Advanced Information Understanding Algorithms to Detect Counter-Terrorist Activity in Support of Total Force Protection

21st Century Technologies proposes NETWAR: Predictive Threat Analysis for Computer Network Defense, a Phase II SBIR proposal. The objective of NETWAR is to develop an advanced knowledge discovery capability that would support the Air Force Information Warfare Center (AFIWC), a component within the Air Intelligence Agency (AIA). There are two functional elements to this objective:  To predict and provide adequate warning of future threat activity  To fuse intelligence and network-monitoring data in an effort to identify aggressive actions against Air Force computer networks. To achieve this objective, we have identified several technical goals that will leverage from TMODs, Terrorist Modus Operandi Detection System, a technology developed on the formerly DARPA EELD and Genoa II programs. TMODS will reduce the number of threats identified as false positives presented to AIA analysts by better fusing and analyzing patterns coming in from sensors and other systems. Elements of the threat library are represented as graphs and will be "pattern matched" against AIA data sets. The end product will provide the AIA analyst the ability to detect and analyze computer-based network attacks in terms of social network based threat patterns - a capability currently unavailable from COTS products.