Enhancing Network Defense

System administrators are better equipped to handle some intrusion attempts while automatic systems work best on others. This system utilizes neural or Bayesian network techniques--supplementing the rule based systems currently in use for deciding which traffic is allowed. Neural and Bayesian networks have been used in similar fields for some time: IBM's boot sector virus detection and defense against email spam are two examples. A decision making classifier will learn from existing IDS and/or firewall rules and traffic logs. This has the advantage in that it doesn't require human intervention and is easily adapted to a particular network topology. The system is then used to enhance existing network security and provide detection of possible attacks and prioritization of alerts. Both options are based on this intelligent classification of prior events. There is a general framework that can easily be adapted to work with any input data. Once categorized, the data is fed into a neural or Bayesian network. From there it is sent to the classifier for rule generation and alert prioritization. The key lies in the system learning which events should then be sent to the administrator to minimize the possibility of intrusion given finite administrator time. It works in real time and makes decisions on whether network events that indicate a perceived level of risk should be handled automatically or sent to the system administrator: the prioritization component of the system. The techniques are used to supplement and enhance an IDS and/or firewall. A possible expansion is to include temporal correlation to prevent attack progress. Further work can be done in optimizing the training algorithm and classifier so as to maximize accuracy with the evolution of threats.