Shipboard Defensive Cyberspace Operations (S-DCO)

Cyber threat hunting is defined in current standards as a proactive search capability in organizational systems to search, detect, track, identify, and disrupt advanced persistent cyber threats. We propose a Shipboard Defensive Cyberspace Operations (S-DCO) for the Navigation Enclave that operates in parallel and in coordination with the other warfare areas.Ā It is an integrated approach that addresses the various functions which need to be integrated into a complete real-time analysis process.Ā The purpose is mission assurance. The Navigation Enclave supports many aspects of ship missions. Firstly, it supports navigation and maneuver and system availability is critical in restricted, shallow, hazardous, or congested waterspace. But, it also provides critical support to other Warfare Areas.Ā For Air warfare, precisely timed and highly accurate initialization of SM-x Āis critical for successful guidance. For Land and Surface warfare, transfer alignment of shipÆs aircraft and cruise missiles is critical. For Space, it must provide very exacting stabilization parameters for radar beam pointing with little to no noise anomalies. For operations under the ice cap, it must perform with extreme stability and statistical uniformity. These examples illustrate the imperative to protect the Navigation EnclaveÆs systems and to ensure they can provide the demanding Quality of Service (QoS) required by mission systems. This work is innovative in several ways: Newly invented Data Fusion (DF) Artificial Intelligence (AI) algorithms infer attack behavior from observations and features of ownforce assets.Ā This way, when a zero-day (never seen before) attack occurs, the DF algorithms will still detect the effects even though the cause is initially unknown. Ā Typical cyber threat detection products have signature-based threat detection.Ā Catching threats by signatures is like trying to catch burglars by fingerprinting every surface in a city. The DF can produce multiple hypotheses yet keep the operatorÆs decision space tractable because each hypothesis has a mathematically rigorous likelihood ratio that can be used to filter, screen, threshold, and prioritize the cyberspace situational display. The DF algorithms are informed by a formal ontology populated with authoritative cyberspace knowledge such as CAPECÖ and ATT&CK«. Artificial Intelligence (AI) statistical and deep learning algorithms will be developed to learn normalcy and abnormal cyberspace behavior to fine-tune the attack behavior parameters in the Cyber Ontology. Novel adaptation of patented IBSM Level 4 data fusion algorithm to optimize cyberspace expected information value rate. Never before sophisticated Level 0-4 DF and ontology applied to realtime shipboard Industrial Control System (ICS) environment. Integration of a widely used Commercial Off The Shelf (COTS) cyber product (Elastic) with state-of-the art scientific DF algorithms.