Emerald Mission-Based Correlation System - An Experimental Data Analysis of Air Force Research Laboratory (AFRL) Air Force Enterprise Defense (AFED) Information Security (INFOSEC) Alarms

摘要

This project was established to experiment on the efficacy of the SRI EMERALD Mission-based Correlation System (M-Correlator) in analyzing INFOSEC device aloft in the Air Force Research Laboratory Information Directorate (AFRL/ IF) Air Force Enterprise Defense (AFED) System. A large set of ISS RealSecure alerts produced within the AFRL network computing environment was analyzed by SRI using M-Correlator. Review of the M-Correlator experimental results identified a significant incident reduction capability, coupled with an effective alert ranking system. M-Correlator provided two orders of magnitude reduction in aloft, and effectively isolated highest-threat security incidents in the experimental date set. Further development may integrate a future M- Correlator release into the AFRL AFED system.