Intelligent network survivability tools

点击翻译按钮获取中文摘要

Most medium and large-scale network infrastructures include multiple high-speed connections to the Internet and support many customer collaborative networks; thousands of internal users and various web servers. Many of these systems are faced with an ever-increasing likelihood of unplanned downtime due to various attacks and security breaches. In order to adequately protect these networks there is a critical need to be able to deliver systems that can automatically detect intrusion patterns and performance bottlenecks, and automatically defend themselves. Due to the exponential growth in size, distribution, and complexity of communication networks, current intrusion detection/prevention technologies are not very effective against new attacks and have severe limitations as far as performance, scalability, and flexibility are concerned. Moreover, the improvements to these systems are often too slow and too little to keep up with the innovations by the attackers. The main drawbacks of the current intrusion detection systems are: 1) the large number of false positives; 2) the inability to detect unknown attacks; and, 3) the inability to properly assess the relative danger of the misuse and provide an appropriate response. There is a general consensus that the primary focus of the intrusion detection technologies must be: a) to reduce the rate of false positives; b) to develop non-signature-based intrusion detection methods; and, c) work on prevention instead of detection. The primary objective of our research work is to identify a bank of models/tools/techniques that are well suited to address the above shortcomings. We will focus on developing: 1) algorithms for automatically detecting anomalies in flow or event streams; 2) automated rules tuning, learning and adaptation; 3) alert correlation and creation of graphs for multi-stage attacks; 4) automatic discovery of network applications; and, 5) simulation of network attacks. A tool which allows simulation of attacks and `what-if' and `did you know' scenarios to identify security loopholes and assess preparedness, and is of great interest to network administrators.