Intrusion Detection and Security Management Technologies for Early Warning and Response to Computer Attacks Against Mobile Networks

The overall objective of the proposed Phase II effort is thedevelopment and evaluation of AWARENET (Advance WArning and REsponseNETwork) system, an intrusion detection and security managementinfrastructure for providing early warning and automated response tocomputer attacks against MANETs (Mobile Ad-Hoc Networks). AWARENET isa network of Intrusion Detection System (IDS) agents placed at thenodes of a MANET. The agents detect intrusions using local information(autonomous detection), exchange information to detect attacks againstthe network infrastructure (cooperative detection), and correlatelocal detections with suspicious activities (proactive detection) inorder to extract the attack signatures and identify the roguenodes. Phase I has demonstrated the validity of the approach fordetecting and responding to selective packet dropping and denial ofservice attacks against MANETs. Further development and evaluation ofAWARENET in Phase II includes: (1) the development of a hierarchicalsecurity management protocol for IDS agent communication; (2) theintegration of signature-based and anomaly-based detectors forincreased detection accuracy; (3) demonstration of the concept on anetwork of COTS PDAs. Northrop Grumman Information Technology willsupport the transition of the detection algorithms and communicationprotocols to the PDA environment and support the commercialization ofAWARENET. Prof. Wenke Lee from Georgia Tech and Prof. Suresh Singhfrom Portland State University will be consultants in Data Mining,Mobile Computing, and Computer Security.At the defense side, mobile technology is crucial for the Army in the21st century. For the commercial market side, the wireless LAN marketalone is expected to be a 5 billion dollars market by 2005. The proposedtechnology provides a much needed early warning capability forcomputer attacks against mobile networks. The homeland defense marketis also developing rapidlyand will require this capability.