Mission-centric network defense systems (MCNDS)

A method for network defense, comprising the steps of:

• detecting mission events by processing communications packets and traffic streams;
• forming mission tracks by processing said mission events,
• determining active mission types, using said mission events;
• determining state of each mission, using said mission events, including producing a mission state vector for each mission;
• estimating mission sensitivities by processing said mission tracks;
• prioritizing network operations by processing said mission sensitivities;
• and
• correlating network alarms to missions by processing said mission sensitivities,
• wherein said steps include a database of dynamic and a priori information,
• wherein estimating mission sensitivities by processing said missiontracks
• comprises estimating mission sensitivity to network perturbations, using mission tracks;
• using a system dynamics model and a set of network perturbations to produce a nominal version of the mission state at k+1 and a perturbed version of the mission state at k+1, by injecting the perturbed version with the set of network perturbations at a predetermined time;
• propagating out the nominal version of the mission state at k+1 and the perturbed version of the mission state at k+1, to a computation horizon;
• and
• computing the difference between the overall mission effectiveness along the nominal version of the mission state and the perturbed version of the mission state;
• predicting mission impact of network perturbations and implementation of a network-operations Course Of Action (COA) with respect to expected impact on operational effectiveness.