DARPA builds Cyber Range to test security measures

The Defense Advanced Research Projects Agency and industry are developing a National Cyber Range to test network attack-and-defend strategies, much the same way that the United States created a range at Bikini Atoll in the 1940s and 1950s to test atomic weapons.

The goal of the NCR is to accelerate government research and development in high-risk, high-return areas and jump-start technical cyber transformation in the private sector. NCR will achieve this by providing a real-world simulation environment from which companies and research organizations can develop, field and test advanced concepts and capabilities to defend U.S. communications networks against cyber threats.

There are already a number of smaller, noninterconnected cyber ranges for testing in the United States, but none of them provides the single, large-scale test bed that DARPA said will quickly produce qualitative and quantitative assessments of cyber R&D. For example, there is the Joint Forces Command Information Operations Range, which has been operating since 2006 and routinely conducts more than 100 experiments a year related to information operations.

What DARPA wants to do with the NCR is take testing automation to the next level so that time-consuming, manual setup time can be kept to a minimum, leaving more time to conduct experiments so cyber defense can be more quickly woven into the nation’s communications networks.

“We’re looking at revolutionizing the state of the art of cyber testing itself,” said Michael VanPutte, DARPA program manger of the National Cyber Range. “We want to create a test range that is fully automatic and rapidly configured so that we can get the results back out to the community. We don’t want to take six months to do the test and another three months to do the analysis. We want to do a large number of tests rapidly and really push the comprehensive national cyber initiative to get technologies deployed.”

NCR is not a Defense Department program even though DARPA is the lead agency. Rather, it is part of the Comprehensive National Cybersecurity Initiative, a major governmentwide effort established during the Bush administration to increase the nation’s defenses against electronic attack. As such, NCR will be open to industry network scientists and engineers from industry, government, the military and academia who want to test their cyber tools.

For CNCI to be successful, the government must develop technologies that dramatically improve cybersecurity.

“There are so many areas that need research that we’re not going to solve a lot of these problems in an evolutionary fashion,” VanPutte said. “That’s why we’re focusing on high-risk, high-payoff technology experimentation related from everything from spam to mitigating computer bots."

“We can’t solve those problems by patching the boxes,” VanPutte added. “We need better solutions, so what we ask is for the community to bring their ideas to NCR, test them, and see what works and what doesn’t work in a quick fashion.”

Prototype Ranges

The second phase of the NCR program began in February with the award of a $31 million contract to Lockheed Martin's Simulation, Training and Support unit and the Applied Physics Laboratory at Johns Hopkins University. In Phase II, DARPA, Lockheed Martin and Johns Hopkins will build and evaluate prototype ranges and their corresponding technology.

Under Phase I of the NCR program, which lasted for about six months, DARPA and a number of industry organizations created initial conceptual designs, concepts of operation, and detailed engineering and system demonstration plans. Besides Lockheed Martin and Johns Hopkins, participants in the first stage were BAE Systems Information and Electronic Systems Integration unit; General Dynamics Advanced Information Systems unit; Northrop Grumman's Intelligence, Surveillance and Reconnaissance Systems division; Science Applications International Corp.; and Sparta.

Although the National Cyber Range is designed to be a test bed for experimentation of offensive and defense network capabilities, VanPutte said the main purpose of NCR is to improve the defensive skills of the agencies that operate communications networks.

“We want to bring realistic attacks against our defensive capabilities,” he said. “Somebody with an academic point of view and understanding of computer security may not necessarily understand what is capable in the offensive community. By bringing nation-state-level offensive capability into the NCR, we can test out defensive tools in a more realistic fashion and get more realistic results out to the community.”

From a scientific point of view, there have been a number of technical and engineering challenges associated with developing the NCR concept. With the goal of speeding cybersecurity systems to government, military and private-sector communications networks, automating test processes has been one of the top goals for NCR.

“Probably the biggest technical objective that we’ve laid out is the full automation of both the resources and the testing itself,” VanPutte said. “We want a researcher to be able to come in and configure a task in an automated fashion, perhaps using a drag-and-drop graphic user interface, in order to design his architecture, the links, and the operating systems and applications. There are a number of solutions that are out there that have challenges, and testing in the NCR can help to get those technologies out there.”

Full-Spectrum Threats

Another challenge to testing has been the inability to stress systems in an operational environment against realistic users, who do not always behave as might be expected. That situation would be described as a full-spectrum cyber threat, VanPutte said. NCR will help developers challenge their basic assumptions and think outside the box of the engineer’s or user’s original assumptions.

A third challenge is the difficulty to reproduce machines down to the instruction level.

“I give you a machine, and within four hours, you give me a virtual machine that includes all the hardware," VanPutte said. "That is a really hard technological challenge. Some research has been put into all these areas, but we’re really trying to push them to a whole new level.”

In the future, DARPA will get NCR to a working state but will not operate the range, which coincides with the agency's charter for technology development. The plan is to transition NCR to an agency that has not yet been determined.

“It won’t necessarily be the DOD,” VanPutte said. “We’re looking across the U.S. government to see what makes the most sense. And that decision will most likely be made by the CNCI."

“But one of the things we’re trying to ensure is that we can share the technology we develop across all test beds," VanPutte added. "We’re not trying to build just a DARPA test bed. We’re trying to build technologies such as an automated tool suite, for example, that anyone can use in their own test beds.”