New Ideas

1
Explaining Recovering from Computer Break-ins

• New Ideas
• Forensic analysis of intrusions uses database of
  current vulnerabilities and exploits
• Analysis drives explanation-based recommendation
  of steps for recovery and prevention
• Automated reporting from sites updates database
  used in analyzing subsequent attacks

Impact
Schedule
FY00
FY99
FY98

• DoD Information Security improved by DERBI
  providing expertise to widely distributed,
  minimally trained System Administrators
• Crisis response improved by current information
  distributed via database
• Downtime and exposure minimized by nullifying
  current attacks
• Situation awareness raised by reporting coverage
  and accuracy

Exploit database
Intrusion indicators knowledge base
Evidential correlations among indicators
Explanation and reporting
Recovery and repair
Artificial Intelligence Center, SRI
International Mabry Tyson