ONR MURI area: High Confidence Real-Time Misuse and Anomaly Detection Intrusion and Anomaly Detection in Network Traffic Streams: Checking and Machine Learning Approaches ONR MURI area: High Confidence Real-Time Misuse and Anomaly Detection

Framework and System Architecture for Anomaly and Intrusion Detection Sampath Kannan Insup Lee Oleg Sokolsky Wenke Lee Diana Spears William Spears Linda Zhao

Overview Our approach is based on integration of a variety of anomaly and intrusion detection techniques A uniform mechanism and architecture is needed to support the integration Requirements: Flexibility Transparency Efficiency

MaC-based IDS

Background: MaC system MaC has been designed for run-time verification of software systems Main features: Checker decoupled from the system Event recognizer extracts relevant events from input stream Impact on reduced checking overhead

Background: MaC architecture

MaC extensions for IDS Multiple specification languages Dynamic property adjustment Checking of probabilistic properties

Integration architecture Unsupervised learner Cluster identification routines provide new detection rules Supervised learner Logistic regression modeling Tree-based algorithms Support vector machines

Integration architecture