SBIR-STTR Award

Curriculum corporation proposes to research and development an innovative platform independent intrusion detection and response tool. The tool would be based on DCE in order to support mainstream computer platform. The ability to automatically recover from an information attack will reply on 'on-the-fly' modification of the DCE security service. The tool is innovative in that the response to a security attack would be a concerted effort from all of the systems in a DCE cell (potentially thousands of systems). DCE provides some basic security building blocks but lacks the ability to automatically react to intrusion. The proposed research effort would design an infrastructure capable of reacting appropriately to a wide range of security anomalies and implementation of these responses. The centralized nature of the DCE security implementation will facilitate very fast response to any potential attack. The main goal of the proposed Phase I effort will be build upon the intrusion detection and response work done by others by augmentation and application to a DCE-based infrastructure. During I project, a prototype intrusion response tool will be developed using a combination of DCE executables and dcecp/TCL scripts.

Curriculum Corporation proposes to research and develop an innovative platform-independent intrusion detection and response tool. The tool would be based on OSF DCE (but will support every mainstream computer platform. The ability to automatically recover from an information attack will rely on 'on-the-fly' modification of the DCE security service. The tool is innovative in that: a) The response to an attack would be a concerted effort from all of the systems in a DCE cell or NT Domain (potentially thousands of systems) b) No commercial IDS has ever supported all platforms (including mainframe) c) Common Intrusion Detection Framework is fully implemented. The proposed research & development effort would design a product capable of reacting appropriately to a wide range of security anomalies and implementation of these responses. The centralized nature of DCE security will facilitate very fast response to any potential attack. The Phase I work undertaken has proven that it is technically feasible to reach the goals set out here, however, we do not underestimate the effort required. One of the largest hurdles to overcome is the typically high false alarm rates associated with other Intrusion Detection Systems.