CFD-Based Anomaly DETection Device (CADET) for Computer Network Operations

In this SBIR, ISAC proposes to develop an innovative, high-accuracy anomaly detection system for missile defense network systems. Currently, ISAC is developing a novel, CFD-based simulation software package named CFD-DoS that provides Denial-of-Service prediction and traceback for the MDA. Spray tracking capabilities utilized in Computational Fluid Dynamics (CFD) are used to track and simulate information packets on a time scale that is faster than real time. What is needed, and proposed in this SBIR, is a new detection system that uses observed characteristics and metrics of the CFD-DoS simulation to create patterns of normal weapon system network traffic. The learned pattern of network behavior will then be used to detect network anomalies and alert security managers when attacks may be occurring. The proposed detection system (named CADET for CFD-Based Anomaly Detection Device) will be fully integrated into the CFD-DoS software. CADET is anticipated to outperform current payload anomaly detection systems (based on speed and low false-positive rate). At the conclusion of Phase I, ISAC will show feasibility by testing a CADET prototype against known network attacks, and demonstrating performance increase over current Commercial Off-the-Shelf (COTS) and open-source anomaly detection systems. In Phase II, ISAC will further develop the CADET software, and demonstrate increased attack detection of both known and unknown network attacks on a live C3 network.