Signature Management Using Operational Knowledge and Environments (SMOKE)   3

Background
The SMOKE program aims to develop data-driven tools to automate the planning and execution of threat emulated cyber infrastructure for network security assessments, such as red team exercises. It also seeks to develop tools to automate the discovery of distinguishable patterns of sophisticated cyber threat infrastructure (i.e., signatures). The program is solicited by the DARPA Information Innovation Office (I2O) and is focused on addressing strategic objectives important to the Department of Defense (DoD).

Work Details
The SOW includes tasks related to automated planning and execution of attribution-aware cyber infrastructure, discovery and generation of infrastructure signatures, transition support activity, technical exchanges, evaluations, and operational assessments. The work involves developing algorithms, building tools for automated acquisition, management, and disposal of cyber personas for third-party infrastructure resources/options, and integrating components on the SMOKE platform.

Period of Performance
The SMOKE program is a three-year effort divided into two 18-month phases. Phase 1 will focus on developing, demonstrating, and evaluating individual components. Phase 2 will focus on comparative evaluations formed by integrating program components.