SBIR Phase I: Transforming Incident Response: A Platform for High-Fidelity Network Forensics at Scale

在美国经济几乎所有部门都依赖于关键基础设施的安全和稳定之际，这项小企业创新研究（SBIR）第一阶段项目的更广泛影响/商业潜力涉及提高互联网的安全性。这项创新的商业化将使美国经济的多个部门受益，包括政府、国防、关键基础设施、公用事业、金融服务、制造业、教育和研究。通过改变分析和响应网络安全事件的计算机专业人员的工作流程，这一创新将使国家的私营和公共组织能够更快、更有效地应对快速增长的外部威胁。该项目将以开源软件的形式向公众发布底层核心技术，使其功能免费提供给更广泛的网络安全社区，同时利用将系统紧密集成到现有产品线中的附加价值来推动收入。这个小企业创新研究（SBIR）第一阶段项目将开发一个新型网络取证平台的早期原型，该平台提供对客户网络活动的长期取证档案的高度交互式访问。该平台将通过采用高效、紧凑的网络事件表示，支持各种规模和背景下的网络事件实时分析，从而实现比传统产品更细粒度的网络活动统一视图。将产品推向市场的主要技术挑战包括将当前的原型技术扩展到高性能的生产级软件中，将其集成到现有的商业设备平台中，而不影响两者的性能，以及设计一个有效支持法医调查的交互式用户界面。

The broader impact/commercial potential of this Small Business Innovation Research (SBIR) Phase I project concerns improving the security of the Internet, at a time when virtually all sectors of the U.S. economy depend on the safety and stability of that critical infrastructure. The commercialization of this innovation will benefit multiple sectors of the US economy, including government, defense, critical infrastructure, utilities, financial services, manufacturing, education, and research. By transforming the workflow of computer professionals who analyze and respond to cyber security incidents, this innovation will enable the nation's private and public organizations to respond to the rapidly-increasing levels of external threats much more quickly and effectively. The project will release the underlying core technology as open-source software to the public, making its capabilities freely available to the broader network security community, while exploiting the added value of tightly integrating the system into its existing product line to drive revenue. This Small Business Innovation Research (SBIR) Phase I project will develop an early prototype of a novel network forensics platform that provides highly interactive access to a long-term forensic archive of a customer's network activity. The platform will support real-time analysis of cyber events at a variety of scales and contexts by employing an efficient, compact representation of network events that enables a unified view of network activity at much finer granularity than with traditional products. The primary technical challenges for bringing the product to market include scaling current prototype technology into high-performance production-grade software, integrating it into an existing commercial appliance platform without impairing the performance of either, and designing an interactive user interface that supports forensic investigations effectively.