DOODLEBUG: A Distributed, Peer-to-Peer Approach to Cross-Domain Attack Correlation

Award Information
Agency:
Department of Homeland Security
Branch
n/a
Amount:
$99,743.00
Award Year:
2004
Program:
SBIR
Phase:
Phase I
Contract:
NBCHC050002
Award Id:
69310
Agency Tracking Number:
0421009
Solicitation Year:
n/a
Solicitation Topic Code:
n/a
Solicitation Number:
n/a
Small Business Information
211 N 1st St., Suite 300, Minneapolis, MN, 55401
Hubzone Owned:
N
Minority Owned:
N
Woman Owned:
N
Duns:
n/a
Principal Investigator:
RobertGoldman
Senior Principal Research Scientist
(612) 384-3454
rpgoldman@sift.info
Business Contact:
HarryFunk
Vice President, Research and Development
(612) 578-7438
hfunk@sift.info
Research Institute:
n/a
Abstract
SIFT`s DOODLEBUG approach provides a revolutionary approach to intrusion event correlation and fusion. Existing correlation systems are brittle, mostly rule-based systems that provide centralized correlation of intrusion events from very restricted areas. They require access to confidential information of the systems whose events they correlate, share those systems` false positive problems, and are difficult to configure and operate. By contrast, DOODLEBUG provides a lightweight event correlation solution that will operate over extremely large areas (e.g., continent-wide). The DOODLEBUG approach will build a robust, redundant, decentralized network for event correlation, producing rich results by incorporate very large amounts of information. Using large amounts of information, and combining it with relatively simple, and computationally inexpensive operations, DOODLEBUG will enable detection and identification of both known and novel attacks. In order to incorporate these large numbers of nodes, DOODLEBUG must stretch across not just administrative domains, but enterprises as well. To make this possible, DOODLEBUG will incorporate techniques for robust computation even in the face of malicious network members, and will provide strong assurances of the privacy of network nodes. DOODLEBUG will do this by combining a novel re-framing of the correlation problem with existing techniques for robust distributed computation and privacy protection.

* information listed above is at the time of submission.

Agency Micro-sites


SBA logo

Department of Agriculture logo

Department of Commerce logo

Department of Defense logo

Department of Education logo

Department of Energy logo

Department of Health and Human Services logo

Department of Homeland Security logo

Department of Transportation logo

Enviromental Protection Agency logo

National Aeronautics and Space Administration logo

National Science Foundation logo
US Flag An Official Website of the United States Government