ITR: Integrating Intrusion Detection with Intelligent Visualization and Interaction Strategies

ITR：将入侵检测与智能可视化和交互策略集成

• 批准号: 0219315
• 负责人: Peng Ning
• 金额: $ 41.51万
• 依托单位: North Carolina State University
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2002
• 资助国家: 美国
• 起止时间: 2002-09-15 至 2006-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0219315&HistoricalAwards=false
• 关键词: ITR; Integrating; Intrusion; Detection; Intelligent

The overall objective of this project is to develop new intrusion detection techniques by integrating intrusion detection with visualization and intelligent interaction strategies. The resulting system allows a user to easily monitor an underlying intrusion detection system (IDS), intercede if it fails to detect potential attacks, identify and address attacks, and update the IDS with attack profiles so that future occurrences will be properly reported. The expected contributions of this project include (1) interactive intrusion detection algorithms that capitalize on human knowledge and judgment, (2) visualization and interaction techniques that support rapid, accurate, and effective monitoring of potential attacks, and (3) semi-automated tools for constructing and evaluating attack profiles to extend the capabilities of an intrusion detection system.Research in this project offers the potential for significant advances in our understanding of how to detect and prevent network intrusions. We expect to make important breakthroughs on a number of fronts, including (1) new methods to automatically identify sophisticated intrusion attempts, (2) new techniques that harness a human observer's unique analysis talents to augment and extend an automated IDS's ability to respond to new or unexpected attacks, and (3) new approaches that allow automated detection algorithms to continually improve by learning from their users. Moreover, the multidisciplinary approach we are using offers the significant benefit of making the problem-solving processes of intrusion detection accessible and available to non-experts. Interactive systems that incorporate visualization and some degree of intelligent assistance can be very appealing to students and even casual computer users, providing a platform for exploration and further learning about the topic. Due to growing interest in the area of intrusion and appropriate countermeasures, the impact of this work will be broadly felt. The research will lead to improved techniques for intrusion detection, and thus to significantly enhanced computer and network security.

该项目的总体目标是通过将入侵检测与可视化和智能交互策略相结合来开发新的入侵检测技术。由此产生的系统允许用户轻松地监视底层入侵检测系统(IDS)，在它未能检测到潜在攻击时进行干预，识别并解决攻击，并使用攻击配置文件更新IDS，以便正确地报告未来发生的事件。这个项目的预期贡献包括(1)利用人类知识和判断的交互式入侵检测算法，(2)支持快速、准确和有效地监控潜在攻击的可视化和交互技术，以及(3)用于构建和评估攻击配置文件的半自动工具，以扩展入侵检测系统的能力。该项目的研究为我们理解如何检测和防止网络入侵提供了潜在的重大进展。我们希望在许多方面取得重要突破，包括(1)自动识别复杂入侵企图的新方法，(2)利用人类独特的分析天赋来增强和扩展自动入侵检测系统响应新的或意外攻击的能力的新技术，以及(3)允许自动检测算法通过向用户学习而不断改进的新方法。此外，我们正在使用的多学科方法提供了显著的好处，使入侵检测的问题解决过程可供非专家访问和使用。包含可视化和某种程度的智能辅助的交互式系统对学生甚至临时计算机用户非常有吸引力，为探索和进一步了解这一主题提供了一个平台。由于对入侵和适当对策的兴趣与日俱增，这项工作的影响将被广泛感受到。这项研究将改进入侵检测技术，从而显著提高计算机和网络的安全性。