Active Filtering and Adaptive Reconfiguration Technologies for Real Time Intrusion Detection in High Speed Data Streams

The overall objective of the proposed Phase II effort is thedevelopment and evaluation of a Reconfigurable Intrusion DetectionSystem (RIDS) for real time operation in high-speed data streams(OC-12 and above). The Phase I effort developed and validated acomprehensive cost model for designing real time intrusion detectionsystems, which capture the design trade-offs involving thecomputational time of the detection rules, the accuracy of the rules,the hostility level of the environment and the damage costs/falsealarm costs of the attacks. The development of RIDSs in Phase IIcombines: (1) advances in algorithm design centered on optimizationtheory, allowing for the adaptive reconfiguration of the intrusiondetection rule sets; (2) the ability of performing firewall-likeactions (active filtering) based on the cost model; (3) communicationwith SNMP-based Network Management Systems (NMSs), for exchange ofparameters related to the cost model; (4) hardware implementation foroperation at Gigabitps speeds. Georgia Tech will provide support inalgorithm design and evaluation at the 100 Mbitps range. MCNC willlead the project tasks related to demonstrating the scalability of thealgorithms into the OC-12 and above range. Aprisma ManagementTechnologies (manufacturer of the SPECTRUM NMS suite) will support theintegration and commercialization of the Reconfigurable IntrusionDetection System and the SPECTRUM NMS suite.Protecting institutional networks from attacks accounts for about 25billion US dollars each year. It is estimated that 95 percent of theDoD communications pass through the National InformationInfrastructure (NII) at some point. The proposed technology has thepotential to provide the NII with a robust, real time defense lineagainst general classes of security violations against its backboneand high-speed links.