P21-181 CyCog-H Cyber Hunt Toolkit

The level of connectiveness in today’s world is a double-edged sword. Nowhere is this more apparent than in systems critical to infrastructure. Increased connectivity is necessary to monitor and control complex systems with many connected devices but leads to a multitude of attack vectors. The typical Navy ship has a number of critical systems including C4, navigation, and weapons control. Compromising any of these at a critical moment could lead to terrible repercussions, so adversaries are incentivized to find means to discretely compromise them. To meet this challenge, SoarTech, partnered with IronNet and Gormat, will design, prototype, and assess the Autonomous Cyber Hunt Toolkit (AHuT), a modular, open architecture system that monitors devices for abnormal behavior and uses threat models to drive an autonomous cyber hunt that aggressively monitors likely threat vectors. AHuT will bring information together, reason about the information, take appropriate mitigation steps, and generate a report supporting quick corrective action. This system will operate with limited threat intelligence based on learned cyber hunt models and ingest additional information when available by hooking up to shore based intelligence systems such as SharkCage.