Srinivas Kankanahalli

TRINETR: An architecture for collaborative intrusion detection and knowledge-based alert evaluation

Current reactive and standalone network security products are not capable of withstanding the onslaught of diversified network threats. As a result, a new security paradigm, where integrated security devices or systems collaborate closely to achieve enhanced protection and provide multi-layer defenses is emerging. In this paper, we present the design of a collaborative architecture for multiple intrusion detection systems to work together to detect real-time network intrusions. The detection is made more efficient and effective by using collaborative intelligent agents, relevant knowledge base and combination of multiple detection sensors. The architecture is composed of three parts: Collaborative Alert Aggregation, Knowledge-based Alert Evaluation and Alert Correlation. The architecture is aimed at reducing the alert overload by correlating results from multiple sensors to generate condensed views, reducing false positives by integrating network and host system information into the evaluation process and correlating events based on logical relations to generate global and synthesized alert report. The architecture is designed as a layer above intrusion detection for post-detection alert analysis and security actions. The first two parts of the architecture have been implemented and the implementation results are presented in this paper.

TRINETR: an intrusion detection alert management systems

In response to the daunting threats of cyber attacks, a promising approach is computer and network forensics. Intrusion detection system is an indispensable part of computer and network forensics. It is deployed to monitor network and host activities including dataflows and information accesses etc. But current intrusion detection products presents many flaws including alert flooding, too many false alerts and isolated alerts etc. We describe an ongoing project to develop an intrusion alert management system

Evaluating adaptability in frameworks that support morphing collaboration patterns

TRINETR. We present a collaborative architecture design for multiple intrusion detection systems to work together to detect real-time network intrusions. The architecture is composed of three parts: alert aggregation, knowledge-based alert evaluation and alert correlation. The architecture is aimed at reducing the alert overload by aggregating alerts from multiple sensors to generate condensed views, reducing false positives by integrating network and host system information into alert evaluation process and correlating events based on logical relations to generate global and synthesized alert report. The first two parts of the architecture have been implemented and the implementation results are presented.

A collaborative architecture for intrusion detection systems with intelligent agents and knowledge-based alert evaluation

This paper emphasizes the need for systems to be adaptable due to the manner in which groups collaborate over the lifetime of a project. It is observed that humans tend to adopt patterns of behavior when collaborating and these patterns tend to morph over a projects lifecycle. We identify the factors that cause such change along with the challenges that such evolving patterns pose on existing collaborative information systems. We propose a method to assess the adaptability of systems in ensuring that they can accommodate this change. Adaptability assessment is an essential criterion in the evaluation of a collaborative system.

A workflow-centric, context-aware collaboration framework

Current reactive and standalone network security products are not capable of withstanding the thriving of diversified network threats. As a result, a security paradigm where integrated security devices or systems collaborate closely to achieve enhanced protection and provide multilayer defenses is emerging. We present a collaborative architecture design for multiple intrusion detection systems to work together to detect real-time network intrusions. The architecture is composed of three parts: collaborative alert aggregation, knowledge-based alert evaluation and alert correlation. The architecture is aimed at reducing the alert overload by correlating from multiple sensors to generate condensed views, reducing false positives by integrating network and host system information and correlating events based on logical relations to generate global and synthesized alert report. The first two parts of the architecture have been implemented and the implementation results are presented in this paper.

The design of a workflow-centric, context-aware framework to support heterogeneous computing environments in collaboration

During recent years, ubiquitous computing and universal network connectivity have given rise to expectations of building a digital society, where remote participants with heterogeneous and dynamic connection and process capabilities can join seamlessly to accomplish a common task. Intelligent, context-aware, and workflow-centric collaboration is an essential prerequisite to fulfill that expectation. In this paper, we describe a generic framework, dubbed as EkSarva, which is capable of embedding process and context-awareness intelligence into collaborative sessions leading to increased opportunities for process automation.

Workflow-centric distributed collaboration in heterogeneous computing environments

Networked based distributed collaboration has become pervasive and makes today’s enterprises much more productive than ever before. The automation of the collaborative processes can be driven and managed by workflow rules. In addition, during recent years, ubiquitous computing and universal network connectivity have imposed another imperative requirement on collaboration systems. That is, remote participants with heterogeneous and dynamic connection and process capabilities should be able to join seamlessly in the collaboration at any time. Intelligent, context-aware, and workflow-centric collaboration is an essential prerequisite to fulfill that requirement. In this paper, we describe a generic framework, dubbed as EkSarva, which is capable of embedding workflow rules and context-awareness intelligence into collaborative sessions leading to increased opportunities for process automation

Adaptive collaboration in an ever-changing environment

Few contest that Computer Supported Cooperative Work has contributed to a significant improvement in productivity and effectiveness of collaboration. During recent years, pervasive computing has imposed another imperative requirement on collaboration systems. That is, remote participants with heterogeneous computing environments should be able to join seamlessly in the collaboration process and the collaboration process itself should be able to satisfy the needs of different computing environments as well be able to adapt to the changes among different environments. In order to satisfy this new requirement and embed collaboration workflow rules into automated process, we have presented a generic framework, EkSarva, which incorporates context-awareness and workflow-centric into the collaborative sessions. In essence, we believe CSCW should be a design-oriented research.

EkSarva: Enabling Adaptability in Distributed Collaboration

Traditional collaboration systems are typically bundled with a set of tools with pre-specified static workflow and usage patterns. They are found to be inflexible and incompetent for todays heterogeneous and ever-changing collaboration contexts and computing environments. Todays collaboration systems must be aware of the dynamic changes of collaboration contexts in a timely manner and be adaptive to these changes appropriately. In this paper, we illustrate how business logic and computing environment context awareness are provided through a set of shared ontologies with well-defined semantics in a project called as EkSarva. The awareness of collaboration contexts and its changes then enables the collaboration system to adapt to these changes and be more flexible. A dynamic workflow process is also facilitated by the context-awareness.

An epistemological view of collaboration

Traditional distributed collaboration frameworks based on assumption of static collaboration and usage patterns cannot fulfil many new requirements imposed by todays collaboration with heterogeneous and ever-changing environments and computing contexts. In this paper, we describe a collaboration framework, called as EkSarva, which enables adaptability by providing context-awareness through a set of ontologies with well-defined semantics and embedding workflow into collaboration processes