CORSA: A Comprehensive Toolset for CORrelation and Situation Awareness

Cyber networks have evolved into a ubiquitous infrastructure, and the Internet has become a mission-critical asset for governments, companies, institutions. Therefore, there is a need for tools and techniques that will provide situation awareness of the current defense status of large-scale networks during 24/7 operations. This includes assessing the impact of attacks and predicting future adversary intentions. The product of the proposed program is an environment, called CORSA, that integrates correlation techniques with models of cyber-missions and the associated cyber-assets. The CORSA environment provides the cyber-mission decision-makers with: a succinct picture of the adversarial activity on the cyber-network; the capability to analyze the impact of the adversarial activities; knowledge of what assets have been compromised or are being threatened; the ability to anticipate what is going to happen next; access to alternative responses to counter current and future attacks. In Phase I of this program we developed prototypes that demonstrated how the integration of advanced intrusion correlation and sophisticated mission modeling can provide the basis for effective situation awareness and threat analysis. Phase II will yield a more mature and more sophisticated environment with more efficient, large-scale correlation algorithms and an intuitive graphical control console.