NOVADEF: A Pervasive, Programmable Monitoring Platform for Semantic Attacker Profiling in Cyber Defence

Abstract

The growing expansion of cyberspace fuels the increasing exposure of critical infrastructures to new, persistent, and complex threats. Although organizations typically employ a diverse set of security tools, the lack of integration among these tools fragments defense and hinders detection and response. Moreover, static configurations and the absence of dynamic mechanisms limit the ability to counter imminent attacks. This article presents NOVADEF, a pervasive, programmable monitoring platform that enables the deployment and configuration, through microservices, of diverse security tools based on dynamic policies, and that transforms raw telemetry into semantic, AI-enriched attacker profiles through a knowledge-graph representation. We instantiate the Observe and Orient phases of the OODA loop, and we present the design of a Decide/Act closed loop in which course-of-action selection and deception-based countermeasure orchestration are intended to operate on the resulting attacker profiles. Experiments on an OWASP Top 10 attack scenario show that the implemented Observe/Orient pipeline achieves high telemetry coverage and data flow integrity levels above 99.5% with sub-four-second end-to-end profiling latency, establishing a foundation for the automated decision and response capabilities described in the architecture.