Mining Extant Security-Relevant Information to Yield GIG Situational Awareness and Actionable Intelligence

Mining information produced by network and security devices is a vital component of any security operation. Over the years number of security devices and network services/devices that spit out information has significantly increased. Unfortunately, the methods to mine this data to extract meaningful information has remained unchanged, mostly focusing on intrusion detection systems and firewalls. The use of correlation of fusion of alerts usually yields no useful information about a network or the state of hosts that make a network. We focus on two major goals. First, we will focus on methods to identify the roles-of-hosts in a network using the normalized data source. Out of lot of noisy entries running this algorithm will classify hosts into a variety of categories, such as workstations, web servers, DNS servers, NATs, etc. Secondly, we will create heuristics and algorithms to detect zombies in large networks using the data source. This algorithm will be able to identify zombie-like behaviors within a network which can then be verified out of band. In both algorithms will also work on on-line mode for streaming data so that security personnel can monitor change of behavior of a host in real-time.