Grant: Engage Plus Grants Program

Computer networks are playing the role of nerve systems in many critical infrastructures, governmental andmilitary organizations, and enterprises today. Existing technologies in network and host-based intrusiondetection systems (IDSs) and vulnerability analysis are all useful but may be insufficient by themselves. Themain objective of the proposed project is to further our previous ENGAGE project towards the ultimate goal ofhaving a comprehensive solution for correlating information obtained from different sources, including IDSsand vulnerability scanners, to defend enterprise networks. Above Security Inc. has been providing managedsecurity monitoring and strategic consulting services to more than 250 private and government organizations in22 countries for over a decade. A new project coded Cerberus has been recently launched to introduce thesemantic alert correlation and asset management functionalities. This proposed research will continue ourprevious effort on asset management. Specifically, we will conduct passive asset detection from network trafficand correlate network IDS alerts to logging information on the target host, which have both been identified asthe two tasks with the highest priority in the ongoing Cerberus project. This project will have immediatetechnological and economical benefits to Canada since it will produce a whole set of deliverables that can leadto better network security products and services and improve Canada's cyber security.