This paper describes the Cyber Situational Understanding (Cyber SU) Proof of Concept (CySUP) software system for exploring advanced Cyber SU capabilities. CySUP distills complex interrelationships among cyberspace entities to provide the “so what” of cyber events for tactical operations. It combines a variety of software components to build an end-to-end pipeline for live data ingest that populates a graph knowledge base, with query-driven exploratory analysis and interactive visualizations. CySUP integrates with the core infrastructure environment supporting command posts to provide a cyber overlay onto a common operating picture oriented to tactical commanders. It also supports detailed analysis of cyberspace entities and relationships driven by ad hoc graph queries, including the conversion of natural language inquiries to formal query language. To help assess its Cyber SU capabilities, CySUP leverages automated cyber adversary emulation to carry out controlled cyberattack campaigns that impact elements of tactical missions.
United States Army Training and Doctrine Command (TRADOC). The US Army operating concept: win in a complex world (2020-2040). Pamphlet 525-3-1, 7October2014. Fort Eustis, VA: TRADOC.
NoelSHarleyETamKH, et al. CyGraph: graph-based analytics and visualization for cybersecurity. In: GudivadaVRaghavanVGovindarajuV, et al. (eds) Cognitive computing: theory and applications, vol. 35 (Handbook of statistics). Amsterdam: Elsevier, 2016, pp. 117–167.
6.
NoelSHarleyETamKH, et al. (Inventors). System and method for visualizing and analyzing cyber-attacks using a graph model. US Patent 10,313,382, 4June2019.
7.
NoelSHarleyETamKH, et al. Big-data architecture for cyber attack graphs: representing security relationships in NoSQL graph databases. In: Proceedings of the IEEE symposium on technologies for homeland security, Boston, MA, 14–16 April 2015.
Splunk. The data-to-everything platform built for the cloud, 2005–2020, https://www.splunk.com (accessed 3 December 2020).
10.
Internet Engineering Task Force (IETF). The LDAP Data Interchange Format (LDIF)—technical specification, 2000, https://tools.ietf.org/html/rfc2849 (accessed 2 December 2020).
11.
Apache Kafka®. A distributed streaming platform, 2017, https://kafka.apache.org (accessed 2 December 2020).
12.
Docker Inc. Docker: empowering app development for developers, 2020, https://www.docker.com (accessed 6 December 2020).
13.
The Apache Software Foundation. Apache ZooKeeper™, 2010–2020, https://zookeeper.apache.org (accessed 7 December 2020).
NoelS.A review of graph approaches to network security analytics. In: SamaratiPRayIRayI (eds) From databases to cyber security (Lecture notes in computer science). Cham: Springer, 2018, pp. 300–323.
16.
The PostgreSQL Global Development Group. PostgreSQL: the world’s most advanced open source relational database, 1996–2020, https://www.postgresql.org (accessed 4 December 2020).
17.
Neo4j, Inc. Neo4j graph platform—the leader in graph databases, 2020, https://neo4j.com (accessed 4 December 2020).
18.
OpenJS Foundation. Node.js® is a JavaScript runtime built on Chrome’s V8 JavaScript engine, 2020, https://nodejs.org/ (accessed 4 December 2020).
DiFonzoCNoelS, DeCypher: human machine interaction for graph-based cyber situational understanding, in 89th Military Operations Research Symposium (MORS), virtual, 2021.
Program Executive Office Command Control Communications–Tactical (PEO C3T). Tactical network initialization and configuration, 2020, https://peoc3t.army.mil/i2s/tnic.php (accessed 7 December 2020).
The MITRE Corporation. MITRE ATT&CK®, 2015–2020, https://attack.mitre.org (accessed 7 December 2020).
31.
HeinbockelWNoelSCurboJ. Mission dependency modeling for cyber situational awareness. In: Proceedings of the NATO IST-148 symposium on cyber defence situation awareness, Sofia, 3–4 October 2016, pp. 5.1–5.14. North Atlantic Treaty Organization Science and Technology Organization.
32.
NoelSBodeauDMcQuaidR. Big-data graph knowledge bases for cyber resilience. In: Proceedings of the NATO IST-153 workshop on cyber resilience, Munich, 23–25 October 2017.
