The goal of the project is to detect compromised or misconfigured hosts by correlating file system changes across different machines.  Most of the current intrusion techniques result in modification, insertion, or deletion of system configuration files, binary files, libraries, log files, or system kernel.   However, as the operation system and application software become more and more complex, users, even system administrators usually lose track of the up to date machine configuration status and file system updates.  One existing solution is using tools such as tripwire to report file system updates daily by manually specifying a set of rules before hand. A rule violation means possible malicious attacks.  Since each host has its own unique configuration, system administrator needs to specify a unique rule set for each host correspondingly, which task is extremely time consuming and thus not often used in practice.

Figure 1. Pointillist Approach to Intrusion Detection

An important observation is that attacks usually have strong temporal and spatial correlations across multiple hosts in one administration domain. Since attacks often propagate quickly, if one host is compromised, then it is likely that another host get compromised soon afterwards. On the other hand, machines in the same administration domain usually have similar configurations. Thus they tend to have common vulnerabilities. If one host is compromised by an attack, then it is likely that another host nearby will also be compromised by the same attack. Therefore, correlating file system changes across multiple machines may provide us a way to detect attacks early on without manually specified rules.

• Faculty

David O'Hallaron
Mike Reiter
Hui Zhang
• Students

Yinglian Xie
Hyang-Ah Kim