Concepts for Knowledge Management in the Cyber Control System (presented to

1. Concepts for Knowledge Management in the Cyber Control System (presented to Major General William Lord, AFCyber Command (provisional) 18 Feb 2008

2. Contents • Purpose • Background • Vision/Objectives/Concepts • Approach • Key Conclusions

3. Purpose (of the Briefing) To Communicate Some Core Concepts for Knowledge Management in the Cyber Control System

4. Background • Advances in IT and Internet Technology • Growth of and Dependency on the Internet • Military Applications of Internet Technologies • Hacker Threat • Cyber Security • Information Dominance • Cyberspace, Cyber Ops, and Associated Doctrine • Freedom of Operations in Cyberspace • Denial of Freedom to Operate in Cyberspace

5. Background (cont) • We Have Been Communicating Concerns About KM in the IC, Dod, and DHS in General and a Proposal on KM for Cyber Ops to AFCyber/CC in Particular • General Lord Has Resonated with Our Proposal • He Has Asked Us to Develop/Communicate to You Our Concerns, Concepts, and Proposed Way Ahead

6. What Is Cyberspace? • A Civilian Definition: • cyberspace: The impression of space and community formed by computers, computer networks, and their users; the virtual "world" that Internet users inhabit when they are online. • The Military Definition: • cyberspace: a domain characterized by the use of electronics and the electromagnetic spectrum to store, modify, and exchange data via networked systems and associated physical infrastructures cyberspace; a physical domain within the electro-magnetic environment,

7. What Are Cyber Operations? • Cyber Operations Are Operations Carried Out in the Cyberspace Domain (per the military definition) • Three Categories of War-fighting Ops • Ensuring Operational Freedom of Action • Delivering Cross Domain Effects (Air, Space, Ground, Sea, and Cyber) • Supporting Civil Operations

8. Cyber Ops KM Concept Map

9. Cyber Control System Concept Map

10. Cyber Ops Givens Cyberspace and Cyber OperationsAre Very Complex! Cyber Operations Will Be Highly Automated and No Doubt Involve All Manner of Event Driven Processes, Rule Selection/ Execution and Machine to Machine Operations and Data Flows Cyber Operations Will Require Rapid Capture, Access, Acquisition, Transmission, and Sharing of Relevant, Complete, Precise, Structured, and Current Cyber Knowledge Cyber Operations Will Require Very Robust, Systematic, and MLS Capable Management of Cyber Knowledge

11. What Does This Mean?Some Implications for Cyber Ops KM Cyberspace Knowledge Required to Drive the Cyber Control System Must Have Requisite Scope and Depth of Content Cyberspace Knowledge Must Provide for Requisite Complexity, Structure, and Detail, and Include Rich Content Meta-data Cyberspace Knowledge Must Be “Info Product” or “Client Domain” Neutral and Highly Re-purposable Cyberspace Knowledge Must Have Associated Classification and Other Meta-data at the Attribute Value Level The Cyberspace Knowledge Mgt Capability Must Be Readily Extensible to New and Modified Data/Info Models Cyberspace Knowledge Management Should Be and Probably Must Be Ontology Based/Driven by a Robust Federated Ontology for Cyberspace in the Context of Cyber Operations

12. Some Envisioning Envision US Cyber Ops Events, Processes, Flows, and Knowledge Being Driven by a Federated Cyber Ops Ontology Which Serves As the Externalized Specification of What Constitutes Cyber Ops Envision That Virtually Any Cyber “Entity” Than Can Be Conceptually Modeled Can Be Represented in the Cyber Ontology and Hence Be Instantiated in the Cyber Knowledge Base Envision That All Data, Info, Knowledge Is Logically Structured IAW the Ontology So That Automated Machine to Machine and Agent Based Info Sharing Is Facilitated Envision That MLS Operations Are Made Possible Via Attribute Value Level Classification Meta-data Envision That the Knowledge Repository Is Product Neutral and Highly Re-purposable So That JIT Cyber Products Can Be Spun Out Readily

13. Cyber Ops Learning and Control SystemFeatures of Top Level CONOPS • Double Loop Control System • Inner Execution Loop Has to Do With Executing the Control System in Its Current Configuration • Outer Configuration Loop Has to Do With Updating, Revising the Control System Configuration • Specified and Driven by Extensive/Intensive Knowledge of Cyberspace and CyberOpsand Codified Externalized Semantics (Ontologies): • Cyberspace and CyberOps • Capabilities • Structure • Behavior/Rules • Parametrics • Control System Behavior and Configuration Is Modified by Modifying the Cyber Knowledge and Semantics (Ontologies) • Semantics Are Modified IAW What Is Sensed and Analyzed • An Irony: The Cyber Control System Is Actually a Part of the Cyberspace That It Seeks to Monitor and Control!!!

14. Top Level Cyber Ops Architecture Cyber Operations Cross Domain Ops Counter Cyber Ops Support to Civil and Defense Cyber Ops Knowledge Base Federated Ontology of Cyber Space Ops Cyber Semantics Requisite Complexity, Structure, Detail Rich Content Meta-data MLS Ready Readily Re-purposed Data, Info, Knowledge Drives Agent Activity Drives Machine-to-Machine Processes Drives Generation of JIT Dynamic Products

15. Cyber Learning & Control System Cyberspace Cyber Ops Info Consumer Process & Analyze Sense, Detect & Collect Deliver Cyber Effects Decide Cyber Ops Knowledge Base Discover Generate Deliver Dynamic Cyber Ops Products Federated Ontology of Cyber Space Ops Cyber Semantics Requisite Complexity, Structure, Detail Rich Content Meta-data MLS Ready Readily Re-purposed Data, Info, Knowledge Drives Agent Activity Drives Machine-to-Machine Processes Drives Generation of JIT Dynamic Products Analyze Cyberspace and CyberOps Events Develop, Update Cyber Ops Semantics (Ontologies, Processes, Rules, Facts) Capture Cyber Knowledge Cyber Learning and Control System

16. SAVANT Features • KPS: • Ontology Driven Capture/Mgt of Complex Structured Knowledge IAW Domain Specific Information Models (Ontologies) • Rich Content Meta-data At Hand (Inherent in Capture of the Info Model) • Attribute Value Meta-data Including: • Security Classification • Confidence Level • Releasability • MLS Ready • VPS: • Dev/Capture/Mgt of Static/Dynamic “Presentation Independent” Product Components and Meta-data • Dev/Capture/Mgt of Product Presentations (Applied to Product Components at Presentation Run Time) • MLS Ready • VIPRE: • Mission Subject Domain Portlets • KPS and VPS Meta-data Driven Product/Data Discovery, Access, Delivery • MLS Ready

17. KPS/VPS/VIPRE Segments KPS/VPS/VIPRE Knowledge Pre-positing System (KPS) Virtual Production System (VPS) Virtual Intel Product Rendering Environs (VIPRE) Product Components & Layouts Knowledge Objects Portlets/Products

18. Cyberspace Cyber Ops Info Consumer Process & Analyze Sense, Detect & Collect Deliver Cyber Effects Decide Cyber Ops Knowledge Base Discover Generate Deliver Dynamic Cyber Ops Products (VIPRE) Federated Ontology of Cyber Space Ops Cyber Semantics Requisite Complexity, Structure, Detail Rich Content Meta-data MLS Ready Readily Re-purposed Data, Info, Knowledge Drives Agent Activity Drives Machine-to-Machine Processes Drives Generation of JIT Dynamic Products SAVANT Segments KPS VPS VIPRE Develop Knowledge Driven Product Components (VPS) Develop Conceptual Models & Semantics (KPS) Process & Analyze Data Capture Cyber Knowledge (KPS) Cyber Learning and Control System

19. General Approach • Emphasize Cyber Knowledge-Driven System Constructs and Cyber Knowledge Management in Development/Refinement of CONOPS, Operational/Info Architecture, and Top Level Requirements • Employ Rigorous System Modeling Methodology (e.g. SysML) • Develop Specific Requirements for Cyber Knowledge Management • Develop Initial Working Ontology for Cyberspace and Cyber Ops • Develop/Deploy/Employ Cyber Ops Info Architecture • Apply Concepts and Capabilities Associated with Government Owned SAVANT • Developed by NASIC and NGMS (Dayton, Ohio) • Deployed at NASIC; SAVANT Deploying at ONI • Provide the Core Features Required for Cyber Ops KM • SAVANT Is Imminently Extensible Via Ontology Driven CONOPS • SAVANT May Be Only System of Its Kind Operating in the DOD and/or IC!

20. General Approach (cont) • Plan, Execute a Series of Prototype Spirals Which Apply SAVANT or SAVANT-like Concepts and Capabilities to Parts of the Cyber Ops Mission • Operational Architecture, Working Ontology, and Cyber Knowledge base Are Enhanced and Refined • Plan, Execute Increments of Operational Cyber Knowledge Management Capability in Concert with Related Cyber Ops Developments/Deployments • Interact with Intel Elements to Enhance and Refine the Working Ontology of Cyberspace/Ops and Its Instantiations Via Associated Threat Assessments

21. Key Conclusions Cyber Control System Must Be Propelled by Requisite and Properly ManagedKnowledge and Semantics of Cyberspace and Cyber Ops The Requisite Cyber Knowledge Must Be Very Conducive to Machine to Machine Operations and There For Must Be Highly Structured and Tagged The Requisite Cyber Knowledge Must Be Appropriately Accessible to Players at Different Security Levels and There For Have Attribute Value Level Labeling The Cyber Knowledge Base Must Drive Cyber Control System Configuration and Operations and There For Include Requisite Conceptual Models and Semantics The Cyber Control System Must Provide for Rapid Generation of Cyber Knowledge Base Driven Dynamic Products The NG Developed SAVANT Concepts and Capabilities Serve As an Excellent Point of Departure for the Development of the Requisite Cyber Control System Knowledge Management Capability