FROG LEAPS - Field Ready Operational Gadget for Locating Electronic Adversaries and Persistent Snoopers

This technical proposal outlines a Phase I Small Business Technology Transfer (STTR) effort aimed at adapting and deploying thatDot, Inc.'s commercial product, Novelty Detector, to support the timely detection of Advanced Persistent Threats (APTs) in Denied, Degraded, Intermittent, or Limited (DDIL) environments, as required by the Defensive Cyber Operations (DCO) initiative of the US Navy. APTs are a growing concern globally, posing a significant challenge to cybersecurity efforts due to their evolving techniques and the complexities of analyzing high-volume, diverse data sources. In this Phase I STTR, thatDot has partnered with the New Jersey Institute of Technology (NJIT) to extend the work performed under DARPA's Transparent Computing program, which successfully combined Novelty Detector and Quine, an open-source streaming graph database, for APT detection. The key technical objectives of Phase I include designing and developing an Initial Distillation Capability (IDC) to address the impact of connectivity loss on APT detection. The team will evaluate the combined technology stack of Novelty Detector and Quine, along with architectural considerations for alternative databases. Furthermore, Phase I will involve comparing the performance of Novelty Detector in stand-alone and connected/networked configurations. The analysis will address differences in STIX Indicators and detection timeliness between connected and disconnected environments. A detailed research plan will be developed, outlining data manipulation and software environment simulations to mimic DDIL conditions. The Phase I base period, spanning six months, will involve data selection, manipulation, and testing using Novelty Detector with Quine. The objective is to demonstrate that DDIL environments do not degrade the quality or timeliness of APT detection. Additionally, the team will explore how Novelty Detector's output can be effectively utilized for cyber event distillation. During the Phase I option period, the team will focus on the development of the IDC Design and Architecture plan. This plan will guide iterative software development and the containerization of IDC for customer deployment. Stakeholder feedback will be incorporated throughout this period to ensure seamless integration into operational environments. Ultimately, the Phase I effort will pave the way for a portable analytics solution capable of detecting APTs in DDIL environments, aligning with the US Navy's objectives outlined in their Cyber Strategy. This proposal encompasses critical research and development activities necessary to enhance the Navy's cybersecurity capabilities, safeguarding against evolving cyber threats.