DARPA tackles enterprise threat protection
The Cyber-Hunting at Scale program seeks to develop automated tools that can detect and protect multiple Defense Department enterprise networks from nefarious actors and novel attack vectors.
The Defense Advanced Research Projects Agency's Cyber-Hunting at Scale program seeks to develop automated tools that can detect and protect multiple Defense Department enterprise networks from nefarious actors and novel attack vectors.
FCW sat down with CHASE program manager Jennifer Roberts in DARPA's Information Innovation Office sat down to talk about the program at the agency's inaugural AI Colloquium March 7.
The following interview has been edited for length and clarity.
What's the CHASE program about?
Roberts: If you look at cyber defense across multiple enterprise networks, what you'll find very quickly is maybe on the order of a dozen networks, and the folks who are using those networks already generating cyber defense-relevant data.
But then, if you aggregate the amount of data storage that we [need] in order to process that data and detect who is attacking our networks, we have a fraction of that. Often it's on the order of 100 petabytes aggregate, and it depends on the network. That means the cyber-relevant data that can tell us who's attacking the network is an order of magnitude larger than our storage capabilities every single month. So we can't catch up.
We also have a constraint where algorithmically we can only process a very small fraction of the data in front of a human analyst.
The essence of the program is getting the right data from the right device at the right time in order to really bolster our security in our networks.
What are the challenges?
Roberts: There are a number of technical areas…. On the detection characterization piece, once we collect data, how do we more accurately detect who's attacking the network and [find] what's unusual? There's also the feedback loop where if we didn't collect the right information the first time, we can go back and adjust our sensors to get clarification.
Think of a computer acting as a VPN. We might want to adapt our sensors so that we can now have the analyst say, "Yeah, that is weird." But more than that, have the algorithm say, "Well I actually want these three log types from that host to be able to provide more information from the analyst" and really dive in quickly and identify what to do next. Do you isolate the device? Do you move it to a honey pot? What do you do?
Are any solutions ready to launch?
Roberts: As we look across the programs, some of these technologies are essentially ready to have impact for people in the DOD networks today. Some of them we're continuing to develop and expect to have a steady stream of capabilities over the next four years.
We're really focusing the program on the development of components that could be applicable to a number of different scenarios, [including] where we have a security operation center operating 24/7 and we have some DOD partners that are connecting our performers with real-time data feeds so that we can do demonstrations.
We just kicked off that effort last week and expect to have some more impressive demonstrations by June. Those partners would take the results and decide which to integrate into their platforms. We're also partnering with folks that do triage, the cyber protection teams where they're going out and trying to improve the defense of the network on a short time frame. We also have ongoing conversations with the folks who are in charge of the mission processes that make it so that we can figure out some long-term support once the DARPA program concludes.
We had a hackathon last week with representatives from five different parts of the DOD community who were interested in trying to help us with test and evaluation of the technology in a mission or operational context.
Was this your first hackathon?
Roberts: The first in-person one for the CHASE program. We kicked off in July and we had an online workshop to get people acclimated to the computing infrastructure in October or November timeframe. And then we had our first in-person one last week.
Any more planned for this year?
Roberts: Right now, folks are working on data demonstrations on a large data feed that's enterprise-sized, and we're hoping to have another event in the June timeframe with close family and friends given the nature of the data. And we're going to do demonstrations that will push on things like scalability and whether the algorithms can really operate at the size they would need to in order to protect DOD networks.
A longer version of this interview was first posted to FCW, a sibling site to GCN.
NEXT STORY: Digital forensics for large-scale networks