Intrusion alert: System uses machine learning, curiosity-driven ‘honeypots’ to stop cyber attackers

A Purdue University team created a detection system to alert organizations to cyberattacks. The system is called LIDAR – which stands for lifelong, intelligent, diverse, agile and robust. (Stock image) Download image

WEST LAFAYETTE, Ind. – In recent months, the FBI issued a high-impact cybersecurity warning in response to increasing attacks on government targets. Government officials have warned major cities that such hacks are a disturbing trend that is likely to continue.

A new tool from Purdue University researchers may help stop some of those threats. The Purdue team created a detection system to alert organizations to cyberattacks. The system is called LIDAR – which stands for lifelong, intelligent, diverse, agile and robust.

“The name for this architecture for network security really defines its significant attributes,” said Aly El Gamal, an assistant professor of electrical and computer engineering in Purdue’s College of Engineering. “Our system is robust and able to adapt to different environments through lifelong learning.”

El Gamal created the technology with Arif Ghafoor, a professor in electrical and computer engineering, and Ali Elghariani, a graduate of electrical and computer engineering.

LIDAR can be used for computer systems and networks, including wireless networks. The system works with preprocessing components that are designed to be resilient to adversarial attacks and a cross-layer feature extraction mechanism for wireless networks.

The Purdue system is made up of three main parts: supervised machine learning, unsupervised machine learning and rule-based learning.

“One of the fascinating things about LIDAR is that the rule-based learning component really serves as the brain for the operation,” El Gamal said. “That component takes the information from the other two parts and decides the validity of a potential attack and necessary steps to move forward.”

The supervised machine-learning component uses an algorithm to compare abnormalities detected in the system to known attack templates. The unsupervised component uses an algorithm to detect any anomalies in the overall system being monitored.

Purdue’s LIDAR system also uses a novel curiosity-driven honeypot, which lures attackers but does not let them infiltrate the system.

The innovators are working with the Purdue Research Foundation Office of Technology Commercialization to patent the technology.

The researchers are looking for partners to continue developing their technology and create prototypes. For more information on licensing and other opportunities, contact Matt Halladay of OTC at mrhalladay@prf.org and mention track code 2019-GHAF-68713.

About Purdue Research Foundation Office of Technology Commercialization

The Purdue Research Foundation Office of Technology Commercialization operates one of the most comprehensive technology transfer programs among leading research universities in the U.S. Services provided by this office support the economic development initiatives of Purdue University and benefit the university's academic activities through commercializing, licensing and protecting Purdue intellectual property. The office recently moved into the Convergence Center for Innovation and Collaboration in Discovery Park District, located on the west side of the Purdue campus. The office is managed by the Purdue Research Foundation, which received the 2019 Innovation and Economic Prosperity Universities Award for Place from the Association of Public and Land-grant Universities. The Purdue Research Foundation is a private, nonprofit foundation created to advance the mission of Purdue University. Visit the Office of Technology Commercialization for more information.

Writer: Chris Adam, 765-588-3341, cladam@prf.org 

Sources: Aly El Gamal, elgamala@purdue.edu

Arif Ghafoor, ghafoor@ecn.purdue.edu

Ali Elghariani, aelghari@purdue.edu