Topic: New software aims to snare hackers

[bat69]

New software aims to snare hackers

A suspected crooked insider at a New York software company sells consumer-credit reports to identity thieves, at roughly $54 a pop, in a high-tech scam prosecutors say victimises thousands.

An unemployed British computer administrator fights extradition to face federal charges in Virginia and New Jersey that he hacked into 92 separate US military and government networks, often getting past easy-to-guess passwords to download sensitive data.

These and other recent data intrusions, whose authors are typically intent on theft, sabotage or cyberterrorism, have given rise to a promising profiling strategy aimed at preventing online break-ins as they happen.

Just as authorities use profiling to guard against criminals at ports and borders, researchers at the State University of New York at Buffalo are developing software that can generate highly personalised profiles of network users by analysing the sequences of commands entered at each computer terminal.

The system - a prototype is likely to be ready for intensive testing this year - could provide a high-grade layer of protection for military installations and government agencies as well as banking or other commercial networks that require especially tight monitoring.

The software draws up regularly updated profiles by closely tracking over time how each person performs an array of routine tasks, such as opening files, sending email or searching archives.

Designed to tell if someone has strayed into an unauthorised zone or is masquerading as an employee using a stolen password, the program keeps watch for even subtle deviations in behaviour.

Alerted to anomalies, network administrators then begin monitoring more aggressively to assess whether pilferage is in progress.

"The ultimate goal is to detect intrusions or violations occurring on the fly," said chief researcher Shambhu Upadhyaya, a SUNY computer science professor.

"There are systems that try to do this in real time but the problem is it results in too many false alarms."

Keeping false alarms to a manageable minimum is key, but extremely difficult to achieve, said Bruce Schneier, a network security and cryptography expert and author of Secrets & Lies, Digital Security in a Networked World.

"These systems live and die on false alarms," said Schneier.

"You see this problem in facial recognition, trying to catch terrorists by recognising faces in airports. All those trials failed miserably."

The university is one of 36 research and teaching centres designated by the National Security Agency since 1998 to help safeguard America's information technology systems.

Aided by doctoral student Ramkumar Chinchani and Kevin Kwiat of the Air Force Research Laboratory, Upadhyaya began examining in 1999 whether monitoring simple user commands instead of network traffic might produce faster, more effective monitoring.

Some computer-security products that feature user-profiling seek out deviations on the basis of huge amounts of data flowing through entire networks. They're typically 60% to 80% reliable, whereas simulation tests indicated the new software would be up to 94% reliable, Upadhyaya said.

The software borrows from risk-analysis economic models. And even if it proves successful, the software would be just one tool of the many needed to defend computer security, Upadhyaya said.

"Hackers are a step ahead of you always," he explained, noting that the military "is especially worried about the insider who's been there a long time and learned all the loopholes."