DIA: Distributed Information Assurance in Ballistic Missile Defense Systems using Scalable, Distributed Data Mining Technology

This work develops Distributed Information Assurance (DIA) system based on the distributed data mining technology. The key capabilities are: ++Multi-agent architecture linking multiple, heterogeneous network-sensors to perform distributed and decentralized analysis of the data, supporting local management of the policy-based control for different sensors. ++Collection of distributed data mining algorithms. ++Module for supporting the complete life-cycle of the information assurance management process in a BMDS including information discovery, linking cross-domain information, policy management, and effective utilization of the knowledge. ++Detect (a) distributed network “signatures” of attackers based on distributed observations from different nodes in the network. (b) attack patterns on different components of the BMDS network in terms of clusters, outliers and also identify statistical properties of attack distribution in order to perform a trend analysis. (c) stealth network probes by attackers and worms (d) insider attacks on the BMDS network. The DIA system will be interfaced with existing third-party network sensors such as network intrusion detection systems (e.g. SNORT), host-based intrusion detection systems (OSSEC), router logs (e.g. CISCO Netflows), network and personal firewalls. ++Web-service based service-oriented architecture for quick intervention from the administrators, distributed collaboration among peers supporting analysis of a threat by allowing case archival and case-based reasoning.