Agent Enabled Advanced Intrusion Detection System

Current commercial Intrusion Detection Systems (IDS) have several major shortcomings. These include low detection rates of 20 percent or less, the inability to detect previously unseen or new attacks, and high false alarm rates. Frequent false alarmsoften prompt Computer Network Defense (CND) operators to disable or disregard sensor warnings. Current IDS are also inflexible, because of their monolithic design, and non-adaptable, new sensor capabilities cannot be added without rebuilding the IDS.Innovative approaches are required to provide a new generation of flexible, scalable, high quality Intrusion Detection Systems to overcome existing shortfalls.Sentar proposes to leverage ongoing NSA and DARPA research to develop an Agent-Enabled Advanced Intrusion Detection System to protect the GMD network against attacks. The proposed architecture combines DARPA's advanced intrusion detection techniques withSentar's previous work in intelligent agents which combines intelligent agents, statistical anomaly detection, and model-based profiles to provide high attack detection rates (up to 80 percent), the ability to detect previously unknown attacks, andacceptable false alarm rates. The overall result will be a user friendly, flexible infrastructure capable of rapidly adapting new intrusion detection capabilities to enable GMD security managers to stay out in front of the growing and ever-changing cyberthreat. The commercial potential for advanced intrusion detection systems is extensive. Virtually every company in the U.S. relies on the Internet to conduct business. Because of the growing and ever changing threat posed by hackers and malicious insiders,commercial companies need high quality, state of the art, low cost advanced intrusion detection protection. In addition to government applications, potential application areas include eCommerce, logistics, business operations, transportation, supply chainmanagement, and entertainment.