Beautiful Teams

Chapter 22. Research Teams

Michael Collins

The area that Michael Collins works in interests us for two reasons. First, Michael spent much of his career working on research with teams in an academic setting. But second, that research has been oriented at solving concrete, real-word security problems for serious customers inside and outside government, and the work that he's done spans both academic and commercial areas. We wanted to hear what he had to say about that.

Andrew: You were working on a research project to try to detect intrusions into networks.

Michael: Mostly what we were trying to do was model normalcy. Most of what I do falls into the field of anomaly detection, which falls under the field of intrusion detection. Most anomaly detection is trying to build a model of normal behavior, so when you see that all of a sudden you're falling outside the domain of normal behavior, you get curious as to why that's happening.

A credit card example of this is that you've got normal spending habits. And if all of a sudden you start spending in Katmandu, that's when the credit card company calls up and asks, "Are you in Katmandu?" And the answer is no. That's anomaly detection, as done with credit cards. You do the same thing with network traffic.

Andrew: So, your goal was to look at the data from routers, and just by looking at the gigabytes of daily data from router logs you can detect successful and unsuccessful attempts at intrusion?

Michael: That's the Holy Grail. But the first ...