System for Understanding Potential Espionage and Reconnaissance in Network Operations through Visual Analytics (SUPERNOVA)

Today, security experts for high-value networks face a pernicious and evolving threat: hundreds to thousands of infected computers that work in coordination to overcome defensive network countermeasures. Distributed Intrusion Detection Systems (DIDS), consisting of connected IDS nodes that communicate to identify threats, are critical for identifying and responding to cyber espionage networks. However, each IDS node produces massive amounts of data that can quickly overwhelm network operators when aggregated in the distributed system. Network operators face an onslaught of data that they must wade through to glean information relevant to their situation. To address the need for helping Army tactical network operators and users to efficiently identify, quickly understand, and respond effectively to network threats, we propose to design and demonstrate a System for Understanding Potential Espionage and Reconnaissance in Network Operations through Visual Analytics (SUPERNOVA). The visualization techniques and role- and device-based information tailoring techniques in SUPERNOVA will combine the perceptual reasoning capabilities provided by sound visual analytic principles with a novel, visual ontology-based solution for tailoring displays to the user. This will reduce the cognitive burden placed on army warfighters, improve their threat detection accuracy, and improve their response time.