Graph analytics and visualization for cyber situational understanding

Abstract

This paper describes the Cyber Situational Understanding (Cyber SU) Proof of Concept (CySUP) software system for exploring advanced Cyber SU capabilities. CySUP distills complex interrelationships among cyberspace entities to provide the “so what” of cyber events for tactical operations. It combines a variety of software components to build an end-to-end pipeline for live data ingest that populates a graph knowledge base, with query-driven exploratory analysis and interactive visualizations. CySUP integrates with the core infrastructure environment supporting command posts to provide a cyber overlay onto a common operating picture oriented to tactical commanders. It also supports detailed analysis of cyberspace entities and relationships driven by ad hoc graph queries, including the conversion of natural language inquiries to formal query language. To help assess its Cyber SU capabilities, CySUP leverages automated cyber adversary emulation to carry out controlled cyberattack campaigns that impact elements of tactical missions.