|
Flyer (pdf)
Associate Professor John McEachen of the Department of Electrical and Computer Engineering received the 2005 Menneken Award for his work on the research project titled Conversation Exchange Dynamics (CED). The work was conducted between March 2001 and September 2005; the project itself is ongoing. This project, sponsored by the Navy Network Warfare Command (NETWARCOM) and the Joint Task Force – Computer Network Operations (JTF-CNO), has provided research opportunities for a total of seven NPS students.
Technical Approach:
Conversation Exchange Dynamics (CED) produces a continuous real-time, compact and visual representation of states of exchange between network entities. The basic premise results from modeling the network as a finite number of conversation groups called buckets that pass information, called balls, among themselves. This produces a notion of a network state represented by the aggregate of all the buckets with the balls they contain. The complexity and asynchrony of this exchange among a large set of network nodes creates a high-dimensional combinatoric system to which dimensionality reduction inspired by statistical physics is applied. From this network state and the state transitions that occur during each packet arrival, the thermal properties of entropy, energy, temperature, work and heat can be computed and displayed. Asymmetrical perturbations in these displays have revealed anomalous network activity resulting from malicious activity and misconfiguration, some of which was not detected by standard signature-based intrusion detection systems.
Transition of CED ideas to the Fleet has developed along two parallel paths – direct delivery of government off-the-shelf (GOTS) software to its sponsors and affiliates but, perhaps more significantly, indirectly through its appearance in commercial products that DoD organizations have purchased. Rights to the CED ideas have been purchased from DoD by two commercial organizations, Lancope of Atlanta, GA in November 2003, and Secure Cognition of San Jose, CA in August 2004. In September 2004, Lancope release its flagship Stealthwatch product integrating CED ideas. Since that time, Lancope has sold over 2,000 units to DoD customers. In January 2005, Stealthwatch was named InfoWorld’s best network IDS. Further, Innovative Emergency Management (IEM) Inc. of Baton Rouge, LA, offers system integration and training in the any of the CED variants.
Selected Related Publications:
McEachen, J. and Zachary, J., Accentuating Anomalies in Computer Network Conversations for Enhanced Security, WSEAS Transactions on Information Science and Applications, Vol. 2, No. 10, pp. 1551 – 1561, October 2005.
Zachary, J., McEachen, J. and Ettlich, D., Conversation Exchange Dynamics for Network Monitoring and Anomaly Detection, Proceedings of the Second IEEE International Information Assurance Workshop, Charlotte, NC, April 5-8, 200 (Also in review for publication by IEEE Transactions on Knowledge and Data Engineering).
|
