CAREER: Adaptive Intrusion Detection Systems

入侵检测是网络纵深防御安全机制的重要组成部分。当前的入侵检测系统（ids）对新的和复杂的攻击是无效的。本研究项目的主要目标是开发自适应入侵防御系统的算法、工具和系统架构。非自适应IDS需要检测新的攻击，并根据异常操作的变化进行调整。为此，研究了一种基于信息理论的异常检测框架。该方法首先利用信息论度量计算正常数据的规律性，然后根据规律性度量选择特征并构建检测模型。自适应IDS还需要自我监视其运行时工作负载和性能，并动态地重新配置其组件，以便在有限资源的情况下提供最佳检测功能。为此，研究了性能监控、负载减少、攻击场景分析和成本效益分析技术。通过本研究的出版物、算法和工具，研究人员和从业者可以了解自适应入侵防御系统的好处和技术。本研究对可生存网络系统、智能审计等相关领域也有重要贡献。最终，社会将受益于更有效、更健全的安全机制。

Intrusion detection is a critical component of the defense-in-depthnetwork security mechanisms. Current intrusion detection systems(IDSs) are ineffective against new and sophisticated attacks.The key objective of this research project is to develop thealgorithms, tools, and system architecture for adaptive IDSs. Anadaptive IDS needs to detect new attacks and adjust to changes innormal operations. Towards this end, an information-theoretic basedanomaly detection framework is investigated. The approach is to firstcompute the regularity of normal data using information-theoreticmeasures, then select features and construct a detection modelaccording to the regularity measures. An adaptive IDS needs to alsoself-monitor its run-time workload and performance, and dynamicallyreconfigure its components to provide the best detection capabilitygiven the limited resources. Towards this end, performance monitoring,load-shedding, attack scenario analysis, and cost-benefit analysistechniques are investigated.Through the publications and algorithms and tools from this research,researchers and practitioners can learn the benefits and techniques ofadaptive IDSs. This research also makes important contributions torelated fields, e.g., survivable network systems and smartauditing. Ultimately, the society will benefit from the more effectiveand robust security mechanisms.