HawkNest: Computer Forensic Listening Posts for Rapid BMDS Network Forensics

Information Security and Assurance Corporation (ISAC, Inc.) proposes to develop an innovative HawkNest Computer Forensic Listening Post technology for the BMDS. The purpose of a Forensic Listening Post is to capture and store network forensic data at strategic points in the weapon system network for improved real-time and post mortem forensic analysis. The Listening Post will provide advanced analysis and forensic data synopsis for rapid forensic investigations. HawkNest features include: intelligent network capture and logging to minimize forensic data storage, innovative network forensic synopsis, and high assurance forensic data storage necessary for liturgical investigation. Network forensics is a wide open research field critically important to MDA because: 1. Host based forensic analysis requires the host to be taken off line for data collection. This will have an adverse operational readiness impact on the BMDS. 2. Host-based forensic analysis takes too much time. Forensics analysts have to travel from site to site to collect data. In a large, geographically disbursed network like the BMDS, days and weeks may pass before useful results are available. During a missile crisis, BMDS operators may only have a seconds or minutes to remedy the attack. In Phase I, ISAC will demonstrate feasiblity of a Forensic Listening Post with a proof-of-principle prototype.