I know my network: collaboration and expertise in intrusion detection

ABSTRACT

The work of intrusion detection (ID) in accomplishing network security is complex, requiring highly sought-after expertise. While limited automation exists, the role of human ID analysts remains crucial. This paper presents the results of an exploratory field study examining the role of expertise and collaboration in ID work. Through an analysis of the common and situated expertise required in ID work, our results counter basic assumptions about its individualistic character, revealing significant distributed collaboration. Current ID support tools provide no support for this collaborative problem solving. The results of this research highlight ID as an engaging CSCW work domain, one rich with organizational insights, design challenges, and practical import.

REFERENCES

• 1: Allen, J., Christie, A., Fithen, W., McHugh, J., Pickel, J. & Stoner, E. State of the Practice of Intrusion Detection Technologies. Tech. Report CMU/SEI-99-TR-028, 1999.
• 2: Goodall, J.R., Lutters, W.G., & Komlodi, A. The work of intrusion detection: rethinking the role of security analysts. Proc. of AMCIS, (2004).
• 3: Klaus Julisch , Marc Dacier, Mining intrusion detection alarms for actionable knowledge, Proceedings of the eighth ACM SIGKDD international conference on Knowledge discovery and data mining, July 23-26, 2002, Edmonton, Alberta, Canada [doi>10.1145/775047.775101]
• 4: Anita Komlodi , John R. Goodall , Wayne G. Lutters, An Information Visualization Framework for Intrusion Detection, CHI '04 extended abstracts on Human factors in computing systems, April 24-29, 2004, Vienna, Austria [doi>10.1145/985921.1062935]
• 5: Wenke Lee , Salvatore J. Stolfo , Kui W. Mok, Adaptive Intrusion Detection: A Data Mining Approach, Artificial Intelligence Review, v.14 n.6, p.533-567, December 1, 2000 [doi>10.1023/A:1006624031083]
• 6: McHugh, J. Intrusion and intrusion detection. Int'l Journal of Information Security, 1, 1 (2001). 14--35.
• 7: Martin Roesch, Snort - Lightweight Intrusion Detection for Networks, Proceedings of the 13th USENIX conference on System administration, November 07-12, 1999, Seattle, Washington
• 8: Jan Steffan , Markus Schumacher, Collaborative attack modeling, Proceedings of the 2002 ACM symposium on Applied computing, March 11-14, 2002, Madrid, Spain [doi>10.1145/508791.508843]
• 9: Straus, A & Corbin, J. Basics of Qualitative Research. 2nd ed. Sage Publications, Thousand Oaks, CA, 1998.
• 10: Yurcik, W., Barlow, J. & Rosendale, J., Maintaining perspective on who is the enemy in the security systems administration of computer networks. ACM CHI Workshop on System Admins. Are Users, Too, (2003).

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.3 Group and Organization Interfaces
          Subjects: Computer-supported cooperative work

General Terms:
Human Factors, Security

Keywords:
expertise, field study, information security, intrusion detection