JACKS: Joint AI-Cyber/EMSO Knowledge System

This proposal addresses topic areas 1 (Artificial Intelligence) and 3 (Cybersecurity).Building on SIFT's experience in cyber-aware Large Language Models (LLMs) and automated planning of cyber attack campaigns, we propose to develop Joint AI-Cyber/EMSO Knowledge System (JACKS) to address three key challenges required to achieve the envisioned Human-AI partnered workflows for Offensive Cyber Operations (OCO):Building scalable OCO planning models: Symbolic AI planning has been used in small, academic-scale demonstrations of planning for cyber operations. Scaling that approach up to realistic environments faces a knowledge-acquisition problem: how to create and maintain symbolic models of all the available sensors and their possible values, actions and their preconditions and postconditions, and goals that might be desired. JACKS will use fine-tuned LLMs to automatically translate the knowledge that is already available in CVE reports, threat intelligence feeds, and other data sources into the AI planning models required to automatically plan OCO campaigns. JACKS will use active experimentation to establish confidence that these planning models are accurate.Creating sound and diverse OCO plans: LLMs alone are not capable of reliably planning OCO campaigns. For example, they can hallucinate actions that do not exist, and they can make fundamental errors in logical and causal reasoning. Furthermore, military operations frequently require planning diverse, alternative courses of action to provide commanders with choices and backups. JACKS will use diverse symbolic AI planning methods to reliably create logical, sound plans that meet an operator's needs, incorporating rules of engagement and other constraints.Helping human operators develop OCO campaigns: Cyber plans, especially those built by automation, can be complex and difficult to understand. JACKS will use LLMs to help with this problem as well, providing a Natural Language interface that can accept goals and constraints from the human operator, explain resulting plans, and implement an operator's requests for revisions, all while keeping in mind prior conversations and context.JACKS will help humans plan OCO campaigns, using LLMs for scalable knowledge acquisition and natural language tasking and interaction.