Virtualitics AI-based Anomalous Activity Threat Detection and Intelligent Monitoring

The Nuclear Logistics Technical Division (NLT) maintains vital databases and application services for the national nuclear stockpile. These contain sensitive data requiring continuous monitoring for cybersecurity threats. This proposal seeks to develop an automated anomaly detection system for NLT databases, utilizing recent advancements in machine learning (ML), artificial intelligence (AI), and data science (DS). The system will analyze user activity data in real-time to promptly identify and mitigate potential cybersecurity risks, ensuring the security of the national nuclear stockpile. The proposed solution incorporates various ML/AI/DS techniques, including supervised algorithms (e.g., support vector machines, neural networks, rule-based techniques) and unsupervised and statistical algorithms (e.g., principal component analysis, clustering). These algorithms can be trained on large datasets and deployed in real-time, surpassing traditional heuristic approaches. Analysts' expertise will be leveraged in feature generation, model design, and training to enhance the performance of the ML/AI/DS methods. The models will continuously learn and adapt with additional event data, improving their effectiveness over time. Moreover, ML/AI/DS methods can identify complex trends and insights missed by rule-based protocols. To address the challenge of coding expertise, low-code application environments supporting in-database machine learning will be used. These platforms empower end-users, expedite development cycles, and increase productivity. Integrating ML/AI/DS modules within the low-code environment enhances analytical capabilities, allowing analysts to explore and gain deeper insights. This approach reduces cybersecurity risks associated with custom code deployment, ensuring resilience against threats. Virtualitics, an experienced SBIR award winner specializing in cybersecurity threat identification and low-code platform development, proposes to build upon Phase I efforts. The objectives for Phase II include deploying the Virtualitics AI Platform (VAIP) to the production network, developing an Extract, Transform, and Load (ETL) pipeline for processing real-time data, refining and training anomaly detection models on production data, and creating network activity and anomaly detection dashboards. The aim is to have a fully deployed ML algorithm capable of automatically identifying anomalous activities to support network security investigations. The refined models will be evaluated for additional processing, storage, and network requirements. By implementing this system, the NLT will enhance its ability to protect critical nuclear stockpile data and proactively respond to cybersecurity threats.