Ulap CYBOT - Automated Network Monitoring and Alerting

Problem: The Air Forceĺs Unified Platform and the U.S. Cyber Commandĺs top priorities are centered around advancing cyber capabilities that will help exploit, deny, or degrade Countries of Concern, all while maintaining continuous defensive cyber operations. Every day, new threats and attacks targeting the Nationĺs infrastructure contribute to the expanding landscape of malicious cyber activity, both in scope and speed. In recent news, the massive ransomware attack on MGM Resorts cost the company over $100M, including $10M in one-time consulting cleanup fees. It is only a matter of time before The Department of the Air Force is targeted for these types of attacks but would have much greater impacts than the commercial sector. The growth and surface area for these types of cyber threats presents an ongoing challenge, with emerging dangers demanding constant vigilance. The pace and diversity of these attacks highlight the pressing need for evolutions in cybersecurity infrastructure, processes, and AI/ML based technologies to safeguard critical systems and reduce the dependency on highly skilled individuals. In short, the DAF is behind the curve with an insufficient amount of Cyber Officers and Cyber Enlisted personnel equipped to protect the critical data and assets they are responsible for, in order to effectively remain a dominating presence, the DAF must invest in AI/ML software to help augment this shortage. Through extensive targeted discovery and research, Ulap has found the following limiting factors in the identified End-User and supporting Defensive Operations Squadrons: á Defensive:á Resource Shortage:á The DOD continues to face resource shortages required to support the 24x7 monitoring of networks and networked assets. Skilled Resource Shortage: In efforts to address the resource shortages, existing personnel are trained to support various cyber activities.á Even with cyber training, resources continue to lack the combination of technical and cyber expertise required to support defensive cyber operations.(ôshortage of 1.8 Million cyber professionals in the Federal Government in 2022ö - Chief Information Officers Council Report) Legacy Tooling: Existing Defensive Cyber tooling is configured via several applications focused on specific cyber needs. Tools currently utilize previous generations of cyber detection, traditionally depending on rules, pattern matching, and simple analytics Alert Fatigue: Existing tooling provides alerts and notifications based on the configurations of rules, patterns, and analytics that identify anomalous or suspicious behavior.á The volume of alerts exceeds the current team capacity and in many cases, alert review is deferred or ignored. á