Seminar.
Today's speaker is Jose Fernandez from Montreal Polytechnic, and he will speak on
Semantic Security, or How I Learned to Stop Worrying and Love the Internet.
Jose.
Thank you very, very much.
So most of you are probably a bit too young to understand the cultural reference there to Dr.
Strangelove, probably one of Peter Sellers' masterpieces, moving from the 60s, where that was about nuclear doom.
And the reference there is that there is impending doom, I think, in the way the Internet is becoming an increasing part of our lives, and certain aspects of it we're not caring about.
And one of them is actually semantics.
How do we give value to the information that is on the Internet?
How do we interpret it?
And so forth.
The soft underbelly of modern information systems, as I called it.
So a disclaimer, as you can see at the bottom of the screen, I'm mostly responsible for this nonsensical talk.
This is inspired by some of the ideas of other people, and there is references to research of other people.
This is not my day job.
I'm a security researcher, and mostly I do reasonable security research, doing with malware and botnets and things that get published like that.
This idea of semantic security is something that a good friend of mine, Robert Garrigue, started to make me think about, about four or five years ago, before he passed away, unfortunately.
And I've been trying to make a collection of various ideas that occurred to him, to me, to other people, trying to make some sort of research agenda, and at the same time carry a message here that we need to start looking at other aspects of how we look at security of information systems.
So this is not my day job, but one of the reasons I'm here is actually to learn and get your feedback.
So what are we going to talk about quickly?
Semantics and syntax.
I realize that I have my good friend Victor Raskin here, which I'm here to learn from, in terms of semantics, but maybe some of the people in the audience who are watching us, that difference in how it pertains to computer systems is not so obvious.
Then we will talk about what this talk is not about, and we will spend about half of the time talking about what this talk is not about, i.e.
applications of semantics to security.
And then we will go into semantic warfare, what we mean by that, what is a semantic attack, what is a semantic hack, how these attacks on semantics, how do they relate to current information systems, what are the semantic components of current information systems,
how can they be attacked or hacked.
And then we'll go into a bit of discussion on various research or avenues or ideas how to improve the security of these semantic components.
And finally we'll summarize and open the floor for discussion.
I'm quite willing to have you interrupt me at any time that you think is relevant, especially if I digress.
So what is syntax?
Syntax is what defines form and function in language, in natural language.
This is not electron syntax, but just to situate everybody in the room, when we talk about syntax in high school we're talking about grammar, we're talking about sentence, subject, verb, object.
What are these, how they should be arranged, what is the functional relationship between them, and what order they should come in, and what rules should govern how they're being formed.
But nothing about what it means, and how this, you know, this we do in literature class, we interpret poetry, and this is about love, this is not syntax, it is semantics.
Now on the computer science side, syntax is related to what?
The notion of syntax is of course incorporated into programming languages, into communication protocols, into database models, and we even have a nice part of theoretical computer science called formal language theory, which deals with syntax and its forms.
The interesting thing here is that often the syntactic metadata is the data that defines the syntax.
That is itself data, okay, and it's metadata because it's data about data.
This data about data in the natural language, it's your grammar book.
This defines the syntax of the particular language.
In computer science we also have these things.
We have programming language grammars, we have header files, and in the case of protocols, ASN.1, database schemas are files that define what the data is in databases.
Now let's look first at semantics.
It's a position in natural language context.
So semantics is about giving meaning and interpretation to what is being said in the form, in the syntax.
So semantics or meaning is what says that these two syntactically correct phrases, one makes sense, the other one doesn't.
Man bites dog doesn't make sense to us.
It's not usual within the context of what the man is a dog is, but it's perfectly syntactically correct.
And dog bites man is, would say, is the most usual or interesting.
So what the notions that I have to do with semantics are things like ambiguity or disambiguation, which is how to... the fact that one syntactically correct sentence could have several interpretations.
Poetry, humor, all of these things have to do with semantics, with meaning.
What is a semantic metadata?
In languages, dictionaries would tell us that these particular words, these meanings, are syntactic metadata themselves.
They are formatted in a certain way.
And of course the main tool that we have developed in computer science for representing syntactic metadata are called ontologies.
Ontologies, which are a way of representing knowledge, of representing concepts, how these concepts are related in terms of inheritance or in terms of association.
And there's also, of course, various kinds of logics that allow us to reason onto these ontologies.
And it took me a while to realize that ontology is not the same thing as ontologies.
Okay, when I was in high school, actually I did philosophy in high school, and I remember studying Plato and Socrates and the science of being and answering... ontology is actually a subfield of philosophy that has to do with answering the very important questions in life.
This has nothing to do with, or very little to do with, ontologies as we use them in computer science.
And once I understood that, thanks to my Wikipedia, my confusions disappeared.
Anyways, another way to look at the difference between semantics and syntax, at least I like to think of it this way, and Victor might tell me that it is wrong, but some of you might have heard of the DIKY model of information processing, in which we're talking about the data which is raw,
unprocessed, becomes information once we are able to understand which parts of the data mean are doing what.
And then this information, once it is interpreted by somebody intelligent within the context of concepts, becomes knowledge.
And if you're lucky, this knowledge, when it is being used efficiently, becomes wisdom, becomes profit in some sense.
So this DIKY model, which is a old model from psychology, has been adapted to various things, decision theory, and so forth.
Essentially, syntax has to do with the D and the I, how to transform data into information, and semantics tells us how to transform that information into meaning, and eventually, potentially, how to use that meaning for useful decision-making or wisdom,
etc.
The recursive paradox, and this will become important, is what I call it, it doesn't always fit in my small head, is that the semantic metadata that allow us to interpret the ontologies, the dictionaries, is itself data.
And the fact that it's itself data will become important for us in terms of security, because since it is data, this data has to be provided by a computer system, by some sort of information system.
And that information system is another system, another information system like any other, with its vulnerabilities and with security shortcomings.
And in some sense, even though semantics and syntax are quite different things, and they're used differently by the human brain, at the end of the day, from a reductionist computer science point of view, they're systems.
Now, in information systems, well, semantics in general, ontologies are, theoretically speaking, can allow us to represent any concept of knowledge, of human knowledge, of computer knowledge.
But the ones that are particularly important in information systems, or at least nowadays, are some of these concepts that I have here.
Origin, who really wrote this piece of information?
Who is the author?
Or where does it come from?
Okay, who gave it to me?
Who sent it to me?
The trustworthiness of the source, you know, should I do what they tell me to do in this piece of information?
Should I obey this order?
Should I be... and this will be influenced by how much do I trust the source of that information, whether it's the actual author or the transmitter.
The trustworthiness of the information itself, is it true?
Okay, is this statement true or credible?
Obsolescence, is this information still applicable?
Okay, is it still relevant?
And in a particular kind of obsolescence is relevance.
Should I waste time reading this?
Should I influence... should I be influenced by this?
And what is this?
Think about it in terms of nowadays, in the internet, and how we all...
we're in elections in Canada right now, so we are in a process of decision-making, all of us.
So where do we get this information about how to go about voting?
We get it from the TV, from the press, but increasingly from the internet.
From what?
From reading a particular blog, or a particular article in the broadcast media on the internet.
And all of these values that we're giving to the information that we are going to consider, is informed by these concepts of origin, trustworthiness of source, trustworthiness, obsolescence, relevance, and so forth.
And want it or not , and this is what we'll discover later, we will go into more detail later, even though theoretically speaking the internet or the web was created as a information system, and the web and the protocols in the web are all defined in syntax,
there has appeared a semantic layer about it that allows us to say nowadays, like this is not foreign to you, that this particular blog is worth reading.
And what is in it is actually more trustworthy than this other piece of information I could find, or that I did not even read.
So semantics has, in as much as the internet was created in a ad hoc fashion, the semantic layer of it has also been created in an ad hoc fashion, and we'll come back to that.
Okay, on the other hand, we've got this field, computational semantics, of which I know absolutely nothing about, except to pretend to give a talk on it.
No, I'm not an expert in it, Victor is, but I guess the notion of... one of the things that computational semantics can be used for is the notion of concept extraction, of meaning extraction.
I have a text, and we all know how we can do syntactic analysis... well, we know that syntactic analysis is being done, for example, by Microsoft Word, who is telling you that this verb is not properly... correctly declined, and how you forgot your plurals,
and so forth.
This is syntactic analysis.
Now, semantic analysis is not about, is the text rightly formed, but what is the text about?
What are... what is the topic, what are the concepts in it, and how these concepts are being related in the text?
So there is a whole field about this, and there are automated tools for doing some of that.
Some of the examples are things like, okay, what is the gist of this text?
What is its main statement?
What is hypothesis or thesis?
Things like computational humor, which Victor was one of the fathers of.
Is this a joke, or why is this funny?
And things like that.
And spam.
Is this spam?
Now, I haven't seen much, and maybe you could correct me at a later date, I haven't seen much application of computational semantics in spam detection.
But this is definitely something that shows promise, and we'll discuss it.
So the first part of the... this next part of the talk is about what this talk is not about.
The talk is about semantic security, but I want to spend some time saying another aspect, which is how do we apply... what applications are there of semantic technology, of computational semantics, in security applications?
This is not about the security of the semantic component of the system, but what applications there are of using semantics in security.
So there are a few examples that are worth mentioning.
Of course, the number one which I like is spam.
So we all know that most spam filters are essentially based... or the initial spam filters were based on finding several copies of the same text, the same email being sent over and over again.
So the basic technique there is to generate cryptographic hashes from these texts and compare them.
If two texts have the same cryptographic hash, they're the same text, this is a quick way of checking it, and I shall reject it.
So the technique of hash-busting text was introduced by spammers to essentially keep the same meaning of the text, but introduced randomly generated tags into that text, or introduced random variation, whether by HTML tags that won't get interpreted, or actual text.
But there's several ways of introducing randomness, but the one that's most interesting to me is the insertion of text at the end, which shall not be interpreted by the target, but is changing the hash-busting text.
And the reason it initially had to be text is because if you introduce something that wasn't text, then it could be detected by some other spam filters.
For example, if you just introduce a random string, then some of these early spam filters would do a dictionary lookup and say, okay, this is not a word, therefore this is a hash-busting text, and this is spam.
So therefore, there were two techniques that were introduced by spammers.
One was to copy existing text from textbases, Gutenberg or Google in the Internet, and you had the very nice piece of a pharmaceutical article at the bottom of your spam, or a nice piece of literature, or there were even some models that were generated for generating semi-syntactically correct text that had the right form and had enough words per sentence that they would pass simple syntactic filters.
Now, that suggests right away countermeasure, which is if we analyze this text and try to extract its content, then we would see a semantic content that it has none, or that its content, semantic content, is incoherent.
So semantic analysis might give us a way of detecting that this text is randomly generated, it has no meaning.
In addition, even if it has meaning, does it have meaning that matches the user context?
Okay, I am a accounts payable person in a small company.
Is it within my normal context to get emails about inheritances in African countries?
It's not within the context of what I normally do.
So I postulate that semantic analysis of the emails might actually help some of this filtering.
Of course, the counter-countermeasure of that, it is semantically correct random text generation.
And I understand that there are some tools that can do this.
As a matter of fact, you might be familiar with one of its most public demonstrations, which was a program written by some MIT graduate students called Router, which was a generator that generates syntactically and somewhat semantically correct computer science articles.
And this was used by them to expose one of these scam conferences organized by this person in Venezuela.
They submitted this randomly generated article that followed the right syntax introduction, I references at the end with some randomly generated figures and some buzzwords here and there.
And this article was, of course, accepted to this conference.
And there is even a tool, if you Google Router, which was the name of the article, you'll find, I think, the tool is still online.
It has a nice web interface.
You can put your name.
I did this, Jose Fernandez, Alan Turing, and it will generate an article with those co-authors.
And you can choose a title, and it will generate everything for you in perfect LaTeX format.
But the interesting thing about it is that it is somewhat semantically correct because it chooses concepts and it intersperses phrases that make references to these concepts within the article.
So I postulate, again, that this might be a technique that spammers could introduce to make better, faster, you know, spam.
Now, the other obvious is security intelligence, the obvious application.
So the first example is actually research that has been done by a colleague, Carrie Gates, at Computer Associates.
The goal of her research was to try to detect inappropriate behavior in employee email.
So indicators and warnings that this employee is about to commit some inappropriate behavior or act, whether it is harassment or, as we like to say, going postal, that there is an increase in threat levels or things like this.
So this uses somewhat a mix of unsupervised learning and supervised learning and semantic technology.
The other obvious use, and I understand that this, well, we never know whether it's being used or not, but one of the problems, especially of signals intelligence, which is the interception of large amounts of electronic data, emails, and so forth, is that how do you find the needle in the haystack?
How do you find the email that says start the cyber 9-11 attack within terabytes and exabytes of data of emails that are completely anodyne and have no relationship?
So string matching, which is a reliable technique, and here are some examples of phrases that would string match, I really don't like these bomb makers, okay?
I really don't like them.
I really hate these terrorists.
Is this a terrorist threat?
No, on the contrary.
But you need meaning to understand this, right?
And the package is ready for delivery.
There is no string matching there, unless you find that package is a, you know, is a negative word.
So therefore, it's concept extraction and matching onto ontologies of, or semantic matching, if you wish, is probably something that would need to be done if it's not being done already.
The third one is probably the most interesting one, which is semantic analysis of the security of systems.
One of the examples that was given to me by Robert Garrigue, who at the time was a chief information officer of one of Canada's largest banks.
The problem that they had with the implementation of the bail agreement, the bail agreement is a banking agreement between international banks for supporting interbanking transactions, is that they each had to cross-certify their security policies of their computer systems.
So now we have a big brick of a thousand pages which describes the security policy of the Bank of Montreal.
Another 2,000 page document describes the security policy of Citibank.
And now somehow there has to be some comparison.
So imagine the very highly paid consultants going through these documents to analyze that the security policies are both compliant to the bail agreement, and they're both compatible.
So this, of course, was going to cost hundreds of millions of dollars.
So one of the ideas was that we could maybe clear some of the way of that work by doing some automatic semantic analysis of the security policies to see whether there were some obvious, at least, misalignment in concepts.
The other second bullet point is, I think, far more interesting, which is, are there any exploits in hacker parlance?
Are there any exploitable misalignments between what the system believes and what the user believes?
In some sense, we know, and most we can construct from design documents or from programmers, what the ontology of the system concepts are.
And we might be able to extract a user representation of what the user believes from user interviews or other techniques.
Now the question is, if we have these two ontologies, can we identify misalignments for example, concepts that are being used that have the same label, the same name, but are being interpreted completely differently?
And to discover potential attacks, potential semantic attacks.
And a very good example of that is actually the interpretation of what the little lock is in the bottom right of most web browsers.
Most users will believe that this means that the session is secure, and that the contents of the session is safe from interception.
And if we actually look at the meaning of that within the context of public key infrastructure, that is quite different.
It means that a particular piece of information has been verified as per its origin under certain conditions.
The authenticity of the public key certificate has been verified.
It actually does not mean that the session is free from interception.
And the fact that the proof of that is that most large corporations and organizations actually put money in the middle in SSL in order to be able to monitor the traffic for security purposes.
So this is an example of ontological misalignment in between the user model and the system model.
So it would be interesting then for future hackers or for white hat security analysts to use semantic analysis to explore the specifications of systems and what users believe about the system to find ahead of the hackers what these exploitable misconceptions could be.
So in fact, the sentence I want to underline, we've spent a lot of effort in detecting buffer overflows.
Buffer overflows are the mother of all vulnerabilities, or 80% of all important syntactic vulnerabilities are related to buffer overflows.
And we spent a lot of effort in trying to detect them, trying to correct them, either by source code analysis or by dynamic instrumentation of code.
What I contend here is that we should start doing the same thing at the conceptual level with semantic analysis.
A third, very quick, fourth example, which is related actually to our research, we are just trying to design or revive some of the intrusion detection ideas.
And one of the key things that we discovered is that most of the approaches so far, or a lot of the approaches, have been based on supervised learning or machine learning.
But we believe that the introduction of a lightweight ontology and ontological structure will actually make things much more efficient.
And the key idea here of the intrusion ontology is that an attack, events that are being generated by systems, they are being generated always within the context of an ontology, sorry, they are being generated within a context, which is a context meaning a type of system,
a type of user.
And this is what we see.
We see events, and we see the context in which they happen.
Now, if you wish, the hypothesis is that attacks, intrusions, must happen within a context which is related to the vulnerabilities that they exploit.
And then attacks generate sequence of events.
So by having an idea of what these attacks are in terms of sequence of events, in terms of where they happen, then we can do some sort of hypothesis testing in the intrusion detection.
But we need to have that domain knowledge.
And this domain knowledge representation has been mostly absent, or at least in ontological fashion, in intrusion detection.
So we're proposing to introduce it.
Okay, so this was all about applications of semantics into the field of security.
How about the security of the semantic components of our information systems?
This is what the talk really was meant to be about.
And the phrase I put to you there is not mine, it's from my friend Robert Garrigue, which is in true JFK fashion, hack not the system, hack the belief system.
Okay, so as I said in the abstract of the presentation, the first time I heard this talk, I thought it was about hacking the Quran or something, okay, or hacking into the heads of people to make them believe something else.
It was in some sense, in Robert Garrigue, the military background, I thought it was a bit of psychological warfare, really.
But in time, and in discussions with him, and in observing what the world has brought to us, I realized that this phrase is not to be interpreted so much as in hacking the belief systems, the human brain, but into computer hacking, really the semantic components of the computer systems.
So it's not as provocative a phrase as you might think it is.
Having said that, let's look a little bit about the human belief system.
So the example I will put here is, and this is very, I hope I do not offend anybody here, but I meant this as a metaphor, as a metaphor of language to be able to describe how ontologies in the computer world might or might have witnesses or so forth.
So as you know, there is a big difference between how the Catholic Church, and in its history, and the various Protestant churches after the reform in the 16th century, have handled dogma.
So in the Catholic Church, interpretation of the scriptures, interpretation of the dogma, is essentially left to the Church, and the ultimate authority is the Pope.
The Pope is infallible, he has divine authority to interpret the dogma.
So in some sense, from an ontological point of view, the concepts in the Catholic dogma are more or less fixed.
They can change, but this change is only brought about by one central authority.
So in that sense, that ontology is very resistant to attack, from an ontological point of view.
And as we've seen in history, the Catholic Church has been able to defend dogma by various means, including military ones, but in some sense, the ontological maintenance is very resilient.
At the same time, it's not very flexible.
And some people might contend that the Catholic Church has not been able to adapt itself to new concepts, or to new realities of life, like contraception, like evolution in the world, and so forth, multiculturalism, and so forth.
On the other hand, in most Protestant churches, each Christian is supposed to do his own interpretation of the scriptures, is actually required to study the scriptures and interpret them as he best fits in conscious.
So this, in some sense, this is one of the reasons why Northern European... it's actually argued that one of the reasons that Northern European nations, England, Germany, Scandinavia, the Netherlands, have been able to more quickly go into economical development in industrial revolution.
They were more receptive to innovation and scientific development, because it was possible to challenge and introduce new concepts into the social ontologies, which eventually fueled technological development and economic development.
On the other hand, what you see is that from an ontological point of view, what was initially one dogma has splintered into several dozens of Protestant churches.
So dogma and ontologies are weak from a realism point of view, but they are efficient, they allow for change.
So these contracts, I think this is talking, this is why it in some sense makes sense, this is not my terminology, a friend of mine, of thinking of Catholic versus Protestant type of ontological system.
Not necessarily the ontologies themselves, but the systems that maintain them.
Islam is very interesting.
Islam is very interesting because the Quran and what is believed about the Quran.
The Quran is believed by Muslims that it is the word of God, in computer science parlance, to the bit.
Every bit, every zero and one of the Quran was dictated by God, and therefore in some sense the Quran is syntactically as it was.
So the belief in Islam ensures the syntactic integrity of the Quran.
There is even procedural ways in which the level of certainty of the Quran can be established through the trustworthiness of the imams that have studied it and so forth.
Western scholars call, sometimes Muslims, the people of chains, because there is various ways in which this trust chains in the integrity of the Quran is established.
Something that is from a computer science point of view is very interesting.
Now the semantic interpretation is somewhat coded and protected in hadith, which are the traditions which are written interpretations by learned and trusted scholars, mostly in the 12th and 13th century.
But this is of course not as rigid as it is in the Catholic Church.
But all of this to say that what to retain of this is that different systems we have in different religions, different ontological systems, and they have different ways of handling security in some sense.
Now, nowadays, 21st century, I'm sure you've all seen this picture.
Forget about religions, talk about politics, talk about money, talk about government systems.
What is this picture saying about how we are making decisions today, how we're giving semantics and value to information?
It's saying that large portions of it are now computer based.
Explore the web, Google and Yahoo search engines that are telling us what is relevant, where is the right information for me to read to make decisions.
PayPal has to do with, well, PayPal is the other one here, but and Twitter, social network, social networking.
This is, and I was just discussing with one of your colleagues, Elisa Bertino today, some recent work on the trustworthiness of tweets.
How can I know that this tsunami alert really is a credible tweet and not a hoax?
So I think there are current events in Egypt and Tunisia and other Middle East countries are speaking to the fact that the semantic component or the cybernetic component of how we give value, of how we're defining semantics, is increasingly cybernetic.
So how do you hack these human belief systems?
Well, hacking human belief systems really is not new.
Publicity is all about hacking how we believe and interpret information.
Politics is all about influencing us and what we believe, and politicians are quite good at that.
And even love and seduction, what we do in our private lives, it's all about making people believe what we want them to believe, okay?
So this is not new, right?
There's nothing shattering here.
But the difference is that increasingly there is a cybernetic component to hacking into the human belief system, just because we are relying more and more on computers, not so much for getting the information, but for giving value to that information.
So of course the social networks are interesting.
The dust attacks on Georgia are an interesting semantic component.
I will not go into the details of it, I'm running short.
Let's go forward.
The next aspect is the fact that
semantic systems are becoming really cybernetic.
So there are three aspects here.
The first one is that we have cybernetic or electronic representations of ontologies.
These ontologies are machine interpretable.
That's one of the advantages of ontologies.
They can be interpreted by humans, but also by machines.
They are behind things like the semantic web, and increasingly service-oriented architectures are using these.
XML for defining what this part of the page is and so forth, and what it means.
And some of the more advanced information management systems are using these technologies.
But it's not so interesting yet because we're not using these information systems or these ontologies for... the impact is not there.
We're not using them as much for decision making.
The second part that I will talk about in more detail is trust management systems, or what has been called trust management systems, which are part of the system which manage some concepts, like the ones we described earlier.
Origin, trustworthiness, truth, and so forth.
And these have been... there are several examples of them, which we'll discuss quickly.
And third, everything... this ad-hoc layer on top of the web, which are the search engines, the indexing services, and the reference sites like Wikipedias, have become, if you think about it, an ad-hoc semantic system, in which they do not provide full concept ontologies,
but they are providing us with metadata about some of these properties that we care about, that we use for decision making.
Again, like trustworthiness, like relevance, obsolescence, etc.
So all of these components, or cybernetic semantic components, are potentially hackable.
I will not discuss the hackability of ontologies too much, except that I will leave you with the notion that there might be some ontological systems that are more Catholic, i.e.
more resilient to attack, and there might be some ontological systems that are more Protestant, that might be softer in the underbelly, but eventually more interesting from an efficiency point of view.
So analyzing the... if you wish, analyzing the resiliency of ontological systems is something we need to start thinking about.
And maybe this religion metaphor is a good point to start with.
What I'd like to discuss now is the notion of attacking these semantic components, or semantic hacks.
So if we go back to these first components, how do we do a syntactic hack of these semantic systems?
What I mean by a syntactic hack is that we are just attacking these semantic systems, these ontological maintenance systems.
They are just a system, so we're just doing regular attacks on them.
Maybe the XML definitions are on some web server and I just need to do a denial of service on that server.
Or maybe I just find a zero day to become root on that machine and I change the ontological component.
That is not a semantic attack in my book.
It is a traditional system attack on a semantic component.
This is not new, but this is possible.
The second one is what I was talking, referring back to what I was talking earlier, which is we're not... where the attacker is going to use the ontological misalignments, the ambiguities, the misconceptions between the user and the machine, or between two different systems,
machine and machine, and he's going to exploit this misalignment to make one of the systems do something that it is not meant to do.
Or to make the user do something that it was not meant to do.
So again, this probably will need some sort of automated ontology extraction from what people believe and some sort of, I don't know, this is not my field, some sort of tools for comparing these ontologies and eventually finding this potential exploit.
This is the way we are finding some unsafe declaration of memory in C, now for buffer overflows.
And the third part, which is related to these trust management systems, and mostly that are collaborative, collaborative trust management system, is this semantic dilution attack.
If I cannot change the ontologies themselves by exploiting a misalignment, if I do not hack the semantic system just by traditional methods, you know, owning it, then what I can do is dilute the value of the numerical values of trustworthiness, of origin,
of the information, and potentially of the sources of the information.
So this is what?
This is typically will be slandering attacks, where I say something about somebody else that is untrue in order to lower its trustworthiness.
I will plant false information into the system that is not necessarily changing its interpretation, but it will confuse things.
And one example that was very interesting is Scott Knight's attack to illustrate the difference between the semantic attack and a syntactic attack.
Suppose that I wanted to take down the critical infrastructure for online banking.
One way would be to denial of service against the servers of the bank.
Another way would be to do phishing, where I steal credentials to go and do transactions.
But another more much more interesting attack is from a, if you wish, natural infrastructure security point of view, is I want to lower the confidence of users in the banking system.
So what I do is instead of going and stealing the credentials to empty the accounts and run with the money, I start introducing false transactions.
A little $10 here, a little $20 there, and I do this on a very low level.
So every once in a while, maybe every other month or every three months, you get an error when you try to reconciliate your accounts.
And you don't do this for everybody, but you do this for maybe 20-10% of the population, so that at the end everybody knows somebody who knows somebody who's got an error in their bank account.
And now it goes on TV, but it's not a widespread, completely everybody has an error.
So it's not clear what is true.
Is it what they're saying that on television, that the banking account is not working?
Is it true or not?
Well it's working for me.
I'm in the 80% who got lucky.
So now we are diminishing the confidence into the banking system.
And that's what banks do.
What they sell is confidence.
So that is a semantic attack, because it's changing the value of the system or the information in the system.
And I guess a generic, I guess this is where we come back to Robert Garrigue.
Hacking the belief system, it's all about attacking the semantic component, because A, it's normally less protected, and B, the impact will ultimately be much higher.
If we hack what people believe, the impact would be much higher.
We are attacking directly the decision-making process, and we are eventually closer to imposing our will, which is the goal of all conflict.
So if we're talking about the security of the semantic systems, we have to, how rich or how important this semantic metadata is in our decision-making.
If it is not, then it's not so important.
And then, of course, we have to protect the semantic systems like we would protect any other system.
So apply strong authentication, access control, security engineering practices, version control, things like that.
This in itself is not new.
I'm just saying that it's a system like any other.
It's probably more important.
So let's apply our security hardening, auditing, best practices the same, but maybe with more priority to these components.
But let's talk about the more research aspect of it.
We talked about ontological anomalous alignments.
What are they?
It's the existing of two conflicting interpretations.
And this slide is full of question marks that I'd like to discuss with some of the experts here.
Is it possible to detect these misalignments automatically?
Is it possible to have some sort of method for assessing their impact or risk assessment?
And now let's talk about the security or the resilience of the ontological maintenance systems.
What is an ontological maintenance system?
It's a way, a protocol by which we add concepts.
We allow the addition of concepts and how they're related and changing this relationship between concepts.
How is this maintenance done?
Is it through a collaborative system?
Do we have a central access control system that defines who can change what?
I would contend that in most interesting systems, these editing mechanisms are going to be collaborative.
In the systems of the future, they're going to be done through social networks.
Wikipedia already is a good example of an ontological maintenance system and its security model is okay, but it's not optimal.
We need to start thinking about these future Wikipedias.
And the doomsday of all, social networks meets Wikipedia.
Wikipedia doesn't have a central editing team anymore, but we're allowing changes to Wikipedia based on our scores on a social network.
So this will happen, believe me.
So we need to start thinking about the security of such monstrosities right now.
Anyways, I'm running out of time.
And there's another aspect to this topic, which has to do with trust management models, which is how various ways of maintaining these values of trustworthiness, origin, and so forth.
I will just jump to some examples.
Probably one of the two most interesting ones, at least most commonly known ones, are the
distributed key management models or public key infrastructure, the PGP model, in which there's no central authority, there's no certification authorities.
Everybody can certify everybody else's keys.
So what you have there is you have a network of trust, where I certify the people that I know's keys, and then they can certify the people that they know's keys.
And then what I have is I receive some key, and I need to determine whether that key really belongs to who it says it belongs.
And then the notion of key chain of trust, which is if Alice signed Bob's key, and Bob signs Charlie's keys, and Charlie signs David's key, what confidence can David have in Alice's key, and vice versa?
And there's a whole research area about how we should compute this trust, along these chains of trust.
What mathematical formulas should we use?
And then if, in addition, the same key is signed along another chain of trust, which involves other individuals, how can we combine the confidence that we have through these two independent means?
Should it be the sum?
Should it be the product?
Or should it be just we should just assess confidence using the chain that gives us more confidence, in some sense, taking the maximum value?
So there has been some research, including by a friend, but this is just a representation of it, a friend of mine in Spain, about mathematical elucubration of how should we define these mathematical constructs behind these theories of trust?
And what aspects of reality or of the domain should influence our choices in this trust management or trust computations systems?
What I would like to go straight is to the summary.
Essentially, what we've seen is that there are lots of applications of semantics in security.
Spam is one, security intelligence is one, and semantic vulnerability assessment, which is essentially trying to find out what the soft spots are of Amens in Machina, which is the man in the machine, how the interaction of man and machine has problems that could be exploited,
that are security problems, but also machine against machine.
And I put it in italics because it's not really computer science anymore, but men against men.
How are the misalignments between different groups of different persons exploitable, in this case not for computer security, but for politics and so forth, right?
So this is related to psychological warfare, semantic warfare, media, publicity, and so forth.
I'm just putting it there for completeness, but that's not really part of the computer science research agenda, even though some of the same tools might be usable.
Then semantic security is about designing secure semantic systems.
So this is application of standard security practices, security engineering, but it's also starting to develop constructs to or analysis techniques for saying what is a good ontological system from a security point of view, being able to define what the resilience of an ontological system is to attack.
And finally, one of the applications of that is to trust management systems.
And why is this an important, I believe, security or research agenda?
It's because the impact is much more important.
The impact of bad semantic systems, bad cybernetic semantic systems, is much more important than the impact of bad or insecure systems, period.
And I would like to leave you with this quotation from Robert Garrigue, which launches this whole discussion into another topic that we can discuss at dinner or with you in question, which is the notion of a semantic warfare.
So essentially what he's saying is information warfare can be physical.
I send a bomb.
It can be syntactic.
I change the form of the content of the information.
Or it can be semantic.
I can change how it is being interpreted.
So the use of a physical weapon will result in the permanent destruction of physical components and denial of service.
A syntactical weapon will focus on attacking the operating logic of the system.
I hack the system.
I hack the access control system.
I change its integrity.
And it will introduce delays and unpredictable behaviors.
A semantic weapon will focus its effect on destroying the truth and trust maintenance components of the system.
And this is exactly what we're talking about.
Now what's interesting about this quote is that for Robert Garrigue, for Robert, he integrates a standard military doctrine which already makes a distinction between the physical plane and the intellectual plane.
But within the intellectual plane he's making the distinction.
There is a syntactic plane, systems in terms of computers, and there's the semantic plane, which is how we use and interpret that information.
And all of these three planes are vulnerable to attack and can be used in conflict.
So the next step, with our friends, some of them in the military college, we're discussing some of these ideas.
Military college in Kingston, which is our military academy, we're discussing what is the doctrine of semantic warfare going to look like in the future.
And that is it.
Thank you.
Are there any questions?
The semantic system and semantic security is much more like the information system.
What's the difference between the two conceptions?
Between information system and semantic system?
Yeah.
So an information system, as I view it, has two components.
It has a syntactic component, which describes how the data and information should be arranged in it.
Yes, so an information system has two components in it, as I view it.
A syntactic component and a semantic component.
Concretely, if we're taking, for example, a database, a relational database, the database itself, the database management system, and the tables that it contains, and what tables contain what fields, and what tables are indexed with what other tables,
this is form, this is syntax.
Now, what is the meaning of the third attribute in the table called ABC, and how this attribute shall be interpreted?
That is semantics.
Normally, the semantics in a database application is actually in the code.
It's actually in the code, it's in the user messages, and so forth.
And it's the way we use that information.
Data security, for me, is syntactic security.
I'm sharing the integrity of the data, integrity of the data, confidentiality of the data, that is syntactic security.
It is the security of the syntactic component.
Now, the semantic component is what allows us to give meaning to this information, interpret it, and use it for decision making.
And this is what this talk was about, is how do we ensure that this semantics of the data, how we are using it, how we are interpreting it, how that is being protected as well, not just the integrity and the confidentiality.