Dr. Lee's research focuses on systems and network security. He is motivated by the challenges of building effective and efficient intrusion detection and response systems. His research in intrusion detection involves developing algorithms for automating the process of feature extraction and model construction, studying the theories and techniques of anomaly detection, building high-speed sensors that are scalable with networking technologies, and designing new algorithms and system architectures for emerging environments and applications such as mobile ad hoc networks. He is also motivated by the need to make security services work together seamlessly. His work involves developing techniques for integrating network management and intrusion detection, and algorithms for alert correlation and scenario analysis. Dr. Lee is also studying new and emerging threats, such as Internet worms, and developing techniques to counter these threats.