MLIDS, a Machine Learning Intrusion Detection System

High-fidelity simulation environments using Distributed Mission Operations (DMO) may be attacked by enemies wishing to subvert the simulation performance and results. To detect, mitigate, and inoculate against such attacks, ATC-NY, in collaboration with Architecture Technology Corporation and Cornell University Professor Thorsten Joachims, will develop the Machine Learning Intrusion Detection System (MLIDS). We will locate specific features in High Level Architecture (HLA) and Distributed Interactive Simulation (DIS) that prove to be significant when attacks occur, and build HLA and DIS profiles that separate these features’ values into two categories: when attacks take place and when they do not take place. MLIDS will use Support Vector Machines (SVMs), a new learning system based on recent advances in statistical learning theory, to build profiles for HLA and DIS and detect malicious DMO network traffic in real-time. MLIDS will alert the network administrator to abnormal—and hence possibly malicious—traffic in real-time and provide guidance in dealing with attacks. To create MLIDS, the ATC-NY team will develop novel technologies for classifying network intrusions in HLA and DIS simulation environments.