REAL-TIME INNOVATIONS, INC. — Department of Defense SBIR Phase I: Computer Network Defense (CND) relies on sensors to observe hosts and networks. Functions

Description

Computer Network Defense (CND) relies on sensors to observe hosts and networks. Functions include pattern or signature matching against known hostile profiles, anomaly detection, log file analysis and raw packet capture and analysis. Many of these processes, especially raw packet analysis, generate large amounts of data. Incidents can occur at locations remote from a cybersecurity incident response team. Cybersecurity communications formats, schemas and protocols use data encoded in XML, which is not an efficient data encoding method. These protocols include SCAP, IODEF and CYBEX. Additionally, cybersecurity systems collect large raw log files from hosts, routers, switches and other devices, for future analysis. To solve this bandwidth problem, RTI proposes a set of four solutions. First is an XML protocol converter which converts XML messages of various protocols into RTPS, significantly reducing transmission overhead. Second is to use the RTI Limited Bandwidth Plugins to reduce RTPS header size, compress cybersecurity data and apply other techniques to enable transmission on a limited bandwidth channel. Third, to use RTI sender-side filtering to limit the types of messages sent during normal operation while allowing a cybersecurity incident response team to increase reporting granularity in response to a security event. RTI also proposes to use its upcoming OMG standard Secure DDS product to secure cybersecurity messages against modification. Secure DDS is more applicable to unreliable and low bandwidth connections than current data integrity solutions.