Predicting Malicious Behavior E-Book

Gary M. Jackson

• Herausgeber: John Wiley & Sons
• Kategorie: Wissenschaft und neue Technologien
• Sprache: Englisch

Veröffentlichungsjahr: 2012

Beschreibung

A groundbreaking exploration of how to identify and fight security threats at every level

This revolutionary book combines real-world security scenarios with actual tools to predict and prevent incidents of terrorism, network hacking, individual criminal behavior, and more. Written by an expert with intelligence officer experience who invented the technology, it explores the keys to understanding the dark side of human nature, various types of security threats (current and potential), and how to construct a methodology to predict and combat malicious behavior. The companion CD demonstrates available detection and prediction systems and presents a walkthrough on how to conduct a predictive analysis that highlights proactive security measures.

• Guides you through the process of predicting malicious behavior, using real world examples and how malicious behavior may be prevented in the future
• Illustrates ways to understand malicious intent, dissect behavior, and apply the available tools and methods for enhancing security
• Covers the methodology for predicting malicious behavior, how to apply a predictive methodology, and tools for predicting the likelihood of domestic and global threats
• CD includes a series of walkthroughs demonstrating how to obtain a predictive analysis and how to use various available tools, including Automated Behavior Analysis

Predicting Malicious Behavior fuses the behavioral and computer sciences to enlighten anyone concerned with security and to aid professionals in keeping our world safer.

Leseprobe

Contents

Cover

Title page

Copyright page

Dedication

About the Author

Credits

Acknowledgements

Foreword

Introduction

Part I: Understanding the Dark Side: Malicious Intent

Chapter 1: Analyzing the Malicious Individual

Analyzing the Unique Individual

Richard Reid: The Shoe Bomber

Ted Bundy: The Infamous Serial Murderer

The Individual Cyber Attacker

Modeling the Individual: Advantages and Disadvantages

Advantages of AuBA #1: Automated Summarization

In Summary

Chapter 2: Analyzing the Malicious Group

Understanding the Group Adversary

Analyzing al-Qaeda

Analyzing Hezbollah

Analyzing the Coordinated Group Cyber Threat

Advantages of AuBA #2: Theme-Guided Smart Searches

In Summary

Chapter 3: Analyzing Country-Level Threats

Threats to Our National Infrastructure

Analyzing the Specific Threat of Terrorist Attacks

Improving Network Security

Facing Chemical, Biological, Radiological, and Nuclear (CBRN) Threats

Advantages of AuBA #3: Reducing Errors and Inefficiencies of Manual Predictive Modeling

In Summary

Chapter 4: Threats and Security Nightmares: Our Current Reactive State of Security

Analyzing Mall, School, Workplace, and Other Seemingly Random Public Violence

Unanticipated Terrorist Network Attacks

Can Technology Detect First-Time Attacks?

Advantages of AuBA #4: Building Predictive Applications

In Summary

Chapter 5: Current Network Security

Hacking and National Network Security

Growing Damage and Threat

Assessing Current Technology

Moving Toward Fixing Current Ineffective Network Protection

Envisioning an Effective Future Network Protection Technology

Advantages of AuBA #5: Conducting a Human Behavior Assessment of Threats from Network Packets

In Summary

Chapter 6: Future Threats to Our National Security

Our Growing National Security Dependency on Computers and Networks

Increasing Threat on a Global Basis

The Dire Need for New Proactive Methods

Advantages of AuBA #6: Automated Pattern Classification

In Summary

Part II: Dissecting Malicious Behavior

Chapter 7: Applying Behavior Principles: Predicting Individual Malicious Behavior

Using a Behavior Analysis Methodology That Works

Using Behavior Principles to Analyze Behavior

Environmental Variables

Different Environments, Different Antecedents

Antecedents, Behavior, and Consequences

Behavior Modeling

Advantages of AuBA #7: Incorporating, Refining, and Expanding Behavior Principles for Global Security

In Summary

Chapter 8: Applying Behavior Principles: Predicting Group Malicious Behavior

Analyzing Threat

Group Attempts to Inflict Harm and Damage

Moving from Analysis to Prediction of Malicious Behavior

How Do You Know the Predictive Application Works?

Advantages of AuBA #8: Automating Behavioral and Computer Sciences to Ensure Success

In Summary

Chapter 9: Applying a Predictive Methodology: From Principles to Practice

Construction of Predictive Models

What Is Needed: The Behavioral Methodologies

Making Sure It Works: An Introductory Example

Testing and Use in the Real World: Implications

Advantages of AuBA #9: Designing the Focus of an AuBA-Developed Model

In Summary

Chapter 10: Predicting Domestic Threat

Characterizing Domestic Threat

The Malicious Insider: Spies, Thieves, and Sabotage

Advantages of AuBA #10: Moving from Reactive to Proactive

In Summary

Chapter 11: Computer Networks: Protection from External Threat

Protecting Against Known Attacks: Signature Detection

Identifying Unknown and First-Time Attacks

Forensics: Studying and Defining the Past

Advantages of AuBA #11: Network Intrusion—Converting Digital Information to Human Behavior Assessment

In Summary

Chapter 12: Computer Networks: Protection from Internal Threat

Defining the Insider

Current Trends in Insider Threat Protection

Advantages of AuBA #12: Powerful Predictive Analysis Engines That Fit on a Laptop

In Summary

Chapter 13: Predicting Global Threat

Understanding State-Sponsored Threat

Describing and Identifying Future Global Threat

Understanding the Role of Network Forensics

Determining State Support of Terrorist Activities

Moving from Detection to Protection: A Major Leap

Advantages of AuBA #13: The AuBA Behaviorprint and How It Compares to Signatures

In Summary

Part III: Applying Tools and Methods

Chapter 14: Predictive Capability in Software: Tools for a New Approach

Fusing Computer and Behavioral Sciences

Using the Computer's Speed and Memory to Our Benefit

Human Bias: The Enemy to Accuracy and Analysis

Capturing Cultural Nuances

Moving from Theory to Practice: A Necessary Transition

Advantages of AuBA #14: Incorporating Key Technological Advances

In Summary

Chapter 15: Predictive Behavioral Modeling: Automated Tools of the Trade

Automated Behavior Analysis (AuBA)

ThemeMate

AutoAnalyzer

Using the Advantages of Speed, Accuracy, and Lack of Bias

Conducting Behavioral Modeling: Integrating ThemeMate and AutoAnalyzer

Advantages of AuBA #15: What Is the AuBA Predictive Engine?

In Summary

Chapter 16: Developing AuBA Applications

Modeling from Text Accounts of Past Behavior

Modeling from Sensor Output

Advantages of AuBA #16: Extending Our Analytical Brains

In Summary

Chapter 17: Mastering AuBA Tools for Real-World Use

Predicting the Unpredictable: Identifying Future Malicious Behavior

Advantages of AuBA #17: Versatility

In Summary

Chapter 18: Analyzing Future Malicious Behavior

The Necessity of Context in Predicting Future Behavior

Analyzing the Individual and the Group

Analyzing Threat on a Global Level

Implications for Security

Advantages of AuBA #18: Automated Characterization of Network Attacks

In Summary

Part IV: Predicting Malicious Behavior: Tools and Methods to Support a Paradigm Shift in Security

Chapter 19: AuBA Future Extensions Today

Predicting New Adversary Threat with Enhanced Accuracy

A Behavioral Science–Based Paradigm Shift

Advantages of AuBA #19: AuBA in the Future

In Summary

Chapter 20: How to Predict Malicious Behavior: A Walkthrough

A Manual Walkthrough of AuBA Principles

Moving Beyond the Clinical Setting to Expanded Environments: Automated Assist

Full Automation of the Prediction of Human Behavior: Automated Behavior Analysis

Advantages of AuBA #20: Final Thoughts

In Summary

Appendix

Index

Download CD/DVD content

End User License Agreement

Guide

Cover

Table of Contents

Begin Reading

Pages

iii

iv

v

vii

ix

xi

xii

xiii

xiv

xvii

xviii

xix

xxx

xxxi

xxxii

xxxiii

xxxiv

xxxv

xxxvi

xxxvii

1

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

161

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

329

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

440

441

442

443

444

445

446

447

448

449

451

452

453

454

455

456

457

458

459

460

461

462

463

464

465

466

467

468

469

470

471

472

473

474

475

476

477

478

479

480

481

482

483

484

485

486

487

488

489

491

490

492

493

494

495

501

502

503

504

505

506

507

508

509

510

511

512

513

Predicting Malicious Behavior

Tools and Techniques for Ensuring Global Security

Gary M. Jackson, PhD

Predicting Malicious Behavior: Tools and Techniques for Ensuring Global Security

Published by

John Wiley & Sons, Inc.

10475 Crosspoint Boulevard

Indianapolis, IN 46256

www.wiley.com

Copyright © 2012 by Gary M. Jackson

Published by John Wiley & Sons, Inc., Indianapolis, Indiana

Published simultaneously in Canada

ISBN: 978-1-118-16613-0

ISBN: 978-1-118-22625-4 (ebk)

ISBN: 978-1-118-23956-8 (ebk)

ISBN: 978-1-118-26418-8 (ebk)

No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, [phone], fax [phone]. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, [phone], fax [phone], or online at http://www.wiley.com/go/permissions.

Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or website is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or website may provide or recommendations it may make. Further, readers should be aware that Internet websites listed in this work may have changed or disappeared between when this work was written and when it is read.

For general information on our other products and services please contact our Customer Care Department within the United States at [phone], outside the United States at [phone] or fax [phone].

Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material included with standard print versions of this book may not be included in e-books or in print-on-demand. If this book refers to media such as a CD or DVD that is not included in the version you purchased, you may download this material at http://booksupport.wiley.com. For more information about Wiley products, visit www.wiley.com.

Library of Congress Control Number: 2012933633

Trademarks: Wiley and the Wiley logo are trademarks or registered trademarks of John Wiley & Sons, Inc., and/or its affiliates, in the United States and other countries, and may not be used without written permission. All other trademarks are the property of their respective owners. John Wiley & Sons, Inc., is not associated with any product or vendor mentioned in this book.

Disclaimer: All statements of fact, opinion, or analysis expressed are those of the author and do not reflect the official positions or views of the CIA or any other U.S. Government agency. Nothing in the contents should be construed as asserting or implying U.S. Government authentication of information or Agency endorsement of the author's views. This material has been reviewed by the CIA to prevent the disclosure of classified information.

I dedicate this book to the Reverend Manuel Lee Jackson and Linnie Mae Jackson, my loving parents, recently deceased, and my sister, Reita (DeDe) Carringer, and brother, Kevin Lee Jackson.

About the Author

Dr. Gary M. Jackson is an Assistant Vice President and Technical Lead within the CyberSecurity Business Unit at Science Applications International Corporation (SAIC). A behavioral psychologist with specialties in artificial intelligence and automated assessment, Dr. Jackson has designed and developed scores of advanced applications across both corporate and U.S. Government settings. Dr. Jackson's career has spanned academia as assistant and associate professor (University of South Florida), director of R&D and treatment development in various clinical settings, research psychologist within the U.S. Secret Service Intelligence Division, Intelligence Officer and Chief of three advanced technology branches within the Central Intelligence Agency, vice president and director of research and development for Psychological Assessment Resources (PAR), Director of the Center for the Advancement of Intelligent Systems (CAIS) for the American Institutes for Research, and, until recently, the founder, president, and CEO of Psynapse Technologies in Washington, D.C. Dr. Jackson has extensive R&D and field experience in counterterrorism, counterintelligence, and asymmetric warfare prediction. He was a former President of the Florida Association for Behavior Analysis (FABA). He holds B.A. and Ph.D. degrees from Southern Illinois University–Carbondale and an M.A. degree from University of Illinois. He has completed additional postdoctoral training in neurophysiology at the University of South Florida Medical School. Fusing the behavioral and computer sciences, Dr. Jackson is the inventor of the patented automated behavioral assessment (AuBA) technology, CheckMate intrusion protection system, InMate misuse detection system for insider threat, and automated prediction of human behavior technology.

Credits

Executive Editor

Carol Long

Senior Project Editor

Kevin Kent

Technical Editor

Dr. Eric Cole

Production Editor

Kathleen Wisor

Copy Editors

Caroline Johnson

Gayle Johnson

Editorial Manager

Mary Beth Wakefield

Freelancer Editorial Manager

Rosemarie Graham

Associate Director of Marketing

David Mayhew

Marketing Manager

Ashley Zurcher

Business Manager

Amy Knies

Production Manager

Tim Tate

Vice President and Executive Group Publisher

Richard Swadley

Vice President and Executive Publisher

Neil Edde

Associate Publisher

Jim Minatel

Project Coordinator, Cover

Katie Crocker

Proofreader

Nicole Hirschman

Indexer

Johnna VanHoose Dinse

Cover Designer

Ryan Sneed

Media Project Manager 1

Laura Moss-Hollister

Media Associate Producer

Josh Frank

Media Quality Assurance

Doug Kuhn

Acknowledgements

Although I conceptualized, designed, and led the development of AuBA over the past three decades, it takes very talented developers to pursue, develop, and validate new technology in such a radical area as prediction of human behavior. Skeptics abound, and traditional statisticians loom large. It takes a village to pursue radical new approaches and methodologies. For these reasons, I have many to thank for their dedication, contributions, and effort to make AuBA a reality.

Beginning in the early clinical days, my colleague and lifelong friend Charles Antonelli and I developed methods to alter institutional environments to provide antecedents and consequences to support adaptive behavior and suppress highly inappropriate and maladaptive behavior. The precursors to AuBA were born in those early clinical days, and thoughts started focusing on prediction and not just behavior change. At the time, Lincoln State School in Lincoln, Illinois, was the largest institution for the developmentally disabled in the world. Indeed a challenge; we made a difference.

Carrying what was known as contingency management to Florida at Sunland Center of Miami working with such colleagues as Melinda S. Gentile and then Florida Mental Health Institute (FMHI) at the University of South Florida, I continued in research and treatment development, leading several programs for different populations with serious mental illness. At USF such talented colleagues as Dr. Roger Patterson, Dr. Lawrence Schonfeld, Dr. Louis Penner, Dr. Carla Kelly, David Eberly, and I developed new behavior methods to significantly impact the downward slide of the elderly, and developed methods to reverse the occurrence of serious behavior associated with aging. We found that creating the right environment and providing appropriate behavioral treatment could enhance the lives of many elderly patients. The clinical methods I developed were direct precursors to AuBA.

In 1985, I left academia for the government. Many individuals were key in continuing to pursue significant changes in altering a statistical view of prediction to one with a strong science of human behavior foundation that incorporated proven principles of behavior analysis. At the top of the list of individuals to thank is a very talented developer who after hearing my brief on how we could pursue a new technology for prediction of human behavior stopped what he was doing and joined my team as lead developer within the U.S. Secret Service. Marion Georgieff was a loyal and dedicated professional, and our ideas and concepts starting taking shape in advanced pattern classification and software supported by Special Agents David Bressett, Kenneth Baker, and Phil Leadroot.

Then the missing years—the CIA. During this period of time very special recognition is given to those who must remain nameless. They made those years possible for me and were contributors to, as well as supporters of, the new anticipatory vision. Leaving the CIA, I took a position as Vice President and Director of Research and Development for Psychological Assessment Resources in Lutz, Florida. Working closely with Dr. R. Bob Smith, Cathy Smith, and later Justin Smith as part of the AuBA team, the PAR psychological team helped me to fuse ideas of commercial psychological assessment practices into the developing predictive methodology. The development of interpretive reports was especially important, as well as the insistence on quality development of software that is psychologically based. Coming back to Washington to the American Institutes for Research (AIR), I created the Center for the Advancement for Intelligent Systems (CAIS), which morphed into my own spin-off, Psynapse Technologies, to market the developing AuBA technology. This was a time of exuberant growth in the technology thanks to government funding and the strong support from Mr. Larry Willis, the Defense Advanced Research Projects Agency (DARPA) Program Manager. Larry realized the vision and spearheaded support that made AuBA actually possible. Without Larry's vision and directed support, there would not be the AuBA of today. Other key support from DARPA included Dr. Sean O'Brien and Dr. Robert Hummel. Dr. Ruth Willis at the Naval Research Laboratory (NRL) added significantly to support provided. Special appreciation is expressed to the Office of Naval Research support provided by William Krebs and Anita Berger, as well as the former Deputy Chief of Naval Operations, Former Vice Admiral John Morgan.

Of special note is Byron Raines, who has remained part of the AuBA approach for over 11 years now, and, until taking a new position recently, Joan Wang, who has been a faithful AuBA developer for over 11 years. In addition for the past 22 years, Rosemarie Hesterberg has provided undying support and loyalty and was responsible for suggesting that I use AuBA for network protection. While dedicated staff may come and go, the contributions of these dedicated colleagues rank very high and their fingerprints are all over AuBA. I truly appreciate their dedication not only to the technology but also to supporting the AuBA vision. There are also other notables who contributed to development at this time. Mona Habib lent her Arabic expertise. Helene Mullaney was a key staff member who quickly grasped the concepts and mentored/trained others in the rapidly developing methodology and automation. A born leader as smart as they come, she helped move the technology forward. Bob McMahon was a key contributor to CheckMate and InMate as cyber applications constructed from AuBA technology. AIR Company support provided by Dr. Michael Kane and Sol Pelavin, the talented AIR CEO, was always appreciated and necessary for continued growth.

Spinning off Psynapse Technologies, my wife, Dr. Stephanie Jackson, my Deputy at the time, demonstrated her considerable talent as a professional and former school principal. She provided superb support for all company operations, and for that, I am appreciative. Dr. Terry Gudaitis, Julian Kamil, and Jeff Hall assisted in moving the technology forward on the application side, as well as Byron Raines and Joan Wang. Of special mention is a world-class expert who has supported AuBA since beginning with the CIA. A computer scientist and network intrusion expert, Dr. Eric B. Cole was there at the beginning when we worked out the first cyber network protection prototype for government funding and is still contributing today. Dr. Cole graciously consented to be technical editor for this book and wrote the foreword. Eric is actually a part of the vision of providing a paradigm shift in security. AuBA offers a new approach, and his support as one of the best has been truly appreciated, as have his contributions.

At SAIC, who acquired AuBA intellectual property, special appreciation is expressed to supporters Clay Stewart, Richard Shipman, and Dennis Andersh, as well as Hawaii staff Roger Medd and Brian Banks. Dr. Mary M. Quinn's support as a behavioral colleague has been invaluable. Current support by Roger Tjarks as a Chief Scientist and Julie Taylor as Director of our Cyber operations is especially appreciated. Although many teams have worked on the development of AuBA over the years, the current Columbia, Maryland, team of Byron Raines, Ricky Smith, Garrett Henderson-Tjarks, Gary Cruttenden, Jonathon Conti-Vock, Erin Britz, Kyle Kubin, William Pollock, Kyle Mann, June Liu, and James (Don) Bowers led by the very talented development team leader Paul McAllister, and the Arlington, Virginia, team of Carl Symborski, Marguerite Barton, Geoffrey Cranmer, Jasmine Pettiford, and Kathleen Wipf are at the top. Paul McAllister, as a true collaborator, has made more recent developments a reality through new and improved software application. On a personal note, much appreciation is expressed to my family: Dr. Stephanie Jackson, daughter Ashley Henley and her husband Jason, daughter Kary Borden, and grandchildren Kayla and Jared Borden for supporting me over the decades and tolerating many hours of work above and beyond the norm that was necessary to develop AuBA.

Last, but certainly not least, I would like to acknowledge John Wiley & Sons. Writing the content of a book is the purview of the author, but publishing a book is a collaboration and ongoing interaction between an author and publications staff. From the early collaboration of the book with Carol Long, Acquisition Editor, to the very talented editorial leadership and personal work of Senior Project Editor Kevin Kent supported by content editors Maureen Spears, Rebekah Worthman, and Rayna Erlick, and Technical Editor Dr. Eric B. Cole, I express great appreciation for their talent and patience. I also want to thank all of the staff members who worked on the evolutionary development of AuBA with names just too high in number to list individually, but your many contributions are deeply appreciated. Most important, thank you reader for taking the time to read and study what this village of professionals has done for the future of security.

Foreword

The ancient Chinese proverb states, “May you live in interesting times.” When it comes to cyber security, this statement is definitely true. We cannot go a day without hearing about another organization being compromised. No one is spared. Government, commercial organizations, universities, and non-profits are all being compromised. For many organizations it is a very frightening, frustrating, and scary time because the old tools and methodology that we have used in the past to properly defend our networks no longer work. Organizations are spending tremendous amounts of money, energy, and effort on security, and they are still getting compromised. One executive pulled me aside during a consultant engagement and said, “Be honest with me. Is trying to secure an organization helpless? Should we just give up?” The good news is things are not hopeless and we can get ahead of the curve, but we have to change our way of thinking. As Albert Einstein stated, “We cannot solve our problems with the same thinking we used when we created them.”

The threat has changed dramatically over the past 3 years, but our approach to security has not changed. Traditional threats were treated by using reactive security. An organization would wait for an attacker to break in and cause harm, and then it would react to the threat and improve its security. With today's threats increasing and becoming stealthier, targeted, and data focused, reactive security no longer works. Predictive, proactive security is the answer. We need to stop looking for signs of an attack, get inside the mind of the adversary, and understand how it thinks and operates. We need to combine computer science with psychology to get at the root of the problem, not just treat the symptom.

Many years ago while I was working with Dr. Gary M. Jackson, one of the most brilliant scientists and technology visionaries, he briefed me on a concept called CheckMate. The concept was simple. Computers do not attack, people do. People ultimately write the code, create the malware, and control what is behind any attack. If people are ultimately behind the attack and people are creatures of habit, why not predict human behavior via a computer resulting in more robust defensive measures of prediction? The technology was amazing, but the problem was the world was not ready for it. Ten years ago the idea was way ahead of its time. Gary created technology that would effectively deal with the APT (advanced persistent threat); the only issue was he needed to wait 7 years for the term to be created. In essence, CheckMate needed to wait for the adversary's sophistication to catch up to prove the uniqueness of this technology.

While many people today are talking about the concept and starting to perform research in the area, this book is based on 20 years of validated research on how to catch an adversary. The concepts presented in this book are not things that might work; they are proven technologies that have worked over and over again.

In reading through this book, the world is now given the details straight from the developer for dealing with sophisticated attacks. Detecting attacks through signatures is old school. Predicting attacks by understanding malicious behavior is the future. If you understand the concepts that are covered in this book, Gary provides a step-by-step detailed handbook of how to get inside the mind of the adversary and provide proper defensive measures to protect an organization today and in the future.

While very few people will have the distinct honor and privilege to learn from the master directly, this book allows everyone to gain the insight and knowledge of what is required to defend a network that will scale from the person who created the fundamental technology for predicting behavior.

— Dr. Eric Cole