A progress report on UNICOS misuse detection at Los Alamos
J.L. Thompson, K.A. Jackson, C.A. Stallings, Dennis D. Simmonds, Christine L. B. Siciliano, G.A. Pedicini · University of North Texas Digital Library (University of North Texas) · 1995
An effective method for detecting computer misuse is the automatic monitoring and analysis of on-line user activity. During the past year, Los Alamos enhanced its Network Anomaly Detection and Intrusion Reporter (NADIR) to include analysis of user activity on Los Alamos` UNICOS Crays. In near real-time, NADIR compares user activity to historical profiles and tests activity against expert rules. The expert rules express Los Alamos` security policy and define improper or suspicious behavior. NADIR reports suspicious behavior to security auditors and provides tools to aid in follow-up investigations. This paper describes the implementation to date of the UNICOS component of NADIR, along with the operational experiences and future plans for the system.