Improving Air Force Active Network Defense Systems through an Analysis of Intrusion Detection Techniques; Graduate Research Project

摘要

The main objective of this research is to highlight real world and exercise events that indicate our technologies, techniques, and processes for active network defense need to be improved. The research then presents four recommendations to improve DCC operations. These include: Transition or improve the current signature-based IDS systems to include the capability to query and visualize network flows to detect malicious traffic; re-dedicate training and OPTN efforts to fully utilize the latest host-based IDS tools already provided by DISA and CITS; integrate Host-based IDS monitoring into all echelons of current network defense organizations; and finally, establish dedicated network defense training on Host-based IDS for both network defenders as well as system administrators.