Statistically Based Network Intrusion Detection

Project Summary

Many intrusion detection systems are based on signature checking. This approach is not effective for insider attacks which are often the most harmful. Our approach is based on comparing the statistical behavior of intruder and privileged users.

Our research provided several solutions for addressing these problems. First, we made fundamental advances in the study of anonymous routing for the Internet so as to increase the privacy available to honest citizens as they rely on the Internet for personal and commercial transactions. We increased the ability of law enforcement to locate the source criminal activities on the net hidden by anonymous routing technology by identifying an attack that works on all known anonymous protocols and determined the amount of resources to break each protocol. Second, we made fundamental progress on host-based intrusion detection systems to alert administrators of system break-ins and malware propagation modeling to track and evaluate the threat posed by virus, worms, and similar attacks. Finally, we made fundamental progress on secure ad hoc routing protocols, which create routers between wireless devices (such as 802.11). Ad hoc networking is playing an increasingly important role in the deployment of 802.11 networks.

• Project Lead: Weibo Gong (U of Mass)