ABSTRACT Privacy-Preserving Distributed Event Correlation

Event correlation is a widely-used data processing methodology, and is useful for the distributed monitoring of software faults and vulnerabilities. Most existing solutions have focused on “intra-organizational ” correlation; organizations typically employ privacy policies that prohibit the exchange of information outside of the organization. However, “inter-organizational ” Internet-scale correlation holds promise given its potential role in both software fault maintenance and vulnerability detection. In this thesis, I reconcile these opposing forces via the use of privacy preservation integrated into an event processing framework. I introduce the notion of event corroboration, a reduced yet flexible form of correlation, enabling collaborative ver-ification without revealing sensitive information. The framework supports both source anonymity and data privacy, yet allows for temporal corroboration of a broad variety of data. It is designed as a lightweight collection of components to enable integration with existing COTS platforms and distributed systems. I also present an implementation: Worminator, a Collaborative Intrusion Detection System (CIDS)