UNICORN: misuse detection for UNICOS

Authors:
Gary G. Christoph;Kathleen A. Jackson;Michael C. Neuman;Christine L. B. Siciliano;Dennis D. Simmonds;Cathy A. Stallings;Joseph L. Thompson
Affiliations:
Computing, Information and Communications Division, Los Alamos National Laboratory, Los Alamos, New Mexico;Computing, Information and Communications Division, Los Alamos National Laboratory, Los Alamos, New Mexico;Computing, Information and Communications Division, Los Alamos National Laboratory, Los Alamos, New Mexico;Computing, Information and Communications Division, Los Alamos National Laboratory, Los Alamos, New Mexico;Computing, Information and Communications Division, Los Alamos National Laboratory, Los Alamos, New Mexico;Computing, Information and Communications Division, Los Alamos National Laboratory, Los Alamos, New Mexico;Computing, Information and Communications Division, Los Alamos National Laboratory, Los Alamos, New Mexico
Venue:
Supercomputing '95 Proceedings of the 1995 ACM/IEEE conference on Supercomputing
Year:
1995

Citing 2
Cited 3

NADIR: an automated system for detecting network intrusion and misuse

Computers and Security
NERD: Network Event Recording Device: an automated system for network anomaly detection and notification

SNDSS '95 Proceedings of the 1995 Symposium on Network and Distributed System Security (SNDSS'95)

Real-time network-based anomaly intrusion detection

Real-time system security
ELICIT: a system for detecting insiders who violate need-to-know

RAID'07 Proceedings of the 10th international conference on Recent advances in intrusion detection
Detection of anomalies from user profiles generated from system logs

AISC '11 Proceedings of the Ninth Australasian Information Security Conference - Volume 116

Quantified Score

Hi-index	0.00

Visualization

Abstract

An effective method for detecting computer misuse is the automatic auditing and analysis of on-line user activity. This activity is reflected in the system audit record, by changes in the vulnerability posture of the system configuration, and in other evidence found through active testing of the system. In 1989 we started developing an automatic misuse detection system for the Integrated Computing Network (ICN) at Los Alamos National Laboratory. Since 1990 this system has been operational, monitoring a variety of network systems and services. We call it the Network Anomaly Detection and Intrusion Reporter, or NADIR. During the last year and a half, we expanded NADIR to include processing of audit and activity records for the Cray UNICOS operating system. This new component is called the UNICOS Real-time NADIR, or UNICORN. UNICORN summarizes user activity and system configuration information in statistical profiles. In near real-time, it can compare current activity to historical profiles and test activity against expert rules that express our security policy and define improper or suspicious behavior. It reports suspicious behavior to security auditors and provides tools to aid in follow-up investigations. UNICORN is currently operational on four Crays in Los Alamos' main computing network, the ICN.