CAREER: Adaptive Intrusion Detection Systems

Georgia Tech Research Corporation, Atlanta GA

Investigators

Abstract

Intrusion detection is a critical component of the defense-in-depth network security mechanisms. Current intrusion detection systems (IDSs) are ineffective against new and sophisticated attacks. The key objective of this research project is to develop the algorithms, tools, and system architecture for adaptive IDSs. An adaptive IDS needs to detect new attacks and adjust to changes in normal operations. Towards this end, an information-theoretic based anomaly detection framework is investigated. The approach is to first compute the regularity of normal data using information-theoretic measures, then select features and construct a detection model according to the regularity measures. An adaptive IDS needs to also self-monitor its run-time workload and performance, and dynamically reconfigure its components to provide the best detection capability given the limited resources. Towards this end, performance monitoring, load-shedding, attack scenario analysis, and cost-benefit analysis techniques are investigated. Through the publications and algorithms and tools from this research, researchers and practitioners can learn the benefits and techniques of adaptive IDSs. This research also makes important contributions to related fields, e.g., survivable network systems and smart auditing. Ultimately, the society will benefit from the more effective and robust security mechanisms.