State of the Art in CyberSecurity Monitoring: An Update

摘要

This paper is an update to the author's report, 'State of the Art in CyberSecurity Monitoring' (Sep 2000), and depends heavily on its companion paper, 'CyberSecurity Monitoring Tools and Projects: A Compendium of Commercial and Government Tools and Government Research Projects' (Aug 2000). Both of these referenced papers are revisions of the original 1999 publications. Although this update claims there are no major trends discernible since the publication of the 2000 report, it should nevertheless have utility for anyone interested in the state of the art in cybersecurity monitoring since it was described in the original report. There have been some noteworthy developments in the past year or so, including new commercial tools being released and new government research initiatives. The update first considers who the market leaders are and takes a look at mergers, acquisitions, and product transfers. It revisits commercial offerings and government research and development efforts. Based on these short reviews and other information gathered over the past year, the update considers technical trends. The update is organized as follows: (1) Commercial Products -- a look at the marketplace and a summary of commercial products based on the updated (Aug 2000) CyberSecurity Monitoring Compendium; (2) Research and Development -- identification of some new initiatives; and (3) Technical Trends -- discussion of trends and commentary on what the state of affairs augurs for MITRE's military sponsors. The appendix presents a summary of commercial off-the-shelf (COTS) cybersecurity monitoring products in tabular form. The information includes name of tool, type of tool, when it was released, and commercial vendor.