Network Sensing and Analytics for Low Bandwidth Cyber Protection Team (CPT) Deployment Scenarios

Many existing network intrusion detection systems (IDS) employ expensive deep packet inspection (DPI) and sophisticated pattern matching algorithms to spot evidence of known threats in the network traffic. While IDS are a valuable component of a defense-in-depth strategy, they often require significant compute power, tend to miss new (previously unknown) threats, run on heavy hardware, may require access to high-bandwidth external cloud-based threat analysis services, and can be energy-hungry. Clearly, these systems cannot meet the desirable properties of a modern, accurate, adaptive, and highly portable cyber-protection kit. To address the shortcomings of existing IDS, we propose to build HULCK, a novel lower-size, low-weight, low-power cyber-protection system that provides accurate network anomaly detection and threat prioritization. HULCK will consist of three main components: (i) one or more Miner devices that can be deployed at the edge and inside the mission network to observe and summarize all network traffic; (ii) an Analytics module that receives and aggregates the summarized network traffic information coming from the Miners, and that applies advanced anomaly detection and threat prioritization algorithms inspired by collective classification methods in machine learning; and (iii) an Intel module that provides threat intelligence and threat attribution capabilities.