Sumitra Reddy

TRINETR: An architecture for collaborative intrusion detection and knowledge-based alert evaluation

Current reactive and standalone network security products are not capable of withstanding the onslaught of diversified network threats. As a result, a new security paradigm, where integrated security devices or systems collaborate closely to achieve enhanced protection and provide multi-layer defenses is emerging. In this paper, we present the design of a collaborative architecture for multiple intrusion detection systems to work together to detect real-time network intrusions. The detection is made more efficient and effective by using collaborative intelligent agents, relevant knowledge base and combination of multiple detection sensors. The architecture is composed of three parts: Collaborative Alert Aggregation, Knowledge-based Alert Evaluation and Alert Correlation. The architecture is aimed at reducing the alert overload by correlating results from multiple sensors to generate condensed views, reducing false positives by integrating network and host system information into the evaluation process and correlating events based on logical relations to generate global and synthesized alert report. The architecture is designed as a layer above intrusion detection for post-detection alert analysis and security actions. The first two parts of the architecture have been implemented and the implementation results are presented in this paper.

TRINETR: an intrusion detection alert management systems

In response to the daunting threats of cyber attacks, a promising approach is computer and network forensics. Intrusion detection system is an indispensable part of computer and network forensics. It is deployed to monitor network and host activities including dataflows and information accesses etc. But current intrusion detection products presents many flaws including alert flooding, too many false alerts and isolated alerts etc. We describe an ongoing project to develop an intrusion alert management system

Enabling Technologies: Infrastructure for Collaborative Enterprises

TRINETR. We present a collaborative architecture design for multiple intrusion detection systems to work together to detect real-time network intrusions. The architecture is composed of three parts: alert aggregation, knowledge-based alert evaluation and alert correlation. The architecture is aimed at reducing the alert overload by aggregating alerts from multiple sensors to generate condensed views, reducing false positives by integrating network and host system information into alert evaluation process and correlating events based on logical relations to generate global and synthesized alert report. The first two parts of the architecture have been implemented and the implementation results are presented.

Evaluating adaptability in frameworks that support morphing collaboration patterns

The International Conference on Enabling Technologies: Infrastructure for Collaborative Enterprises WETICE is an international forum for state-ofthe-art research in enabling technologies for collaboration. The 26th WETICE edition takes place on June 21-23, 2017 in Poznan, Poland. In this edition, WETICE starts the second quarter of century of scientific excellence, academic and industrial success. The longevity of WETICE demonstrates its undeniable success in the scientific and academic community.

A collaborative architecture for intrusion detection systems with intelligent agents and knowledge-based alert evaluation

This paper emphasizes the need for systems to be adaptable due to the manner in which groups collaborate over the lifetime of a project. It is observed that humans tend to adopt patterns of behavior when collaborating and these patterns tend to morph over a projects lifecycle. We identify the factors that cause such change along with the challenges that such evolving patterns pose on existing collaborative information systems. We propose a method to assess the adaptability of systems in ensuring that they can accommodate this change. Adaptability assessment is an essential criterion in the evaluation of a collaborative system.

Empowering mobile healthcare providers via a patient benefits authorization service

Current reactive and standalone network security products are not capable of withstanding the thriving of diversified network threats. As a result, a security paradigm where integrated security devices or systems collaborate closely to achieve enhanced protection and provide multilayer defenses is emerging. We present a collaborative architecture design for multiple intrusion detection systems to work together to detect real-time network intrusions. The architecture is composed of three parts: collaborative alert aggregation, knowledge-based alert evaluation and alert correlation. The architecture is aimed at reducing the alert overload by correlating from multiple sensors to generate condensed views, reducing false positives by integrating network and host system information and correlating events based on logical relations to generate global and synthesized alert report. The first two parts of the architecture have been implemented and the implementation results are presented in this paper.

A workflow-centric, context-aware collaboration framework

Moving rapidly between patient examining rooms, physicians have to examine, diagnose and decide on a course of treatment appropriate for each patient. However, if the patients health plan administrators subsequently deny coverage, the prescribed treatments would then have to be changed. There are a wide range of health insurance plans and varying cost curtailment procedures. Physicians are therefore ill-equipped to determine a course of treatment that addresses the patients needs and complies with the payers regulations. Benefits authorization applications on handheld devices using wireless communications can help mobile healthcare providers quickly determine patient medical benefit eligibility. Such facilities could improve the quality of care and physician patient communications, prevent denial of services by health plan administrators and consequential expenses to the patient. The authors originally developed a prototype desktop application as part of a secure telemedicine research project. They identify enhancements to this work to address interoperability issues and support the needs of mobile healthcare providers.

The design of a workflow-centric, context-aware framework to support heterogeneous computing environments in collaboration

During recent years, ubiquitous computing and universal network connectivity have given rise to expectations of building a digital society, where remote participants with heterogeneous and dynamic connection and process capabilities can join seamlessly to accomplish a common task. Intelligent, context-aware, and workflow-centric collaboration is an essential prerequisite to fulfill that expectation. In this paper, we describe a generic framework, dubbed as EkSarva, which is capable of embedding process and context-awareness intelligence into collaborative sessions leading to increased opportunities for process automation.

Workflow-centric distributed collaboration in heterogeneous computing environments

Networked based distributed collaboration has become pervasive and makes today’s enterprises much more productive than ever before. The automation of the collaborative processes can be driven and managed by workflow rules. In addition, during recent years, ubiquitous computing and universal network connectivity have imposed another imperative requirement on collaboration systems. That is, remote participants with heterogeneous and dynamic connection and process capabilities should be able to join seamlessly in the collaboration at any time. Intelligent, context-aware, and workflow-centric collaboration is an essential prerequisite to fulfill that requirement. In this paper, we describe a generic framework, dubbed as EkSarva, which is capable of embedding workflow rules and context-awareness intelligence into collaborative sessions leading to increased opportunities for process automation

Collaboration framework for nomadic healthcare providers

Few contest that Computer Supported Cooperative Work has contributed to a significant improvement in productivity and effectiveness of collaboration. During recent years, pervasive computing has imposed another imperative requirement on collaboration systems. That is, remote participants with heterogeneous computing environments should be able to join seamlessly in the collaboration process and the collaboration process itself should be able to satisfy the needs of different computing environments as well be able to adapt to the changes among different environments. In order to satisfy this new requirement and embed collaboration workflow rules into automated process, we have presented a generic framework, EkSarva, which incorporates context-awareness and workflow-centric into the collaborative sessions. In essence, we believe CSCW should be a design-oriented research.