Increasing Flexibility in Network Visibility and Intrusion Response0

This paper describes recent advances in computer network defense visualization and response capabilities developed by General Dynamics Advanced Information Systems. Due to the need for the network defender to comprehend key elements of a large amount of network information and data on potential intrusions, the focus of our effort has been to define new approaches that maximize the user-defined flexibility to meter and highlight key network information. We have developed measures and displays for quickly comprehending the depth, breadth, and frequency of potential intrusions that maintain network defender's awareness in all three dimensions. Moreover, response capabilities are enhanced by both node-based responses as well as prediction capabilities of next-likely intrusion events based on preceding events. Overall, we have advanced the state of the art in computer network defense by focusing on the information needs of the network defender by tailoring the information available into more comprehensible packages that provide rapid comprehension of the problem space and recommending a subset of the solutions available