Developing Cyber Situation Awareness for Enterprise Health

To ensure survival, next-generation networks in defense systems and enterprises must monitor the health of each component, detect failures and anomalies, and fight through attacks. Currently deployed intrusion detection systems and network monitoring tools provide useful information, but they cannot provide the complete view and seamless access required to understand and react quickly. Real-Time Innovations (RTI) proposes to develop a distributed framework that can collect and integrate status from a real-time Combat Management network, near-real-time Intelligence Surveillance Reconnaissance network, or non-real-time enterprise network. The framework will create a Cyber Common Operating Picture (CCOP) by making all relevant data in the system available for analysis to any authorized entity. The framework will build on the Object Management Group (OMG) Data Distribution Service (DDS) standard. DDS enables portable, interoperable, real-time data delivery. The proposed architecture will use DDS to collect data from a variety of smart sensors, normalize the data, and deliver it quickly to interested monitors. Operators and analysis servers will then subscribe to this data, learn the schema, and perform real-time analysis, aggregation, or recording. When commercialized, the framework will bring facile, real-time Cyber Situational Awareness, greatly increasing network reliability and defensibility through cyber conflict.