In this paper, we present an approach to detecting novel cyber attacks though a form of program diversification, similar to the use of n-version programming for fault tolerant systems. Building on extensive previous and ongoing work by others on the use of code clones in a wide variety of areas, our Functionally Equivalent Variants using Information Synchronization (FEVIS) system automatically generates program variants to berun in parallel, seeking to detect attacks through divergence in behavior. Unlike approaches to diversification that only change program memory layout and behavior, FEVIS can detect attacks exploiting vulnerabilities in execution timing, string processing, and other logic errors. We are in the early stages of research and development for this approach, but have made sufficient progress to provide a proof of concept and some lessons learned. In this paper we describe FEVIS and its application to diversifying an open-source webserver, with results on several different example classes of attack which FEVIS will detect.

We describe a novel architecture for network defense designed for scaling to very high data rates (100 Gb/s) and very large user populations. Scaling requires both efficient attack detection algorithms as well as appropriate an execution environment. Our architecture considers the time budget of traffic data extraction and algorithmic processing, provides a suite of detection algorithms - each designed to present different and complementary views of the data-that generate many ¿traffic events,¿ and reduces false positives by correlating these traffic events into benign or malicious hypotheses.

Coordinating multiple overlapping defense mechanisms, at differing levels of abstraction, is fraught with the potential for misconfiguration, so there is strong motivation to generate policies for those mechanisms from a single specification in order to avoid that risk. This paper presents our experience and the lessons learned as we developed, validated and coordinated network communication security policies for a defense-in-depth enabled system that withstood sustained red team attack. Network communication was mediated by host-based firewalls, process domain mechanisms and application-level security policies enforced by the Java virtual machine. We coordinated the policies across the layers using a variety of tools, but we discovered that, at least for defense-in-depth enabled systems, constructing a single specification from which to derive all policies is probably neither practical nor even desirable

In this project, w e dev eloped a technique for extracting useful information from databases that contain both xedformat and free-text elds.The present state of the art in data mining is a schism betw een tec hniques that handle only xed-format data (pattern recognition, classi cation algorithms from machine learning), and techniques designed for free-form text (information retrieval).Advanced knowledge disco very tec hnologies ha ve been developed in both research areas, but systems that can categorize or cluster records containing both kinds of data are still lacking.Speci cally, w e examined database records from a Honeywell service cen ter to extract information about the expected cost of dierent kinds of service requests.Our goal was to test the h ypothesis that incorporating information from free-text elds would provide a better categorization of these records; in this case, better predictions of the cost of the service call.In our w ork, we h a ve i n tegrated feature extraction and clustering techniques from information retrieval with classi cation algorithms from machine learning in order to categorize the hybrid elds.Our preliminary results suggested that incorporating free-form text could potentially induce better classi cation models.

The paper describes a novel application of neural networks to model the behavior of students in the context of an intelligent tutoring system. Self-organizing feature maps are used to capture the possible states of student knowledge from an existing test database. The trained network implements a universal student knowledge model that is compatible with knowledge space theory approaches to student assessment and computer aided instruction. The student model can be applied to rapidly assess the knowledge of any given student, and chart a path from lower to higher states of expertise. The authors illustrate the concept on an aircraft fuel management domain, demonstrating its noise-tolerance and insensitivity to feature map parameter values. An approach to determining the correct feature map size is also described.>