Situ, a Cyber Attack Discovery Technology

UT-Battelle, LLC, acting under its Prime Contract No. DE-AC05-00OR22725 with the U.S. Department of Energy (DOE) for the management and operation of the Oak Ridge National Laboratory (ORNL), is seeking end-users and commercial distributors for its Situ technology for real-time situational understanding and discovery of cyber attacks. Technology Summary Situ is a scalable, real-time platform for discovering and explaining suspicious computer network behavior. Situ helps network operators discover and understand suspicious events that would otherwise go undetected. The technology reduces the huge volumes of raw network data to a smaller, manageable number of events that should be examined by human domain experts. By highlighting suspicious activity, Situ enables the discovery of novel attacks, but can also alert operators to insider threats, policy violations, misconfigurations, and new kinds of behavior that may require some investigation. The technology is a multi-anomaly detection approach based on unsupervised, probabilistic modeling. Key to the approach is modeling events in different contexts or at multiple scales; each event is modeled and scored by multiple anomaly detectors to identify different kinds of anomalous behavior. The anomaly detectors update the behavior models online as new data are streamed into the system. Situ was selected for the DHS Cyber Security Division's FY15 Transition to Practice program. More information can be found at this ORNL Technology Transfer website . Licensing Distribution license applications will be evaluated based on prospective partners' ability and commitment to successfully commercialize the technology, with a preference for United States-based businesses and small businesses. For additional information and license application, contact David Sims, Commercialization Manager, Oak Ridge National Laboratory, [email protected] , 865-241-3808.