Grant: Department of National Defence / NSERC Research Partnership

The proposed project focuses on the detection of abnormal behavior in computer hosts. It aims to improvesignificantly the efficiency, accuracy and timeliness of online anomaly detection and the lowering of falsealarm rates by targeting three unprecedented targets. Firstly, more observation points from all layers ofexecution on the host computer must be available for detection analysis. A number of observationstechnologies will be selected (antivirus, host-based intrusion detection systems, performance monitoringsystems, software tracers and profilers, etc.), improved and new ones developed, and then harmonized tocombine all available types of captured data into an enhanced data for further detection analysis. Secondly, thisenhanced data plus the latest results of detection analysis will be captured online in a specialized centralizeddata store, which will make its content available for other modules of the surveillance infrastructure. Thirdly, anumber of advanced anomaly detection technologies will be improved and new ones developed to detect onlinevery hard to detect undesired software anomalies (such as the ones caused by complex malware infection andalready installed rootkits) in the operating system. The surveillance infrastructure will allow the running ofmany complementary harmonized detection mechanisms in parallel to address this multivariate problem.Thanks to the new software tracer LTTng, the whole surveillance infrastructure will be madefeedback-directed. This new capability will be especially designed to add the needed flexibility and adaptabilityto the infrastructure (to face leading-edge hidden cyber threats). An extensive scalable knowledge base of theoperating system kernel will be developed to support these new detection capabilities. Finally, the wholesurveillance infrastructure will be made interoperable with network-level surveillance systems for being able tocontribute to national-level cyber surveillance operations. Its scalability will allow the integration of newleading-edge techniques as they become mature, and the ability of saving on disk the observations anddetection analysis results will greatly help offline forensic investigations and software improvement.