Towards the Next Generation Security Monitoring and Analysis Systems

This Small Business Innovation Research (SBIR) Phase I project examines the feasibility of creating a scalable, responsive network security monitoring tool. The tool, based previous activity on network forensics and network security research, monitors traffic and filters out metadata in the form of synopsis, compresses it efficiently, and stores it online. This synopsis data is then analyzed for symptoms associated with malware. Upon recognizing such symptoms, the tool flags clients, managed as well as unmanaged, that have been compromised. Captured data can be further analyzed to identify where and when the malware entered the network, its actions since entry, and its communications with dormant peers. If successful, the tool developed will play a vital role in the cyber security of defense, government, private sector, education, and other networks. Each year significant and costly damage is inflicted upon all these institutions. Products and services available today typically endeavor to build a shield around networks to keep malware out. However, they fight a difficult battle and highly-publicized compromises occur each year. This tool presumes that penetration of networks will occur, and focuses on eliminating / minimizing damage caused post-compromise. If successful, the tool may address a significant portion of the damage incurred each year.