Anomaly Detection Techniques to Detect Malicious Intruders

MDA is searching for innovative virtual software solutions that provide measures of cyber security to take offensive and defensive measures in protecting and defending information, computers, and networks from disruption, denial of service, degradation, or destruction. Among the applications and technologies that MDA is seeking are those that can detect malicious intruders. This difficult to address threat must be handled by techniques that facilitate early and accurate detection and characterization of such threats by determining the differences between normal and abnormal user behavior. For this effort, we propose to implement technologies and services that utilize neural-networking concepts to detect anomalies within enterprise networks that stem from malicious insider threats. A further objective of this effort will be to ensure that our solution works with existing Commercial Off-The-Shelf and Government-Off-The-Shelf tools used to manage and analyze information management environments. This Phase I effort will develop a neural network technology for the detection of anomalies associated with malicious insider threats and demonstrate its use in a testbed environment. The Neural Network's Phase I development will consider both various encoding schemes and neural network architectures to train the network under "normal" conditions and detect emulated threats when hosted in our testbed environment