PNNL-13501 - Pacific Northwest National Laboratory

the future. The process that the analyst used to make the
final decision is recorded so that these processes can be
used in an automated manner in future systems.
Researchers have recently concluded that no single
method or algorithm is able to detect all types of
intrusions. Thus, research has shifted from single to
multiple solution methods. This proposed design is
modular and anticipates the required empirical testing for
fine-tuning and expansion.
Most researchers today are trying to directly reach the
“malicious behavior” conclusion with limited success.
Our proposed approach included a three-step process.
The first step included a general-purpose anomaly
detection engine that detects a wide variety of anomalous
behaviors. Upon detection of these anomalous behaviors,
this engine will signal an algorithm engine that will select
one or more enhanced anomaly detection engines to
interrogate new data being supplied based on the type and
source of the first anomaly to discern the type and nature
of the behavior and report the results. The following
block diagram (Figure 2) illustrates this structure.
Another new approach being used is the data metric
selection and collection criteria. Typical anomaly and
Figure 2. Block diagram
150 FY 2000 Laboratory Directed Research and Development Annual Report
intrusion detection systems use audit and system logs. It
is the intent of this design to go directly to the source of
the data—the system memory. In the system memory,
one will have access to all activity on that host, including
all network traffic. Both host and network information is
readily available for analysis.
General Anomaly Detection Engine
The general anomaly detection engine can use algorithms
that have been developed for anomaly detection and/or
intrusion detection. These algorithms tend to produce a
higher incidence of false positive signals, which is a
desired feature in this application. Some of the
algorithms considered are
• artificial neural networks
• SRI International Menlo Park, California, covariance
algorithm
• Carnegie Mellon University, Pittsburgh,
Pennsylvania, algorithms.