Real-time Adversarial Characterization and Adaptive Software Protection Countermeasures

Clear Hat is developing technologies to address the problem of computer system survivability. Survivability can be defined as the capability of a system to fulfill its mission in the presence of attacks, failures, or accidents. Properties that increase survivability include resistance to attacks, the recognition of attacks and resulting damage, the recovery of essential services following an attack, and the ability to adapt in a way that minimizes damage from future attacks. This research is drawing on concepts from the biological immune system to design a set of cyber threat assessment and response algorithms and capabilities. These will enable a system to assess threats in real-time so that cyber attacks can be aborted before they cause damage or otherwise impact system operation. We are considering a broad scope of threats in our design. These include both known and unknown threats that operate at both high and low levels in the system. Gathering information about attack dynamics during the threat assessment process is also a secondary goal of this effort. During Clear Hat"s Phase I effort, a Proof of Concept system demonstrating the feasibility of our approach was developed and successfully tested.