SBIR Phase II: Global Correlation Service for Network Security Applications

This Small Business Innovation Research Phase II project is directed toward fulfilling the need of business and Government organizations to more effectively monitor and protect their electronic networks. Network security devices (NSDs) such as Anti-virus, Intrusion Detection/Prevention, spam/phishing filtering, and bandwidth anomaly detection systems have become an integral part of our networks as they provide invaluable services in maintaining data integrity and confidentiality, while protecting the availability of computing resources. This research aims at significantly increasing the timeliness, accuracy and cost-effectiveness of NSDs in combating fast-changing and ever-more sophisticated network security attacks. The programming and maintenance of NSDs is today a very significant obstacle to their wider adoption. The most common and significant complaints of existing NSDs users are (1) excessive amounts of false positive events (events that should not be generated) and the difficulty in analyzing security events (2) their extreme sensitivity to the timeliness of the security updates to catch emerging threats and (3) the expertise required in the installation, maintenance and operation of these systems. These obstacles limit adoption by many smaller companies that cannot afford to hire expert system administrators and network security analysts. MetaFlows seeks to capitalize on these deficiencies by providing ways to outsource this complexity. If successful, this research effort will inexpensively and thoroughly improve the manageability, accuracy and return on investment of many existing NSDs.