{'fraction_non_alphanumeric': 0.02254335260115607, 'fraction_numerical': 0.0, 'mean_word_length': 5.48314606741573, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
A SAS ® Framework for Network Security Intelligence

An organization’s computer network is constantly under attack, facing threats such as probes, worms, viruses, and host-system root access attempts. The threats originate outside the network from sources worldwide, as well as inside network boundaries. To counter threats, most organizations employ various types of point products, such as firewalls, routers, and intrusion detection sensors to alert them of hostile activity. Some organizations employ event correlation engines to manage these point products and provide a single point of control for reacting to hostile activity. The end goal is obvious—provide an impenetrable Computer Network Defense (CND) that prevents interruption of network services and protects an organization’s critical data. This paper presents a SAS-based framework that enhances the real-time data provided by point products and event correlation engines, provides a consolidated view of CND data in a historical context, and most important, improves an organization’s understanding of the health of its computer networks. This paper details the key components of the framework: a centralized repository to integrate and manage all CND-related data, scalable storage architecture to efficiently handle extremely large volumes of data, and role-based interfaces to deliver critical CND information to the right consumers at the right time. This paper also explains the potential use of advanced analytics for the detection of hostile activity undetectable by the signature-based point products. The last section contains a case study of a real-world implementation of this framework at the Navy Computer Incident Response Team in Norfolk, Virginia.