Effective Monitoring of a Survivable Distributed Networked Information System

In 2002, DARPA put together a challenging proposition to the research community: demonstrate using an existing information system and available DARPA developed and other COTS technologies that a very high level of survivability against unconstrained attack by a nation-state-level red team is achievable. This report describes the monitoring, intrusion detection, and reporting infrastructure of the resulting system, highlighting the design principles and lessons learned that are generally applicable to survivable information systems.