Novel Detection Mechanisms for Advanced Persistent Threats

The Department of Defense (DoD) is supported by a vast global network of computers, sensors, and equipment that is continually at risk of being breached by adversaries. Such cyber elements comprise an important part of the DoDs military readiness and the loss or degradation of such elements would reduce key advantages in communication, intelligence, and organization. Despite heavy investments in security and cyber defense, the sheer ubiquity and interconnectedness of DoD equipment leave open the possibility of intrusion through a myriad of means including advanced persistent threats (APTs). Such threats take many forms, including Trojans, back-doors in embedded systems, worms, spear-phishing, and viruses, all of which could prove detrimental to the war fighter if not discovered. As part of our work we have demonstrated several novel ideas for detecting APTs based upon modern ideas in space-time signal processing, multiple hypothesis testing, and robust principal component analysis. In particular, previous results by Numerica have proven especially pertinent to APT detection since these algorithms have been demonstrated to scale to millions of data streams, can fuse data from a variety of input types, and have quite advantageous sparsity properties for visualization and analytics.