Potential Research Problems
Updated 8/28/09
Each of these areas are potential dissertation topics that I am
willing to support. Note that
students in ÒResearch inÉÓ project courses can also use these areas for their
work by selecting a narrow component of the area for their project (additional
project topics listed at the end of the document).
Swarm Immunity
Current autoimmune approaches focus on
the identity of unusual activity by hard coding established norms into the AIS
components. An autoimmune approach that is based on swarm intelligence
may possess enhanced flexibility and adaptability in complex
environments. This research should include a focus on autoimmune
capability as an emergent behavior.
Principal Component Analysis for Feature
Extraction
The extreme amount of approach to feature
extraction in large data sets makes it difficult for current intrusion
detection approaches to identify attacks, especially in high-speed
connections.
Self-replicating Intrusion Detection
Most intrusion detection approaches rely
on pre-determined components that are coded and placed in the system. A potentially viable alternative is an
approach that grows and adapts to the particular environment that it is
operating in. This may increase
effectiveness and reduce complexity of the intrusion detection approach.
Self-Authorizing Systems
This research will focus on the
development of an authentication approach for trusted computing systems that is
based on the fact that the ability of an entity to gain access to information
is confirmation of their authorization.
Aggressive Misuse Detection
Most intrusion detection systems utilize
a passive observe and identify approach which rely on the presentation of the
correct sequence of activity to correctly detect an attack. This research
would focus on the development of an autonomous approach that would be capable
of adaptively pursuing potential ÒleadsÓ as it aggressively hunts the attacker
in the data stream. This research should focus on detection speed instead
of perfect accuracy.
Self-organized Criticality/Scale-free
self-organization
Do self-organizing systems perform better
based on power law distributions or as random connections within the problem
space?
Competitive Swarms
Existing swarm intelligence approaches
assume a fundamental level of cooperation among the agents. This may
limit the capabilities of the entire system as well as contributing to the
unpredictability of emergent behavior.
Self-organizing Network
This research will expand on the benefits
of a Random Boolean Network, but where the connections are motivated by a
self-organizing process.
Artificial Stem Cells
Neural networks must be designed and
modified as a complete system. This research will focus on the
development of neural Òstem cellsÓ which have the ability to evolve based on
the characteristics of the local environment. The neural stem cells will
probably require lifetimes. If they are unnecessary to the optimal
network they should be pruned to reduce complexity.
Distributed
Reasoning
This research will focus on the
development of a reasoning approach that emerges as an artifact of the
self-organization of simple distributed components.
Distributed Learning
Can learning occur without changes in
behavioral characteristics (i.e., can learning be a cooperative process that
emerges without changes to individual agents)?
Predictive Emergence
Emergence is a hallmark of
self-organizing systems. Unfortunately, it is usually impossible to predict
and anticipated with all the excitement of a child on Christmas eve. Is
it possible to predict, and therefore influence, emergent behavior in
self-organizing systems?
Fractals/self-similarity in neural
systems
Preliminary work has been conducted on
fractal neural networks. Most of this work has focused on the ability to
apply a higher level of abstraction to neural modeling. There may also be
an opportunity to apply this work to network-based anomaly detection.
Network Rating Model
The Rainbow Series was used by NSA to
evaluate Trusted Computing Bases (TCB).
No similar method of objectively evaluating disparate networks has been
devised.
Data Reduction in Network Data Streams
using Wavelets or other approaches
Wavelets have been applied to the
detection of unusual activity in network data streams. The approach may also enable the system
to reduce the data necessary to detect intrusions to only relevant data
elements.
Back-tracking of Network Attacks
Even when intrusion detection is
successful, there is no viable approach to tracking the intrusive activity back
to its source.
Potential Projects
Updated 8/28/09
Each of these areas are possible research projects
for students in ÒResearch inÉÓ courses.
These projects are too limited for dissertation research, though they
could serve as the foundation for acceptable dissertation research.
Minimum Data Set for Effective Intrusion
Detection in Wireless Networks
What data elements need to be collected
and analyzed for various wireless attacks?
Pruning of Rules in Expert Systems to
Increase Performance
Expert systems are recognized as useful
tools for many applications, but a method of accurately pruning unused rules
may increase the efficiency of expert systems.
Accurate Attack Modeling
Current attack models include attack
trees and pseudo code. Nether of
these is useful for automated intrusion detection approaches.
Illusory Security
Make a protected system appear stronger
than it really is, which may provide intrusion prevention.
Deceptive Security
An approach that makes it appear that
systems strengths are actually weaknesses so that actual vulnerabilities may be
ignored by an attacker.
Real-time Risk Monitor (three
possibilities)
1.
Automated alert function that notifies the user when risk appetite is
exceeded due to changes in the system.
2.
A risk analysis model that can incorporate near real-time changes in the
protected environment to more accurately track overall risk.
3.
A risk analysis model that addresses the unique characteristics of
wireless networks.
Adaptive Obscurity
Security through obscurity is an
acceptable, if not entirely successful, risk mitigation approach. A method of adaptively modifying the ability
of the protected system to hide from potential attackers.
Attack Indicators
What is the set of representative
indicators of a system under attack?
Based on available metrics, what does an attack look like?