Advanced Persistent Cyber Threat Anomaly Detection

The imminent cyber-attack most threatening to Navy IP-based combat system networks is the Advanced Persistent Threat.Characterized by its ability to go undetected on the targeted system for extended periods of time, this adversary looks to compromise data for economic or military advancement.Common predict-and-control cyber defense tactics such as anti-virus and patching are rendered useless against the custom malware and tools leveraged by this advanced adversary.IDTs proposed solution for Cyber Threat Anomaly Detection and Mitigation (CTADM) supports the shift in cyber defense strategy, from predict-and-control to detect-and-learn.Focusing cyber defense resources inside the boundary of the system network enables the defense to monitor anomalous behavior and discriminate threats as they occur in real-time.IDTs ATRT system threads uniquely provide the capability to capture cyber-related system data in the context of expected operational function, an important discriminator in balancing missed detections and false alarms.This increased dimensionality of solution space more clearly reveals the tactics, techniques, and procedures that indicate the presence of an APT on the system.Leveraging these threat indicators for threat engagement, earlier in the kill chain, enables information superiority over the APT to be achieved.