Item 4 - Intrusion Detection and Prevention Yuh-Jye Lee Dept. of Computer Science and Information Engineering National Taiwan University of Science and Technology International Collaboration Project on Information Security

2 Goals of the Project  Bring rich research results into local communities and stimulate further research in related fields  Our target cooperation is the Center for Automated Learning and Discovery (CALD) in Carnegie Mellon University  Implement in a concrete structure and transfer the experience to local industries  Aim to publish research results in top international conferences and journals

3 Major Tasks of International Collaboration  Constructing a honey pot system to acquire typical benchmarks for system training and test  Tracking the intruders to find a complete pattern of attacks  Developing a robust prototype system for intrusion detection and prevention  Designing metric(s) to objectively evaluate an intrusion detection system (IDS)

4 Why Machine Learning Approach and CALD? Machine Learning has been shown an important approach in computer security research Machine Learning has been shown an important approach in computer security research The Journal of Machine Learning Research (JMLR) recently calls for paper of a special issue on Machine Learning for Computer Security The Journal of Machine Learning Research (JMLR) recently calls for paper of a special issue on Machine Learning for Computer Security What is CALD? The Center for Automated Learning and Discovery (CALD) is an academic department within Carnegie Mellon University's School of Computer Science. CALD focuses on research and education in all areas of statistical machine learning. What is CALD? The Center for Automated Learning and Discovery (CALD) is an academic department within Carnegie Mellon University's School of Computer Science. CALD focuses on research and education in all areas of statistical machine learning.

5 Collaboration Scholar Dr. Maxion has a distinctive contribution in Information Security 、 intrusion detection 、 anomaly detection He also published several intrusion detection related conference and journal papers in International Conference on Dependable Systems & Networks (DSN) 、 IEEE Transactions on Reliability 、 International Symposium on Recent Advances in Intrusion Detection (RAID) 、 International Symposium on Fault-Tolerant Computing Dr. Maxion important projects in IDS: Constellation: Scalable Metrology to Support Theory and Practice of Anomalous-Event Detection Profiler-2000: The objective of the Profiler-2000 project is to improve detection performance by: Developing a basic science of profiling, Developing a diverse suite of detectors, Providing custom, calibrated test beds, Providing statistically and methodologically rigorous assessment procedures.

6 Collaboration Scholar There still are many outstanding researchers in Information Security as well as Machine Learning areas in CALD There still are many outstanding researchers in Information Security as well as Machine Learning areas in CALD Dr. Tom Mitchell Fredkin Professor of AI and Learning Director, Center for Automated Learning and Discovery School of Computer Science Carnegie Mellon University Recent Research (Selected) -"Bayesian Network Learning with Parameter Constraints," R.S.Bayesian Network Learning with Parameter Constraints Niculescu, T.M. Mitchell, R.B. Rao, Journal of Machine Learning Research, to appear 2006 Dr. Yiming Yang Professor of Language Technologies Institute and Center for Automated Learning and Discovery at the School of Computer Science of Carnegie Mellon University Recent Research (Selected) -Yiming Yang, Shinjae Yoo, Jian Zhang and Bryan Kisiel. Robustness of Adaptive Filtering Methods in a Cross- benchmark Evaluation. In the 28th Annual International ACM SIGIR Conference (SIGIR 2005), Brazil, 2005

7 Manpower & Budget Position Title Projected Number Professor6 Research Assistant 1 Ph.D Student 2 Master Student 6 Total manpower for the first year is 16 researchers

8 Team Members Functional Position NameAffiliation Professional Title Project Leader Hahn-Ming Lee Dept. of Computer Science and Information Engineering (CSIE), National Taiwan University of Science and Technology (NTUST) Professor Project Co-Leader Yuh-Jye Lee Dept. of CSIE, NTUST Assistant Professor Project Co-Leader Cheng-Seen Ho Hwa Hsia Institute of Technology Principal Associate Project Leader Yuan-Cheng Lai Dept. of Information Management, NTUST Associate Professor Associate Project Leader Hsing-Kuo Pao Dept. of CSIE, NTUST Assistant Professor Associate Project Leader Yi-Leh Wu Dept. of CSIE, NTUST Assistant Professor

9 Team Members (Cont.) Functional Position NameAffiliation Professional Title Full-time Research Assistant (Master Degree) One person TBD Part Time Research Assistant (Ph D. Student) Two persons TBD Part Time Research Assistant (Master Student) Six persons TBD

10 Budget Expense for the First Year (unit ： thousands in NT dollar ） Budget Expense for the First Year (unit ： thousands in NT dollar ） Item List Budget Amount Percentage Personnel Expense 2,377, % Travel Expense （ Int ’ l Conference, etc ） 400,0008.5% International Collaboration Expense (8 man-month) 719, % Operation Expense 725, % Equipment Expense 500, % Overhead377,8008% Total Amount 5,100,000

11 Key Performance Indicators for Expected Outcomes and Review Points Research Result Technical Report 1 International Conference Paper 1 Build the kernel of intrusion detection system Construct a honey pot to collect data and to analyze the behavior of intrudersNo.Date Description of Check Point 195/09 Construction of a Honey Pot to collect hackers’ behavior 295/12 Collection of Intrusion related data for future evaluation, and development of statistic- based IDS techniques

12 Proposed Project Schedule Schedule : Report generated 1. Identify and select the research topics XXXX1XX 2. Collect and analyze related research papers and prototypes XXXXX X2 + 3.Build research environment and learn necessary skills XXXX 4.Send researchers to work with CMU scholars on site XXX3+ 5. Construct honey pot system, and IDS kernel technology XXX4+ Work Complete Percentage( ％ ) 40 % 80 % 100 %

13 Thank you! Q&A