[117786] in Cypherpunks
IP: New Techniques to Foil Cyber Intruders
daemon@ATHENA.MIT.EDU (Robert Hettinga)
Fri Sep 10 14:56:46 1999
Mime-Version: 1.0
Message-Id: <v0421015ab3feeee7bd3b@[204.167.108.57]>
Date: Fri, 10 Sep 1999 13:22:57 -0400
To: cryptography@c2.net, cypherpunks@cyberpass.net
From: Robert Hettinga <rah@shipwright.com>
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
Reply-To: Robert Hettinga <rah@shipwright.com>
--- begin forwarded text
From: believer@telepath.com
Date: Fri, 10 Sep 1999 09:20:33 -0500
To: ignition-point@precision-d.com
Subject: IP: New Techniques to Foil Cyber Intruders
Sender: owner-ignition-point@precision-d.com
Reply-To: believer@telepath.com
Status: U
Source: Office of Naval Research
http://www.onr.navy.mil/onr/newsrel/to9909.htm
(2nd article)
September 1999
NEW TECHNIQUES TO FOIL CYBER INTRUDERS
Researchers at the Naval Surface Warfare Center in Dahlgren, Va., are
developing new statistical techniques to aid human operators in detecting
and defending computer networks against intrusion. Most existing intruder
detection software works by flagging access attempts from pre-identified
attack attempts. However, that approach presumes some pre-existing
knowledge of the intruder's methods. The ONR-funded researchers at Dahlgren
are developing new algorithms to flag access attempts that are not routine
for a particular workstation, local-access network, wide-area network, or
Internet service provider. Using statistical pattern analysis, the
algorithms will filter out access attempts from strange places or at
strange hours, or any attempts asking for unusual information. The data
will then be given further analysis to determine if it represents a threat
or just a benign anomaly. This research builds on the network-based
intrusion detection system "Secondary Heuristic Analysis for Defensive
Online Warfare," or SHADOW, system also developed at Dahlgren. The SHADOW
system detects suspicious activities such as network scans and probes,
denial of service attacks and unauthorized connection attempts. The
statistical pattern recognition research has the potential to enhance the
effectiveness of SHADOW, as well as many other network protection software
systems. This research effort, led by Drs. Jeff Solka and David Marchette,
was described at the recent USENIX Workshop on Intrusion Detection and
Network Monitoring in Santa Clara, Calif., and was the subject of a
tutorial at a recent System Administration and Network Security Institute
Conference. Diane Banegas, ONR Public Affairs, 703-696-2868,
banegad@onr.navy.mil.
-----
The Office of Naval Research pursues an integrated science and technology
program from basic research through manufacturing technologies. Research
areas include oceanography; advanced materials; sensors; electronics;
surveillance; mine countermeasures; weapons; and surface ship, submarine
and aircraft technologies. For more information about ONR programs, refer
to the ONR home page at http://www.onr.navy.mil on the World Wide Web.
author: Public Affairs Office
maintained by: WEBMASTER
last modified: 9/9/99
**********************************************
To subscribe or unsubscribe, email:
majordomo@precision-d.com
with the message:
(un)subscribe ignition-point email@address
**********************************************
<www.telepath.com/believer>
**********************************************
--- end forwarded text
-----------------
Robert A. Hettinga <mailto: rah@ibuc.com>
The Internet Bearer Underwriting Corporation <http://www.ibuc.com/>
44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
