Senior Project - SINBAD

Real-Time Intrusion Detection (RTID) systems attempt to determine when and how systems might be compromised by external attacks on the systems, for instance, an unauthorized user obtaining passwords of legitimate users and accessing confidential data. While there are a number of systems that detect possible attacks, they tend to generate many false positives, i.e. they report large numbers of incidents as possible attacks that, after analysis, turn out to be normal activity. Analyzing these incidents to determine if they are indeed an attack is a very tedious and time-consuming task.

The goal of the project was to research the possibility of automating this process. The approach was to develop a system that profiled normal activity on a per user basis, and with the use of a neural network, compares potential attacks to normal activity to determine if the suspected attack was real or not.