Feed Aggregation for Threat Evaluation Service (FATES)

CNDSP analysts protect US computer networks, detect threat occurrences on those networks, and respond to threat incidents. The adage"know thy enemy"is as true for network defense as it is for defense of any asset. A robust computer network defense requires current knowledge of possible and actual threats and knowledge of conditions within the network. However, analysts must invest valuable time manually gathering and processing threat descriptions, which reduces the time available for understanding the nature of new threats, preparing responses to those threats, monitoring network conditions for threat occurrences, and responding to threat incidents. Approaches are needed that automate and make routine collection of threat information, aggregating collected information into comprehensive threat descriptions, assessing the risk severity posed to US networks, and generating meaningful I & W for a future or occurring threat. We propose a Feed Aggregation and Threat Evaluation Service (FATES) that will: (1) automatically collect network threat information from multiple threat information feeds, (2) aggregate information from these feeds to produce a timely comprehensive threat description, (3) provide web services that distribute threat descriptions to CNDSP analysts displays, and (4) provide a web service that distributes advanced I & W for CNDSP analysts.