DCOFlow TRAIN Station: train, release, automate, and integrate network ML-analytics into cyber operations

PUNCH proposes DCOFlow, a defensive cyber operations (DCO) ML analytic pipeline to train, manage, and deploy a suite of unsupervised ML algorithms that leverage contextual cyber features. DCOFlow fills a current need within ML-based methods used in cyber – to update, monitor, and deploy ML-based analytic methods in a context-aware, dynamic way into different mission environments. DCOFlow is designed to deploy optimized ML-based analytics in multiple cyber operation configurations to include commodity 1U servers, portable analytic workstations, and large-scale distributed computing environments. DCOFlow provides a robust suite of unsupervised ML algorithms using cyber data repositories for continuous training and evaluation. Detections are geared toward coverage of MITRE’s ATT&CK matrix and results are combined using ensemble techniques in order to improve the generated alerts. The resulting is an end-to-end, integrated solution for contextual feature engineering, model training, and delivery of ML-based analytics into cyber operations. DCOFlow provides timely, relevant, accurate, and explainable results via common formats to provide and improve actionable, operational threat detection.