An overview of the parallax BattleMind v1.5 for computer network defence

Authors:
Duncan Grove;Alex Murray;Damien Gerhardy;Benjamin Turnbull;Troy Tobin;Christopher Moir
Affiliations:
Defence Science Technology Organisation, Edinburgh, South Australia;Defence Science Technology Organisation, Edinburgh, South Australia;Defence Science Technology Organisation, Edinburgh, South Australia;Defence Science Technology Organisation, Edinburgh, South Australia;Defence Science Technology Organisation, Edinburgh, South Australia;Defence Science Technology Organisation, Edinburgh, South Australia
Venue:
AISC '13 Proceedings of the Eleventh Australasian Information Security Conference - Volume 138
Year:
2013

Citing 5
Cited 0

CYC: a large-scale investment in knowledge infrastructure

Communications of the ACM
Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning

Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning
A knowledge-based approach to network security: applying Cyc in the domain of network risk assessment

IAAI'05 Proceedings of the 17th conference on Innovative applications of artificial intelligence - Volume 3
SHOP2: an HTN planning system

Journal of Artificial Intelligence Research
Ant system: optimization by a colony of cooperating agents

IEEE Transactions on Systems, Man, and Cybernetics, Part B: Cybernetics

Quantified Score

Hi-index	0.00

Visualization

Abstract

BattleMind (BM) version 1.5 is the first of a series of Artificial Intelligence systems for semi-automatically understanding, planning and conducting Computer Network Defence. It makes use of a wide range of existing techniques including classification and feature extraction, semantic web technologies, data fusion, ontologies, first order predicate logic based forward and backward chained reasoning, hierarchical task network planning and supervised learning. Novel contributions of our work compared to other AI based CND tools are: (1) explicitly modelling people and organisations as well as computers and networks as part of the overall system, and elements of the business processes that link them; and (2) using a broad range of high level data sources rather than just traditional low level data sources such as packet capture.