Multiple INtrusion detection FUsion Learning (MINDFUL)

To limit the damage from cyber attacks, Computer Network Defense (CND) managers need real time, high quality intrusion detection. However effective any of the current IDSs may be individually, they are not infallible across an operational scenario that is dynamic. Since the underlying constructs differ from one IDS to the next, it is unlikely that failures of different IDSs will be consistently congruent or simultaneous. It is therefore advisable to synergistically exploit the non-congruent capabilities of multiple IDSs through utilization of information fusion. To make quantum advancements in intrusion detections, Sentar proposes the Multiple INtrusion Detection FUsion Learning (MINDFUL) system. The MINDFUL system will implement a Decision In-Decision Out (DEI-DEO) mode of fusion that learns the fusion logic from the environment without having to have an externally pre-defined fusion rule imposed by the designer. Further, we envisage the learning of the fusion rules as a non-iterative process that permits adaptive relearning in the operational phase on an ongoing basis with potential for near real time update for the fusion rules. Our proposed MINDFUL system will be designed with a flexibility and adaptability while minimizing processing time so as to accommodate real time system constraints.