Behavior Models to Express and Share Threat Information

The Department of Homeland Security Science and Technology Directorate's Linebacker technology is a behavior-model approach that lets defenders express events and behaviors in terms of deviation from baseline models--for example, a characteristic change in entropy that's indicative of a particular bad event. Linebacker leverages bio-inspired techniques to analyze individual actors and create models of cyber behavior.