Galois Awarded $6 Million DARPA Contract To Address Advanced Persistent Threats (APTs) in Systems and Networks
Portland, OR (PRWEB) July 18, 2016 -- Galois today announced it has been awarded a $6 million contract under a Defense Advanced Research Projects Agency (DARPA) program to develop a system to detect Advanced Persistent Threat (APT) cyber attacks in increasingly complex enterprise network and system environments.
Nearly 3 in 10 enterprise security professionals believe their networks were hit by an APT in 2015, while many others were unsure. That uncertainty is in part because enterprise networks have grown so complex that gaining visibility into network activity is nearly impossible. Because of this complexity, adversaries have been able to mount long-term stealthy APTs that hide amid other system activity for long periods of time, stealing data and in some cases corrupting the integrity of mission-critical applications.
To address the growing challenge posed by APTs, the Galois-led team, which includes the University of Edinburgh, PARC (a Xerox company), and the Oregon State University, will develop A Diagnostic Approach for Persistent Threat Detection (ADAPT) as a project under the DARPA I2O Transparent Computing program. ADAPT will offer system defenders unprecedented ability to identify subtle but potentially malicious activities by observing long-term behavior patterns and causality in system activity.
“Complexity of system activity and resulting lack of transparency has created a world where carefully crafted APTs can act ‘under the radar’ for long periods – stealing data, expanding presence, and affecting system operation without triggering traditional detection systems,” said Dr. David Archer, Research Lead, Cryptography & Multiparty Computation, Galois. “By tracing the computational provenance of APTs, and by detecting subtle behavioral anomalies that distinguish APTs from normal business logic, ADAPT will offer system operators enhanced situational awareness about security of their networks.”
The DARPA Transparent Computing program aims to make currently opaque computing systems transparent by providing high-fidelity visibility into component actions and interactions during system operation across all layers of software abstraction, while imposing minimal performance overhead. By automatically or semi-automatically “connecting the dots” across multiple activities that are individually legitimate but collectively indicate malice or abnormal behavior, TC has the potential to enable the prompt detection of APTs and other cyber threats, and allow root cause analysis and damage assessment once adversary activity is identified.
ADAPT will be of considerable value for the SIEM (Security Information and Event Management) industry. SIEM systems are designed to provide a real-time view of an enterprise’s security posture by aggregating log files, external threat information, and device configurations. Today, such systems typically rely on simple aggregation of log file data and summary statistics, and so are incapable of nuanced or complex inferences, especially for long-lived threats. ADAPT represents a significant upgrade in SIEM capabilities for both vendors and consumers, providing actionable recommendations as the output of truly context-sensitive analysis.
For additional information on this project, visit http://galois.com/projects/adapt.
About Galois
Galois has been performing computer science research and development since 1999. With many of the world’s foremost experts in computer science and mathematics and a world-class team of programmers and engineers, Galois is uniquely positioned to take on the world’s most difficult challenges in computer science. Galois is a trusted partner in the defense and intelligence industries, proving the feasibility of cutting edge research as it applies to critical systems. Technology companies turn to Galois to build reliability, safety and security into their product development efforts from day one. For additional information, visit http://www.galois.com.
Brian Lustig, Bluetext for Galois, http://www.bluetext.com, +1 (202) 469-3608, [email protected]
Share this article