Computer Network Defense (CND) for Future Satellite Operations Center (SOC) - MP 91-10

ABSTRACT: Metron, Inc. (Metron) proposes a distinctive solution for the identification of relevant cyberspace characteristics that can lead to early detection of cyber attacks and then couple that identification to an effective mitigation strategy using an expert-system optimization tool. This system will consist of both an expert system and distributed agents. The expert-system optimization tool, or inference engine, will combine together multiple data sources to dynamically extract and condense relevant network data traffic information. This tool combines the programmed knowledge of network experts with advanced mathematical techniques for rapid automated informational data mining to identify anomalous characteristics. In this process, the engine will dynamically sift through large amounts of network data and then fuse only the most significant network information to help identify suspicious network activity. Once a cyber intrusion or anomalous activity is detected, the inference engine will then apply the programmed knowledge of expert operators in order to recommend courses of action. Human operators may directly respond to fault conditions once alerted, or utilize tailored network software agents that can be node-deployed in order to institute recovery procedures. These agents allow for a modular architecture in which different remedial behaviors may be uploaded or swapped. BENEFIT: The Cyber Alert Tool described for this Solicitation for Computer Network Defense for DOD Satellite Control Centers has potential use for network defense in other complex, multilayered enterprises. Commercial applications could include Commercial Satellite Operations that would benefit from using this technology to safe guard their commercial space assets from Cyber Attack, and more generally any large scale corporation that needs an optimization tool for Cyber defense of their network.