Multi-Layer Mapping of Cyberspace

Cyberspace includes a wide range of physical networks, storage and computing devices, applications, and users with different roles and requirements. These can be grouped into three layers: Physical, Logical, and Cyber-persona layers. Securing and protecting such complex and dynamic cyberspace resources and services are grand challenges. This project aims at developing a multi-layer anomaly behavior analysis of all components associated with each cyberspace layer and how they interact with each other in order to achieve superior capabilities in characterizing their normal operations and proactively detect any anomalous behavior that might be triggered by malicious attacks. In this project, we will develop a Multi-Layer Anomaly Behavior Analysis (MLABA) technology that is a true alternative to the existing security technologies. Our methodology to develop the proposed MLABA is based on a holistic approach that will continuously monitor, analyze, and diagnose the operations of all cyberspace layers in an integrated manner. For each layer, we will develop innovative data structures that can be used to accurately characterize the normal behavior of a resource, application or user to integrate the behavior of each layers to overcome the main limitations of anomaly behavior analysis and take proactive actions to stop cyberattacks propagation.