Open source cyber fusion center

点击翻译按钮获取中文摘要

Small businesses, including early-stage startups with high-growth potential, face the same cybersecurity threats as large companies, including cyber-crime, cyber-espionage, and cyber-vandalism that can compromise the confidentiality and integrity of sensitive business data and the availability of essential business services. Furthermore, smaller organizations often lack the knowledge, skills, resources, and capabilities to respond effectively and to keep up with a constantly-shifting threat landscape. The new Cyber Fusion Center will aggregate information about security events and architecture-related information from the installed application stacks, identify attack patterns and architectural flaws, generate and deploy new sensor rules, and identify areas of the application source code that need to be patched. The proposal addresses four research challenges: (1) gathering security and architecture-related events from installed application stacks and aggregating events in real time, (2) enabling a proactive response to threats by detecting attacks, campaigns, and patterns in aggregated threat information, and generating both (i) semantically-rich and easily-understood metrics and (ii) rules to be deployed back into installed stacks to enhance resilience, (3) monitoring the application stack architecture for flaws indicative of security risks and recommending patches to the software source code, and (4) deploying application stacks and security patches. Benefits will include new knowledge, production of much-needed highly qualified personnel, and competitive advantage for Ontario and Quebec businesses that are more resilient to cyberattacks and more aware of emerging cyberthreats.