u003chr /u003enu003cpu003eu003cimg class=u0022wp-image-13209 alignnone size-mediumu0022 src=u0022https://www.avi.com/wp-content/uploads/2026/01/johnHopkinsAPL-logo-300x79.webpu0022 alt=u0022u0022 width=u0022300u0022 height=u002279u0022 /u003eu003c/pu003enu003cpu003eAs part of an Intelligence Advanced Research Projects Activity (IARPA) effort, AVI teamed with the Johns Hopkins University Applied Physics Laboratory (APL) to assist in designing and building an agile ATN experimentation environment.  ATN was built to host experimentation scenarios designed to evaluate technology systems under test (SUTs) while providing consistency and valid scientific method throughout the experimentation environment. Our team helped to design and develop the experimentation network command and control (C2) environment to support experimentation operations, designed and developed ATN C2 interfaces to SUT technologies and assisted in the design of measurement methods, scoring u0026amp; metrics scorecards.u003c/pu003e

u003chr /u003enu003cpu003eThe Branching Interactive Graphic Stories for Cybersecurity Education (BIGSCE) project, sponsored by the National Science Foundation (NSF), enabled us to evaluate how to use branching, interactive web comics to teach middle school students about cyber security. Branching stories provide opportunities to explore cause and effect, and middle school students found the comic book style highly engaging. The project leveraged u003ca href=u0022https://comic-bee.com/u0022 target=u0022_blanku0022 rel=u0022noopener noreferreru0022u003eComic-BEEu003c/au003e, AVI’s cyber security education technology based on research sponsored by the Department of Homeland Security (DHS) Science and Technology Directorate, Cyber Security Division (DHS Su0026amp;T/CSD).u003c/pu003enu003cpu003eBIGSCE informed the development of new approaches to teaching and learning cyber security: branching graphic stories can incorporate culturally relevant pedagogy, and therefore have the potential to reach a broader and more diverse body of students. The goal of BIGSCE was to explore how this innovative technology can enhance cyber security education, with the following aims:u003c/pu003enu003colu003enu003cliu003eAttract a broad and diverse workforce to the field of cyber security, starting in middle school.u003c/liu003enu003cliu003eUse expert-created comics to evaluate a learner’s knowledge, skill, and ability in the area of cyber security.u003c/liu003enu003cliu003eDeepen students’ understanding of cyber security challenges and consequences using a comic creation activity. BIGSCE will also contribute new understanding of how to effectively use branching, graphic stories as a learning and assessment tool for middle school students.u003c/liu003enu003c/olu003enu003cpu003eAVI partnered with Stony Brook University, led by Dr. Lori Scarlatos, Associate Professor, Department of Technology u0026amp; Society. The free workshops were held at the Town of North Hempstead’s “Yes We Can Community Center” in New Cassel, New York.u003c/pu003enu003cpu003eThe BIGSCE workshops covered topic such as:u003c/pu003enu003culu003enu003cliu003ePrivacy and keeping safe on the Internetu003c/liu003enu003cliu003eThe nature of cyber crimesu003c/liu003enu003cliu003eCyber security professionals, and how they solve those crimesu003c/liu003enu003cliu003eHeroes in cyber security and STEM (science, technology, engineering, mathematics)u003c/liu003enu003cliu003eFact and fiction in television and movies about cyber securityu003c/liu003enu003cliu003eHow to prepare for a career in cyber securityu003c/liu003enu003c/ulu003enu003cpu003eSee the video with some of our workshop participants! u003c/pu003enu003cpu003eu003cpu003eu003cpu003eu003c/pu003eu003c/pu003eu003c/pu003enu003cpu003eu0026nbsp;u003c/pu003enu003cpu003e“Branching Interactive Graphic Stories for Cybersecurity Education” (BIGSCE) was sponsored by the National Science Foundation, Award Number 1623131.u003c/pu003e

u003chr /u003enu003cpu003eu003cimg class=u0022wp-image-13210 alignnone size-mediumu0022 src=u0022https://www.avi.com/wp-content/uploads/2026/01/camus_meaning-e1493227595985-300x169.jpgu0022 alt=u0022u0022 width=u0022300u0022 height=u0022169u0022 /u003eu003c/pu003enu003cpu003eu003cstrongu003eCamus (Cuh-moo) is a proof of concept that enables cyber impact assessment by modeling and automatically mapping cyber assets to the missions and users that depend on them.u003c/strongu003eu003c/pu003enu003cdiv class=u0022fusion-text fusion-text-1u0022u003enu003cpu003eCamus collects from various sources data that describe the organization and the activity between users and cyber assets, such as traffic captures and people directories, and fuses the data into a comprehensive model that reveals relationships between cyber assets and the users and missions that rely on them. By automatically mining existing data to create contextual information, Camus provides an up-to-date picture of what an organization really looks like, who uses what asset, and what they are using it for. This information improves risk assessments by identifying critical assets and single points of failure for critical processes, and enhances situational awareness by providing an improved context for the decision-making process. Additionally, with no manual maintenance to update dependencies, and no client software install required, Camus saves time and labor.u003c/pu003enu003cpu003eCamus was funded by the Office of the Secretary of Defense, and managed by the Air Force Research Laboratory through a two-year Phase II Small Business Innovative Research contract that commenced in May 2008.u003c/pu003enu003c/divu003enu003cdivu003enu003cpu003eu003cimg src=u0022https://www.avi.com/wp-content/uploads/camus-tooltip-node-300x173.jpgu0022 width=u0022300u0022 height=u0022173u0022 alt=u0022u0022 class=u0022wp-image-13394 alignnone size-mediumu0022 /u003eu003c/pu003enu003cpu003eu0026nbsp;u003c/pu003enu003ch3u003eMission-to-Cyber Mapping Ontologyu003c/h3u003enu003cpu003eu003cimg src=u0022https://www.avi.com/wp-content/uploads/camus-mission_ontology_radial-300x143.jpgu0022 width=u0022300u0022 height=u0022143u0022 alt=u0022u0022 class=u0022wp-image-13396 alignnone size-mediumu0022 /u003eu003c/pu003enu003cpu003eUnderlying the Camus technology is a cyber asset-to-mission ontology, which was developed with a multidisciplinary group of leading subject matter experts and operational practitioners. The ontology uses Resources (entities) and Properties (relationships) to build a model of the domain. The Resources define specific concepts in the domain, while the Properties define the relationships between the Resources. We defined this ontology based on the concepts of User, Mission, Capability, and Asset.We developed a Foundation Ontology that defines the core Resources and Properties for Camus and an Extension Ontology that can extend the Foundation Ontology for a specific implementation.u003c/pu003enu003cpu003eu0026nbsp;u003c/pu003enu003ch3u003eMission Impact Workshopu003c/h3u003enu003cpu003eAs part of the Camus project, Secure Decisions conducted a workshop on mapping cyber assets to missions and users. The workshop addressed how to map the relationships between cyber assets such as network devices and the users, missions, business processes and other entities that depend on those assets. The 30 participants included individuals with operational responsibility is to assure the availability of cyber assets for critical missions, researchers in areas related to the mapping of cyber assets to missions, and developers of technology that can be used in this mapping. The group exercises yielded insight into the information requirements for mapping cyber assets to missions and users, and the participant’s presentations summarized the state-of-the-art of this topic.u003c/pu003enu003c/divu003enu003cpu003eu0026nbsp;u003c/pu003enu003cdiv class=u0022et_pb_button_module_wrapper et_pb_button_0_wrapper et_pb_module u0022u003eu003ca class=u0022et_pb_button et_pb_button_0 et_pb_bg_layout_lightu0022 href=u0022/research-lab/download-hub/#camusu0022u003eCamus Download Hubu003c/au003eu003c/divu003e

u003chr /u003enu003cdiv class=u0022et_pb_main_blurb_imageu0022u003eu003cimg src=u0022https://www.avi.com/wp-content/uploads/2026/01/code-dx-250w.pngu0022 width=u0022250u0022 height=u0022125u0022 alt=u0022u0022 class=u0022wp-image-13161 alignnone size-fullu0022 /u003eu003c/divu003enu003cdiv class=u0022et_pb_blurb_containeru0022u003enu003cdiv class=u0022et_pb_blurb_descriptionu0022u003eCode Dx is an award-winning application security tool that correlates weakness data from open source and commercial source code and dynamic analysis tools, putting them into the proper context for effective triage and mitigation. The software integrates the results of multiple software analysis tools into one coherent picture, offers a workflow that lets analysts visually analyze and prioritize results, explore them to uncover trends, and assign remediation tasks. Originally developed by Secure Decisions, the intellectual property of Code Dx was transferred to Code Dx, Inc. as part of a corporate spin-out.u003c/divu003enu003c/divu003enu003cpu003e u003c/pu003enu003cdiv class=u0022et_pb_button_module_wrapper et_pb_button_6_wrapper et_pb_module u0022u003eu003ca class=u0022et_pb_button et_pb_button_6 et_pb_bg_layout_lightu0022 href=u0022/results/code-dx/u0022 rel=u0022noopeneru0022u003eCase Studyu003c/au003eu003c/divu003enu003cpu003e u003c/pu003enu003cdiv class=u0022et_pb_button_module_wrapper et_pb_button_6_wrapper et_pb_module u0022u003eu003ca class=u0022et_pb_button et_pb_button_6 et_pb_bg_layout_lightu0022 href=u0022https://codedx.com/u0022 target=u0022_blanku0022 rel=u0022noopeneru0022u003eOfficial Websiteu003c/au003eu003c/divu003e

u003chr /u003ennu003cdiv class=u0022et_pb_main_blurb_imageu0022u003enu003cdiv class=u0022et_pb_main_blurb_imageu0022u003eu003cspan class=u0022et_pb_image_wrap et_pb_only_image_mode_wrapu0022u003eu003cimg loading=u0022lazyu0022 decoding=u0022asyncu0022 src=u0022https://www.avi.com/wp-content/uploads/2026/01/code-pulse-logo_h113.pngu0022 width=u0022674u0022 height=u0022113u0022 srcset=u0022https://www.avi.com/wp-content/uploads/2026/01/code-pulse-logo_h113.png 674w, https://www.avi.com/wp-content/uploads/2026/01/code-pulse-logo_h113-480x80.png 480wu0022 sizes=u0022(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) 674px, 100vwu0022 class=u0022et-waypoint et_pb_animation_top et_pb_animation_top_tablet et_pb_animation_top_phone wp-image-13166 et-animatedu0022 alt=u0022Code Dx logou0022 /u003enu003c/spanu003eu003c/divu003enu003cdiv class=u0022et_pb_blurb_containeru0022u003enu003cdiv class=u0022et_pb_blurb_descriptionu0022u003ennCode Pulse is a penetration testing support tool that provides real-time visual feedback into the code coverage of black box testing activities. Originally developed by Applied Visions Inc., Code Pulse is an official OWASP Project and is now maintained by Code Dx, Inc. after the intellectual property was transferred during a corporate spin-out.nnu003c/divu003enu003c/divu003enu003c/divu003enu0026nbsp;nu003cdiv class=u0022et_pb_button_module_wrapper et_pb_button_6_wrapper et_pb_module u0022u003eu003ca class=u0022et_pb_button et_pb_button_6 et_pb_bg_layout_lightu0022 href=u0022/research-lab/astam/#code-pulseu0022 target=u0022_blanku0022 rel=u0022noopeneru0022u003eDetailed Overviewu003c/au003eu003c/divu003enu0026nbsp;nu003cdiv class=u0022et_pb_button_module_wrapper et_pb_button_6_wrapper et_pb_module u0022u003eu003ca class=u0022et_pb_button et_pb_button_6 et_pb_bg_layout_lightu0022 href=u0022https://code-pulse.com/u0022 target=u0022_blanku0022 rel=u0022noopeneru0022u003eOfficial Websiteu003c/au003eu003c/divu003e

u003chr /u003ennu003cimg class=u0022wp-image-13202 alignnone size-mediumu0022 src=u0022https://www.avi.com/wp-content/uploads/2026/01/hybrid-analysis-xl-400x296-1-300x222.jpgu0022 alt=u0022u0022 width=u0022300u0022 height=u0022222u0022 /u003enu003ch4 class=u0022fusion-responsive-typography-calculatedu0022 data-fontsize=u002218u0022 data-lineheight=u002221.6pxu0022u003eHybrid Analysis Mappingu003c/h4u003enTwo methods for analyzing software security risks are dynamic application security testing (DAST), an outside-in perspective, and static application security testing (SAST), an inside-out perspective. Both have shortfalls. DAST findings do not give insight into the root cause, making remediation time-consuming. SAST tools give you full breadth, but warn of weaknesses that are not exploitable.nnCorrelating the results of SAST and DAST can overcome these individual challenges. AVI engaged in a DHS-funded Phase II SBIR program entitled Code Ray: Software Assurance Risk Management Framework for Hybrid Analysis Mapping, to produce a hybrid analysis method that can be incorporated into Code Dx and into the DHS SWAMP.nnThe end result of this Ru0026amp;D program (1) improved speed, accuracy and confidence in detection of vulnerabilities by cross-mapping and normalizing the output of hybrid techniques – dynamic analysis, dynamic tracing, static analysis, and static contextual analysis; (2) enhanced prioritization and mitigation of vulnerabilities by providing both the run-time context for those vulnerabilities and their mapping to security standards; and (3) improved the rapid comprehension and assessment of risks associated with vulnerabilities by delivering results in a simplified risk-management framework.nnu0026nbsp;nu003cdiv class=u0022et_pb_button_module_wrapper et_pb_button_6_wrapper et_pb_module u0022u003eu003ca class=u0022et_pb_button et_pb_button_6 et_pb_bg_layout_lightu0022 href=u0022/research-lab/download-hub/#code-rayu0022 rel=u0022noopeneru0022u003eCode Ray Download Hubu003c/au003eu003c/divu003e

u003chr /u003enu003cdiv class=u0022et_pb_main_blurb_imageu0022u003eu003cspan class=u0022et_pb_image_wrap et_pb_only_image_mode_wrapu0022u003eu003cimg fetchpriority=u0022highu0022 decoding=u0022asyncu0022 src=u0022https://www.avi.com/wp-content/uploads/2026/01/Comic-BEELogo_HiRes-300ppi-no_stroke-transBkg-scaled.pngu0022 width=u0022350pxu0022 height=u0022autou0022 srcset=u0022https://www.avi.com/wp-content/uploads/2026/01/Comic-BEELogo_HiRes-300ppi-no_stroke-transBkg-scaled.png 2560w, https://www.avi.com/wp-content/uploads/2026/01/Comic-BEELogo_HiRes-300ppi-no_stroke-transBkg-1280x317.png 1280w, https://www.avi.com/wp-content/uploads/2026/01/Comic-BEELogo_HiRes-300ppi-no_stroke-transBkg-980x242.png 980w, https://www.avi.com/wp-content/uploads/2026/01/Comic-BEELogo_HiRes-300ppi-no_stroke-transBkg-480x119.png 480wu0022 sizes=u0022(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) and (max-width: 980px) 980px, (min-width: 981px) and (max-width: 1280px) 1280px, (min-width: 1281px) 2560px, 100vwu0022 class=u0022et-waypoint et_pb_animation_top et_pb_animation_top_tablet et_pb_animation_top_phone wp-image-13155 et-animatedu0022 /u003eu003c/spanu003eu003c/divu003enu003cdiv class=u0022et_pb_blurb_containeru0022u003enu003cdiv class=u0022et_pb_blurb_descriptionu0022u003enu003cpu003eu003c/pu003enu003cpu003eComic-BEE provides an integrated, guided process for educators and subject matter experts to plan a lesson, write a branching script that is closely aligned with their instructional goals, storyboard the visual layout of their comic, and format the comic with final artwork prior to online delivery and presentation.u003c/pu003enu003c/divu003enu003c/divu003enu003cpu003e u003c/pu003enu003cdiv class=u0022et_pb_button_module_wrapper et_pb_button_6_wrapper et_pb_module u0022u003eu003ca class=u0022et_pb_button et_pb_button_6 et_pb_bg_layout_lightu0022 href=u0022https://comic-bee.com/u0022 target=u0022_blanku0022 rel=u0022noopeneru0022u003eOfficial Websiteu003c/au003eu003c/divu003enu003cpu003e u003c/pu003enu003cdiv class=u0022et_pb_button_module_wrapper et_pb_button_6_wrapper et_pb_module u0022u003eu003ca class=u0022et_pb_button et_pb_button_6 et_pb_bg_layout_lightu0022 href=u0022https://www.comic-bee.com/samplecomicsu0022 target=u0022_blanku0022 rel=u0022noopeneru0022u003eSample Comicsu003c/au003eu003c/divu003e

u003chr /u003enu003cpu003eu003cimg class=u0022wp-image-13203 alignnone size-mediumu0022 src=u0022https://www.avi.com/wp-content/uploads/2026/01/CWEvis-screenshot-20180131-800x628-1-300x236.jpgu0022 alt=u0022u0022 width=u0022300u0022 height=u0022236u0022 /u003eu003c/pu003enu003ch4u003eCommon Weakness Enumeration Visualizationu003c/h4u003enu003cpu003eCWE-Vis is a resource made available to the software assurance community to explore and learn about weaknesses in software. It provides visualizations and interactions with MITRE’s Common Weakness Enumeration (CWE), an international standard created to define a dictionary of software weaknesses. The CWE greatly facilitates the discussion and collaboration in efforts revolving around the always-present quest to improve software systems. CWE-Vis helps users familiarize themselves with the CWE through visual means. High-level CWE structures and detailed relationship graphs are displayed visually helping users gain a better and quicker understanding of the CWE. Powerful filtering and searching is made available to allow users to focus in on the details of how weaknesses can be manifested in source code and ways to avoid and fix them.u003c/pu003enu003cpu003eu0026nbsp;u003c/pu003enu003cdiv class=u0022et_pb_button_module_wrapper et_pb_button_0_wrapper et_pb_module u0022u003eu003ca class=u0022et_pb_button et_pb_button_0 et_pb_bg_layout_lightu0022 href=u0022https://cwe.mitre.org/u0022 target=u0022_blanku0022 rel=u0022noopeneru0022u003eOfficial Siteu003c/au003eu003c/divu003e

u003chr /u003enu003cpu003eu003cpu003eu003cpu003e

• 

u003c/pu003eu003c/pu003eu003c/pu003enu003cpu003eThe Curriculum to Broaden Participation in Cybersecurity for Middle School Teachers and Students (CyberMiSTS) project builds on BIGSCE, our prior NSF-funded research into cybersecurity education.  In CyberMiSTS, we are developing and disseminating a curriculum and resources for giving middle schools educators the knowledge, skills, and tools the need to teach cybersecurity.u003c/pu003enu003cpu003eDuring the CyberMiSTS workshop, educators  will gain insights from cybersecurity researchers and educators, and learn to use a variety of interactive instructional approaches for teaching cybersecurity, including Comic-BEE, Applied Visions Inc. web application for creating branching web comics aligned with a lesson plan. With basic curriculum, resources, and guidance from the CyberMiSTS team, each educator will create a customized lesson plan for cybersecurity and course materials targeted at their own students.u003c/pu003enu003cpu003eEducators are expected to use their lesson plan and course materials in their own classrooms to teach their students about cybersecurity, and share aggregate and anonymized classroom data with the CyberMiSTS team.u003c/pu003enu003cpu003eCyberMiSTS has the following research aims:u003c/pu003enu003colu003enu003cliu003eIntegrate recent research-based understanding of cybersecurity into a curriculum that is accessible to teachers and their middle school students.u003c/liu003enu003cliu003eEncourage participation of a broad and diverse set of students in the field of cybersecurity by showing them how human relations play an important role in cybersecurity.u003c/liu003enu003cliu003eIdentify what educators need to successfully teach cybersecurity in a middle school classroom and, based on this, develop guidelines and resources for disseminating this teacher instruction widely.u003c/liu003enu003c/olu003enu003cpu003eCyberMiSTS is funded by an award from the National Science Foundation, under the Secure u0026amp; Trustworthy Cyberspace: Education (SaTC: EDU) Program, Award Abstract #1821757.u003c/pu003enu003cpu003eApplied Visions Inc. partnered with a team from Stony Brook University led by Dr. Lori Scarlatos, Associate Professor of Educational Technology, Department of Technology u0026amp; Society, College of Engineering u0026amp; Applied Sciences.u003c/pu003enu003cpu003eu003cpu003eu003cpu003eu003c/pu003eu003c/pu003eu003c/pu003e

u003chr /u003enu003cdiv class=u0022et_pb_main_blurb_imageu0022u003eu003cspan class=u0022et_pb_image_wrap et_pb_only_image_mode_wrapu0022u003eu003cimg loading=u0022lazyu0022 decoding=u0022asyncu0022 src=u0022https://www.avi.com/wp-content/uploads/2026/01/flyingsquirrel_all_logos-secdecsite.webpu0022 width=u0022250u0022 height=u0022184u0022 srcset=u0022https://www.avi.com/wp-content/uploads/2026/01/flyingsquirrel_all_logos-secdecsite.webp 250wu0022 sizes=u0022(max-width: 250px) 100vw, 250pxu0022 class=u0022et-waypoint et_pb_animation_top et_pb_animation_top_tablet et_pb_animation_top_phone wp-image-13156 et-animatedu0022 /u003eu003c/spanu003eu003c/divu003enu003cdiv class=u0022et_pb_blurb_containeru0022u003enu003ch4 class=u0022et_pb_module_headeru0022u003eu003c/h4u003enu003cpu003eu003c/pu003enu003cdiv class=u0022et_pb_blurb_descriptionu0022u003enu003cpu003eTo enhance the security posture of DoD networks, Flying Squirrel provides real-time wireless discovery, integrated visualization and mapping, and post-hoc analysis capabilities. These capabilities are provided in the Flying Squirrel Wireless Assessment Tool Suite via the Flying Squirrel, MeerCAT-FS, Caribou and Ubertooth One components. For a complete description of the Flying Squirrel Suite of technologies, please visit the u003ca title=u0022Flying Squirrelu0022 href=u0022https://www.nrl.navy.mil/Our-Work/Areas-of-Research/Information-Technology/Center-for-High-Assurance-Computer-Systems/Flying-Squirrel/u0022 target=u0022_blanku0022 rel=u0022noopener noreferreru0022u003eNaval Research Laboratory (NRL) Center for High Assurance Computing Systems (CHACS)u003c/au003e.u003c/pu003enu003c/divu003enu003c/divu003enu003cpu003e u003c/pu003enu003cdiv class=u0022et_pb_button_module_wrapper et_pb_button_6_wrapper et_pb_module u0022u003eu003ca class=u0022et_pb_button et_pb_button_6 et_pb_bg_layout_lightu0022 href=u0022/research-lab/flying-squirrel/u0022 target=u0022_blanku0022 rel=u0022noopeneru0022u003eDetailed Overviewu003c/au003eu003c/divu003e

u003chr /u003enu003cpu003eu003cimg class=u0022wp-image-13214 alignnone size-mediumu0022 src=u0022https://www.avi.com/wp-content/uploads/ARL-logoseal_noPadding-400x405-1-296x300.pngu0022 alt=u0022u0022 width=u0022296u0022 height=u0022300u0022 /u003eu003c/pu003enu003cpu003eAs part of an Air Force Research Lab research project, AVI worked to identify specific types of mission data needed to support the AFRL Cyber Experimentation Environment, determined and helped to implement the practical mechanisms for harvesting such data from a military exercise (the InterTEC Cyber Event), and developed mission-relevant datasets, based on data harvested from the ICE Exercise, to support a mission-centric testing environment for the CEE.u003c/pu003e

u003chr /u003enu003cdiv class=u0022et_pb_main_blurb_imageu0022u003eu003cspan class=u0022et_pb_image_wrap et_pb_only_image_mode_wrapu0022u003eu003cimg loading=u0022lazyu0022 decoding=u0022asyncu0022 src=u0022https://www.avi.com/wp-content/uploads/2026/01/logo_meercatpro_h184.pngu0022 width=u0022182u0022 height=u0022184u0022 srcset=u0022https://www.avi.com/wp-content/uploads/2026/01/logo_meercatpro_h184.png 182wu0022 sizes=u0022(max-width: 182px) 100vw, 182pxu0022 class=u0022et-waypoint et_pb_animation_top et_pb_animation_top_tablet et_pb_animation_top_phone wp-image-13165 et-animatedu0022 alt=u0022Code Dx logou0022 /u003eu003c/spanu003eu003c/divu003enu003cdiv class=u0022et_pb_blurb_containeru0022u003enu003cpu003eu003c/pu003enu003cdiv class=u0022et_pb_blurb_descriptionu0022u003enu003cpu003eMeerCAT®-Pro is an award-winning visualization tool specifically developed to help decision makers locate wireless assets and networks, and assess the risk they pose to the organization. What distinguishes MeerCAT®-Pro are its advanced visual analytics specifically designed to support and expedite wireless security risk assessment. MeerCAT®-Pro presents interactive geospatial, topological, and spatiotemporal 3D views to quickly locate potential security issues, and to efficiently identify relevant vulnerabilities, threats, and remediation.u003c/pu003enu003c/divu003enu003c/divu003enu0026nbsp;nu003cdiv class=u0022et_pb_button_module_wrapper et_pb_button_6_wrapper et_pb_module u0022u003eu003ca class=u0022et_pb_button et_pb_button_6 et_pb_bg_layout_lightu0022 href=u0022/research-lab/meercat-prou0022 target=u0022_blanku0022 rel=u0022noopeneru0022u003eDetailed Overviewu003c/au003eu003c/divu003e

u003chr /u003enu003cpu003eu003cimg class=u0022wp-image-13355 alignnone size-fullu0022 src=u0022https://www.avi.com/wp-content/uploads/mission_impact_img-400x301-1.jpgu0022 alt=u0022u0022 width=u0022400u0022 height=u0022301u0022 /u003eu003c/pu003enu003cpu003eSystems administrators in large data centers often do not know the mission of the machines they manage; their strategy is, “Let’s pull the plug and see who calls.”u003c/pu003enu003cpu003eThe problem is similar for computer security analysts – they do not know the cyber capabilities, mission, or users that depend on a machine that is attacked.u003c/pu003enu003cpu003eTo assess the impact of a compromised or degraded cyber asset, analysts need to know:u003c/pu003enu003culu003enu003cli style=u0022list-style-type: none;u0022u003enu003culu003enu003cliu003eWho relies on an attacked asset for their job?u003c/liu003enu003cliu003eWhat social network will be disrupted if an asset is compromised?u003c/liu003enu003cliu003eWhat organizational mission is impacted by the loss of an asset?u003c/liu003enu003cliu003eWhat other assets or cyber capabilities depend on an attacked asset?u003c/liu003enu003cliu003eWhere is the attacked asset located in the physical or logical network?u003c/liu003enu003c/ulu003enu003c/liu003enu003c/ulu003enu003cpu003eThis lack of contextual information makes it impossible to effectively prioritize cyber events or assess the impact of attacks. Because organizations do not have accurate mappings between mission tasks and the network assets on which they depend, decision makers cannot accurately assess u003cemu003emission readinessu003c/emu003e of their network assets or interpret u003cemu003eoperational impactu003c/emu003e of network failures or cyber attacks. Security analysts cannot report u003cemu003eoperationalu003c/emu003e u003cemu003eimpactu003c/emu003e of cyber incidents or defensive countermeasures. Managers are unable to accurately assess mission or business u003cemu003erisksu003c/emu003e associated with cyber incidents, or identify cascading operational effects from the degradation or loss of cyber assets.u003c/pu003enu003cpu003eA current and accurately map of the dependencies between mission tasks, information needed to perform those tasks, and the cyber assets that provide and communicate that information.u003c/pu003e

u003chr /u003enu003cpu003eu003cimg class=u0022wp-image-13217 alignnone size-mediumu0022 src=u0022https://www.avi.com/wp-content/uploads/National-Cyber-Range-screenshot-300x195.pngu0022 alt=u0022u0022 width=u0022300u0022 height=u0022195u0022 /u003eu003c/pu003enu003cpu003eThe Defense Advanced Research Projects Agency (DARPA) created a National Cyber Range (NCR) to protect and defend the nation’s critical information systems. The NCR revolutionized the state of the art for large-scale cyber testing and provided fully automated range management and test management suites to test and validate leap-ahead cyber research technologies and systems.u003c/pu003enu003cpu003eu0026nbsp;u003c/pu003enu003cdiv class=u0022et_pb_button_module_wrapper et_pb_button_0_wrapper et_pb_module u0022u003eu003ca class=u0022et_pb_button et_pb_button_0 et_pb_bg_layout_lightu0022 href=u0022/research-lab/download-hub/#ncru0022u003eNCR Download Hubu003c/au003eu003c/divu003e

u003chr /u003enu003ch4u003eu003cimg class=u0022wp-image-13356 alignnone size-fullu0022 src=u0022https://www.avi.com/wp-content/uploads/netdemon_logo_w546.pngu0022 alt=u0022u0022 width=u0022546u0022 height=u0022311u0022 /u003eu003c/h4u003enu003ch4u003eu003cstrongu003eGoal Directed Task Analysisu003c/strongu003eu003c/h4u003enu003cpu003eThe purpose of the NetDemon project was to identify the information real decision makers actually need, and how they use it. The goal was to identify that information in order to evaluate the environment in which these decision makers operate to determine how well the current technology meets their needs. Future designs can then be created that take those needs into account from the beginning, rather than add in critical features and integration later. To accomplish this, the NetDemon project documented specific information that was required for the operators to do their jobs, and how they used that information to address particular issues or inform decisions.u003c/pu003enu003cpu003eThe first part of the NetDemon project was to determine the current decision model used by the client, and determine if the existing data sources and capabilities were adequate. In the second part of the project, we developed an idealized, future decision model that helped the client reach Information Dominance goals, and described the data necessary to support it. Once the model was defined, we identified technology insertion opportunities that provided new data sources and technologies to support the decision process, and to automate part of it.u003c/pu003enu003cpu003eu0026nbsp;u003c/pu003enu003cdiv class=u0022et_pb_button_module_wrapper et_pb_button_0_wrapper et_pb_module u0022u003eu003ca class=u0022et_pb_button et_pb_button_0 et_pb_bg_layout_lightu0022 href=u0022/research-lab/download-hub/#netdemonu0022u003eNetDemon Download Hubu003c/au003eu003c/divu003e

u003chr /u003enu003cpu003eDARPA’s Scalable Network Monitoring (SNM) program focused on the development and testing of gateway malicious activity detection devices. AVI teamed with Johns Hopkins University Applied Physics Lab (JHU/APL) to design, develop, and operate a cyber test environment that provides the capability to generate a sufficient volume of both benign and malicious activity to maintain full-line speed (from 1 Gbps to 100 Gbps) at the network gateway.u003c/pu003enu003cpu003eu003cstrongu003eThe Defense Advanced Research Projects Agency (DARPA) has created a Cyber Defense Program, responsible for developing the core computing and networking technologies required to protect DoD’s information, information infrastructure, and mission-critical information systems.u003c/strongu003eu003c/pu003enu003cpu003eThe Cyber Defense Program is developing network traffic monitoring techniques with performance and scalability orders of magnitude better than conventional approaches.u003c/pu003enu003cpu003eThe focus of DARPA’s Scalable Network Monitoring (SNM) program is the development and testing of gateway malicious activity detection devices. Secure Decisions has teamed with Johns Hopkins University Applied Physics Lab (JHU/APL) to design, develop, and operate a cyber test environment, that provides the capability to generate a sufficient volume of both benign and malicious activity to maintain full-line speed (from 1 Gbps to 100 Gbps) at the network gateway.u003c/pu003enu003cpu003eNetwork engineers and analysts built a test network environment simulating a secure DoD network gateway and also designed test procedures, program metrics, and a corpus of malicious activity for use within the test environment. Through execution of a series of test scenarios, scoring of those results, and analysis of the performance of the systems under test, the SNM program will provide innovative network defense capabilities for the nation.u003c/pu003enu003cpu003eApplied Visions Inc. has built an SNM Status Board System for monitoring test execution. This system provides the ability to monitor the test network and display the performance of systems under test. The Status Board console is a Graphical User Interface consisting of six different information monitoring and management panels:u003c/pu003enu003cpu003eu003cimg class=u0022wp-image-13218 alignnone size-mediumu0022 src=u0022https://www.avi.com/wp-content/uploads/SNM-1-300x210.webpu0022 alt=u0022u0022 width=u0022300u0022 height=u0022210u0022 /u003eu003c/pu003enu003ch3u003eTraffic Panelu003c/h3u003enu003culu003enu003cliu003eShows the quantity of throughput flowing through both the high bandwidth switches in both directions, for a total of four charts.u003c/liu003enu003c/ulu003enu003cpu003eu0026nbsp;u003c/pu003enu003cpu003eu003cimg class=u0022wp-image-13219 alignnone size-mediumu0022 src=u0022https://www.avi.com/wp-content/uploads/SNM-status-board-2-300x233.pngu0022 alt=u0022u0022 width=u0022300u0022 height=u0022233u0022 /u003eu003c/pu003enu003ch3u003eSUT Assessment Panelu003c/h3u003enu003culu003enu003cliu003eDisplays the latest test results. It consists of three different regions: Activity Coverage, Cumulative Activity, and Current Assessment. The Activity Coverage and Cumulative Activity areas are both interactive charts, providing the user the ability to drill down or aggregate data of particular interestu003c/liu003enu003c/ulu003enu003cpu003eu0026nbsp;u003c/pu003enu003ch2u003eOther panels include:u003c/h2u003enu003ch3 style=u0022padding-left: 40px;u0022u003eManagement Panelu003c/h3u003enu003culu003enu003cli style=u0022list-style-type: none;u0022u003enu003culu003enu003cliu003eProvides the ability to monitor switch status, manage switch state, configure switch monitoring polling intervals, and manage and refresh data.u003c/liu003enu003c/ulu003enu003c/liu003enu003c/ulu003enu003ch3 style=u0022padding-left: 40px;u0022u003eScenario Panelu003c/h3u003enu003culu003enu003cli style=u0022list-style-type: none;u0022u003enu003culu003enu003cliu003eAllows the user the ability to add, modify, and delete scenarios related to a test event.u003c/liu003enu003c/ulu003enu003c/liu003enu003c/ulu003enu003ch3 style=u0022padding-left: 40px;u0022u003eReporting Panelu003c/h3u003enu003culu003enu003cli style=u0022list-style-type: none;u0022u003enu003culu003enu003cliu003eGenerates reports from test event data that support traffic measurements and SUT assessments.u003c/liu003enu003c/ulu003enu003c/liu003enu003c/ulu003enu003ch3 style=u0022padding-left: 40px;u0022u003eSystems Event Panelu003c/h3u003enu003culu003enu003cli style=u0022list-style-type: none;u0022u003enu003culu003enu003cliu003eDisplays information related to the internal operation of the Status Board system.u003c/liu003enu003c/ulu003enu003c/liu003enu003c/ulu003e

u003chr /u003enu003cpu003eu003cimg class=u0022wp-image-13221 alignnone size-mediumu0022 src=u0022https://www.avi.com/wp-content/uploads/shortcut-400x271-1-300x203.pngu0022 alt=u0022u0022 width=u0022300u0022 height=u0022203u0022 /u003eu003c/pu003enu003cpu003eCreating interactive visualizations and educational games for skill acquisition is hard, requiring subject matter expertise and interactive design skills. Instructional goals and specific subject matter details must be integrated with other information to develop interactive scenarios. To provide a more efficient turnaround of training games or visualizations, we are developing ShortCut, a web-based collaborative framework for rapid development of serious games. ShortCut’s goal is to facilitate knowledge exchange between subject matter experts and game designers, thereby streamlining the creation of serious games.  Using an interactive, web-based knowledge elicitation, ShortCut allows the instructor or subject matter expert to describe in detail the subject matter, and it also captures additional information needed by interaction and game designers, such as learning objectives and descriptions of real-world situations using the skill or knowledge.u003c/pu003e

u003chr /u003enu003cpu003eu003cimg class=u0022wp-image-13222 size-mediumu0022 src=u0022https://www.avi.com/wp-content/uploads/SimBLEND-400x314-1-300x236.jpgu0022 alt=u0022u0022 width=u0022300u0022 height=u0022236u0022 /u003eu003c/pu003enu003cpu003eThe result of a research program funded by the Air Force Research Laboratory Human Effectiveness Directorate, Warfighter Readiness Research Division (AFRL/HEA) to develop new and exciting concepts for training the next generation of cyber warriors, u003cstrongu003eSimBLENDu003c/strongu003e facilitates  blending the delivery of computer based training (CBT) materials with interactive visualizations and serious games to create a web-based environment where learning is fun and skills can be practiced immediately. To demonstrate SimBLEND, we created browser-based, CND-themed casual games that focused on low-level cyber security concepts and tools. These games are simple to use and can be delivered as stand-alone games or integrated into a Learning Management System or other training environment.u003c/pu003enu003cpu003eSimBLEND was sponsored by Air Force Research Laboratory Contract number: FA8650-08-C6858.u003c/pu003enu003cpu003eu0026nbsp;u003c/pu003enu003cdiv class=u0022et_pb_button_module_wrapper et_pb_button_0_wrapper et_pb_module u0022u003eu003ca class=u0022et_pb_button et_pb_button_0 et_pb_bg_layout_lightu0022 href=u0022/research-lab/download-hub/#simblendu0022u003eSimBLEND Download Hubu003c/au003eu003c/divu003e

u003chr /u003ennu003cimg class=u0022wp-image-13224 alignnone size-mediumu0022 src=u0022https://www.avi.com/wp-content/uploads/SWAMP-Logo-med-400x129-1-300x97.pngu0022 alt=u0022u0022 width=u0022300u0022 height=u002297u0022 /u003ennAVI has developed several professional partnerships and teamed with leaders in the Software Assurance community.nnThe SWAMP is a forward-looking effort to improve the state of secure software development, particularly for open source projects. Developed by Morgridge and funded by DHS it was an effort that has offered its initial capability since early 2014. It is no longer operational.

u003chr /u003ennu003cimg class=u0022wp-image-13225 alignnone size-mediumu0022 src=u0022https://www.avi.com/wp-content/uploads/viassist-analysis-screenshot-400x242-1-300x182.jpgu0022 alt=u0022u0022 width=u0022300u0022 height=u0022182u0022 /u003enu003ch4u003eNetwork Defense Visualizationu003c/h4u003enVIAssist is a visual analysis platform to help network security analysts protect their networks. It was designed after a comprehensive cognitive task analysis of network defenders. It provides visual tools for the evaluation of network flow and security data. VIAssist presents multiple, coordinated views – highlighted or filtered data in one view is reflected in all other views – to provide different visual perspectives of the data. These views transform network data into a collection of interactive visualizations that make it easier to analyze data, to see patterns and trends, and to identify risks and actionable information.nnu0026nbsp;nu003cdiv class=u0022et_pb_button_module_wrapper et_pb_button_0_wrapper et_pb_module u0022u003eu003ca class=u0022et_pb_button et_pb_button_0 et_pb_bg_layout_lightu0022 href=u0022/research-lab/viassistu0022u003eDetailed Overviewu003c/au003eu003c/divu003e

u003chr /u003enu003cpu003eu003cimg class=u0022wp-image-13231 alignnone size-mediumu0022 src=u0022https://www.avi.com/wp-content/uploads/whyviz-flow2-289x300.pngu0022 alt=u0022u0022 width=u0022289u0022 height=u0022300u0022 /u003eu003c/pu003enu003cpu003eThe goal of WhyViz was to conduct a study of the effectiveness of visualizations on cyber operator performance during the early stages of incident handling, which require defense analysts to review an endless alert queue of cyber event data to identify, record, and report suspicious behavior or cyber events of interest. Most cyber security visualizations are currently used for historical analyses, however, as part of the WhyViz project, Secure Decisions developed visualizations to support the real-time, in situ processing as it is actually being performed by cyber operators to facilitate event detection and preliminary event analysis.u003c/pu003enu003cpu003eIn Phase I of this Small Business Innovation Research (SBIR), we applied knowledge elicitation (KE) methods to define specific examples of cognitive work that occur in the early stages of incident handling that have the potential for being enhanced (faster, more accurate, more complete) through the use of visualizations by the cyber operator. This cognitive work took the form of the operator seeking to answer specific analytic questions using the available data, in a severely time-constrained work environment. A KE with domain practitioners revealed that cyber operators regularly ask fundamental analytical questions that cut across specific tasks and roles. Our research identified the type of information operators need to answer these questions, the visualization concepts that represent that information in a visual form that can be rapidly comprehended and acted on, and methods to transform raw cyber sensor data into a form that can be used to populate the visualizations. In Phase II of the project (in progress) we will conduct an experiment to objectively evaluate the effects of these visualizations on operator performance.u003c/pu003enu003cpu003eIn Phase II of the project, we conducted an experiment to objectively evaluate the effects of these visualizations on cyber defense analyst performance.u003c/pu003enu003cpu003eContract No: FA8650-16-C-6711u003cbr /u003eDISTRIBUTION STATEMENT A.  Approved for public release:  distribution is unlimited.  88ABW Cleared 02/08/2017; 88ABW-2017-0518.u003c/pu003enu003cpu003eu0026nbsp;u003c/pu003enu003cdiv class=u0022et_pb_button_module_wrapper et_pb_button_0_wrapper et_pb_module u0022u003eu003ca class=u0022et_pb_button et_pb_button_0 et_pb_bg_layout_lightu0022 href=u0022/research-lab/download-hub/#whyvizu0022u003eWhyViz Download Hubu003c/au003eu003c/divu003e

u003chr /u003enu003cpu003eu003cimg class=u0022wp-image-13233 alignnone size-mediumu0022 src=u0022https://www.avi.com/wp-content/uploads/higherContrast-WildCAT-300x152.jpgu0022 alt=u0022u0022 width=u0022300u0022 height=u0022152u0022 /u003eu003c/pu003enu003ch4u003eWireless Threat Visual Analyticsu003c/h4u003enu003cpu003eCritical infrastructures can be vulnerable to cyber attacks through 802.11 wireless networks. WildCAT is a prototype system that enables integration of physical and cyber security resources in order to detect and immediately respond to wireless threats. It is designed to use physical security vehicles as a platform to collect wireless activity and send the data via a cellular network to an analysis center.u003c/pu003enu003cpu003eu0026nbsp;u003c/pu003enu003cdiv class=u0022et_pb_button_module_wrapper et_pb_button_0_wrapper et_pb_module u0022u003eu003ca class=u0022et_pb_button et_pb_button_0 et_pb_bg_layout_lightu0022 href=u0022/research-lab/wildcat/u0022u003eDetailed Overviewu003c/au003eu003c/divu003e