Developing Cyber Situation Awareness for Enterprise Health

Zel Technologies will provide a feasibility report and demonstrate a proof-of-concept Enterprise Health and Situation Awareness (EHSA) prototype for mission-oriented network situation awareness and enterprise health. We will extend our existing automated Course of Action (COA) Modeler (ACAM) with two emerging technological enablers in this effort: security metrics (SM) and visual analytics (VA). We enhance results from traditional sensors and conventional situation assessment solutions for network operations with new sensors and ambiguity resolution. ACAM enables anticipatory and predictive awareness at enterprise and enclave levels. Our concept includes a unique data mining capability for unifying data from multiple sources and indicating possible new observables from ontology changes detected in the data itself. Automated ontology creation integrates observations from existing and emerging sensors and sensor webs, and offers the capability of creating new sensors compatible with a distributed semantic sensor web. Human understanding is aided by advanced VA techniques for knowledge representation that provide 2D, 3D, and non-traditional displays with interactive levels of detail. Combined information supports visualization displays for distributed cooperative decision makers to determine the effects of network cyber attacks on the mission and organization. The prototype will provide the information and capability for autonomic and man-in-the-loop responses.