Ingalls Information Security LLC — Department of Defense SBIR Phase I: AF192-001

Description

Current network monitoring systems and auditing methods are limited in their ability to present enough information simultaneously necessary for human analysts to gain network situational awareness. Some known limiting factors: • Existing two-dimensional, spreadsheet format, user Interfaces with scroll bars severely limit the amount of information that can be displayed. • Analysts must construct a mental model of the environment they are investigating based on their knowledge and experience by slowly consuming information via legacy 2D methods. • Existing security monitoring systems require manual correlation mapping of security event data between multiple systems in order to present relevant information simultaneously. Ingalls Viewpoint is designed to solve these problems by: • Identifying geospatial, temporal, and contextual connection between data that allows quick identification of emerging threats and user patterns • An effective, common model of the network environment that provides proper context for security events and structured intelligence • Information from security data that is automatically correlated through visual overlay of specific security event data on top of computers and connections in the environment Ingalls Viewpoint satisfies the issues raised by AF User Need ID: 3092; 3442. The approach is innovative and has the potential for commercialization.