
180 Park Ave - Building 103
Florham Park, NJ
AT&T Fellow, 1996.
Artificial intelligence applications: Honored for pioneering work in artificial intelligence applications and technology, and outstanding contributions in enabling organizations throughout AT&T to realize benefits from this technology.
DarkNOC: Dashboard for Honeypot Management
Bertrand Sobesto, Michel Cukier, Matti Hiltunen, David Kormann, Gregory Vesonder, Robin Berthier
USENIX LISA'11: 25th Large Installation System Administration Conference,
2011.
[PDF]
[BIB]
USENIX Copyright
The definitive version was published in USENIX LISA'11: 25th Large Installation System Administration Conference, Usenix. , 2011-12-04
{Protecting computer and information systems from security attacks is becoming an increasingly important task for system administrators. Honeypots are a technology often used to detect attacks and collect information about techniques and targets (e.g., services, ports, operating systems) of attacks. However, managing a large and complex honeynet of honeypots becomes a challenge in itself given the amount of data collected as well as the risk that the honeypots may themselves become infected and start attacking other machines. In this paper, we present DarkNOC, a management and monitoring tool for complex honeynets consisting of different types of honeypots as well as other data collection devices. DarkNOC has been actively used to manage a honeynet consisting of multiple subnets and hundreds of IP addresses. This paper describes the architecture and a number of case studies demonstrating the use of the tool.}

Nfsight: NetFlow-based Network Awareness Tool
Robin Berthier, MIchel Cukier, Matti Hiltunen, David Kormann, Gregory Vesonder, Daniel Sheleheda
Proceedings of the 24th Large Installation System Administration Conference (LISA '10),
24th Large Installation System Administration Conference (USENIX LISA),
2010.
[PDF]
[BIB]
USENIX Copyright
The definitive version was published in LISAI '10., 2010-11-07
Network awareness is highly critical for network and security administrators. It enables informed planning and management of network resources, as well as detection and a comprehensive understanding of malicious activity. It requires a set of tools to efficiently collect, process and represent network data. While many of such tools already exist, there is a lack of a flexible and practical solution to visualize network activity at various granularities, and to quickly gain insights about the status of net- work assets. To address this issue, we developed Nfsight, a Netflow processing and visualization application designed to offer a comprehensive network awareness solution. Nfsight leverages the use of bidirectional flows to provide client/server identification and intrusion detection capabilities. We present in this paper the internal architecture of Nfsight, the evaluation of the service and intrusion detection algorithms. We illustrate the contributions of Nfsight through several case studies conducted by security administrators on a large campus network.
Monitoring Complex Data Feeds Through Ensemble Testing,
June 29, 2010
Managing and monitoring multiple complex data feeds is a major challenge for data mining tasks in large corporations and scientific endeavors alike. The invention describes an effective method for flagging abnormalities in data feeds using an ensemble of statistical tests that may be used on complex data feeds. The tests in the ensemble are chosen such that the speed and ability to deliver real time decisions are not compromised.