(4) Machine Learning based Cyber Threat Investigation and Risk Assessment

To apply Navy’s CYBERSAFE concept to a near real-time environment, traditional cyber defense tools are not sufficient to achieve reasonable performance or catch all the security related anomalies. Moreover, dynamic and evolving cyber threats are well beyond the abilities of human analyst and defenders. Furthermore, although the cybersecurity knowledge data are available, there is no mechanism to automatically map them to the Navy platforms and correlate these data quantitatively to enhance cyber situational awareness and risk decision. To address the above issues, Machine learning (ML) is promising to act as a force multiplier to effectively detect the stealthy and sophisticated attacks, zero-day attacks, and conduct risk assessment in near real-time. Towards this goal, Intelligent Automation, Inc. (IAI) proposes to develop CyTIRA, a ML-based Cyber Threat Investigation and Risk Assessment system. CyTIRA automatically collects, converts and fuses available cyber threat information to build and maintain a cybersecurity knowledge base using up-to-date specification, and protocols. CyTIRA also provides an online processing pipeline for the data collected form protected networks/systems. Using the cybersecurity knowledge base and the detected anomalies/behavior, CyTIRA will conduct risk assessment, such as threat detection and classification, vulnerability identification, and further risk analysis.