text:
Noc engineer Jobs16,568 Jobs
Filter Jobs
- Desktop or Network Engineer - CitrixApply on GlassdoorCategory: Information Technology Location: Bloomington, Illinois Seeking Desktop EngineerPro-Tech Search5.0 9 Reviews Pro-Tech SearchBloomington, ILApply on Glassdoor
- Senior Network EngineerApply on GlassdoorDescription • Troubleshoot and resolve advanced desktop, server, and network issues. Serve as an escalation point for all levels of Systems AdminBlueWave Computing4.4 36 Reviews BlueWave ComputingPeachtree Corners, GAApply on Glassdoor
- DNT Network Engineer III-IP , enterprise, and Charter Business. The candidate will also work with IPControl System Engineering TeamCharter Communications3.3 684 Reviews Charter CommunicationsMadison, WI
- DNT Network Engineer I-CMTS . Participates in network planning, network architecture design and engineering. Integrates communicationCharter Communications3.3 684 Reviews Charter CommunicationsMadison, WI
- DNT Network Engineer III-3rd Shift the customer experience. Leads in network planning, network architecture design and engineeringCharter Communications3.3 684 Reviews Charter CommunicationsMadison, WI
- Principal Network Engineer a single pane of glass, all backed by an industry–leading network operations center (NOC) and Help DeskContinuum Managed Services3.9 60 Reviews Continuum Managed ServicesBoston, MA
- Network Engineer At the heart of Zillow Group is the IT Operations group, and as an experienced Network EngineerZillow4.2 316 Reviews ZillowSeattle, WA
- Network Engineer Principal a substantial technology transformation. We are seeking a talented Senior Network Engineer to join the WasteWaste Management2.9 680 Reviews Waste ManagementHouston, TX
- Network Engineer Packet Core Data the position of Network engineer (Packet Core Data) within this department. We are operating in a multiEricsson-Worldwide3.6 2,910 Reviews Ericsson-WorldwideUnited States
- Network Engineering Manager production environment can be beautiful. You are an experienced network engineer who shares our valuesSquare4.4 131 Reviews SquareSan Francisco, CA
- Software Engineer, Network Engineering As a member of the Network Engineering team you will write tools to operate, manage and monitorSquare4.4 131 Reviews SquareSan Francisco, CA
- Senior Network Engineer : · Experience with Backbone policy, engineering, and operation · Experience with Edge policy, engineeringSony Playstation3.3 244 Reviews Sony PlaystationAliso Viejo, CA
- Sr. Infrastructure Administrator (Network Engineer) Administrator (Network Engineer) is to design, develop and support a large data center packet networkHeartland Payment Systems3.3 358 Reviews Heartland Payment SystemsPlano, TX
- Senior Network Engineer ethic. Strong network engineering background in a TCP/IP MPLS WAN environment. Requires the abilityA10 Networks3.1 57 Reviews A10 NetworksSan Jose, CA
- Senior Network Engineer We are currently seeking a Senior Level Network Engineer to join our in-house IT departmentFXCM, Inc.2.9 143 Reviews FXCM, Inc.New York, NY
- Network Engineer The position holder is responsible for design, configuration, day-to-day support, and capacity planning for the global LAN and WAN infrastructTate & Lyle2.5 83 Reviews Tate & LyleHoffman Estates, IL
- Senior Network Engineer The Senior Network Engineer will be responsible for the architecture, implementation, and scaleYodle3.2 308 Reviews YodleNew York, NY
- Lead Software Developer, Network Engineering science, engineering or related degree (additional experience may substitute) Agile DevelopmentGoDaddy3.5 461 Reviews GoDaddyScottsdale, AZ
- Staff NOC Engineer Overview: Staff NOC Engineer Are you passionate about your work? Are you lookingBlackhawk Network2.6 130 Reviews Blackhawk NetworkPleasanton, CA
- Network EngineerApply on GlassdoorLong View is seeking a dynamic Network Engineer to join our Denver, CO office. As a NetworkLong View Systems2.6 98 Reviews Long View SystemsDenver, COApply on Glassdoor
- Sr Network Engineer as a Network Engineer or equivalent. Cisco Call Manager experienced preferred. CCNA qualification preferredUSANA Health Sciences3.5 69 Reviews USANA Health SciencesSalt Lake City, UT
- Network Engineer PEAK6 is seeking a Network Engineer to join a team of talented, energetic, forward thinkingPeak6 Investments, Inc.2.6 77 Reviews Peak6 Investments, Inc.Chicago, IL
- Network Engineer 4 (Specialized Ser) locations. 5+ years network operations or network engineering experience. 3+ years of experienceWells Fargo3.3 9,828 Reviews Wells FargoChandler, AZ
- Network EngineerApply on Glassdoor/post sales engineering and technical delivery is a plusBayside Solutions3.3 42 Reviews Bayside SolutionsPleasant Hill, CAApply on Glassdoor
- NOC Technician while fueling incredible success for our customers. The NOC Technician is the first level of our NOCRocket Fuel Inc.3.7 154 Reviews Rocket Fuel Inc.East Lansing, MI
- Network Engineer Network Engineer Job Type: Full-Time Location: San Francisco, CA Department: Data CenterOpenTableOpenTable
- NOC Engineer than 8 data centers worldwide. NOC Engineers troubleshoot and resolve routine and complex networkProofpoint4.0 83 Reviews ProofpointDraper, UT
- Senior Network Engineer - High Frequency Trading FirmApply on Glassdoorand talented Senior Network Engineer to join our Networks team in New York. They have a high performance, lowAndiamo Partners4.7 20 Reviews Andiamo PartnersNew York, NYApply on Glassdoor
- Network Engineer/TechnicianApply on GlassdoorNetwork Engineer/Technician (Ft Myers/Naples) Fast paced Southwest Florida consultingSoftrim3.8 10 Reviews SoftrimNaples, FLApply on Glassdoor
- Network Engineer (Contract position) a Network Engineer contractor to join our team. The duration of this contract is through December 2015PatientKeeper Inc.3.6 15 Reviews PatientKeeper Inc.Waltham, MA
- Senior Network Engineer month, please continue reading. We're looking for an exceptional Network Engineer to join our teamWhitepages4.5 44 Reviews WhitepagesSeattle, WA
- Senior Network Engineer Senior Network Engineer Job Type: Full-Time Location: San Francisco, CA Department: DataOpenTable4.4 102 Reviews OpenTableSan Francisco, CA
- Senior Network Engineer We are looking for a talented Network Engineer to join our global infrastructure teamVolant Trading4.3 9 Reviews Volant TradingNew York, NY
- Manager, Network Engineering The Manager, Network Engineering is responsible for the high-level success of a business groupTelesystem4.0 1 Review TelesystemToledo, OH
Upload your resume to easily apply to jobs.
Hiring? Post a Job


text:
en he walked out of the tent with shining eyes.
At last it grew dark, and torches began to blaze in front of the booths.
"Shall we go home, Charmides?" said Glaucon.
"Oh, no!" cried the boy. "I haven't seen it all. I am not tired. It is gayer now than ever with the torches. See all those shining flames."
And he ran to a booth where a hundred little bronze lamps hung, each with its tongue of clear light. It was an imagemaker's booth. The table stood full of little clay statues of the gods. Charmides took up one. It was a young man leaning against a tree trunk. On his arm he held a baby.
"It is a model of the great marble Hermes in the temple of Hera, my little master," said the image maker. "Great Praxiteles made that one, poor Philo made this one."
"It is beautiful," said Charmides and turned away, holding it tenderly in his hand.
Glaucon waited a moment to pay for the figure. Then he followed Charmides who had walked on. He was standing on the bridge gazing at the water.
"Glaucon," he
nice little book for young readers about the discovery and excavation of Olympia.
Greg B.
When the economic downturn ends Matty Cruzs co... Read more
Cara Devon has always suffered curiosity and im... Read more
A telekinetic teenager. A telepathic child. A p... Read more
A century after an apocalyptic war reduces all... Read more
Fall in love with the Kensington siblings in th... Read more
See it as donating a moment of your social media time, every little thing helps us improve and stay online.
The list of books below is based on the weekly downloads by our users regardless of eReader device or file format.
See more popular titles from this genre.

subset: commoncrawl


text:
MR.Barak -are you blind too ? of course there -constituting a terror Group -there for should be treated like A terrorist among us // enough giving up to them = very strange we are building settlement and more settlement -to great monsters of terrorist among us ? WOW WOW ? what a blind and deaf and ignorant of Government we HAVE -do we have one ??? P>S i hope you +we we learn a lesson this time jail all of them with the maximum sentence expel all of them from there Settlement cut there subsidy ++ the list Go ON AND ON so let be shall be Writin shall be done
Yemen's Houthi rebels commit to peace plan in letter to UN chief, BBC reports (Haaretz)
from the article: Barak: Israel must treat Jewish extremists like a terror group


text:
Hide Your Login Page to Reduce the Chance of a WordPress Hackers Attack
Let me start by telling you that I am NOT a security guru. The fixes that I am going to tell you about will significantly reduce the odds of a hacker busting into your WordPress site. So, I really recommend … Read More
WordPress Hacker Attack
Once again, we were targeted with a wordpress hacker attack. One of my buddies websites that I keep on my server has been the weak point for my server for the last year. We have been hacked numerous times and it … Read More


text:
JARRYD Hayne endured another shaky moment in the 49ers' defeat against the Packers. This is how he saw it.
OFF the back of a 216-run opening stand from Cameron Bancroft and Shaun Marsh, Western Australia has posted a total of 350.
BRONCOS coach Wayne Bennett has provided the biggest talking point of the NRL Grand Final - but do you agree with the super coach? Have your say.
DAY one of the Matador Cup saw plenty of runs, with seven batsmen making centuries and one going past the 200-run barrier.
EVERYBODY didn't doubt it, but nobody really thought he'd do it despite his short odds in the market. Enter backstreet brawler Buffering and the knock out punch.
The MCC is delighted to announce its first Comedy @ the 'G, pre-match function for 2013.
Laugh along with some of Australia's top comics - including Lawrence Mooney, Xavier Michelides and Linda Beatty - while enjoying a two-hour snack food and beverage package with friends prior to the Geelong-Hawthorn AFL match.
Lawrence Mooney - With an encyclopedic knowledge and quick wit his sage advice on the prickly topic of women was a highlight of the ABC's Agony Uncles and his insightful one man show "Lawrence of Suburbia" won rave reviews at the 2012 Melbourne International Comedy Festival.
Xavier Michelides - Xavier has won awards, taken part in five Melbourne International Comedy Festivals, three Melbourne Fringe Festivals and performed stand-up all over Australia, supporting acts such as Steven Wright and Weird Al Yankovic.
Linda Beatty - With a magical Celtic harp, heavenly singing, and comic fairytales, Linda is a very unique comedian. Those who love comedy, Disney and cabaret will thoroughly enjoy Linda Beatty.
There is a maximum one guest per member. Guests will need a visitor ticket to access the ground and members should ensure they pre-purchase their visitor tickets for guests through the usual purchase points. A reserved seat on Level 2 to watch the match is also included.
Access to other member-only areas will require a Balcony pass which members need to apply for in advance. Advance applications for this match will open on Monday June 24 at 9.00am.
This function has sold out. To join the waiting list, please email your details to firstname.lastname@example.com.


text:
Written on: 20/08/2013 by pagman67 (1 review written)
Bad failure from thie outfit. 2 months wasted, loads of fob off e-mails from robot staff, a paltry 5% off rotten carrot to change my order
er and at the end of all that........NO GLASSES
If you have failed and cannot deliver in resonable time,ADMIT IT WHEN ASKED FIRST OF ALL. Don't string customers on for months or you will go out of buisiness. Oh and invest in a phone, they are really handy.
As rated by our community of reviewers
" Awesome Deals and Discounts!! " Read More
Written by nikitakhanna
" Prescription Sunglasses " Read More
" Kanken Classic " Read More
" Bon rapport qualité/prix " Read More
" DO NOT BUY FROM HERE!! " Read More


text:
|Publication number
|Publication type
|Application number
|Publication date
|May 16, 2002
|Filing date
|Aug 31, 2001
|Priority date
|Sep 1, 2000
|Also published as
|Publication number
|Alfonso Valdes, Keith Skinner
|Original Assignee
|Valdes Alfonso De Jesus, Keith Skinner
|Export Citation
|BiBTeX, EndNote, RefMan
|Patent Citations (91), Referenced by (50), Classifications (10), Legal Events (3)
|External Links: USPTO, USPTO Assignment, Espacenet
[0001] This is a continuation-in-part of U.S. patent application Ser. No. 09/711,323, filed Nov. 9, 2000 and entitled "Sensor and Alert Correlation in Intrusion Detection Systems," which is a continuation-in-part of U.S. patent application Ser. No. 09/653,066, filed Sep. 1, 2000 and entitled "Methods for Detecting and Diagnosing Abnormalities Using Real-Time Bayes Networks." Both of these patent applications are incorporated herein by reference. This application also claims priority under 35 USC �119(e) from co-pending Provisional patent application No. 60/287,514, filed Mar. 23, 2001, naming Alfonso de Jesus Valdes and Keith M. Skinner as inventors and entitled "Probabilistic Alert Correlation," which is incorporated herein by reference.
[0002] This invention was made with Government support under contract numbers F30602-99-C-0149 and N66001-00-C-8058 awarded by DARPA. The Government has certain rights in this invention.
[0003] The invention relates generally to intrusion detection, and more specifically to sensor and alert correlation in intrusion detection systems.
[0004] There are three main types of intrusion detection systems currently used to detect hacker attacks on computer networks: signature analysis systems, statistical analysis systems, and systems based on probabilistic reasoning. Signature analysis systems compare current data traffic patterns with stored traffic patterns representing the signature or profile of various types of hacker attacks. These systems generate an alert if the pattern of traffic received by the network matches one of the stored attack patterns.
[0005] Statistical analysis systems compare current data traffic patterns with statistical profiles of previous traffic patterns. These systems generate an alert if a current traffic pattern is significantly different from a stored profile of "normal" traffic. Examples of both statistical- and signature-based intrusion detection systems are described in Porras, et al., "Live Traffic Analysis of TCP/IP Gateways," Internet Society's Networks and Distributed Systems Society Symposium, March 1998.
[0006] Examples of intrusion detection systems based on probabilistic reasoning are described in U.S. patent application Ser. No. 09/653,066 entitled "Methods for Detecting and Diagnosing Abnormalities Using Real-Time Bayes Networks." In one such system, a Bayes network is established that includes models (called "hypotheses") that represent both normal traffic and attack traffic received by a computer network. Traffic actually received by the network is examined in real-time to identify its relevant characteristics or features, such as volume of data transfer, number of erroneous connection requests, nature of erroneous connection requests, ports to which connections are attempted, etc. Information about these relevant features is then provided to the Bayes network, which calculates a system belief (a probability) that the current network traffic is either normal traffic or attack traffic.
[0007] A typical intrusion detection system may include one or more sensors that monitor network traffic in the manner discussed above, and one or more other sensors that monitor network resources. A system operator or network administrator (usually a person) reviews all of the alerts generated by the system.
[0008] A major problem with existing intrusion detection systems is that they often provide misleading, incomplete, or low-quality information to the system operator; this may make it impossible to take proper steps to protect the network. For example, during a large-scale hacker attack each of the system's sensors may generate hundreds of alerts. Although each alert may be accurate, the sheer number of alerts could easily overwhelm the system operator. Moreover, false alarms can be triggered by normal traffic directed towards a malfunctioning network resource, such as a server. These false alarms could distract the system operator from alerts triggered by actual hacker attacks. Finally, most intrusion detection systems are unable to detect low-level attacks such as port sweeps, in which hackers slowly "probe" a network to discover its structure and weaknesses.
[0009] This invention uses probabilistic correlation techniques to increase sensitivity, reduce false alarms, and improve alert report quality in intrusion detection systems. In one preferred embodiment, an intrusion detection system includes at least two sensors to monitor different aspects of a computer network, such as a sensor that monitors network traffic and a sensor that discovers and monitors available network resources. The sensors are correlated in that the belief state of one sensor is used to update or modify the belief state of another sensor. For example, a network resource sensor may detect that a server is malfunctioning. This information is used to modify the belief state of one or more network traffic sensors so that normal network traffic directed towards the malfunctioning server does not trigger a false alarm.
[0010] In another example, a network resource sensor transmits its knowledge of network structure to a network traffic sensor. This information is used to modify the belief state of the network traffic sensor so that an attempt to communicate with a non-existent resource appears to be suspicious. By allowing different sensors to share information, the system's sensitivity to low-level attacks can be greatly increased, while at the same time greatly reducing the number of false alarms.
[0011] In another embodiment, probabilistic correlation techniques are used to organize alerts generated by different types of sensors. By comparing features of each new alert with features of previous alerts, rejecting a match if a feature fails to meet a minimum similarity value, and adjusting the comparison by an expectation that certain feature values will or will not match, the alerts can be grouped in an intelligent manner. The system operator may then be presented with a few groups of related alerts, rather than lots of individual alerts from multiple sensors.
[0012] Other features, objects, and advantages of the invention will be apparent from the description and drawings, and from the claims.
[0013]FIG. 1 shows a preferred intrusion detection system with coupled sensors.
[0014]FIG. 2 is a flowchart showing a preferred method for coupling sensors.
[0015]FIG. 3 shows a preferred intrusion detection system with coupled sensors and an alert correlation device.
[0016]FIG. 4 is a flowchart showing a preferred method for grouping alerts into classes of related alerts.
[0017]FIG. 5 is an example of an incident class similarity matrix as used in one embodiment.
[0018]FIG. 6 is an example of a display showing a correlated attack report.
[0019]FIG. 7 is an example of a display showing raw sensor alerts.
[0020]FIG. 8 is an example of a display showing the results of a preferred alert fusion process.
[0021]FIG. 9 is an example of a display showing the results of a preferred incident matching process.
[0022] Like reference symbols in the various drawings indicate like elements.
[0023] I. Introduction
[0024] In preferred embodiments, intrusion detection systems for computer networks include sensors that monitor both network traffic and network resources. Correlation techniques are used to increase system sensitivity, reduce false alarms, and organize alerts into related groups. The sensor and alert correlation techniques described below may be used in intrusion detection systems that include any type or mix of sensors. However, probabilistic sensors similar to those described in U.S. patent application Ser. No. 09/653,066 may provide advantages over other types of sensors.
[0025] Bayes networks are preferably used to perform the probabilistic reasoning functions described below. As is more fully described in U.S. patent application Ser. No. 09/653,066, Bayes networks include models (called "hypotheses") that represent some condition or state; probabilistic reasoning methods are used to determine a belief that a current observation corresponds to one of the stored hypotheses. Before a Bayes network performs an analysis, an initial belief (called a "prior probability") regarding the various hypotheses is established. During the analysis, a new belief based on actual observations is established, and the prior probability is adjusted accordingly. In the context of the embodiments described here, a relevant Bayes hypothesis might be "there is a stealthy portsweep attack against the computer network." Belief in the portsweep attack hypothesis would be strengthened if attempts to connect to several invalid or nonexistent ports are observed.
[0026] II. Intrusion Detection with Correlated Sensors
[0027] As was discussed above, intrusion detection systems typically have several independent sensors that gather different types of information. In preferred embodiments of this invention, the information gathered by the various sensors may be shared to improve overall performance of the intrusion detection system.
[0028] In a preferred intrusion detection system 100 shown in FIG. 1, sensors are coupled so that the belief state of one sensor (such as network resource sensor 103) affects the belief state of another sensor (such as network traffic sensor 101). Each sensor may then transmit alerts to a system operator or network administrator 105. These sensors need not be probabilistic sensors; for example, a sensor that keeps track of the number of servers in a network wouldn't need to generate a probabilistic output.
[0029]FIG. 2 illustrates a preferred method by which sensors are coupled or correlated. At step 201, a first (preferably probabilistic) sensor receives all or part of the belief state of a second (not necessarily probabilistic) sensor. The belief state of the second sensor may indicate an apparent normal, degraded, or compromised state of a monitored system resource, the existence or validity of supported services, or any other relevant belief state held by a sensor in an intrusion detection system. At step 203, a prior belief state of the first sensor is adjusted, the adjustment based at least in part on the second sensor's belief state. For example, the prior belief state of the first sensor or may be adjusted so that an erroneous transaction with a damaged or compromised network resource does not generate an alert. In another example, the prior belief state of the first sensor may be adjusted so that an attempted communication with a system server or resource that does not exist appears to be suspicious. By allowing different sensors to share information, the system's sensitivity to low-level attacks can be greatly increased, while at the same time greatly reducing the number of false alarms.
[0030] III. Alert Correlation
[0031] In another embodiment, probabilistic correlation techniques are used to organize alerts into classes or groups of related alerts. By comparing features of each new alert with features of previous alerts, and adjusting the comparison by an expectation that certain feature values will or will not match, the alerts can be grouped in an intelligent manner. Alerts may be grouped or organized in several different ways, depending on both the type of an attack and the structures of the intrusion detection system and the monitored network. For example, all alerts related to a specific attack (such as a denial of service attack) may be grouped together. Or, all alerts related to the various stages of a staged attack may be grouped together to allow the system operator to view the progression of a staged attack.
[0032] A. Alert Correlation Devices
[0033]FIG. 3 shows a preferred intrusion detection system 300 that includes a network traffic sensor 301 and network resource sensor 303. Intrusion detection system 300 may include any number of sensors, and the belief states of the sensors may be correlated in the manner discussed above. Alerts generated by sensors 301 and 303 are provided to an alert correlation device 305, which uses probabilistic reasoning (preferably Baysian) techniques to organize alerts into classes of related alerts. These alert classes are then provided to a system operator or network administrator 307.
[0034] B. Measurement of Similarity
[0035] To group alerts in an intelligent manner, it is necessary to define and determine the degree of similarity between a new alert and an existing alert or alert class. This measurement of similarity is preferably calculated by comparing similarity among shared features (also called "measures") of the alert and alert class. Examples of features to consider when assessing similarity between a new alert and an existing alert class include source IP address, destination IP address and port, type of alert, type of attack, etc. The nature of an alert may change the expectation of which features should be similar. It is therefore important to define a measurement of similarity to take into account which features are candidates for matching.
[0036] In the following discussion, X is defined to be the value of a feature or measure in a new alert, and Y is the value of that feature or measure in an existing alert class to which it is being compared. For features that have a single value, the features of a new alert and an existing alert class are defined to be similar if their feature values are equal. That is:
[0037] The more general case is one in which a feature of an alert includes a list of observed values, and a "hit count" of the number of times each value has been observed. For reasons of normalization, the hit count may be converted to a probability. In this sense, X and Y are lists of feature and probability values, possibly of different lengths. A probability vector describes a pattern over observed categories, where:
[0038] pX(C)=probability of category C in list X,
[0039] pY(C)=probability of category C in list Y,
[0040] PX=probability vector over categories observed for X,
[0041] PY=probability vector over categories observed for Y.
[0042] The notation CεX is used to denote that category C occurs in list X. The similarity of the two lists is given by:
[0043] If the two lists are the same length, then this measure gives the square of the cosine between the two. This has an intuitive geometric property that is not shared by, say, the dot product as is commonly used in the pattern matching literature.
[0044] If the patterns (1, 0), (0, 1), and (0.5, 0.5) are over the same two features, then:
[0045] In other words, the first two patterns are orthogonal, and the third is halfway in between.
[0046] C. Expectation of Similarity
[0047] As was discussed above, the nature of an alert may change an expectation of which features of a new alert and an existing alert class should be similar. For example, a syn flood is a type of attack in which the source IP address is typically forged. In this case, similarity in the source IP address would not be considered when assessing the overall similarity between a new alert triggered by a syn flood attack and an existing alert class.
[0048] In a preferred embodiment, the expectation of similarity is a feature-specific number between 0 and 1, with 1 indicating a strong expectation of a match, and 0 indicating that two otherwise similar alerts are likely not similar with respect to a specific feature.
[0049] An alert state is preferably represented as a probability vector over likely alert states. For each candidate alert state, each feature has a vector of the same length whose elements are the similarity expectation values (that is, numbers between 0 and 1) given the state. These expectation values may initially be assigned a value of about 0.6 to indicate a medium expectation of similarity, except where it is known that the expectation of similarity is either lower or higher. For example, in an access from a compromised host or a denial of service (DOS) attack, the attacker often spoofs (makes up) the source IP address. Therefore, the expectation values may initially be assigned a value of about 0.1, indicating a low expectation that the source IP address will match that of the attacker.
[0050] Based on the alert state, the similarity expectation may be dynamically generated as the weighted sum of the elements of an expectation table, with the weights from the (evolving) alert state distribution. This is itself an expectation in the statistical sense, conditioned on the belief over the present alert state. The similarity expectation is therefore general enough to cover the situation of an unambiguous alert or "call" from a signature-based sensor, in which case the distribution over states is 1.0 at the state corresponding to the alert or call and 0 elsewhere. For example, algebraically for a feature or measure J:
E J=ΣBEL(i)E J(i)iε{alert_states }
[0051] EJ=Expected similarity for measure J, given present state.
[0052] BEL(i)=Belief that the attack state is presently i.
[0053] EJ(i)=Element i of the lookup table of expected similarity for measure J given state i.
[0054] Both the new alert and the alert class to which it is being compared each compute the similarity expectation for each feature. Feature similarity and similarity expectation are then combined to form a single value of alert similarity. This is done by combining feature similarities and normalizing by similarity expectation, over the set of common features. For example:
[0055] X=Candidate meta alert for matching
[0056] Y=New alert
[0057] j=Index over the alert features
[0058] Ej=Expectation of similarity for feature j
[0059] Xj, Yj=Values for feature j in alerts X and Y, respectively (may be list valued)
[0060] A similar definition can be formed by taking products rather than sums above, and then taking the geometric mean. This has some advantages, but can be overly influenced by a single extremely small value.
[0061] Where appropriate, similarity expectation may also cover list containment and subnet similarity. For example, an intrusion detection system may generate two alerts, one from a network sensor and one from a host sensor. To decide if the target addresses of these two alerts are similar, the expectation of similarity might be that the target address in the alert generated by the host sensor would be contained in the list of target addresses in the network sensor's alert. In another example, an intermediate expectation of similarity may be generated if target addresses from two alerts do not match but appear to be from the same subnet.
[0062] D. Minimum Similarity Requirements
[0063] It may be possible to eliminate many of the similarity calculations discussed above if one or more features of an alert class are assigned a minimum similarity value. That is, if a feature of a new alert and the corresponding feature of an existing alert class do not match at some minimum similarity value, the new alert cannot be a member of that alert class. There is therefore no need to perform any additional similarity calculations comparing the new alert to that alert class. Certain features can be required to match exactly or approximately for a new alert to be considered as a candidate for an alert class.
[0064] E. Transition Models
[0065] When a new alert is encountered, all existing alert classes are preferably passed through their transition models to generate new prior belief states. Transition models attempt to assign a "time value" to alert confidence, as well as try to anticipate the next step in a staged attack. The "time value" is typically modeled as a multiplicative decay factor that reduces alert model confidence slowly over a period of days. The decay period varies by type of attack, and eventually decreases to some background level. This is used to downweight very old alert classes when there are multiple candidates to be compared with a new alert. Transition in time tends to decrease overall suspicion for a specific alert class, as well as spread suspicion over other hypotheses. That is, it tends to make the decision whether to group a new alert with an existing alert class less confident.
[0066] The ability to anticipate the next stage in a staged attack is also achieved by a transition in state. Internally, a transition matrix is maintained that expresses the probability of the next state in a staged attack, given the present state. Persistence (the fact that the next step may match the current) is explicitly captured. The transition gives a prior distribution over attack states that is assumed to hold immediately before the next alert is analyzed.
[0067] After the transition models generate new prior belief states for their respective alert classes, the similarity expectation for each feature in a new alert is updated. The similarity of the new alert to all existing alert classes is then computed. If none match above some similarity threshold, the new alert is defined to be a new alert class. Otherwise, it is assumed that the new alert is a continuation of the best-matching alert class. By including a list of contributing alerts in the alert class structure, full details of the new alert are retained.
[0068] F. Alert Correlation Method
[0069]FIG. 4 is a flowchart showing how alerts may be aggregated into classes of related alerts in a preferred embodiment. As was discussed above, both alerts and alert classes each have one or more distinguishing features that can be assigned different values. First, a set of potentially similar features shared by a new alert and one or more existing alert classes is identified (step 401). Next, an expectation of similarity between the features of the new alert and features of one or more existing alert classes is either generated or updated (step 403). Next, minimum similarity requirements for the features of the new alert and the features of one or more existing alert classes are generated or updated (step 404). After a comparison between the new alert and the existing alert class(es) is complete (step 405), the new alert is either associated with the existing alert class that it most closely matches (step 407), or new alert class is defined to include the new alert (step 409).
[0070] IV. Alternative Embodiments and Experimental Results
[0071] The inventors plan to present various alternative embodiments and experimental results during a conference in late 2001. Relevant portions of a paper submitted for publication during that conference are shown below.
[0072] Introduction
[0073] In response to attacks and potential attacks against enterprise networks, administrators are increasingly deploying intrusion detection systems (IDSs). These systems monitor hosts, networks, critical files, and so forth, using a variety of signature and probabilistic techniques. See, Porras, P. and Neumann, P. "EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances," National Information Security Conference, 1997; and Valdes, A. and Skinner, S. "Adaptive, Model-based Monitoring for Cyber Attack Detection", Recent Advances in Intrusion Detection (RAID 2000), Toulouse, France, October 2000. The use of such systems has given rise to another difficulty, namely, correlating a potentially large number of alerts from heterogeneous sensors. To the degree that this has been addressed in current systems, heuristic techniques have been used. In this paper, we describe a probabilistic approach to this critical problem.
[0074] The intrusion detection community is actively developing standards for the content of alert messages. See, Erlinger, M. and Stanniford, S. "Intrusion Detection Interchange Fonnat," published by the Internet Engineering Task Force. Systems adhering to these evolving standards forward attack descriptions and supporting diagnostic data to an alert management interface (AMI), which may be remotely located and consolidating the reports of numerous sensors. In anticipation of these standards, we are developing systems for alert correlation and ranking.
[0075] In Valdes, A. and Skinner, S. "Blue Sensors, Sensor Correlation, and Alert Fusion," Recent Advances in Intrusion Detection (RAID 2000), Toulouse, France, October 2000, sensor coupling and an initial approach to probabilistic sensor correlation were introduced. At the time, we demonstrated the utility of the coupled sensors approach for false alarm reduction and improved detection performance. We also introduced a correlation approach based on feature-specific similarity functions. The correlation example cited at that time consisted of a single sensor examining a probe that was distributed in time. Since then, we have introduced some important innovations:
[0076] Capability to comprehend heterogeneous sensors.
[0077] Introduction of the probabilistic minimum match criterion, which prevents spurious matches on less important features from causing the system to correlate alerts. By specifying minimum match of unity, this capability causes the system to function as a rule-based correlation system. Explicitly tolerating slightly imperfect matches provides an important generalization of rule-based correlation methods.
[0078] Hierarchy of sensor correlation: thread, incident, and correlated reports from multistep attack scenarios.
[0079] We have also gained considerable experimental experience in both live and simulated environments.
[0080] The remainder of this paper is organized as follows. We introduce our approach to alert fusion, using our defined alert template to report alerts from EMERALD and third-party sensors. We introduce notions of feature overlap, similarity, expectation of similarity, and minimum similarity. We show how these are used to achieve a hierarchy of alert correlation defined as inferred thread (within sensor), security incident (between sensor) and correlated attack report (between sensor and attack step). We then present preliminary results from the alerts generated by various EMERALD and third-party monitors.
[0081] Sensor Correlation and Alert Fusion
[0082] In Valdes, A. and Skinner, S. "Blue Sensors, Sensor Correlation, and Alert Fusion", Recent Advances in Intrusion Detection (RAID 2000), Toulouse, France, October 2000, probabilistic methods for sensor correlation were introduced. Specifically, we considered two closely coupled sensors, a TCP misuse monitor and an asset availability monitor. Both are based on Bayes inference (see, Pearl, J. "Probabilistic Reasoning in Intelligent Systems", Morgan-Kaufmann (1988)), and the former sensor is aware of the state of the latter. Sensor coupling in this fashion is easily expressed in Bayes formalisms; specifically, the coupling is achieved by dynamically modifying priors in the TCP session monitor. The approach demonstrated two important capabilities:
[0083] Failed accesses to services that appear to be invalid are viewed with greater suspicion than other failed accesses. This greatly increases sensitivity against certain stealth probe attacks.
[0084] Certain types of failed access to services that appear "down" are tolerated, so that when a service fails (for malicious or accidental reasons) we do not generate a large number of false alarms.
[0085] Having demonstrated the utility of sensor fusion for improved sensitivity and false alarm reduction, we have further explored the general problem of sensor correlation. In particular, we examine the situation of multiple heterogeneous sensors on diverse platforms, considering realistic problems of late reports and clock drift.
[0086] Our correlation algorithm considers features as reported in a standard alert template. For each matchable feature, we have defined an appropriate similarity function that returns a value between 0 and 1. New alerts are compared to a list of existing meta alerts. The overall similarity is the weighted average of the feature similarities, with expectation of similarity as the normalizing weights. If the minimum match criterion fails for any feature, the match is rejected regardless of the overall similarity. The new alert is correlated with the most similar meta alert, assuming the similarity is above a specified minimum match threshold. Otherwise, the new alert starts a new meta alert thread.
[0087] Meta Alerts and the Alert Template
[0088] We have defined an enhanced alert template that enriches standards (such as the Intrusion Detection Interchange Format published by the IETF) with respect to content while avoiding issues of language specifics. Our template includes the concept of alert thread, which is present in all EMERALD monitors and alert management components. Alert reports are part of the same thread if they are from the same sensor and refer to the same attack, possibly separated in time. Where provided, such as is the case with EMERALD monitors, the thread mechanism causes new reports for an existing thread to be treated as updates, dramatically reducing clutter on a display interface that comprehends threads. For this reason, we identified the capability to reliably infer thread when the sensor does not provide one as a very desirable capability of alert correlation.
[0089] We include an "anomaly" field in addition to the "confidence" field used in the evolving IETF standard. We also include arrays to describe in greater detail the target(s) of an attack (for example, the specific ports scanned). Finally, we include fields describing the sensor type and placement, enabling us to identify each unique instantiation of any sensor in the monitored domain.
[0090] This template is presently used by a diversity of sensors employing both signature and probabilistic techniques. This includes sensors that we have developed under the EMERALD program, as well as prototype wrappers for ISS RealSecure and Checkpoint Firewall-1. Our early experiments indicate that diverse sensors will be able to fill this template with content that will be more useful to correlation engines than is currently available.
[0091] Feature Similarity
[0092] Our probabilistic alert fusion approach preferably considers feature overlap, feature similarity, minimum similarity, and expectation of similarity. We maintain a list of "meta alerts" that are possibly composed of several alerts, potentially from heterogeneous sensors. For two alerts (typically a new alert and a meta alert), we begin by identifying features they have in common (feature overlap). Such features include the source of the attack, the target (hosts and ports), the class of the attack, and time information. With each feature, we have a similarity function that returns a number between 0 and 1, with 1 corresponding to a perfect match. Similarity is a feature-specific function that considers such issues as
[0093] How well do two lists overlap (for example, list of targeted ports)?
[0094] Is one observed value contained in the other (for example, is the target port of a denial-of-service (DOS) attack one of the ports that was the target of a recent probe)?
[0095] If two source addresses are different, are they likely to be from the same subnet?
[0096] For attack class similarity, we maintain a matrix of similarity between attack classes, with values of unity along the diagonal and off-diagonal values that heuristically express similarity between the corresponding attack classes. We prefer to consider attack classes rather than attack signatures, which are much more specific and numerous but may be erroneously or incompletely reported. For example, in our demonstration environment, we run a variant of mscan that probes certain sensitive ports, that is, it is of the attack class "portsweep." Our host sensors have a specific signature for this attack and call it "mscan." The Bayes sensor trades specificity for generalization capability and has no "mscan" model, but successfully detects this attack as a "portsweep". These reports are considered similar (S=1) with respect to attack class.
[0097] Not all sensors produce all possible identifying features. For example, a host sensor provides process ID, while a network sensor does not. Features not common to both alerts are not considered for the overall similarity match.
[0098] The meta alert itself supports the threading concept, so we can visualize composing meta alerts from meta alerts.
[0099] Situation-Specific Similarity Expectation
[0100] An important innovation we introduce is expectation of similarity. As with similarity, this is also between 0 and 1, and expresses our prior expectations that the feature should match if the two alerts are related, considering the specifics of each. For example, two probes from the same target might scan the same set of ports on different parts of our subnet (so expectation of matching target IP address is low). Also, some attacks such as SYN FLOOD spoof the source address, so we would allow a match with an earlier probe of the same target even if the source does not match (expectation of match for source IP is low).
[0101] We now give some examples of how expectation of similarity depends on the situation, that is, the features in the meta alert and the new alert.
[0102] If an alert from a sensor has a thread identifier that matches the list of sensor/thread identifiers for some meta alert, the alert is considered a match and fusion is done immediately. In other words, the individual sensor's determination that an alert is an update of or otherwise related to one of its own alerts overrides other considerations of alert similarity.
[0103] If the meta alert has received reports from host sensors on different hosts, we do not expect the target host feature to match. If at least one report from a network sensor has contributed to the meta alert and a host sensor alert is received, the expectation of similarity is that the target address of the latter is contained in the target list of the former.
[0104] In determining whether an exploit can be plausibly considered the next stage of an attack for which a probe was observed, we expect the target of the exploit (the features host and port) to be contained in the target host and port list of the meta alert.
[0105] Some sensors, particularly those that maintain a degree of state, report start and end times for an attack, while others can only timestamp a given alert. The former deal with time intervals, while the latter do not. Similarity in time comprehends overlap of the time intervals in the alerts considered for correlation, as well as the notion of precedence. We preferably do not penalize time similarity too far from unity if the time difference is plausibly due to clock drift.
[0106] Deciding whether the attacker is similar is somewhat more involved. In the case of an exact match of originating IP address, similarity is perfect. We assign high similarity if the subnet appears to match. In this way, a meta alert may potentially contain a list of attacker addresses. At this point, we consider similarity based on containment. In addition, if an attacker compromises a host within our network, that host is added to the list of attacker hosts for the meta alert in question. Finally, for attack classes where the attacker's address is likely to be spoofed (for example, the Neptune attack), similarity expectation with respect to attacker address is assigned a low value.
[0107] Minimum Similarity
[0108] Our correlation component implements not just expectation of similarity (which effectively acts as a weight vector on the features used for similarity matching) but may also enforce situation-specific minimum similarity. Certain features can be required to match exactly (minimum similarity for these is unity) or approximately (minimum similarity is less than unity, but strictly positive) for an alert to be considered as a candidate for fusion with another. Minimum expectation thus expresses necessary but not sufficient conditions for correlation.
[0109] The overall similarity between two alerts is zero if any overlapping feature matches at a value less than the minimum similarity for the feature (features for which no minimum similarity is specified are treated as having a minimum similarity of 0). Otherwise, overall similarity is preferably calculated as the weighted average of the similarities of the overlapping features, using the respective expectations of similarity as weights.
[0110] By appropriate settings of similarity expectation and minimum similarity, the correlation component achieves the following hierarchy of correlation. The system is composable in that we can deploy multiple instances to obtain correlation at different stages in the hierarchy. For example, we can infer threads (within sensor correlation) and then correlate threaded alerts from heterogeneous sensors into security incidents.
[0111] Synthetic Threads: For sensors that do not employ the thread concept, the correlation may synthesize threads by enforcing high minimum expectation similarity on the sensor itself (the thread must come from a single sensor) and the attack class, as well as source and target (IP and ports). We have wrapped the alert messages from a leading commercial sensor and observed that this facility reliably reconstructs threads.
[0112] In particular, by placing an aggregator component topologically close to an IDS, the pair is made robust against attacks that cause the IDS itself to flood, as described in the recent National Infrastructure Protection Center advisory 01-004.
[0113] Security Incidents: By suppressing minimum expectation of similarity on the sensor identifier, and relaxing expectation of similarity for this feature, we can fuse reports of the same incident from several heterogeneous sensors into a single incident report. In this case, we enforce a moderately high expectation of similarity on the attack class. This is not unity because different sensors may report a different attack class for the same attack. We construct a table of distances between attack classes that expresses which ones are acceptably close. For security incident correlation, we enforce minimum expectations on the source and target of the attack. Using this technique, we have been able to fuse alert reports from commercial and EMERALD sensors into security incident reports.
[0114] Correlated Attack Reports: By relaxing the minimum expectation of similarity on the attack class, we are able to reconstruct various steps in a multistage attack. Each stage in an attack may itself be a correlated security incident as described above. In this fashion, it is possible to recognize a staged attack composed of, for example, a probe followed by an exploit to gain access to an internal machine, and then using that machine to launch an attack against a more critical asset.
[0115] Feature Fusion
[0116] When the system decides to fuse two alerts, based on aggregate similarity across common features, the fused feature set is a superset of the features of the two alerts. Feature values in fused alerts are typically lists, so alert fusion involves list merging. For example, suppose a probe of certain ports on some range of the protected network matches in terms of the port list with an existing probe that originated from the same attacker subnet, but the target hosts in the prior alert were to a different range of our network. The attacker address list has the new attacker address appended, and the lists of target hosts are merged. The port list matches and is thus unchanged.
[0117] Two important features are the sensor and thread identifiers of all the component alerts, so that the operator is always able to examine in detail the alerts that contribute to the meta alert report.
[0118] One additional feature is the priority of the meta alert, supported by our template and provided by EMERALD sensors. We are developing a component that estimates criticality based on the assets affected, the type of attack, the likelihood of attack success, and an administrative preference. The aggregator maintains the high water mark for this field. We are investigating approaches whereby the contributing threads are permitted to update their priority downward, computing meta alert priority as the maximum across thread priorities at any given time. This approach would permit downward revision of the meta alert priority.
[0119] The features presently considered in the probabilistic correlator component include sensor identification (identifier, location, name), alert thread, incident class, source and target IP lists, target TCP/UDP port lists, source user id, target user id, and time. Computations are only over features that overlap in the alert to be merged and the candidate meta alert into which it is to be merged. Incident signature is used as well, but with a low expectation of similarity as these vary widely across heterogeneous sensors.
[0120] If present, a thread identifier from the reporting sensor overrides other match criteria. A new alert that matches the sensor and thread of an existing meta alert is considered an update of the earlier alert.
[0121] The correlator first tries to infer a thread by looking for an exact match in sensor identification and incident class and signature. Note that alerts that are inferred to be from the same thread may be separated in time. The system attempts to infer threads even in incident and scenario operational modes.
[0122] Next the system checks that all overlapping features match at least at their minimum similarity value. Setting minimum expectation for some features to unity (not normally recommended) causes the system to behave like a heuristic system that requires exact matches on these features. Given that this criterion passes, we compute the overall similarity between the two alerts as follows:
[0123] X=Candidate meta alert for matching
[0124] Y=New alert
[0125] j=Index over the alert features
[0126] Ej=Expectation of similarity for feature j
[0127] Xj, Yj=Values for feature j in alerts X and Y, respectively (may be list valued)
[0128]FIG. 5 is an example of an incident class similarity matrix. Incident class similarity is based on a notion of proximity, which at present is the result of our judgment. The proximity of class A to B reflects how reasonably an attack currently of incident class A may progress to class B. Note that this is not symmetric; we more strongly expect an exploit to follow a probe than the other way around. The incident classes shown in FIG. 5 are from the EMERALD 602 message format, but any useful incident classes may be used. Note that some "default" classes such as "invalid" and "action logged" are reasonably proximal to most other classes. This is because the IETF standard does not require a common ontology, and reports from heterogeneous sensors for the same incident may not reliably represent this field. As such, we do not want to reject potential matches based on this field alone. For operational modes other than thread level aggregation, we do not recommend a high minimum similarity value for this field.
[0129] For two alerts that are extremely close in time, it is possible that the alerts may not be in time order. In this case, incident class similarity is the greater of SIM(X, Y) and SIM(Y, X). Mathematically, the similarity computation for incident class can comprehend a discrete call (the alert is from one of the above classes) or a call that is a probability distribution over the above classes (as might result from a meta alert in which the contributing sensors do not agree on the class).
[0130] Most other features are potentially list-valued. For lists, the notion of similarity generally expresses the fraction of the smaller list that is contained in the larger. For source IP addresses, similarity also attempts to express the notion that the addresses in question may come from the same subnet.
[0131] Time similarity is preferably a step function that drops to 0.5 after one hour. A close match in time is expected only when the system operates in "incident" mode. Thread and scenario aggregation may be over time intervals of days.
[0132] Results
[0133] Live Data
[0134] The following is an example of alert correlation over time, in this case correlating alerts that are components of a stealthy port sweep. The following is an example of one of the contributing alerts. In the interest of space, we do not include all the content that is in the alert and meta alert templates, but limit ourselves to the fields needed to illustrate the result.
[0135] Thread ID 69156 Class=portsweep BEL (class)=0.994 BEL(attack)=1.000
[0136] 2001-06-15 17:34:35 from 126.96.36.199 ports 1064 to 1066 duration=0.000
[0137] dest IP aaa.bbb.30.117
[0138] 3 dest ports: 12345{2} 27374{3} 139
[0139] This is a probe for three vulnerable ports on a single IP address in the protected network, and is detected by the system described in Valdes, A. and Skinner, S. "Adaptive, Model-based Monitoring for Cyber Attack Detection," Recent Advances in Intrusion Detection (RAID 2000), Toulouse, France, October 2000. The above is just a single step in a probe that apparently transpired over several days, and resulted in the following correlated meta alert.
[0140] Meta Alert Thread 248 Source IPs source_IParray: 184.108.40.206 184.108.40.206
[0141] Target IPs target_IParray: aaa.bbb.30.117 aaa.bbb.6.232 aaa.bbb.8.31 aaa.bbb.1.166 aaa.bbb.7.118 aaa.bbb.28.83 aaa.bbb.19.121 aaa.bbb.21.130 aaa.bbb.6.194 aaa.bbb.1.114 aaa.bbb.16.150
[0142] From 2001-06-15 17:34:35 to 2001-06-21 09:19:57 correlated_alert_priority −1
[0143] Ports target_TCP_portarray: 12345{4} 27374{4} 139{3}
[0144] Number of threads 10 Threads: 69156 71090 76696 84793 86412 87214 119525 124933 125331 126201 Fused: PORT_SCAN
[0145] We note that we have correlated events from two source addresses that were judged to be sufficiently similar. The attack is quite stealthy, consisting of a small number of attempted connections to single target hosts over a period of days. The list of thread identifiers permits the administrator to examine any of the stages in the attack. In this case, each attack stage is considered a portsweep; if the stages consisted of different attack classes, these would be listed under "Attack steps". Over the three week time period containing this attack, the IDS sensor processed over 200,000 sessions and generated 4439 alerts. The probabilistic correlation system produced 604 meta alerts.
[0146] Experimentation Environment
[0147] The experimentation environment simulates an electronic commerce site, and provides Web and mail services over the Internet. The protected network is behind a firewall, and is instrumented with several host, network, and protocol monitors. Two machines are visible through the firewall, and two auxiliary machines are used for network monitors and alert management. The firewall blocks all services other than Web, FTP, and mail. We have simulated traffic that appears to come from a number of sources, and an attacker who executes certain well-known attacks. The background traffic includes legitimate anonymous and nonanonymous FTP use; the latter triggers false alarms in some signature sensors. There are also low-priority nuisance attacks, as well as low-level failed accesses to blocked ports, which trigger firewall log messages.
[0148] The attack begins with an MSCAN probe to the two machines visible through the firewall. Signature-based sensors on the two machines detect this and set the attack code for mscan in their alert report. The Bayes network sensor detects the attack as of the class "portsweep". The target port lists for these alerts match, as does the attacker address. Similarity with respect to the target address depends on the order in which the alerts arrive (the order at which the alerts arrive is not deterministic as the sensors are distributed). Until the network sensor's alert is received, we do not expect target addresses to match for distinct sensors, since a host sensor can typically report only its own address as a target. We expect the network sensor's target list to contain the targets seen by host sensors (tolerating imperfect matches due to arrival order), and we expect the target address of subsequent host alerts to be contained in the meta alert's target host list. Therefore, regardless of arrival order, these alerts are acceptably similar with respect to target host.
[0149] The attacker next uses a CGI exploit to obtain the password file from the Web server. This exploit is detected by the host sensor. The next stage of the attack is a buffer overflow to gain access on the host providing mail service, detected by an EMERALD host sensor as well as by ISS.
[0150] Although telnet through the firewall is blocked, the attacker may telnet (using a password obtained from the earlier exploit) from the compromised internal host to the critical host, and he now does so. On that host, he uses another overflow attack to obtain root access. He is now free to change Web content.
[0151]FIG. 6 shows the EMERALD alert console for this scenario, containing alert reports for the above attack steps as well as alerts due to false alarms and nuisance attacks. It is not very informative, except to show that more than 1000 alerts are received for this scenario, which lasts approximately 15 minutes, and the critical attack is effectively buried.
[0152] The majority of the alerts are from nonanonymous FTP write operations, which are allowed but trigger alerts from a commercial sensor.
[0153]FIG. 7 shows the result of inferring synthetic threads for sensors that do not support the threading concept. For alert thread inference, we preferably set the minimum match for sensor identifier fields to unity, and require a high match for attacker and target parameters as well; we do not require a minimum similarity in the time field to allow inference of threads that occur slowly over time. Most of the alerts are threaded into sessions according to originating IP address, and the total number of alerts reported is reduced to about sixty. We have highlighted an alert, which is one of the nuisance TCP sweep attacks in the background traffic.
[0154] For attack incident matching, we must look across sensors to determine if several alerts refer to the same security incident. We preferably suppress minimum similarity for sensors, set a moderately high similarity for attacker and target identifiers, and set a moderate minimum for time (to allow for clock drift and sensor response time differences). We may also require a match in attack class, making allowances for sensors that report different attack classes for a given attack sequence.
[0155]FIG. 8 shows the result of incident matching for the attack scenario. Some of the critical steps in the attack reported by several sensors now result in a single alert. For example, the highlighted buffer overflow attack is reported by an EMERALD sensor as well as by ISS. These are fused into a single correlated incident report. The two mscan reports from EMERALD host sensors and the portscan report from the EMERALD Bayes TCP sensor are also fused into a single incident.
[0156] The final step in correlation is an attempt to reconstruct the attack scenario. We now relax attack class similarity to consider what attack steps might follow the present step. For example, it is reasonable to follow a probe with an exploit to a target "contained" in the probe. Also, if the meta alert includes a step indicating a likely root compromise, the host in question is added to the attacker's assets (that is, it is both a victim and now a potential attacker as well). In FIG. 9, the correlated attack report correctly lists as attacker assets his originating host, an internal host compromised at an intermediate step, and the spoofed address of the SYN flood stage. In this fashion, we have successfully combined both the external and internal threads of the attack scenario.
[0157] It is worth pointing out that the EMERALD sensors in this experiment provide response directives which, if followed, would stop the attack in progress. We have adapted and extended notions from the field of multisensor data fusion for alert correlation. The extensions are principally in the area of generalizing feature similarity functions to comprehend observables in the intrusion detection domain. The approach has the ability to fuse alerts for which the match is good but not perfect. The method considers appropriate fields in alert reports as features for a multivariate matching algorithm. Features that overlap are considered for the overall similarity calculation. For each matchable feature, we have defined an appropriate similarity function with range 0 (mismatch) to 1 (perfect match). Depending on the situation, we incorporate expectation of match values (which are used to compute a weighted average of similarity over the overlapping features), as well as a minimum match specification that unconditionally rejects a match if any feature fails to match at the minimum specified value. For each new alert, we compute similarity to existing meta alerts, and merge the new alert with the best matching meta alert, as long as the match passes a threshold value. We realize a reduction of one-half to two-thirds in alert volume in a live environment, and approach a fiftyfold reduction in alert volume in a simulated attack scenario.
|Cited Patent
|Filing date
|Publication date
|Jun 13, 1983
|May 19, 1987
|U.S. Philips Corporation
|Method for the storage on and the reproduction from an optically readable record carrier
|Mar 28, 1986
|Jun 9, 1987
|Tandem Computers Incorporated
|Memory system with operation error detection
|Oct 1, 1984
|Sep 20, 1988
|Tektronix, Inc.
|Method and apparatus for improved monitoring and detection of improper device operation
|Oct 2, 1990
|May 11, 1993
|Technology International Incorporated
|System for prognosis and diagnostics of failure and wearout monitoring and for prediction of life expectancy of helicopter gearboxes and other rotating equipment
|May 6, 1993
|Aug 8, 1995
|Timm; Ronald E.
|Method for evaluating security of protected facilities
|Jan 19, 1993
|Aug 8, 1995
|International Business Machines Corporation
|Automatic immune system for computers and computer networks
|Dec 2, 1994
|Dec 12, 1995
|C & K Systems, Inc.
|Methods and apparatus for intrusion detection having improved immunity to false alarms
|May 8, 1992
|May 14, 1996
|Harrison; Dana C.
|Intelligent area monitoring system
|Feb 16, 1993
|Jul 23, 1996
|Alcatel N.V.
|Method of using a dominant angle of incidence to reduce acoustic noise in a speech signal
|Mar 7, 1994
|Sep 17, 1996
|Haystack Labs, Inc.
|Method and system for detecting intrusion into and misuse of a data processing system
|Sep 6, 1995
|Oct 22, 1996
|International Business Machines Corporation
|System and method for a workstation monitoring and control of multiple networks having different protocols
|Feb 16, 1996
|Dec 30, 1997
|Microsoft Corporation
|Collaborative filtering utilizing a belief network
|Oct 3, 1995
|Jan 6, 1998
|Fujitsu Limited
|Network monitoring device
|Apr 15, 1996
|Apr 7, 1998
|Mci Corporation
|Dynamic network topology determination
|Feb 22, 1994
|May 5, 1998
|British Telecommunications Public Limited Company
|Event correlation
|Jun 9, 1997
|Aug 4, 1998
|Digital Equipment Corporation
|System for sampling network packets by only storing the network packet that its error check code matches with the reference error check code
|Oct 29, 1997
|Mar 2, 1999
|Compuware Corporation
|Network monitoring and management system
|Feb 6, 1997
|Jul 6, 1999
|Hitachi, Ltd.
|Security system and method for computers connected to network
|May 14, 1997
|Jul 13, 1999
|Ncr Corporation
|System and method for traffic management in a network management system
|Oct 3, 1996
|Aug 17, 1999
|Itt Corporation
|Apparatus and method for providing network security
|Dec 18, 1996
|Oct 26, 1999
|Northern Telecom Limited
|Communications network monitoring
|Dec 23, 1993
|Oct 26, 1999
|International Business Machines Corporation
|Intelligent realtime monitoring of data traffic
|Nov 8, 1996
|Nov 23, 1999
|Harris Corporation
|Network surveillance system
|Aug 29, 1997
|Dec 28, 1999
|International Business Machines Corporation
|System for checking status of supported functions of communication platforms at preselected intervals in order to allow hosts to obtain updated list of all supported functions
|Dec 23, 1997
|Apr 18, 2000
|Bright Light Technologies, Inc.
|Apparatus and method for controlling delivery of unsolicited electronic mail
|Aug 13, 1996
|May 23, 2000
|Angel Secure Networks, Inc.
|System for installing information related to a software application to a remote computer over a network
|Nov 10, 1997
|May 30, 2000
|The Chase Manhattan Bank
|Computer network security management system
|Nov 6, 1997
|Jul 18, 2000
|Finjan Software, Ltd.
|System and method for protecting a computer and a network from hostile downloadables
|Dec 10, 1998
|Sep 12, 2000
|Shipley; Peter M.
|Intelligent network security device and method
|Oct 3, 1996
|Oct 3, 2000
|Sun Microsystems, Inc.
|Method and apparatus for user-level support for multiple event synchronization
|Mar 21, 1997
|Nov 7, 2000
|Compuware Corporation
|Method and system for non-intrusive measurement of transaction response times on a network
|May 28, 1996
|Feb 20, 2001
|Siemens Aktiengesellschaft
|Updating mechanism for user programs in a computer system
|Oct 6, 1998
|Jul 17, 2001
|International Business Machines Corporation
|Real-time alert mechanism for signaling change of system configuration
|Jan 11, 2000
|Jul 31, 2001
|Network Associates, Inc.
|Method and system for providing automated updating and upgrading of antivirus applications using a computer network
|May 20, 1998
|Aug 14, 2001
|Network Associates, Inc.
|System, method and computer program product for automatic response to computer system misuse using active response modules
|Jun 4, 1998
|Aug 21, 2001
|Internet Tools, Inc.
|Dynamic signature inspection-based network intrusion detection
|Apr 30, 1998
|Oct 2, 2001
|Netect, Ltd.
|Computer security
|Dec 15, 1997
|Oct 30, 2001
|Intel Corporation
|Network alert handling system and method
|Nov 9, 1998
|Nov 20, 2001
|Sri International
|Network surveillance
|Jun 30, 1998
|Nov 27, 2001
|Cisco Technology, Inc.
|System and method for rules-driven multi-phase network vulnerability assessment
|Aug 25, 2000
|Mar 5, 2002
|Hyperon Incorporated
|Method and system for interfacing an intrusion detection system to a central alarm system
|Dec 8, 1998
|Apr 9, 2002
|Visa International Service Association
|Computer network intrusion detection
|Apr 27, 1998
|May 28, 2002
|Nec Corporation
|Hierarchically interconnected routers for exclusively polling low activity network nodes to reduce polling traffic
|Mar 12, 1999
|Jun 11, 2002
|Psionic Software, Inc.
|Intrusion detection system
|May 6, 1998
|Jun 18, 2002
|Prc Inc.
|Dynamic system defense for information warfare
|Feb 27, 1998
|Aug 27, 2002
|Massachusetts Institute Of Technology
|Fault isolation for communication networks for isolating the source of faults comprising attacks, failures, and other network propagating errors
|Oct 28, 1998
|Oct 1, 2002
|Rsa Security Inc.
|Security and access management system for web-enabled and non-web-enabled applications and content on a computer network
|Jan 8, 1999
|Nov 5, 2002
|Cisco Technology, Inc.
|Intrusion detection system and method having dynamically loaded signatures
|Feb 1, 1999
|Nov 19, 2002
|Cisco Technology, Inc.
|Method and system for dynamically distributing updates in a network
|Nov 29, 2000
|Dec 10, 2002
|Rolligon Corporation
|Method and apparatus for running spooled tubing into a well
|Dec 29, 1998
|Dec 24, 2002
|Cisco Technology, Inc.
|Method and system for adaptive network security using intelligent packet analysis
|Oct 12, 1999
|Dec 31, 2002
|Microsoft Corp
|Modality fusion for object tracking with training system and method
|Apr 14, 2000
|Feb 11, 2003
|James B. Joyce
|Methods and apparatus for heuristic firewall
|Jun 29, 1999
|Mar 4, 2003
|Wandell & Goltermann Technologies, Inc.
|Knowledge based expert analysis system
|Feb 9, 2000
|Mar 11, 2003
|Angel Secure Networks, Inc.
|System and method for installing an auditable secure network
|Feb 8, 2000
|Mar 18, 2003
|Harris Corporation
|System and method for assessing the security posture of a network and having a graphical user interface
|Nov 30, 2001
|Apr 8, 2003
|Networks Associates Technology, Inc.
|System, method and computer program product for risk assessment scanning based on detected anomalous events
|Mar 31, 2000
|Apr 22, 2003
|Network Associates, Inc.
|System and process for reporting network events with a plurality of hierarchically-structured databases in a distributed computing environment
|Sep 23, 1999
|May 6, 2003
|Netarx, Inc.
|Method, apparatus, and article of manufacture for a network monitoring system
|Dec 14, 1999
|Jun 24, 2003
|International Business Machines Corporation
|System and method for predicting design errors in integrated circuits
|Apr 19, 2001
|Sep 30, 2003
|Kasei Optonix, Ltd.
|Phosphor consisting of hollow particles, phosphor slurry, phosphor beads for analysis using tracer technique and their production processes
|May 11, 1999
|Jan 20, 2004
|Cylant, Inc.
|Dynamic software system intrusion detection
|Apr 30, 1999
|Feb 10, 2004
|Invensys Systems, Inc.
|Alarm analysis tools method and apparatus
|Dec 27, 2000
|Mar 2, 2004
|Egurkha Pte Ltd
|Root-cause approach to problem diagnosis in data networks
|Jul 25, 2000
|Mar 9, 2004
|Sri International, Inc.
|Network-based alert management
|Apr 26, 1999
|Mar 16, 2004
|Nortel Networks Limited
|Alarm correlation method and system
|Mar 12, 1999
|Apr 20, 2004
|Networks Associates Technology, Inc.
|Method and system for updating anti-intrusion software
|Nov 30, 1999
|May 4, 2004
|Accenture L.L.P.
|Service request processing in a local service activation management environment
|Aug 1, 2002
|Jun 15, 2004
|Ralph E. Wesinger, Jr.
|Firewall providing enhanced network security and user transparency
|Aug 30, 2000
|Nov 30, 2004
|Symantec Corporation
|System and method for detecting buffer overflow attacks
|Mar 4, 1999
|Jan 4, 2005
|Prc, Inc.
|Method and system for detecting intrusion into and misuse of a data processing system
|Nov 19, 2001
|Sep 20, 2005
|The Boeing Company
|Network security architecture for a mobile network platform
|Jun 20, 2000
|Sep 27, 2005
|Networks Associates Technology, Inc.
|System for sharing network state to enhance network throughput
|Jul 14, 2000
|Nov 29, 2005
|Symantec Corporation
|System and method for tracking the source of a computer attack
|Jan 31, 2000
|May 23, 2006
|Yoshimi Baba
|System for monitoring network for cracker attack
|Mar 31, 2000
|Aug 22, 2006
|Intel Corporation
|Network session management
|Feb 8, 2000
|Aug 22, 2006
|Harris Corporation
|System and method for assessing the security posture of a network
|Jun 28, 2001
|Feb 14, 2002
|International Business Machines Corporation
|Proactive on-line diagnostics in a manageable network
|May 15, 2001
|Mar 14, 2002
|The Regents Of The University Of Michigan
|Method and system for profiling network flows at a measurement point within a computer network
|May 15, 2001
|Mar 14, 2002
|The Regents Of The University Of Michigan
|Method and system for reconstructing a path taken by undesirable network traffic through a computer network from a source of the traffic
|Aug 16, 2001
|Mar 14, 2002
|Poletto Massimiliano Antonio
|Monitoring network traffic denial of service attacks
|May 15, 2001
|Mar 21, 2002
|The Regents Of The University Of Michigan
|Method and system for protecting publicly accessible network computer services from undesirable network traffic in real-time
|Mar 15, 2002
|Sep 26, 2002
|Munson John C.
|Method and system for simplifying the structure of dynamic execution profiles
|Jan 31, 2002
|Oct 3, 2002
|Copeland John A.
|Network port profiling
|Jun 14, 2002
|Dec 19, 2002
|Gladstone Philip J.S.
|Stateful distributed event processing and adaptive security
|Jun 27, 2002
|Feb 20, 2003
|Labovitz Craig H.
|Method and system for monitoring control signal traffic over a computer network
|Oct 8, 2001
|Apr 10, 2003
|Jari Satomaa
|Managing a network security application
|Jan 28, 2002
|Jul 31, 2003
|International Business Machines Corporation
|Integrated intrusion detection services
|Mar 8, 2002
|Sep 11, 2003
|Paul Judge
|Systems and methods for enhancing electronic communication security
|Nov 20, 2003
|Feb 17, 2005
|Yuval Ben-Itzhak
|Method for the automatic setting and updating of a security policy
|Jan 20, 2005
|Nov 3, 2005
|Microsoft Corporation
|Framework for protection level monitoring, reporting, and notification
|Citing Patent
|Filing date
|Publication date
|May 4, 2004
|Aug 1, 2006
|International Business Machines Corporation
|System, method, and program product for managing an intrusion detection system
|Dec 20, 2002
|Nov 21, 2006
|Opnet Technologies, Inc.
|Flow propagation analysis using iterative signaling
|Jan 28, 2002
|May 22, 2007
|International Business Machines Corporation
|Intrusion event filtering
|Feb 6, 2003
|Nov 6, 2007
|Symantec Corporation
|Dynamic detection of computer worms
|Nov 9, 2001
|Jan 15, 2008
|Cisco Technology, Inc.
|Method and system for configurable network intrusion detection
|Oct 29, 2007
|Jan 13, 2009
|Novell, Inc.
|Administration of protection of data accessible by a mobile device
|Jul 21, 2004
|Apr 28, 2009
|Novell, Inc.
|Administration of protection of data accessible by a mobile device
|Jul 7, 2009
|Sun Microsystems, Inc.
|Detection for deceptively similar domain names
|Dec 22, 2004
|Oct 20, 2009
|Radware Ltd.
|Stateful attack protection
|Dec 16, 2004
|Oct 5, 2010
|France Telecom
|Method of managing alerts issued by intrusion detection sensors of an information security system
|Sep 21, 2005
|Mar 15, 2011
|Battelle Memorial Institute
|Methods and systems for detecting abnormal digital traffic
|Sep 18, 2006
|Nov 22, 2011
|Google, Inc.
|Method for evolving detectors to detect malign behavior in an artificial immune system
|Apr 24, 2006
|Mar 6, 2012
|Bank Of America Corporation
|System and method for low latency market data
|Aug 11, 2006
|Jul 24, 2012
|Avaya Inc.
|Method for cooperative intrusion prevention through collaborative inference
|Oct 13, 2005
|Sep 18, 2012
|Honeywell International Inc.
|Physical security management system
|May 5, 2008
|Oct 2, 2012
|Eaton Corporation
|Methods, devices and computer program products for capturing events associated network anomalies
|Dec 24, 2003
|Dec 4, 2012
|Herz Frederick S M
|System and method for a distributed application and network security system (SDI-SCAM)
|Jul 9, 2010
|Feb 19, 2013
|The Trustees Of Columbia University In The City Of New York
|Systems and methods for correlating and distributing intrusion alert information among collaborating computer systems
|Sep 8, 2008
|Mar 26, 2013
|Skybox Secutiry Inc.
|Method for simulation aided security event management
|May 30, 2007
|Oct 22, 2013
|Red Hat, Inc.
|Hosted system monitoring service
|Nov 22, 2011
|Dec 31, 2013
|Google Inc.
|Method for evolving detectors to detect malign behavior in an artificial immune system
|Jul 15, 2010
|Mar 4, 2014
|The Trustees Of Columbia University In The City Of New York
|Systems and methods for correlating and distributing intrusion alert information among collaborating computer systems
|Mar 3, 2006
|May 6, 2014
|AVG Technologies N.V.
|Method and apparatus for detecting harmful software
|May 19, 2004
|Aug 12, 2014
|Ca, Inc.
|Method and systems for computer security
|May 20, 2005
|Oct 7, 2014
|Code Valley Corp Pty Ltd
|Code generation techniques
|May 23, 2012
|Oct 14, 2014
|International Business Machines Corporation
|Predicting attacks based on probabilistic game-theory
|Dec 3, 2012
|Dec 30, 2014
|Fred Herz Patents, LLC
|System and method for a distributed application of a network security system (SDI-SCAM)
|Jul 23, 2010
|Apr 28, 2015
|NSFOCUS Information Technology Co., Ltd.
|XSS detection method and device
|Feb 2, 2011
|Jun 2, 2015
|Hewlett-Packard Development Company, L.P.
|Multicast flow monitoring
|Jan 16, 2013
|Sep 15, 2015
|The Trustees Of Columbia University In The City Of New York
|Systems and methods for correlating and distributing intrusion alert information among collaborating computer systems
|Feb 6, 2003
|Aug 12, 2004
|Peter Szor
|Dynamic detection of computer worms
|Jul 21, 2004
|Mar 10, 2005
|Michael Wright
|Administration of protection of data accessible by a mobile device
|May 19, 2004
|Nov 24, 2005
|Paul Gassoway
|Method and systems for computer security
|Dec 24, 2003
|Mar 9, 2006
|Herz Frederick S
|System and method for a distributed application and network security system (SDI-SCAM)
|Oct 13, 2005
|Mar 16, 2006
|Honeywell International Inc.
|Physical security management system
|Jul 7, 2005
|May 4, 2006
|Brent Beachem
|System and method for filtering access points presented to a user and locking onto an access point
|Jul 8, 2005
|Jan 11, 2007
|Hsing-Kuo Wong
|Method and architecture for online classification-based intrusion alert correlation
|Sep 21, 2005
|Mar 22, 2007
|Battelle Memorial Institute
|Methods and systems for detecting abnormal digital traffic
|May 20, 2005
|Aug 21, 2008
|Noel William Lovisa
|Code Generation Techniques
|May 30, 2007
|Dec 4, 2008
|Karandikar Anirudha S
|Hosted system monitoring service
|Nov 6, 2006
|May 28, 2009
|Pablo Daniel Serber
|Distributed network protection
|Nov 5, 2009
|Eaton Corporation
|Methods, Devices and Computer Program Products For Capturing Events Associated Network Anomalies
|Nov 22, 2011
|Mar 22, 2012
|Google Inc.
|Method for evolving detectors to detect malign behavior in an artificial immune system
|Feb 2, 2011
|Jun 21, 2012
|Manoj Kumar Jain
|Multicast flow monitoring
|Jul 23, 2010
|Aug 2, 2012
|NSFOCUS Information Technology Co., Ltd.
|Xss detection method and device
|Oct 11, 2012
|Njemanze Hugh S
|Meta-event generation based on time attributes
|Jun 4, 2012
|Nov 28, 2013
|International Business Machines Corporation
|Predicting attacks based on probabilistic game-theory
|Oct 8, 2014
|Feb 26, 2015
|The Trustees Of Columbia University In The City Of New York
|System and methods for adaptive model generation for detecting intrusion in computer systems
|May 28, 2014
|Dec 10, 2014
|General Electric Company
|Systems and methods for process alarm reduction
|Jun 27, 2006
|Jan 4, 2007
|Merrill Lynch & Co Inc
|System and method for low latency data
|U.S. Classification
|International Classification
|Cooperative Classification
|European Classification
|Aug 31, 2001
Owner name: SRI INTERNATIONAL, INC., CALIFORNIA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:DE JESUS VALDES, ALFONSO;SKINNER, KEITH;REEL/FRAME:012141/0404
Effective date: 20010827
|May 30, 2002
Owner name: UNITED STATES AIR FORCE, NEW YORK
Free format text: CONFIRMATORY LICENSE;ASSIGNOR:SRI INTERNATIONAL;REEL/FRAME:012935/0318
Effective date: 20020409
|Sep 29, 2014
|Fee payment
Year of fee payment: 4


text:
MSI Just Game Mousepad Review The MSI Just Game mouse pad is the latest addition to MSI's gaming series of accessories. The cloth surface MSI Just Game mouse pad has had special "firm-weave" treatment for extended durability and smooth mouse gliding. Underneath, the Just Game mouse pad uses a full-coverage natural rubber to ensure grip …
Tag Archive: Just Game
MSI Just Game Mousepad Review
16 August 2013
Tags: Just Game, Mousepad, MSI, MSI Just Game, MSI Just Game Mousepad
Published Categories
Affiliate News
Most Recent Comments
- Olin Coles on Beelink GTQ 4K Android Media Center Review
- THEMIS PLESTED on Accessory Power GOgroove BlueSYNC WUD Real Wood Portable Bluetooth Speaker Debuts
- Jason Maxfield on Antec GX505 Window SC Mid-Tower Case Review
- letmepicyou on Antec GX505 Window SC Mid-Tower Case Review
- Grayson Peddie on SilverStone CS01B-HS Mini-ITX Case Review
- Meh on AMD FX-8320E AM3+ Processor Performance Review
- Musaab on SilverStone CS01B-HS Mini-ITX Case Review


text:
DIY/* BEGIN: Block 2 of 2 Greg Add 2013 (Jan 29) */ ?> /* END: Block 2 of 2 Greg Add 2013 (Jan 29) */ ?>
Solar Cookers Save Power in Lhasa, Tibet's 'Solar City'by China.new
Cheap and effective solar power is hot, especially in Lhasa, Tibet, where clear air and up to 3,000 hours of sunlight annually conspire to create the perfect environment for homegrown solar cookers and water purifiers.
Black Market Human Milk Being Bought by the Bag in Beijingby China.new
White milk, black market: Chinese mothers, leery of powdered milk due to a series of well-publicized scandals, are increasingly turning to online human milk sources to help feed their babies.
What I learned from the Inventors at the Minnesota Inventors Congressby Product For Profit
I just came back from speaking at the Minnesota's Inventor's Congress (MIC). For those of you who don't know, the Minnesota Inventors Congress is one of the oldest and most established inventor trade shows in the country. And I have to say, I learned more from the inventors who attended MIC then I ever thought possible. It was so inspiring that I felt compelled to write this article and share.
First Step Toward Invention Success - Ignore The Naysayers!by Product For Profit
As you begin your path toward bringing your invention to market, you might become keenly aware of how many naysayers suddenly show up in your life. And when I say naysayers I mean people who don't share your vision, don't believe you can make things happen or let you know that for some reason or another you cannot actualize your invention dreams.
'Sleeping Girl DVD' Gently Guides You Into Dreamlandby Steve Levenstein
Need a little help sleeping lately? Just pop the "Sleeping Girl DVD" into your player and drift off to slumberland, gently guided by the soft voices and easy-on-the-eyes looks of some of Japan's most alluring dreamgirls.
Aurasmic Experience - Transforming An Image Into A Clip On Your Smartphoneby Jamie Reygle
Aurasma merges the physical and virtual instantaneously on your smartphone.
Miles Of Styles - The 100 Mile Design Challengeby Jamie Reygle
It's amazing what can be made solely from local materials - just see what these design students have done.
Walkie The Talkie - An App That Pays You To Use Itby Jamie Reygle
Gigwalk pays you to use your smartphone.
Picasso Pad? - Living In A Cubeby Jamie Reygle
You really can live in comfort in a small space. The Cube Project is proof.
Give As Good As You Get With GiftFlowby Jamie Reygle
GiftFlow aims to create an economy of giving, which means there will be plenty to receive as well.
Is That A PC In Your Pocket? - The PC That's The Size Of A Flash Driveby Jamie Reygle
You will soon be able to buy a PC that fits in your pocket - for under $25!
Part Of The Process - Participatory Budgeting And Youby Jamie Reygle
People all over the world are deciding how their tax dollars are spent. Why aren't you?
True Economy - Getting Value For Virtually No Moneyby Jamie Reygle
The $300 House is a project that enables the poorest of the poor to build the best houses they can for next to nothing.
Not A Whopping Cough - Hackasaurus Helps Kids Get The Most Out Of The Webby Jamie Reygle
Hackasaurus gives kids the tools they need to truly understand and manipulate the internet.
What Have You Been Up To? - Find Out With Daytumby Jamie Reygle
Daytum charts everything and anything about your life.


text:
New platform starts production at Malampaya gas fieldzoom Malampaya Deep Water Gas-to-Power project joint venture partners, Shell Philippines Exploration, Chevron Malampaya and the Philippine National Oil Company Exploration Corporation inaugurated the new platformand marked the start of gas ... LNG World News, 3 days ago
Malampaya offshore natural gas platform commissioned in Philippines - Offshore Technology, 1 day ago
VIDEO: New Malampaya platform coming to its place - Offshore Energy Today, 2 days ago
DOF hires Vard's PSV for deal with Chevron
zoom Vard 1 08 vessel DOF ASA has won a contract with Chevron in Australia, for which it hired a Platform Supply Vessels (PSV) from Vard Holding's new subsidiary. DOF has signed a bareboat charter contract for the vessel Skandi Responder with ...Offshore Energy Today, 2 weeks ago DOF charters in PSV from Vard for Chevron job Marine Log, 2 weeks ago VARD Secures PSV Charter from DOF Maritime Global News, 2 weeks ago Vard becomes a shipowner, DOF charters Vard PSV for work in Australia Splash 247, 2 weeks ago
Thousands of North Sea oil jobs at risk as platform builder fails to win contract
Tyneside-based OGN fails to make shortlist for work on Chevron's Captain field as work dries up due to low oil prices Thousands of jobs are at risk after one of Britain's leading offshore oil platform builders failed to make the shortlist for one ...ACQ Magazine, 1 month ago
Chevron: No Big Foot oil till 2018
zoom Chevron has informed it does not expect any production from its giant Big Foot tension leg platform (TLP), in the Gulf of Mexico, until 2018. The production was previously planned to start in the late 2015. Chevron Corporation EVP, ...Offshore Energy Today, 2 months ago Big Foot Delayed until 2018 E&P Magazine, 2 months ago Chevron: Big Foot output delayed to 2018 Argus Media, 2 months ago
Exxon, Chevron Brace for Tough Times Ahead
Chevron's Jack/St. Malo platform in the U.S. Gulf of Mexico. Photo: Crowley By Joe Carroll and Dan Murtaugh (Bloomberg) — Exxon Mobil Corp. and Chevron Corp., the biggest U.S. energy producers, hunkered down for a prolonged stretch of ...GCaptain, 2 months ago Exxon, Chevron bracing for dark times ahead as oil slump lingers SweetCrude Reports, 2 months ago
Visa, Chevron pump up mobile payments
By | CNET This article, , originally appeared on CNET.com . Swiping a card at the pump is so 2014. Vstock LLC/Tetra Images/Corbis It's becoming more common to tap your smartphone at Walgreens to pay for cough drops or McDonald's to buy a ...Yahoo! India, 2 days ago
Skipper Chigumbura rallies his Chevrons
Elton Chigumbura Eddie Chikamhi Sports Reporter ZIMBABWE cricket team captain Elton Chigumbura is happy with the spirit in camp and has challenged his teammates to raise their game when they get their Twenty20 series underway against Pakistan at ...Zimbabwe Herald, 1 week ago
Why Chevron Is At $69 A Share
Aug. 26, 2015 10:33 AM ET | About: Chevron Corporation (CVX) by: Summary Many setbacks emerged at Gorgon, which delayed the project and turned it into the most expensive LNG project in the world with huge cost overruns. The share price has ...Seeking Alpha, 1 month ago The Bad In Chevron's Lackluster Q2 Seeking Alpha, 1 month ago Chevron (CVX) Q2 2015 Results - Earnings Call Transcript Seeking Alpha, 2 months ago
Google launches Android Pay, its new mobile payment platform
Image: /Mashable By Karissa Bell 2015-09-10 17:11:12 UTC Google's answer to Apple Pay has arrived. Android Pay , the company's new mobile payments platform, is beginning to roll out in the United States, Google announced Thursday . The platform ...Mashable, 4 weeks ago Mobile Pay Roundup: LoopPay's Breach, Verizon's Pay Plays, Mobile Gas Wars Erupt PYMNTS.com, 18 hours ago
Icustommadeit.com raises $250,000 in third angel round
Hyderabad: Customized merchandise platform icustommadeit.com has raised $250,000 in the third angel round from a group of individual investors, including Deloitte director Aparna Pittie, taking the total equity funding raised so far to $650,000. ...Livemint.com, 1 month ago ICustomMadeIt raises Rs 1.66 crore in 3rd round angel funding Economic Times, 1 month ago
Realtime News
on your WebpageAdd Widget >Get your members hooked!


text:
"\"Dear Diarmuid, After many months of promising myself to write to you I am now finally sitting down to do it. That in itself i"
"found sean through his website at seanmooreplumbing.com he contacted me the day i messaged him online i found him to be good supri"
"\"I am 35 years old and had been trying to conceive for 2.5 years before a friend recommended I try kinesiology and gave me Diarmu"
"Recently I started to use the services of Dr. Ed Sordillo at Sordillo Chiropractic. I had been complaining of a stiff neck for a w"
"i have to say i LOVE the darkside :D the Darkside gets 5* from me :D"
"I have to say that Miss Moneypenny has been of great benefit to my work, I recently started a business and didnt know how to set u"
"no receipt and stopped answering my emails"
"A really great service, I\'m delighted that Diarmuid was able to fix up my computer so quickly, especially since it was in a reall"
"Diarmuid Galvin pc clinic provides great service. computer runing faster and very smooth highly recommended p c clinic."
"Diarmuid is a wiz. I am so pleased with my pc now it is running like clockwork. I would recommend The Pc Clinic to anyone."
"My husband Denis has been suffering intermittently with lower back pain for the last six years. At its worst the whole lower back "
Casa Nova Restaurant/Take Away
"Order food regularly as well as sitting in.Staff always friendly and sincere.Pizzas are far better and tastier than all the mainst"
"old shoes were fit for the bin so i thought but junior franklin in sarsfield st soled&heeled my footwear to new and the very best "
"Great Service at a good price. Can highly recommend the PC Clinic, they resolved all my computer problems and my computer is worki"
"computer up and running again actually alot faster after we got it back from Diarmuid than it was first day when we bought it. wi"
What would you like to do now?


text:
NEW YORK (AP) — Coca-Cola is reversing course after fans of Vitaminwater complained about the drink's new sweetener.
The Atlanta-based company promised Thursday the drink would go back to its previous taste after fans flooded Vitaminwater's Facebook page with negative comments. The reversal comes just a few months after Coca-Cola had changed the sweetener in the drink to a mix of sugar and stevia, a low-calorie sweetener known for its metallic aftertaste.
"Our fans haven't had the greatest things to say about it," said a statement posted on Vitaminwater's website.
The statement said the Vitaminwater that people "loved" would start appearing on shelves this fall and be available nationwide by winter.
Thomas Sowell - The 'Gun Control' Farce
Hillary server had remote-control gateways wide open
The Democratic Debate: Prepare for an Orgy of Unicorn Farts and Pixie Dust | RedState
Hillary's email server called 'total amateur hour' by security expert
Ryan and Reconciliation Is a Powerful Combination | Human Events
- Vladimir Putin's Russia Adopts Concealed Carry
Ruger Jumps Into Self Defense Ammo Market With Radical Bullet Design - Bearing Arms - Ammunition, ARX, Polycase, Ruger