Forum for Science, Industry and Business

Sponsored by:     3M 
Search our Site:

 

To Detect Cyberattacks, New Software System Developed at UB Profiles ’Normal’ Computer Habits

11.10.2002


An early version of a new software system developed by University at Buffalo researchers that detects cyberattacks while they are in progress by drawing highly personalized profiles of users has proven successful 94 percent of the time in simulated attacks.



The "user-level anomaly detection system" was described here today (Oct. 10, 2002) at the military communications conference known as MILCOM 2002.

"We have developed a new paradigm, proactively encapsulating user intent where you basically generate a profile for every single user in the system where security is a major concern," said Shambhu Upadhyaya, Ph.D., associate professor of computer science and engineering at UB and co-author of the paper.


In addition to the paper presentation, MILCOM invited Upadhyaya to give a half-day tutorial on the new intrusion detection system at the meeting.

Upadhyaya directs UB’s Center of Excellence in Information Systems Assurance Research and Education, one of 36 in the U.S. chosen by the National Security Agency to develop new programs to conduct research and train students to protect the nation’s information technology systems from cyberterrorism.

The new UB intrusion detection system is being developed for application in highly secure facilities, such as those in the military.

"Existing approaches look at a past record of computer activity because those systems produce audits of activity for every user," he explained. "Our methodology is a marriage of two known techniques: misuse and anomaly detection. We use an assertion/rule-based approach to precisely capture the initial bracket of activity and then fine-tune this profile to reflect ongoing activity, making highly personalized and accurate profiles possible.

"Also, since users are being constantly monitored, this system can detect intrusions or attacks on-the-fly."

The UB system generates a user profile according to data about standard operations and commands that each user follows to carry out specific tasks.

The system is designed to detect significant deviations from procedures followed by normal users.

While some commercially available computer security packages already feature user-profiling, Upadhyaya noted that they are based on "low-level" methods -- meaning they seek out deviations on the basis of huge amounts of data, so they end up creating many false alarms.

"User modeling is computationally hard," said Upadhyaya. "Since many of these existing systems treat this problem purely statistically, any deviation from the norm is signaled as an anomaly, but it is often the case that an intrusion has not occurred.

"It’s a nuisance because an alarm can go off as often as every five minutes," he said.

By contrast, the system he developed with co-authors Rankumar Chinchani, a doctoral candidate in the UB Department of Computer Science and Engineering, and Kevin Kwiat of the Air Force Research Laboratory in Rome, N.Y., is based on the idea that the computation habits of normal users generally are well-defined and that he or she will work within those bounds.

"The normal behavior of computer users has been very well characterized," said Upadhyaya. "Normal users stick within well-defined parameters. Intruders or hackers, on the other hand, will not be able to carry out their intended operations within such well-defined parameters, and so will make the scope of his or her activities overly permissive," said Upadhyaya. "Our system is based on detecting that kind of behavior."

The key to the UB system’s success and its "scalable" feature is that its monitoring system operates at a high level, examining commands that users execute to perform certain operations. This is in contrast to the low-level monitoring that many existing packages perform, which examine commands as basic as the ones and zeroes of which email messages are composed.

"Our system is looking for a sequence of operations that falls within certain ’normal’ parameters," he explained.

"For example, if you want to make a document, you do certain things in a certain order, you create the document, you use a word processing program, you may run Spellcheck. Our system knows what to look for in the normal sequence that is necessary to accomplish this job. Any deviations from that are assumed to be potential cyberattacks."

The work was funded by the Air Force Research Laboratory in Rome, N.Y.

Ellen Goldbaum | EurekAlert!
Further information:
http://www.buffalo.edu/

More articles from Information Technology:

nachricht The Flexible Grid Involves its Users
27.09.2016 | Fraunhofer-Institut für Angewandte Informationstechnik FIT

nachricht Optical fiber transmits one terabit per second – Novel modulation approach
16.09.2016 | Technische Universität München

All articles from Information Technology >>>

The most recent press releases about innovation >>>

Die letzten 5 Focus-News des innovations-reports im Überblick:

Im Focus: New welding process joins dissimilar sheets better

Friction stir welding is a still-young and thus often unfamiliar pressure welding process for joining flat components and semi-finished components made of light metals.
Scientists at the University of Stuttgart have now developed two new process variants that will considerably expand the areas of application for friction stir welding.
Technologie-Lizenz-Büro (TLB) GmbH supports the University of Stuttgart in patenting and marketing its innovations.

Friction stir welding is a still-young and thus often unfamiliar pressure welding process for joining flat components and semi-finished components made of...

Im Focus: First quantum photonic circuit with electrically driven light source

Optical quantum computers can revolutionize computer technology. A team of researchers led by scientists from Münster University and KIT now succeeded in putting a quantum optical experimental set-up onto a chip. In doing so, they have met one of the requirements for making it possible to use photonic circuits for optical quantum computers.

Optical quantum computers are what people are pinning their hopes on for tomorrow’s computer technology – whether for tap-proof data encryption, ultrafast...

Im Focus: OLED microdisplays in data glasses for improved human-machine interaction

The Fraunhofer Institute for Organic Electronics, Electron Beam and Plasma Technology FEP has been developing various applications for OLED microdisplays based on organic semiconductors. By integrating the capabilities of an image sensor directly into the microdisplay, eye movements can be recorded by the smart glasses and utilized for guidance and control functions, as one example. The new design will be debuted at Augmented World Expo Europe (AWE) in Berlin at Booth B25, October 18th – 19th.

“Augmented-reality” and “wearables” have become terms we encounter almost daily. Both can make daily life a little simpler and provide valuable assistance for...

Im Focus: Artificial Intelligence Helps in the Discovery of New Materials

With the help of artificial intelligence, chemists from the University of Basel in Switzerland have computed the characteristics of about two million crystals made up of four chemical elements. The researchers were able to identify 90 previously unknown thermodynamically stable crystals that can be regarded as new materials. They report on their findings in the scientific journal Physical Review Letters.

Elpasolite is a glassy, transparent, shiny and soft mineral with a cubic crystal structure. First discovered in El Paso County (Colorado, USA), it can also be...

Im Focus: Complex hardmetal tools out of the 3D printer

For the first time, Fraunhofer IKTS shows additively manufactured hardmetal tools at WorldPM 2016 in Hamburg. Mechanical, chemical as well as a high heat resistance and extreme hardness are required from tools that are used in mechanical and automotive engineering or in plastics and building materials industry. Researchers at the Fraunhofer Institute for Ceramic Technologies and Systems IKTS in Dresden managed the production of complex hardmetal tools via 3D printing in a quality that are in no way inferior to conventionally produced high-performance tools.

Fraunhofer IKTS counts decades of proven expertise in the development of hardmetals. To date, reliable cutting, drilling, pressing and stamping tools made of...

All Focus news of the innovation-report >>>

Anzeige

Anzeige

Event News

HLF: From an experiment to an establishment

29.09.2016 | Event News

European Health Forum Gastein 2016 kicks off today

28.09.2016 | Event News

Laser use for neurosurgery and biofabrication - LaserForum 2016 focuses on medical technology

27.09.2016 | Event News

 
Latest News

New Multiferroic Materials from Building Blocks

29.09.2016 | Materials Sciences

Silicon Fluorescent Material Developed Enabling Observations under a Bright “Biological Optical Window”

29.09.2016 | Materials Sciences

X-shape Bio-inspired Structures

29.09.2016 | Interdisciplinary Research

VideoLinks
B2B-VideoLinks
More VideoLinks >>>