Category Archives: History

Attack Source Location in Large Networks

Three researchers at the École polytechnique fédérale de Lausanne (EPFL) — Pedro C. Pinto, Patrick Thiran, and Martin Vetterli — have published a paper called “Locating the Source of Diffusion in Large-Scale Networks” that echoes the principle I presented on six months ago at RSA USA 2012:

How can we localize the source of diffusion in a complex network? Due to the tremendous size of many real networks — such as the Internet or the human social graph — it is usually infeasible to observe the state of all nodes in a network. We show that it is fundamentally possible to estimate the location of the source from measurements collected by sparsely-placed observers. We present a strategy that is optimal for arbitrary trees, achieving maximum probability of correct localization.

Following a common model in nature and science, with a nod to epidemiology as I suggested in my presentation, the authors propose an algorithm for using a highly reduced set of nodes in order to calculate source. In other words we don’t need to wait for data from every single end-point (100% infection) to find the source of an attack.

Here is the slide from my presentation at RSA Conference USA 2012Message in a Bottle: Finding Hope in a Sea of Security Breach Data

As I explained at RSA we can easily leverage the insight of Dr. John Snow’s map-based spatial analysis and algorithm (voronoi diagram) to find the source of attackers.

Measuring relationships (and the lack of relationships) creates clarity in finding sources. Steven Johnson, author of The Ghost Map, tells a colorful story of how it happened in the 1843 epidemic.

Back to the map itself and some fun math, Plus Magazine offers the following explanation of how a Voronoi Diagram/Thiessen Polygon can be used find influence of a specific point.

[Dr. Snow’s] next ingenious step was to represent the time it took to travel to the Broad Street pump on his map and to calculate who was most likely to use each water pump in the area. Snow drew a curve on the map that marked the points where the Broad Street pump was at equal walking distance from neighbouring water pumps. If you live inside this curve the Broad Street pump is your nearest source of water. Almost all the deaths marked on the map lay inside this curve and anecdotal evidence explained the few cases that did not.

Snow's Varoni Map

Michael Friendly offers this animated version of the map, which ends with the bright blue lines of a Voroni Diagram.

Of course Snow’s work is a major and well-known influence in all areas of science. However, in my extensive research from 2008-2011 on breach data and source location, I did not find any prior presentation or publication that suggested using Snow’s approach to solve attack source location in network security. That was exactly my point in presenting it in early 2012 and trying to draw attention in the RSA audience to solutions we can build based on a study of risk characteristics, causes and influences (epidemiology).

For comparison, here is a figure from the CLEP paper that was just released, which shows an estimated attack source location based on nearby yet “sparse” observations:

You could read that map as red for the water pump and green for each person infected by contaminated water. They say they are focused on “inferring the original source of diffusion, given the infection data gathered at some of the nodes in the network”. That sounds like Dr. Snow.

Moreover, their paper actually references a modern cholera outbreak to illustrate their theory; a figure in the paper is of “infected nodes” among “associated water reservoirs” almost exactly like the methods pioneered by Dr. Snow.

With all the obvious similarities, however, they make no mention of my RSA presentation regarding investigation of security breaches and even more shocking is an absence of any reference to the legacy of Dr. Snow.


Please note I will give an updated version of my presentation at the end of this month at RSA China 2012. Here’s a highly abridged version of my presentation produced by the RSA Conference last February:

Hitler Wine in Italy

The Drinks Business has just posted a story of an American visiting the northern town of Garda, Italy who objected to wine bottles decorated with images of Adolf Hitler.

The shopkeeper allegedly told [Philadelphia lawyer Matthew] Hirsch that the bottles were part of history, “like Che Guevara.” “The only crime that could be currently attributable to this is that of apologising for fascism,” prosecutor Mario Giulio Schinaia told news agency Ansa. “At this point though, it would be opportune to invent the crime of human stupidity,” he added. The mayor of Verona said the bottles will be removed from the supermarket.

Source: The Drinks Business

I am surprised he tried to use “like Che Guevara” as some kind of fancy intellectual insult instead of just saying the classic snide phrase “like your mom”.

Apologizing for fascism was made a crime in Italy after 1952. What is left out of the story is that this is not an isolated case (pun not intended).

Note the former news stories from 2008, 2007, 2003….

Those traveling in northern Italy will often find souvenier imagery of Hitler in shops. I have noticed it myself. When I asked shop keepers in 2001 for an explanation they gave me a simple one:

Austrians love Hitler paraphernalia so they come to buy it from Italy.

Italians sell it.

Here is a photo I took of a case of mini-bottles of wine displayed prominently in a convenience store in Assisi, Italy.

The yellow words with a pretty picture above the wine when you open the box cover say “Vino d’Italia”; that’s Italian for the “wine of Italy”.

Basically the stricter regulation in Austria against “promoting or glorifying” the Third Reich has created a market in Italy.

Even Austria’s law, however, earlier this year was tested and failed. The Daily Mail explains that “You can sell Hitler schnapps!”

…state prosecution official Heinz Rusch said the investigation ended because of a lack of proof that it was intended to glorify the National Socialist era. He said the 48-year-old, known as Roland M by prosecutors, from Vorarlberg in the east of the country, was motivated by profit and not by ideology.

Interesting logic. Austrians clearly have not given up glorifying Hitler. Reminds me of books about serial killers motivated by profit and other killers motivated by profit.

Should consequence be ignored when it lacks ideological motive? Likelihood of harm obviously will be far higher if protected by a profit clause. Meanwhile, popularity for Hitler is found even among the Austrian youth, as the Daily Mail also warns.

…new survey asked youngsters aged between 16 and 19 what they thought of the dictator. Pollsters were astonished when 11.2 per cent of them said that Hitler ‘did many good things for the people’.

What good things?

And who are the people? Protip: genocide isn’t great for people.

Maybe it should have asked whether Hitler did good things for their mom. Protip: fascism isn’t great for women.

Or perhaps these Austrian kids are so ignorant of history (in a culture famous for cover-ups) and confused by the Italian merchants that they think Hitler is just some cheap brand of bad wine?

Human stupidity clearly is not a crime, and the Italians seem to think of it as good for profit on dumb Austrians.

Dangers in Predicting the Future With Data

Mike Greenfield has some really insightful things to say on his blog about big data statistical risk and the difficulty in predicting human behavior. Take for example his experience with starting a company, which proved how dangerous it was to rely on a sole supplier.

So Facebook acted rationally, optimizing for their own best interests and those of their users. They killed the notifications feature (which we used to tell someone her friend’s child was turning two). They removed boxes and tabs from profile pages (which over a million moms had added to show off their kids’ accomplishments). And they hid invitations (which moms used to tell their friends about our product).

At that time, we were almost completely dependent on Facebook’s channels to communicate with our users and find new ones. We felt like a beer maker preparing for the government banning beer sales in markets, shutting down bars, and only allowing people to drink in restaurants on Tuesdays. Not quite prohibition, but pretty darned close.

I want reiterate that Greenfield is in the business of predicting human behavior based on data analysis. Although he says “Facebook acted rationally” he actually started his blog post with “Facebook, the VCs said, could suddenly turn off all of their communication channels and we’d collapse. We thought they were full of it…”.

Why didn’t he see it coming?

It sounds to me that VCs predicted the danger of losing a sole supplier. That makes sense in a simple predictive risk model. A “rational” behavior model for suppliers who see economic opportunity, however, is a complex and messy business. It really shouldn’t be so casually described as if a supplier who kills their distribution channel is predicted easily or is rational/optimizing.

Although I love the prohibition analogy it probably is not for the reasons Greenfield uses it. Prohibition is a good example of bad regulation and resulting security risks.

Consider for a moment how the consumption of alcohol actually increased in America after it was banned. If Facebook’s regulation of data were like prohibition then we should predict an illegal data running/smuggling boom.

That didn’t happen, as documented by Greenfield. Instead his story centers on “cutting the cord” and walking away from Facebook forever.

Also consider that prohibition in America was led by popular religious extremists (well, popular in Kansas anyway) who violently forced into power a bunch of blatent hypocrites.

The “conservative” politicians who said they favored a “dry” country ended up meaning someone who drank but refused to admit it. In today’s terms it is similar in nature to the radically homophobic politicans.

Those calling for regulation thus can be mired in complex psychological and cultural issues, which makes “rational” predictions of their economic behavior less than obvious. Was Greenfield accounting for a fundamentalist Carrie Nation element to Facebook when he was threatened by “hatchetation” of his data?

The really interesting point of Greenfield’s story is that at the same time he (like most people) predicted a demise of email and replacement with social networking (risk of staying on email), he also was using the venerable traditional direct-communication path of email to save his company from destruction.

As 2010 came to a close, the proverbial feces was hitting the proverbial fan, and we started to look at email as a way out of the ditch. […] Over the course of 2011, we streamlined our content-writing and emailing operations, in the process turning email into a viable re-engagement channel for millions of moms.

The lesson of course is to predict and manage risk related to distribution channels to your customers, which is what the VCs told them in the first place. It sounds to me had he followed his own risk analysis based on a prediction of the future he would have been far worse off. In other words don’t stop using email unless you realize the true risk of giving up ownership and control over your communication.

Fast forward to Greenfield’s more recent post called “Predicting the Future is the Future” and he extols automation.

Automation is incredibly important. It democratizes the process of building and using statistical models, so that a small startup (with lots of data) can build pretty good statistical models without a team of statisticians. These automated statistical models will almost inevitably perform more poorly than their human-built counterparts, but they’re close enough to be competitive.

I really want to agree with him, because technology can make data more accessible and therefore more democratic. Giving out statistical model tools to everyone means they too can start a company and make money from mining your personal data.

But again he leaves out an essential part of behavior — who gets to own and control access to data. This part of risk has to be better defined before we can celebrate democracy and a risk reduction.

His description of the troubles with Facebook give a clear example of how automation can be rendered completely useless — it runs straight into severe power inequality in terms of resource control and management risks.

Alas, back to the Facebook prohibition analogy, every farm in America used to have an apple tree, if not an orchard. Yet the saying “as American as apple pie” is a subtle reminder of the strange story of hard cider in America.

150 years ago, in the 1840s, hard cider held the position now held by beer as the preferred alcoholic beverage of the working class.

Where did it go? It turns out that while technology democratized the process of building farms and making goods it alone was unable to prevent the extinction of the preferred beverage in America.

…the temperance movement remains as a major culprit responsible for the decline of cider consumption in the U.S., but the association of cider with rural WASP culture was the added factor which distinguishes cider from beer or wine. Add to this the economics of beer production, growing urbanization, German immigration, a predatory beer industry, and a substitute drink in coca-cola, and there seems to be enough factors working together to explain why and how cider so completely disappeared.

A statistician looking at data in 1840 might have said cider was the future, but the question is whether they could or would have predicted a much more complicated mix of risk factors related to irrational human behavior (e.g. religious fervor and ethnic prejudice) that killed the market.


England’s farmers were insulated from the risk of politics and industry in early 1900s America, so they still make cider:

cider at Broome farm
Source: Broome Farm on Flickr.

Mother Earth News says it is not too late to learn how to make your own American cider…assuming you can find a reliable apple distributor.