Integrated Agent-based Cyber Behavior Anomaly Detection and Analysis Approach for Enterprise Networks and Workstations

Cyber behavior anomaly detection has been a critical issue in today’s computer networks. As the business operations and assets are under more and more multiple points of attacks from both inside and outside, protecting data, software and hardware from malwares, fraud and/or malicious activities is, now more than ever, a “need” and not just a “concern” for the enterprise networks. Existing security devices like firewalls are largely ineffective against the insider threats. Traditional intrusion detection systems require prior knowledge of attacks, have high false alarm rates, and need ongoing maintenance of databases, hence lose effectiveness in today’s high-speed networks. To address this problem, in this proposal, Intelligent Automation, Inc., in collaboration with Lockheed Martin Corporation, proposes an integrated agent-based Cyber-Behavior Anomaly Detection and analysis approach (C-BAD) for enterprise networks and workstations to detect and analyze cyber behavior anomalies in both network and host levels. The significant advantage of the proposed system is 1) reliable and high accurate detection, 2) scalable to high-speed networks, 3) allows aggregate detection over multiple routers/gateways, and 4) reduced false alarms. BENEFIT: Essentially, the proposed C-BAD is an integrated cyber behavior anomaly detection and analysis approach. It integrates recent advances on network and host level detecting techniques, as well as signature-based and statistics-based detecting techniques. If our approach is proven successful, the potential market size is very large. In addition, our industry partner, Lockheed Martin can transition these technologies. One direct product of this research will be an integrated cyber behavior anomaly detection software tool. We expect that this tool can support different attack scenarios and various network sizes. It can detect various types of user behavior and network anomalies with high efficiency and reliability. More importantly, the tool is very efficient for detecting unknown threats and attacks. The developed tool can be applied as an independent component for protection of enterprise-level networks as well as military information networks.