PNNL-13501 - Pacific Northwest National Laboratory

Study Control Number: PN00003/1410
Advanced Anomaly Detection
Brad Woodworth
The Department of Energy needs technology to protect its computer networks and information systems. Neither current
technology nor other options available from the computer security industry offers adequate protection levels for the
security requirements of DOE.
Project Description
Most threats to a data center are from internal sources.
Many commercial and public domain security products
focus on the external threat and detect internal abuse only
as it occurs. These products may indicate that a loss has
occurred thus creating a gap between the internal threat
detection and protection from the threat. This project
explored new, more sensitive methods of anomaly
detection that can decrease or eliminate the gap between
the detection of the internal threat and protection from the
threat. The particularly difficult problem of theft of
sensitive data by “non-network” or “sneaker-net” means
by those with legitimate access to the information has
been viewed as the ultimate application of this work.
This problem may not be solved, but it has been
considered throughout the research process for any
unexpected approaches that may be suited to this
problem. Anomaly detection is a sub-field (CMAD IV
1996; Dean) of intrusion detection. Although anomaly
detection may detect malicious behavior, it may also
detect valid anomalous behavior. This feature of false
positives that has beleaguered prior research will actually
be used as a feature in the design of the advanced
anomaly detection engine described.
Introduction
The current state of commercial products still has a long
way to go before they can adequately address the security
concerns of DOE. The latest systems are now combining
network and host-based intrusion detection techniques
(Shipley 1999). No single system passed all the tests
(Shipley 1999) that were given at the network computing
laboratories. Some government and academic tools are
available but these tools lack the broad coverage of
detection capabilities desired. Insider threats are difficult
to detect (Figure 1).
Figure 1. Malicious activity detection solution spectrum
Approach
The solution proposed for advanced anomaly detection
involves a three-step process.
1. A general anomaly detection engine monitors system
activities and detects when this activity deviates
outside the normal range.
2. Upon detection of anomalous behavior, the general
anomaly detection engine signals an algorithm
decision engine, which selects one or more enhanced
anomaly detection engines for final analysis.
3. The enhanced anomaly detection engine(s) monitor
data harvested from memory and attempts to identify
the type of activity that caused the alarm. The
activities are then characterized as malevolent,
benevolent, or inconclusive.
If the activities are inconclusive, a human analyst will
make the final decision. Once the decision has been
made, this information can be fed back into the general
algorithm and enhanced engines for accurate response in
Computer Science and Information Technology 149