MADAR: Malicious Anomalies Detection, Diagnosis, and Response

The complex integration of advanced Air Force weapons system components make them vulnerable to a high number of attacks from malware. The infiltration of malware onto these systems can have critical and catastrophic impacts on mission success. The trend of increasing use of commercial off-the-shelf hardware and software intellectual property within weapon systems provides our adversaries many opportunities to access and compromise our weapon systems. These compromises often are undetected for many months of normal operation of the systems providing adversaries a wide window of time to launch zero-day attacks on the many interconnected systems. The MADAR solution provides a capability to distinguish malicious cyber effects from other anomalies and rapidly diagnose these cyber effects to direct a custom response and maintain mission assurance. MADAR offers a service-based framework that integrates with existing static and dynamic analysis tools to collect the required data for the diagnostic algorithms and applies next generation technology for diagnostic reasoning of an emergent attack to allow a realistic, near real-time response for mission assurance. MADAR has significant government and commercial applications.