NetScout: Network Scanner of Capabilities and Organization via Unobvious Techniques

Our nation's infrastructure is under increasing threat of criminal and terrorist cyber attacks, which can come without warning and cause great harm. There are numerous countermeasures we can take once we detect an attack, but as long as our responses aredefensive and reactionary in character, we are at a great disadvantage. We would be much better served to take the offensive against our cyber adversaries. The essential first step in doing so is to gather intelligence. We need a low-profile, effectivetool for government, law enforcement, and corporate security organizations to use to discover and display the structure and services of suspicious networks attached to the Internet. ATC-NY proposes to develop NetScout - a Java-driven web-based tool withthree basic functional components: network discovery, information correlation, and network display. The network discovery component will use stealthy scans to probe targeted networks. The correlation component will aggregate, assess, and interpret thescan results to form a coherent model of the network. The display component will be user-directed, navigating the network model to show its organization, capabilities, and vulnerabilities. NetScout will assist government, as well as corporate networksecurity administrators and law enforcement agencies, in providing better security to our nation's digital infrastructure against hackers and terrorists.