AMAP-based Autonomic Security Operations Center (ASoC)

In this STTP project, AVIRTEK will leverage the tools and algorithms developed in the AMAP Phase II SBIR to develop an AMAP-based Autonomic Security Operations Center (ASoC) system that continuously monitors the cyber resources and services 24 by 7, performs anomaly behavior analysis to detect malicious activities and proactively recommends actions to stop attacks and minimize their impacts. AMAP-based ASoC architecture is based on the autonomic paradigm that is inspired by the human autonomic nervous system that handles complexity and uncertainties, and aims at realizing computing systems and applications capable of managing themselves with minimum human intervention. In this STTP project, we will extend the current AMAP prototype to develop an innovative security architecture that assumes any cyber component (resources, data, applications, and any external data (obtained from the Internet or from an open source)) is malicious until it can be verified that it is free from any malicious components. The autonomic computing provides the mechanisms to take proactive actions to stop cyber-attacks, their propagation as well as mitigate their impacts. The main modules of the ASoC are: Continuous Threat Modeling (CTM), Cyber Situation Awareness (CSA), Anomaly Behavior Analysis (ABA), and Intelligent Cyber Security Assistant (ICSA).