NSF awards $3 million to improve intrusion detection framework

The National Science Foundation has awarded a grant of almost $3 million to the International Computer Science Institute (ICSI) and the National Center for Supercomputing Applications (NCSA) to improve a widely used open-source program for detecting security intrusions. The three-year project is led by Robin Sommer and Vern Paxson at ICSI and Adam Slagell at NCSA.

The Bro intrusion detection framework monitors network traffic for suspicious activity and unauthorized deviations from established security policies. It was originally developed in 1996 by Paxson, who continues to lead the project jointly with Sommer. Unlike other intrusion detection systems, the core of the Bro system is not tied to any particular detection approach; instead it provides a flexible platform for performing complex analysis tasks. While the system is widely used by universities, research labs, supercomputing centers, and science communities, Bro is still primarily a research platform and requires a high level of expertise from users to deploy it effectively.

This project will improve Bro by:

1. providing extensive documentation and support;
2. unifying and modernizing the Bro code base;
3. improving Bro’s processing performance to the degree required for operation in current and future large-scale scientific environments;
4. adding new data analysis functionality in the form of a highly interactive graphical user interface and a transparent database interface.

“The goal is to achieve better security and stability for NSF resources protected by Bro,” said Slagell. “Also, we are building the user community to address software sustainability issues. We want to make it easy for users to contribute and to provide a central place for that.”

“This project gives us the opportunity to specifically address feedback we’ve gotten from Bro users and to really focus on the end-user perspective,” said Sommer. “We’ll be able to refine many of the rough edges the system has accumulated over time.”

NCSA has used Bro for almost 10 years and plans to employ Bro to monitor the Blue Waters sustained-petaflop supercomputer. Blue Waters will employ more than 300,000 compute cores and hundreds of Gigabits of network infrastructure, and this project is critical to scaling Bro to meet the challenge of such a large system.

About ICSI

The International Computer Science Institute is a non-profit research institute located in Berkeley, California and affiliated with the University of California, Berkeley. For over 20 years, ICSI has provided a collaborative environment where prominent computer science researchers from all over the world pursue cutting edge research on a variety of fundamental topics in computer science.

About NCSA

The National Center for Supercomputing Applications, located at the University of Illinois at Urbana-Champaign, provides powerful computers and expert support that help thousands of scientists and engineers across the country improve our world.

Disclaimer: Due to changes in website systems, we've adjusted archived content to fit the present-day site and the articles will not appear in their original published format. Formatting, header information, photographs and other illustrations are not available in archived articles.