SBIR Phase I: Transforming Incident Response: A Platform for High-Fidelity Network Forensics at Scale

Broala, Llc, San Francisco CA

Investigators

Abstract

The broader impact/commercial potential of this Small Business Innovation Research (SBIR) Phase I project concerns improving the security of the Internet, at a time when virtually all sectors of the U.S. economy depend on the safety and stability of that critical infrastructure. The commercialization of this innovation will benefit multiple sectors of the US economy, including government, defense, critical infrastructure, utilities, financial services, manufacturing, education, and research. By transforming the workflow of computer professionals who analyze and respond to cyber security incidents, this innovation will enable the nation's private and public organizations to respond to the rapidly-increasing levels of external threats much more quickly and effectively. The project will release the underlying core technology as open-source software to the public, making its capabilities freely available to the broader network security community, while exploiting the added value of tightly integrating the system into its existing product line to drive revenue. This Small Business Innovation Research (SBIR) Phase I project will develop an early prototype of a novel network forensics platform that provides highly interactive access to a long-term forensic archive of a customer's network activity. The platform will support real-time analysis of cyber events at a variety of scales and contexts by employing an efficient, compact representation of network events that enables a unified view of network activity at much finer granularity than with traditional products. The primary technical challenges for bringing the product to market include scaling current prototype technology into high-performance production-grade software, integrating it into an existing commercial appliance platform without impairing the performance of either, and designing an interactive user interface that supports forensic investigations effectively.