International Collaboration Project on Information Security Item 6 - Realization of High Speed IDS Expert System and Privacy-preserving Information Protection Management System Yeali S. Sun (孫雅麗) Department of Information Management National Taiwan University

Outline Goals of the Project Major tasks and expected outcomes from International Collaboration Manpower and budget expense Key performance indicators and review points

Realization of High Speed IDS Expert System Motivation The methods of IDS are ad hoc, and generally independently to each other, that are ideally suited for expert system approach. However, expert system approach is aiming for problem solving, not for efficient processing. There is a need to realize IDS expert system for high speed network environment. Network forensics Software-based IDS System For higher-speed links (gigabit and higher) hardware accelerators must be integrated into IDS systems, to process packets in real-time (or near real-time). Hardware-software co-design IDS.

Realization of High Speed IDS Expert System Objectives Collect known IDS methods to design IDS expert system. Design a method and system to translate IDS expert system into intermediate representation Design a pseudo machine with built-in stateful protocols (as finite state machines) to efficiently execute the intermediate result Realize the pseudo machine in an embedded system utilizing special hardware

Privacy-preserving information security and risk management Motivation Information privacy relates to an individual's right to determine how, when, and to what extent personal information will be released to another person or organization. trade-off between the need for data sharing and distribution, and the right of individuals to regulate the release of their personal information. The impacts are at all levels from personal to enterprise/institutional to national. The risks involved need to be analyzed and corresponding risk management models developed. Relevant research topics include access control, information filtering and transparency, data mining, data integration, data authentication, and models for anonymity and unobservability and so on.

Privacy-preserving information security and risk management: Key technical strategies Selective Revelation a method for minimizing exposure of individual information while enabling continuous analysis of potentially interconnected data Strong Audit a tamper-resistant method that identifies where data goes and who has seen it Rule Processing Technologies that guide how data from multiple sources with potentially different privacy constraints can be processed

Privacy-preserving information security and risk management: Objectives Theoretical Privacy-preserving models, encryption techniques Risk analysis and risk management model Centralized multi-layered access/permission control model Extended to distributed multi-layered access/permission control Target application context In use in health care / home care industries, business enterprises, e-commerce, and national security System System architecture (enterprise architecture) and middleware development Software system implementation, efficient algorithms development .net and Java programming

International Collaborations Realization of High Speed IDS Expert System With Professor Hui Zhang of CMU UCB Ph.D.(1996), ACM Fellow(2005) Privacy-preserving Information Protection Management System With Prof Doug Tygar of UCB Planned Activities (2006) Personnel Exchange Ph.D. students will stay at collaborators’ labs PI Visiting

Manpower Functional Position Name Affiliation Title PI Yeali S. Sun Dept. of  Information Management National Taiwan University Professor CO-PI T-C Chou Meng Chang Chen Institute of Information Science Academia Sinica Associate Research Fellow Full-time Research Assistant (Master Degree Two persons TBD Part-time Research Assistant (Ph.D Student) Five persons Part-time Research Assistant ( Master Student)

Budget Expense for the First Year Item List Budget Amount Percentage 1. Personnel Expense 3,315,000 70.2% 2. Equipment Expense 250,000 5.3% 3. Travel Expense （International Conference, etc) 240,000 5.1% 4. International Collaboration Expense 733,800 15.5% 5. Operation Expense 183,400 3.9% 6. Overhead 377,800 8% Total Amount 5,100,000

Review Points of the first year Check No. Period Descriptions 1 6th month Implementation of the interpreter to generate automatically object code for FSM . 2 Complete privacy-preserving information protection models 3 10th month Implementation of flow/connection classifiers and state manager 4 Complete centralized multi-layered access/permission control model 6 12th month Prototype system and algorithms development of risk management 7 Submit papers to related international conferences

Thank you! Q&A