Similar to a credit card company watching for suspect transactions, we consider an anomaly detection system for home users. In this project, students will develop a mechanism which allows an ISP to evaluate consumer usage patterns and identify deviations from these patterns to detect possible hostile activity. Theses basic patterns should include layer 4 information, direction of traffic flows, and time of day usage patterns. Students are required to have programming knowledge in any object-oriented language.

Intrusion Detection and anomaly detection

• Intrusion Detection FAQ
• What You Need to Know About Intrusion Detection Systems
• Intrusion Detection: Reducing Network Security Risk by Recourse Technologies [December 24, 2001]
• ISPs take on DDoS attacks, Computerworld, NOVEMBER 19, 2003
• Victor-Valeriu Patriciu, Liviu Rusu, Iustin Priescu, Data Mining Approaches for Intrusion Detection in Email System Internet-Based
• Min Qin and Kai Hwang, Anomaly Intrusion Detection by Internet Datamining of Traffic Episodes
• Anomaly Detection: The Required Complement To Intrusion Detection
• Balachander Krishnamurthy, Subhabrata Sen, Yin Zhang, Yan Chen, "Sketch-based change detection: methods, evaluation, and applications", Internet Measurement Workshop, Proceedings of the 2003 ACM SIGCOMM conference on Internet measurement.
• Esphion's netDeFlect® A solution for intelligent traffic anomaly detection and analysis in networks
• "packet filtering" in Guide to Firewalls and Network Security, Greg Holden, Thompson Publishing, 0-619-13039-3.
• "intrusion detection" in Guide to Network Defenses and Countermeasures, Greg Holden, Thompson Publishing, 0-619-13124-1.

• Beej's Guide to Network Programming
• Java Network Programming FAQ
• Network Programming with Java 2 Platform, Standard Edition 1.4 (J2SE)
• Examples from Java Network Programming
• Java Network Programming, Elliotte Rusty Harold, O'Reilly, 1-56592-227-1

1. Develop a Java program that will build a dynamic database of consumer usage patterns
2. Develop a Java program that will identify deviations from the consumer usage patterns in order to detect hostile activities.
3. Develop test data for simulation

1. Understanding of intrusion detection systems and anomaly detection
2. Write a survey of intrusion detection systems, describing the different types
3. Develop Java programs that will build the dynamic database of consumer usage patterns and identify deviations in order to detect hostile activities
4. Simulate activity on an ISP to determine hostile activities
5. Write a project report including the programs and results of the simulation

Tentative schedule for Summer 2004 (May 24 -July 30) is as follows:

1. PC for coding (either Java or C++)
2. secure lab for testing