CORSA: A Comprehensive Toolset for CORrelation and Situation Awareness

Cyber-networks have evolved into a ubiquitous infrastructure, and the Internet has become a mission-critical infrastructure for governments, companies, institutions, and millions of everyday users. To protect mission-critical cyber-networks, it is necessary to develop technologies and tools that will enable situation awareness of the current defense status of large-scale networks. This includes assessing the impact of attacks and predicting future adversary intentions. To address these issues, we propose to develop a comprehensive toolset that will assess the system health and mission impact of attacks and will allow one to explore the possible impact of future adversary actions. Our toolset relies on innovative models for the description and management of asset information and mission data. We will develop tools to update the model data with timely information about the status of the assets and the missions. This information is directly integrated into the intrusion correlation process. By doing this, it is possible to determine how a cyber-attack could influence the ability of the infrastructure to support critical missions. Our analysis tools will also support "what if" analysis on the models in order to determine the impact of future actions of the attacker.