Correlating and Analyzing Network Data through Interpretable Decompositions (CANDID)

A critical demand in today’s world is the need for efficiently managing, operating, and securing the network infrastructure and environment. It is very important to allow scientists to operate uninterrupted on high-speed networks and enable them to make scientific discoveries. It is critical to discover and avert constantly increasing cybersecurity attacks and cyber terrorism that are serious threats to global socio-economic prosperity and safety. Existing network analysis and cybersecurity tools lack the capability to consistently provide deep operational network visibility and discover sophisticated cyber attacks. Project Objective The overall objective of the project is to develop a usable and scalable network analysis tool that can analyze huge volumes of network data and provide actionable insights into the network. The purpose of developing such a tool is to address the challenging and critical problems that the Government and commercial organizations are facing in managing and securing their network and provide them with an advanced analytic tool to secure and operate networks effectively. The overall technical approach is based on advanced “tensor analysis,” that enables the user to deeply analyze network data to get actionable insights and discover sophisticated attacks. What was done in Phase I? We successfully developed a prototype network analysis tool and put the tool into use in two different operational network environments. We demonstrated the capability of the tool to provide actionable insights through the extraction of multimodal network patterns and discover cyber attacks even when they are obfuscated. We published and presented the key proof-of-concept capabilities and results from the project in peer-reviewed conferences/workshops. We disseminated the results to interested entities in Government and commercial sectors. Commercial Applications and Other Benefits CANDID will significantly improve the reliability and operation of commercial, research, and Government (DOE, DOD, and other agencies) networks, and will reduce the overall operational costs and risks for network management. By providing visibility into threats and attacks on networks (for example, detecting anomalous behavior such as unauthorized data movement) CANDID will be a critical tool for the defense intelligence community. CANDID will bring tangible benefits to commercial sectors such as the health and finance sectors, by offering improved visibility, reliability, and protection to the networks that are critical for their operations and business.