Ph.D. Dissertation proposal

Creating a Collaborative Situational-Aware IDPS

Lisa Mathews

11:00am Tuesday, 10 June 2014, ITE 346

Traditional intrusion detection and prevention systems (IDPSs) have well known limitations that decrease their utility against many kinds of attacks. Current state-of-the-art IDPSs are point based solutions that perform a simple analysis of host or network data and then flag an alert. Only known attacks whose signatures have been identified and stored in some form can be discovered by most of these systems. They cannot detect “zero day” type attacks or attacks that use “low-and-slow” vectors. Many times an attack is only revealed by post facto forensics after some damage has already been done.

To address these issues, we are developing a semantic approach to intrusion detection that uses traditional as well non-traditional sensors collaboratively. Traditional sensors include hardware or software such as network scanners, host scanners, and IDPSs like Snort. Potential non-traditional sensors include open sources or information such as online forums, blogs, and vulnerability databases which contain textual descriptions of proposed attacks or discovered exploits. After analyzing the data streams from these sensors, the information extracted is added as facts to a knowledge base using a W3C standards based ontology that our group has developed. We have also developed rules/policies that can reason over the facts to identify the situation or context in which an attack can occur. By having different sources collaborate to discover potential security threats and create additional rules/policies, the resulting situational-aware IDPS is better equipped to stop creative attacks such as those that follow a low-and-slow intrusion pattern. Leveraging information from these heterogeneous sources leads to a more robust, situational-aware IDPS that is better equipped to detect complicated attacks. This will allow for detection in soft real time. We will create a prototype of this system and test the efficiency and accuracy of its ability to detect complex malware.

Committee: Drs. Anupam Joshi (Chair), Tim Finin, John Pinkston, Charles Nicholas, Claudia Pearce, Yul Williams

Successful UMBC alum, Greg Cangialosi, is looking for full-time developers and interns to be part of his new team for MissionTix.com (http://www.missiontix.com/). 
    
    If you are looking for a new opportunity or know of any developers looking for a new position, please send your resume to Christine Routzahn, Director of Career Services, at routzahn@umbc.edu.  
    
    The company is seeking new team members who are solid in PHP and mySQL, and who are looking for an exciting opportunity with a growing company, building a product that is heavily used in the market today.
    

Mobile Analytics: An Enabler for Urban Lifestyle Applications

Professor Archan Misra

School of Information Systems, Singapore Management University

10-11:00am 24 June 2014, ITE 459, UMBC

This talk will describe various research initiatives related to the theme of “urban mobile analytics and applications”, which utilizes smartphone sensor data from multiple individuals to extract near-real time insights about individual and collective behavior in urban public spaces. A major part of this research is being conducted under the auspices of the LiveLabs Experimentation Platform, a unique urban behavioral testbed effort that enables an ecosystem of industry partners to test advanced context-based applications on a pool of approximately 30,000 real-world users in multiple real-world public spaces in Singapore. Besides describing LiveLabs-related research in areas related to energy-efficient mobile sensing and large-scale mobile analytics (e.g., queuing analytics, group detection and adaptive indoor localization). I will describe the role of such analytics for a couple of novel industry-driven applications: (a) in-store shopper intent monitoring and (b) large-scale mobile crowd-tasking.

Archan Misra is an Associate Professor of Information Systems at Singapore Management University (SMU), and a Director of the LiveLabs research center at SMU. Over the past 14 years (as part of his previous jobs with IBM Research and Telcordia Technologies), he has worked extensively in the areas of mobile systems, wireless networking and pervasive computing, and is a co-author on papers that received the Best Paper awards in EUC 2008, ACM WOWMOM 2002 and IEEE MILCOM 2001. Archan’s broad research interests lie in the areas of pervasive computing and mobile systems, with specific current focus on applying mobile sensing and real-time analytics to understand human lifestyle-driven activities in urban spaces. He is presently an Editor of the IEEE Transactions on Mobile Computing and the Elsevier Journal of Pervasive and Mobile Computing and chaired the IEEE Computer Society’s Technical Committee on Computer Communications (TCCC) from 2005-2007. Archan holds a Ph.D. in Electrical and Computer Engineering from the University of Maryland at College Park.

Host: Prof. Nirmalya Roy, Sorry, you need javascript to view this email address.

UMBC has been redesignated as a National Center of Academic Excellence in Information Assurance by the National Security Agency and Department of Homeland Security for both Cyber Defense Research (CAE-R) and Education (CAE-IA/CD) for the academic years 2014-2021. UMBC is one of only 38 institutions in the US. that have recognized by NSA and DHS for both education and research.

The CAE educational designation includes (among other elements) a certification that our curriculum satisfies focus areas and knowledge units (KUs) as outlined in the NICE Framework. This framework aims to establish a common lexicon for students, universities, and employers for describing knoweldge and skills needed for various cybersecurity jobs. The CAE research designation signifies UMBC’s demonstrated excellence in conducting quality research activities pertaining to cybersecurity.

The CAE certification process was coordinated by Dr. Alan Sherman through the Center for Information Security and Assurance (CISA). Among other things, CISA oversees UMBC’s Federal CyberCorps Scholarship For Service program and is actively involved with cybersecurity education and research activities at UMBC, to include the upcoming Innovations in Cybersecurity Education Workshop on June 24.