Open source cyber fusion center

小企业，包括具有高增长潜力的早期初创企业，面临着与大公司相同的网络安全威胁，包括网络犯罪、网络间谍和网络破坏，这些威胁可能会危及敏感商业数据的机密性和完整性以及基本商业服务的可用性。此外，较小的组织通常缺乏知识、技能、资源和能力来有效响应并跟上不断变化的威胁格局。新的网络融合中心将从安装的应用程序堆栈中收集有关安全事件和体系结构相关信息的信息，识别攻击模式和体系结构缺陷，生成和部署新的传感器规则，并确定需要修补的应用程序源代码区域。该建议解决了四个研究挑战：(1)从已安装的应用堆栈收集安全和架构相关事件并实时聚合事件，(2)通过检测攻击、活动和聚合威胁信息中的模式来实现对威胁的主动响应，并生成(I)语义丰富且易于理解的度量和(Ii)要部署回已安装堆栈以增强弹性的规则，(3)监控应用堆栈体系结构以发现指示安全风险的缺陷并向软件源代码推荐补丁，以及(4)部署应用堆栈和安全补丁。好处将包括新知识、培养急需的高素质人才，以及为安大略省和魁北克省的企业提供竞争优势，这些企业更能抵御网络攻击，更能意识到新出现的网络威胁。

Small businesses, including early-stage startups with high-growth potential, face the same cybersecurity threats as large companies, including cyber-crime, cyber-espionage, and cyber-vandalism that can compromise the confidentiality and integrity of sensitive business data and the availability of essential business services. Furthermore, smaller organizations often lack the knowledge, skills, resources, and capabilities to respond effectively and to keep up with a constantly-shifting threat landscape. The new Cyber Fusion Center will aggregate information about security events and architecture-related information from the installed application stacks, identify attack patterns and architectural flaws, generate and deploy new sensor rules, and identify areas of the application source code that need to be patched. The proposal addresses four research challenges: (1) gathering security and architecture-related events from installed application stacks and aggregating events in real time, (2) enabling a proactive response to threats by detecting attacks, campaigns, and patterns in aggregated threat information, and generating both (i) semantically-rich and easily-understood metrics and (ii) rules to be deployed back into installed stacks to enhance resilience, (3) monitoring the application stack architecture for flaws indicative of security risks and recommending patches to the software source code, and (4) deploying application stacks and security patches. Benefits will include new knowledge, production of much-needed highly qualified personnel, and competitive advantage for Ontario and Quebec businesses that are more resilient to cyberattacks and more aware of emerging cyberthreats.**********************