CAREER: A Networking Approach to Host-based Intrusion Detection

职业：一种基于主机的网络入侵检测方法raheem A. BeyahGeorgia State university获奖摘要随着时间的推移，对网络基础设施的威胁变得越来越复杂，作为回应，防御机制也变得越来越复杂。保护节点的一种方法是在节点上放置防御机制（例如，入侵检测系统）。这带来了许多挑战，最重要的是防御机制中的潜在漏洞可以提供一个额外的途径，通过这个途径可以危及主机。为了应对这些挑战，本研究调查了与主机完全解耦的防御机制，同时继续提供关于恶意活动的见解，就好像防御机制驻留在主机上一样。这需要开发新的算法和应用各种技术（例如，统计、机器学习、信号处理）来从节点中提取数据。能够推断其硬件组件状态的S网络流量特征。在这个项目的过程中，实验和模拟的结合将导致经验和分析模型的发展。这些模型将用于开发基于网络的防御系统，提供与传统上被认为是基于主机的机制类似的能力。这项工作利用信息泄漏的概念来连接计算机体系结构、计算机网络和网络安全领域。该项目还寻求扩大传统上在科学、技术、工程和数学（STEM）领域代表性不足的群体的参与。因此，通过暑期学院，PI正在积极吸引代表性不足的中学生，利用当前的技术来传达抽象的计算机结构和计算机网络概念。

CAREER: A Networking Approach to Host-based Intrusion DetectionProposal# 0844144Raheem A. BeyahGeorgia State UniversityAward AbstractDay by day, threats to the cyber infrastructure are becoming more complex and, in response, so too are defense mechanisms. One approach to securing nodes is to place a defense mechanism (e.g., intrusion detection system) on the node. This brings many challenges, with the most significant being that potential vulnerabilities in the defense mechanism can provide an additional avenue through which the host can be compromised. To address these challenges, this research investigates completely decoupling the defense mechanisms from the host, while continuing to provide insight about malicious activity as if the defense mechanisms resided on the host. This requires the development of new algorithms and the application of various techniques (e.g., statistical, machine learning, signal processing) to extract from a node?s network traffic characteristics that enable the inference of the state of its hardware components. Over the course of this project, a combination of experimentation and simulation will lead to the development of empirical and analytic models. The models will be used to develop network-based defense systems that provide capabilities similar to those provided by mechanisms traditionally considered host-based. This work leverages the concept of information leakage to bridge the computer architecture, computer networking, and network security fields. This project also seeks to broaden participation of groups traditionally underrepresented in the areas of science, technology, engineering, and mathematics (STEM). Accordingly, through a summer academy, the PI is actively engaging underrepresented middle school students by using current technology to convey abstract computer architecture and computer networking concepts.