Portable Analytics for Automated Reconstruction and Investigation of Multi-Stage Cyber Attacks (PANORAMA)

Recent research and development endeavors have made significant progress in the general area of attack investigation and attack story reconstruction through correlation of multi-layer logs and suspicious information flows. However, these efforts typically assume a central paradigm of computing and information processing, posing great challenge to apply such techniques and tools in relevant defensive cyber operations where connectivity is Denied, Degraded, Intermittent, or Limited (DDIL). The proposed Portable Analytics for Automated Reconstruction and Investigation of Multi-Stage Cyber Attacks (PANORAMA) solution aims to addresses this critical gap. First, the overall architecture is decentralized and opportunistic in that edge nodes perform local analytics on the spot, multiple portable analytics can be performed in parallel, the portable analysis devices will leverage regional computing resources when available, and central computing will be executed when local and regional analytics can upstream the data and analytics results. Second, the analytics, being local, regional, or global, will cover various data sources including multi-layer logs and network information flow, offering opportunities for holistic analytics across the decentralized computing paradigm. Finally, the PANORAMA solution leverages team’s previous development and transition success related to this R&D area for a successful technology development, maturation and transition.