The Air Force Research Laboratory (AFRL), in collaboration with 21st Century Technologies Inc. and Air Intelligence Agency (AIA), has developed a unique product called NETWAR to detect anomalous network activity. This collaboration was made possible through the Air Force Small Business Innovative Research (SBIR) program.

“NETWAR is based on the premise that you have to understand the motive, means, and opportunity of attacks to get inside the attacker’s decision loop,” said Craig S. Anken, program manager in the AFRL Information Directorate’s Situational Awareness Branch.  “Strategic coordinated attacks are intelligence-driven, purposeful attacks with the goal of compromising strategic information and capabilities.  Recent news articles have described numerous attacks being executed against the Air Force from sites in China.”

NETWAR will identify groups of attacks that are strategically motivated by examining the relationships among the entities being attacked, the exploits executed, and vulnerabilities used.  The technology will also identify which groups are most likely to have carried out the strategic coordinated attack by fusing attack data against other intelligence sources.

 “A key technical element of this effort is the application of the Terrorist Modus Operandi Detection System (TMODS), developed under multiple AFRL programs, to computer network defense,” said Anken.  “TMODS provides the fundamental algorithms required to perform graph-based pattern matching and social network analysis.  It offers knowledge discovery capabilities beyond the current state-of-the-art in computer network defense, specifically addressing current weaknesses in the ability to detect insider and coordinated attacks.”

 There has been considerable user interest in the capabilities NETWAR has to offer the Intelligence community.   NETWAR is expected to provide strategic attack detection, strategic attack prediction, tactical attack detection, anomaly detection, and visualization capabilities to the AIA.

For more information, contact Francis L. Crumb, (315) 330-3053.