Badger - The Networked Security State Estimation Toolkit
summary
Open-sourced Cyber Physical Topology Language (CPTL) and the Badger toolkit provide automated network security state estimation by ingesting syslog, SNMP and nmap data, mapping into RDF/GraphML ontologies, and producing a running score via baselining and entropy. Demo normalizes ~40 million sniffer lines to ~2,000 records for a five-node home network, colors nodes red/yellow/green in Cytoscape, and joins flow and state services. An RP-funded integration feeds Badger state into an IEEE 9-bus control model with eight substations; code and ontologies live on GitHub.
AI-written summary · about
chapters (6)
- 0:00Start
- 0:46What is the problem?
- 1:25Networked Security State Estimation
- 2:13What is CPTL?
- 13:19Demo Time
- 18:26State DATA
related talks
39mImproving OT Network and Host Baselines to Secure Critical Infrastructure
29mAttack Defense Graph Analysis for Supporting SOC and CSIRT Operations
30mCybersecurity Risk Assessment Using LLM Agents and Graph Data Science
31mMonitoring Communication Networks of Energy Grids With the Open-source Framework...
45mConnecting the dots to go from tabular security incident data to behavioral graph understanding
54mLessons and Lulz: The 5th Annual Black Hat USA NOC Report
20mAttack of the Graph: Visual Tools for Cyber Analysis
49mA Real-World Example of Using Network Behaviour to Detect Cyber-Compromise