ITR: Integrating Intrusion Detection with Intelligent Visualization and Interaction Strategies

该项目的总体目标是通过将入侵检测与可视化和智能交互策略相结合来开发新的入侵检测技术。 由此产生的系统允许用户容易地监视底层入侵检测系统（IDS），如果它不能检测到潜在的攻击，识别和解决攻击，并更新与攻击配置文件的IDS，以便将来发生的事件将被正确地报告。 该项目的预期贡献包括（1）利用人类知识和判断的交互式入侵检测算法，（2）支持快速，准确和有效监控潜在攻击的可视化和交互技术，（3）半-自动化工具，用于构建和评估攻击概况，以扩展入侵检测系统的功能。本项目的研究提供了我们对如何检测和防止网络入侵的理解有了重大进展。我们希望在许多方面取得重大突破，包括（1）自动识别复杂入侵尝试的新方法，（2）利用人类观察者独特的分析才能来增强和扩展自动IDS响应新的或意外攻击的能力的新技术，以及（3）允许自动检测算法通过向用户学习来不断改进的新方法。 此外，我们正在使用的多学科方法提供了显着的好处，使入侵检测的问题解决过程的访问和提供给非专家。 结合可视化和某种程度的智能辅助的交互式系统对学生甚至是普通计算机用户都非常有吸引力，为探索和进一步学习该主题提供了平台。 由于对入侵和适当对策领域的兴趣日益增加，这项工作的影响将广泛地感受到。这项研究将导致改进的入侵检测技术，从而大大提高计算机和网络安全。

The overall objective of this project is to develop new intrusion detection techniques by integrating intrusion detection with visualization and intelligent interaction strategies. The resulting system allows a user to easily monitor an underlying intrusion detection system (IDS), intercede if it fails to detect potential attacks, identify and address attacks, and update the IDS with attack profiles so that future occurrences will be properly reported. The expected contributions of this project include (1) interactive intrusion detection algorithms that capitalize on human knowledge and judgment, (2) visualization and interaction techniques that support rapid, accurate, and effective monitoring of potential attacks, and (3) semi-automated tools for constructing and evaluating attack profiles to extend the capabilities of an intrusion detection system.Research in this project offers the potential for significant advances in our understanding of how to detect and prevent network intrusions. We expect to make important breakthroughs on a number of fronts, including (1) new methods to automatically identify sophisticated intrusion attempts, (2) new techniques that harness a human observer's unique analysis talents to augment and extend an automated IDS's ability to respond to new or unexpected attacks, and (3) new approaches that allow automated detection algorithms to continually improve by learning from their users. Moreover, the multidisciplinary approach we are using offers the significant benefit of making the problem-solving processes of intrusion detection accessible and available to non-experts. Interactive systems that incorporate visualization and some degree of intelligent assistance can be very appealing to students and even casual computer users, providing a platform for exploration and further learning about the topic. Due to growing interest in the area of intrusion and appropriate countermeasures, the impact of this work will be broadly felt. The research will lead to improved techniques for intrusion detection, and thus to significantly enhanced computer and network security.