FY2010 - Oak Ridge National Laboratory

Director’s R&D Fund—
National Security Science and Technology
05281
Distributed Computational Intelligence for Active Response
to Cyber-Threat
Louis Wilder, Erik Ferragut, Craig A. Shue, Brent Lagesse, and Chris Rathgeb
Project Description
Computer and network attacks continue to grow exponentially, and the insider threat has become
widespread. Currently, the intrusion detection system is the mitigation technique used to thwart these
attacks. Misuse detection is the most common type of method used by the system. Yet, these systems are
limited in their ability to detect zero-day attacks and suffer from high false positives. Additionally, they
have poor scalability and have little or no situational awareness.
Our project goal is to develop a unique capability in anomaly detection and active response to intrusions
in Internet Protocol networks using both statistical host-level learning of normal user behavior and
distributed computational intelligence for near-real-time reaction. This extends traditional intrusion
detection tools by employing advanced probabilistic modeling to advance the statistical analyses.
Quantified normal behaviors are shared ontologically within a hierarchical learning framework that will
allow distributed monitoring, comparison, and storage of normal usage profiles. The framework also
reacts to perceived threats (e.g., isolating network elements, or actively reconfiguring system components
to prevent intrusion spread). This kind of analysis and defense capability is an indispensable aid for
system administrators. It also provides users the ability to monitor system behaviors with previously
unavailable detail.
Mission Relevance
DOE is responsible for the integrity and protection of the nation’s energy delivery systems, where cyber
attacks may cause extreme consequences to public health and safety and the nation’s economy. DOE’s
substantial cyber assets, its international visibility, its mission, and its open research make it a target for
cyber attacks.
This research aligns directly with the missions of DOE, the Intelligence Advanced Research Projects
Activity, the Intelligence Community, and the Department of Homeland Security (DHS). These agencies
are eager for tools to help analyze and detect suspicious anomalous activities. The research will help
establish a capability that is essential for long-term cyber-space security and will establish ORNL as a
leader in an area of cyberspace security traditionally deemed too difficult to solve. Additionally, the
capability provides a novel application of sensor fusion that does not currently exist at any of the
laboratories.
Results and Accomplishments
The resulting research has produced a prototype software framework that employs temporal ontologically
based information in our anomaly detector for distributed intrusion detection with an active response. The
framework provides algorithms that combine elements of learning, adaptation, and evolution to address
the analysis and correlation of intrusion data.
While researching the ontology-based approach, we discovered that using Latent Dirichlet Allocation as a
method for classifying anomalous behavior over port events was viable for network monitoring. In
addition, distinguishing whether anomalous behavior is malicious or benign has been a grand challenge;
we have initiated an investigation of using Petri Nets to model this behavior and to provide a solution.
144