To assure enterprise security, typically a SIEM (Security Information and Event Management) system is built to correlate security events from different preventive technologies and flag alerts. Analysts in a security operations center (SOC) investigate the alerts to decide whether the related hosts are malicious or not. However, the number of alerts is overwhelming which exceeds the SOC’s capaci...

Proceedings of the 5th symposium on Recent Advances in Intrusion Detection (RAID 2002), Zurich, Switzerland, October 2002. Springer LNCS 2516, pages 115-137 This paper describes a testing environment for commercial intrusion-detection systems, shows results of an actual test run and presents a number of conclusions drawn from the tests. Our test environment currently focuses on IP denial-of-ser...

The Next Generation Air Transportation System will introduce new, advanced sensor technologies into the cockpit. With the introduction of such systems, the responsibilities of the pilot are expected to dramatically increase. In the ALARMS (ALerting And Reasoning Management System) project for NASA, we focus on a key challenge of this environment, the quick and efficient handling of aircraft sen...

A system for private stream searching allows a client to retrieve documents matching some search criteria from a remote server while the server evaluating the request remains provably oblivious to the search criteria. In this extended abstract, we give a high level outline of a new scheme for this problem and an experimental analysis of its scalability. The new scheme is highly efficient in pra...

The need for higher-level reasoning capabilities beyond low-level sensor abilities has prompted researchers to use different types of sensor fusion techniques for better situational awareness in the intrusion detection environment. These techniques primarily vary in terms of their mission objectives. Some prioritize alerts for alert reduction, some cluster alerts to identify common attack patte...

Any prediction of the future position and trajectory of an aircraft will contain errors due to both uncertainty caused by the environment and imperfect and incomplete information available to the prediction system. These prediction errors complicate conflict detection and resolution resulting in late or missed conflict detections and false alerts. Generally there are two types of conflict detec...