Context Aware INference for Advanced Persistent Threat (CAIN for APT)

Defending against state-of-the-art cyber attacks such as Advanced Persistent Threats requires rapid, automated, and accurate prioritization of cyber alerts to provide timely and comprehensive cyber-situational awareness. Context Aware INference for Advanced Persistent Threat (CAIN for APT) will address this important operational need by developing, evaluating, and transitioning our innovative case-based, context-aware reasoning capability. CAIN will ingest massive amounts of disparate cyber-sensor data from sources such as component-dependency analyses, intrusion detection outputs, system health diagnostics, activity-based alerting, and adversary threat reports. CAIN will then place these data into operational and environmental context using diverse and distributed sources, and do so in real-time. In Phase II, we will: (i) adapt and extend our existing inference and Bayesian concept learning technologies to the cyber domains; (ii) identify optimal inputs to CAIN, including vetted cyber-attack cases, sources of context, and evaluation data; (iii) design, build, and test a prototype CAIN system that is scalable and targeted towards transition; and (iv) test and evaluate CAIN on realistic data within realistic environments to illustrate the applicability, practicality and scalability of our system. The results of the Phase II program will demonstrate the feasibility and promise of the systems concept to be transitioned in Phase III.