CAREER: Adaptive Intrusion Detection Systems

入侵检测是纵深防御网络安全机制的重要组成部分。针对现有入侵检测系统不能有效抵抗新的、复杂的攻击，本课题的主要研究目标是开发自适应入侵检测系统的算法、工具和系统架构。自适应入侵检测系统需要检测新的攻击，并根据正常操作的变化进行调整。为此，研究了一种基于信息论的异常检测框架。该方法首先利用信息论度量计算正常数据的正则性，然后根据正则性度量选择特征并构建检测模型。一个自适应的入侵检测系统还需要自我监控其运行时的工作负载和性能，并在有限的资源下动态地重新配置其组件以提供最佳的检测能力。为此，研究人员和实践者可以通过出版物、算法和工具来了解自适应入侵检测系统的优点和技术。本研究还在可生存网络系统、智能导航等相关领域做出了重要贡献。最终，社会将受益于更有效和更强大的安全机制。

Intrusion detection is a critical component of the defense-in-depthnetwork security mechanisms. Current intrusion detection systems(IDSs) are ineffective against new and sophisticated attacks.The key objective of this research project is to develop thealgorithms, tools, and system architecture for adaptive IDSs. Anadaptive IDS needs to detect new attacks and adjust to changes innormal operations. Towards this end, an information-theoretic basedanomaly detection framework is investigated. The approach is to firstcompute the regularity of normal data using information-theoreticmeasures, then select features and construct a detection modelaccording to the regularity measures. An adaptive IDS needs to alsoself-monitor its run-time workload and performance, and dynamicallyreconfigure its components to provide the best detection capabilitygiven the limited resources. Towards this end, performance monitoring,load-shedding, attack scenario analysis, and cost-benefit analysistechniques are investigated.Through the publications and algorithms and tools from this research,researchers and practitioners can learn the benefits and techniques ofadaptive IDSs. This research also makes important contributions torelated fields, e.g., survivable network systems and smartauditing. Ultimately, the society will benefit from the more effectiveand robust security mechanisms.