Early Warning and Response for Computer Attacks Against Mobile Networks

The overall objective of the effort (Phases I and II) is todevelop and evaluate a methodology for the early detection andresponse of computer attacks against mobile networks. The key elementsare: (1) Development of temporal attack models for mobile networks --We follow the NEWS (Network Early Warning System) approach introducedby Northrop Grumman Information Technology (NGIT) characterizingcomputer attacks as a sequence of temporally evolving stages. Earlywarning is achieved through the ready identification of the earlystages. SSCI's Proactive Intrusion Detection scheme will be used forthe automatic extraction of features containing early precursors; (2)Fusion of features -- Attack stages will be characterized by thecombination of features collected at multiple nodes and protocollevels; (3) Utilization of Network Management Systems (NMSs) -- COTSNMSs will be customized to gather relevant features; (4)Proposition of courses of action -- Courses of action willbe proposed, following early detection. NGIT will serve as asubcontractor, supporting SSCI in the integration of NEWS with SSCI'sProactive Intrusion Detection technology. Aprisma Inc. (manufacturerof SPECTRUM) will provide consulting in network management. Prof.Wenke Lee from Georgia Tech will be a consultant in ComputerSecurity. Phase I effort will support the development of a MobileNetwork Protection Toolkit centered on COTS NMSs in Phase II. At the defense side, mobile technology is crucial for the Army in the21st century. At the commercial side, the wireless LAN market alone isexpected to be a 5 billion dollars market by 2005. The proposed technologyprovides a much needed early warning capability for computer attacksagainst mobile networks.