Date of Award
4-2006
Document Type
Thesis
Degree Name
Master of Science in Computer Engineering
Department
Department of Electrical and Computer Engineering
First Advisor
Guna Seetharaman, PhD
Abstract
It is proposed to develop a framework of detecting and analyzing small and widespread changes in specific dynamic characteristics of several nodes. The characteristics are locally measured at each node in a large network of computers and analyzed using a computational paradigm known as the Relaxation technique. The goal is to be able to detect the onset of a worm or virus as it originates, spreads-out, attacks and disables the entire network. Currently, selective disabling of one or more features across an entire subnet, e.g. firewalls, provides limited security and keeps us from designing high performance net-centric systems. The most desirable response is to surgically disable one or more nodes, or to isolate one or more subnets.
The proposed research seeks to model virus/worm propagation as a spatio-temporal process. Such models have been successfully applied in heat-flow and evidence or gestalt driven perception of images among others. In particular, we develop an iterative technique driven by the self-assessed dynamic status of each node in a network. The status of each node will be updated incrementally in concurrence with its connected neighbors to enable timely identification of compromised nodes and subnets. Several key insights used in image analysis of line-diagrams, through an iterative and relaxation-driven node labeling method, are explored to help develop this new framework.
AFIT Designator
AFIT-GCE-ENG-06-01
Recommended Citation
Bell, Garrick A., "An Interactive Relaxation Approach for Anomaly Detection and Preventive Measures in Computer Networks" (2006). Theses and Dissertations. 3285.
https://scholar.afit.edu/etd/3285