--Notice of License Opportunity, System Intrusion Alert Software Tool

The Technical Support Working Group, Combating Terrorism Technology Support Office solicits interest from any party interested in the licensing of the Alert TRend Change Tool, (ATRaCT). This tool is used by security analysts to automatically detect a nd display trends in intrusion detection system alerts that may indicate new threats. Network-based intrusion detection (ID) systems generally produce large numbers of alerts. The analyst responsible for monitoring these alerts often spends so much time an alyzing each alert that he fails to see the large trends in alert levels, such as which alerts are becoming more common, or which alerts are no longer occurring. ATRaCT provides an overview of the current trends and alarms when significant trend changes oc cur. ATRaCT takes as input the alerts produced by Snort or other ID systems. It collects that data into hourly and daily segments, and stores the number of alerts and the number of source IP addresses causing alerts in each time period. The running mean an d standard deviation are also calculated for each alert and time period. These data are used to create graphs showing the trends in the alerts, as well as to determine when to issue an alarm. ATRaCT runs on either a Linux or Solaris workstation The output of ATRaCT is standard HTML pages, viewable by the analyst in any standard web browser. It requires several freely available support software packages, most notably the MySQL database, all of w hich are included in the package. Companies interested in licensing this software for commercialization are asked to contact [email protected] for additional information.