Maria Zhdanova, researchermanager

1
FET Universal Techniques of Anomaly (Change)
Detection

• Maria Zhdanova, researcher-manager
• LLC Laboratory of Network Technologies, Moscow,
  RF

2
Contents

• LLC Laboratory of Network Technologies in
  brief history, expertise, vital statistics and
  associates
• Current RD activities development and software
  implementation of novel effective techniques for
  anomaly detection in heterogeneous computer
  networks
• Ideas of cooperation advantages of the approach,
  possible areas of application and corresponding
  research activities

3
1. Companys Brief

• LLC Laboratory of Network Technologies small
  innovative enterprise, established in the 2004 on
  the base of a joint research laboratory.
• Expertise
• RD projects in the field of security threat
  detection in heterogeneous distributed IT -
  infrastructures
• consulting and outsourcing in computer network
  technologies
• teaching information and communication
  technologies
• Vital statistics
• location Moscow, Russian Federation
• number of employees / employees involved in
  research 20 / 6
• products software system SECURITY LOCATOR
• yearly turnover 250 000
• Investor Foundation for Assistance to Small
  Innovative Enterprises (FASIE)
• Collaboration Moscow Engineering Physics
  Institute (MEPhI)
• Partner Science Technology International Park
  Technopark
  in Moskvorechje

4
2. Current RD Activities

• Novel universal methods and algorithms of anomaly
  detection, classification and correlation using
  structured information on security events from
  multiple sources
• substantiated parameter selection and
  optimization
• security events normalization and correlation
• self-adapting object state classification and
  response
• multidimensional data analysis, statistics and
  biological computation applied to actual data
• Software system SECURITY LOCATOR for real-life
  environment testing of new techniques and
  security threat monitoring in a heterogeneous
  distributed IT infrastructure
• universal distributed multi-agent architecture
  for processing security events from multiple
  sources
• accumulation of structured data on network
  interactions (reduced to 1-5 of the raw)
• diverse and extensible set of analysis techniques
• visual analysis and reporting capabilities

5
3. Ideas of Cooperation

• The proposed technique offers advantages as
• effective localization of anomaly sources
• detection of new threats and unregistered
  misuses, including internal and timely
  distributed
• the second echelon of defense behind rapid
  rule-based systems to reduce false operation
  rates
• Effective techniques of anomaly detection are
  required in communications, manufacture and
  transport as a part of
• computer network audit and security information
  management systems
• networked and distributed information and process
  control systems
• Allowing for the specificity of the particular
  area of application such techniques can
  essentially improve
• security threat management and forensics
• operability control and malfunction diagnostics

6
Thank You for Your Kind Attention

• LLC Laboratory of Network Technologies (OOO
  LST)
• address Russia, Moscow, 115409, Kashirskoe
  shosse, 31
• tel. / fax [phone] / 7 (495)
  323-94-96
• url http//www.eyeadmin.com,
  http//www.ntlab.ru
• Maria Zhdanova, researcher-manager
• e-mail zh_maria_at_rambler.ru, mz_at_ntlab.ru
• FASIE http//www.fasie.ru/eng
• MEPhI http//www.mephi.ru
• Technopark in Moskvorechje
• http//park.mephi.ru