PNNL-13501 - Pacific Northwest National Laboratory

The second goal was to research ways to reduce the
massive data logs that need to be reviewed by experts for
detecting unusual events or compromises for which there
is currently no signature. New concepts for log
presentations will be created using multidimensional
representations. Network packet data will be vectorized
by mapping the packet meta data into three dimensions
with source, destination intellectual property, and port
numbers and time constituting the major axis. A unique
clustering algorithm, which had already been developed,
will dynamically convert and map Internet protocol
addresses to “x” and “y” coordinate pairs while
preserving network topological relationships. This
approach will allow the display of current and historical
network traffic data. Most intrusion detection sensors
systems today work only on single packets or a small
window of packets. The interactive network traffic
modeling model will collect and preserve session data
(collections of packets) that will allow the opportunity to
detect the “low and slow” attacks which confound most
intrusion detection sensors systems that are available
today.
Last, the analysis techniques used for providing visual
representation will also serve as a provider of updated
threshold data for the sniffer sensors described above.
Analysts will be able to make changes manually and
programatically through the interactive network traffic
modeling API in the continually updated visual model
that subsequently will alter data collection agents
(sniffers) allowing real-time detection and adaptation to
changing events.
Results and Accomplishments
The original scope of this project was redefined as a
proof-of-concept functional prototype. (See Figure 1.)
Networked
resource
*
1
Intrusion Detection System
(IDS)
hub / router
sniffer
1
*
Broadcast Network Segment
sniffer
Summary and Conclusions
Other Analysis Engines
Interactive Network Traffic Model (INTM)
sniffer
Switched Nodes
Figure 1. Interactive network traffic model architecture
Existing and potential DOE clients have expressed strong
interest in interactive network traffic model technology.
Our strategy for pursuing this technology in the Intrusion
Detection field is to develop a proof-of-concept prototype
to demonstrate capability and implementation feasibility.
Demonstration of true, real-time intrusion detection at
high bandwidth is a necessary prerequisite in this research
domain.
Computer Science and Information Technology 161
1
1
1
1