Statistical Intrusion Detection System Generating Policy-based Responses to Cyber Threats

To address the Navy need for a real-time capability for anomaly-based detection of Advanced Persistent Threats (APTs) in Internet Protocol based Combat System networks, Physical Optics Corporation (POC) proposes to develop a new Statistical Intrusion Detection System Generating Policy-based Responses to Cyber Threats (STINGER) based on Markov decision processes and intelligent action policy. This combination provides artificial intelligence needed to detect and mitigate the APTs and both known and new cyber-attacks. STINGER monitors network traffic, dynamically detects and classifies attacks using statistical analysis and an anomaly-based intrusion detection mechanism. STINGERs infrastructure-agnostic intrusion detection/response mechanism enables detection of currently undetectable new generation of cyber-attacks, such as highly distributed and coordinated attacks and low frequency attacks, as well as classification and mitigation of attacks. In Phase I, POC will develop STINGERs overall system architecture, framework and algorithms, and demonstrate feasibility by assembling and testing a prototype. In the Phase I Option we will refine the system design and prepare detailed technical specifications for the software to be developed in Phase II. In Phase II, POC will develop an advanced prototype to demonstrate real-time attack pattern detection and attack classification prediction model capabilities in representative enterprise networks and environments.