PCA-based Network Intrusion Detection and Health Monitoring

The basic innovation herein proposed exploits Principal Component Analysis (PCA) to reduce the dimensionality of trace data, and to represent the data in a reduced dimensional feature space. From previous work, we believe that normal and abnormalbattlespace network activities will form clusters in that space which we can identify. Furthermore, we expect that the trajectory of the computing activity through the feature space will allow comparison with normal trajectories to further identifyanomalies. Our approach will enable a much larger variety of values which represent ongoing activities in an information system to be used for intrusion detection than have been used by other researchers. While it is relatively obvious that using moredata to represent the ongoing activities of a computer is probably better than less data from the point of view of detecting intruders, using more data also causes problems in determining how to draw conclusions, especially for data which is often notnumeric. Also, to be maximally effective in protecting information, intrusion and other anomaly detection should be near real-time, and using more data suggests that the resulting intrusion detection will become slower and require off-line processing.Our approach solves both these problems. Our approach to commercializing the results of this work will be to make the code available through an Open Source license. While this will give the code away, it will be an ideal way to obtain consulting contractsto help optimize the code for specific customers, and once there is a significant user base, we can then sell modules offering new capabilities which are compatible with the base system.