A New Integrated Approach to Intrusion Prevention, Detection, and Response

We propose an innovative combination of artificial intelligence (AI) techniques in the design of a unique system for defensive information warfare. By drawing on our experience developing intrusion detection systems, software agents, and machine learning techniques, we propose to integrate configuration checking tools, an intrusion detection system, and software agents to provide system administrators with a powerful unified computer security tool. Within our system we will utilize model based reasoning, statistical anomaly detection, case based reasoning (CBR), and a number of machine learning techniques. Our tool will be capable of determining system vulnerability based on configuration examination as well as predictive analysis. Further, our system will be capable of detecting a wide range of attacks from a variety of threats (both insider and outsider). Finally, our system will provide software agents as a means for efficient and effective incident handling. The prototype tool developed in our Phase I effort will form the basis for a complete intrusion prevention, detection, and response system for heterogenous networks of computers to be developed in Phase II.