A Distributed Multi-Agent Architecture for Computer Security Situational Awareness

Distributed systems for computer security analysis must perform information fusion in order to construct a cyberspace situational awareness picture. To date such fusion has been conducted in the context of a single abstraction set. As the complexity and heterogony increase, this approach becomes unwieldy. In a conceptual sense it is unscaleable. In this paper we describe an alternative approach, an architecture which supports concurrent reasoning in multiple sets of abstractions in a structured way. We present the architecture and a reasoning system for cyberspace situational awareness constructed using our approach.