ITR: Integrating Intrusion Detection with Intelligent Visualization and Interaction Strategies

North Carolina State University, Raleigh NC

Investigators

Abstract

The overall objective of this project is to develop new intrusion detection techniques by integrating intrusion detection with visualization and intelligent interaction strategies. The resulting system allows a user to easily monitor an underlying intrusion detection system (IDS), intercede if it fails to detect potential attacks, identify and address attacks, and update the IDS with attack profiles so that future occurrences will be properly reported. The expected contributions of this project include (1) interactive intrusion detection algorithms that capitalize on human knowledge and judgment, (2) visualization and interaction techniques that support rapid, accurate, and effective monitoring of potential attacks, and (3) semi-automated tools for constructing and evaluating attack profiles to extend the capabilities of an intrusion detection system. Research in this project offers the potential for significant advances in our understanding of how to detect and prevent network intrusions. We expect to make important breakthroughs on a number of fronts, including (1) new methods to automatically identify sophisticated intrusion attempts, (2) new techniques that harness a human observer's unique analysis talents to augment and extend an automated IDS's ability to respond to new or unexpected attacks, and (3) new approaches that allow automated detection algorithms to continually improve by learning from their users. Moreover, the multidisciplinary approach we are using offers the significant benefit of making the problem-solving processes of intrusion detection accessible and available to non-experts. Interactive systems that incorporate visualization and some degree of intelligent assistance can be very appealing to students and even casual computer users, providing a platform for exploration and further learning about the topic. Due to growing interest in the area of intrusion and appropriate countermeasures, the impact of this work will be broadly felt. The research will lead to improved techniques for intrusion detection, and thus to significantly enhanced computer and network security.