Open source cyber fusion center

小型企业，包括具有高增长潜力的早期初创企业，面临着与大公司相同的网络安全威胁，包括网络犯罪、网络间谍和网络破坏，这些威胁可能会损害敏感业务数据的保密性和完整性，以及基本业务服务的可用性。此外，较小的组织通常缺乏有效响应和跟上不断变化的威胁环境的知识、技能、资源和能力。新的网络融合中心将从已安装的应用程序堆栈中收集有关安全事件和体系结构相关信息的信息，识别攻击模式和体系结构缺陷，生成和部署新的传感器规则，并识别需要修补的应用程序源代码区域。该提案解决了四个研究挑战：(1)从已安装的应用程序堆栈中收集安全和架构相关事件，并实时聚合事件；(2)通过检测攻击、活动和聚合威胁信息中的模式，实现对威胁的主动响应，并生成(i)语义丰富且易于理解的指标；（ii）将规则部署回已安装的堆栈以增强弹性；(3)监控应用栈架构，发现预示安全风险的缺陷，并对软件源代码推荐补丁；(4)部署应用栈和安全补丁。收益将包括新知识、生产急需的高素质人才，以及为安大略省和魁北克省的企业带来竞争优势，这些企业对网络攻击的抵御能力更强，对新出现的网络威胁也更敏感。

Small businesses, including early-stage startups with high-growth potential, face the same cybersecurity threats as large companies, including cyber-crime, cyber-espionage, and cyber-vandalism that can compromise the confidentiality and integrity of sensitive business data and the availability of essential business services. Furthermore, smaller organizations often lack the knowledge, skills, resources, and capabilities to respond effectively and to keep up with a constantly-shifting threat landscape. The new Cyber Fusion Center will aggregate information about security events and architecture-related information from the installed application stacks, identify attack patterns and architectural flaws, generate and deploy new sensor rules, and identify areas of the application source code that need to be patched. The proposal addresses four research challenges: (1) gathering security and architecture-related events from installed application stacks and aggregating events in real time, (2) enabling a proactive response to threats by detecting attacks, campaigns, and patterns in aggregated threat information, and generating both (i) semantically-rich and easily-understood metrics and (ii) rules to be deployed back into installed stacks to enhance resilience, (3) monitoring the application stack architecture for flaws indicative of security risks and recommending patches to the software source code, and (4) deploying application stacks and security patches. Benefits will include new knowledge, production of much-needed highly qualified personnel, and competitive advantage for Ontario and Quebec businesses that are more resilient to cyberattacks and more aware of emerging cyberthreats.