DCI Solutions AI/ML Augmentation of Cyber Risk Reduction

Understanding and mitigating cyber threats is crucial for safeguarding informational and sensitive data in an increasingly digitized and expansive interconnected world. The Missile Defense Agency (MDA) needs effective tools enabled by Artificial Intelligence (AI)/Machine Learning (ML) solutions to augment and modernize its risk reduction operations and help safeguard emerging technologies and controlled unclassified information in the Defense Industrial Base (DIB). As a leader in cybersecurity leveraging AI/ML, DCI Solutions (DCI) is uniquely positioned to address the MDA’s need. In Phase I, DCI will build a transformer-based anomaly detector powered by our commercially available cybersecurity engine, CyFormer, which leverages the latest advancements in natural language processing techniques as it is applied to a variety of computer data including logs and network data. We will build out scripts (data cleaning and ingestion) for the MDA-provided data types needed to control the CyFormer system to verify the applicability of our analytics approach for the datasets of interest to the MDA. CyFormer has been evaluated on a variety of data formats to include NetFlow, PCAP, Windows events logs, Linux audit logs. This may not encompass the full analytics desired by the MDA DIB, so we anticipate building engines for specific data formats. The CyFormer engine is highly adaptable to new data formats which will be validated in Phase I. This will enable our team to build the foundation to add additional workflows to include multiple data streams to be correlated. This multimodal cyberinformatics approach will reduce the false positive rate over traditional cyber analytics. DCI will also cluster MDA data points into pattern specific categories. We have extensive experience developing clustering models using non-traditional data representations, such as the artifacts generated by the transformer model. We have found that artifacts such as attention weights and output embeddings contain additional information than the original raw data as a result of the learning process during model training. We will leverage these artifacts in clustering actionable patterns to detect deviations and identify possible security incidents leading to advanced analysis. Approved for Public Release | 24-MDA-11906 (16 Sep 24)