The intelligence community’s research arm, the Intelligence Advanced Research Projects Activity, in May released a broad agency announcement for a new program called the
Cyber-attack Automated Unconventional Sensor Environment, which seeks research in predictive cyber solutions.
Specifically, the program was soliciting research in a variety of general research topics to include anticipatory intelligence, analysis, research in operations and collections research, all of which include more specific research areas of interest.
IARPA awarded four organizations contracts under this program, an IARPA spokesperson confirmed to C4ISRNET. They include
BAE Systems Inc., Charles River Analytics, Leidos and the University of Southern California.
BAE’s work and research under the first phase of this contract will focus on the development of unconventional sensors to predict cyber attacks and generate automated warnings,
Rebecca Cathey, the Principal Investigator for the project at BAE said in an emailed statement to C4ISRNET.
“Traditional cyber attack technology relies on private data and conventional sensors and primarily focuses on detecting ongoing events,” she said. “Our system applies behavioral, cyber attack, and social theories to publicly available information, and searches for signals that could indicate the early stages of an attack, including emotional language, sentiment, and topics of conversation. Our sensors will use a wide variety of techniques and algorithms, and the sensor outputs will be fused together using models seeded with expert knowledge.”
For it’s part, Leidos’s solution “
includes a multi-stage model of threat actor intentions and capabilities, which we match up to observed behavior collected through conventional and unconventional sensors to understand the most likely targets and timing of cyber-attacks,” Ron Keesing, Leidos Division Manager, also told C4ISRNET via an emailed statement. “The Leidos team believes that the key to generating timely warnings is to observe the behavior of cyber threat actors as they move through multiple stages of preparing for and executing a cyber-attack.”
Keesing referenced CAUSE’s goal to develop new automated forecasting methods of cyber attacks earlier. According to the BAA documents, IARPA is seeking “research ideas for topics that are not addressed by emerging or ongoing IARPA programs or other published IARPA solicitations. It is primarily, but not solely, intended for early stage research (i.e., seedlings), that may lead to larger, focused programs through a separate BAA in the future, so periods of performance generally will not exceed 12 months.”
“
Leidos’ approach to developing forecasting sensors enhances an existing Leidos Attack Chain (LAC) model – developed through Intelligence Community and commercial experience – into a model of observables related to cyber security events,” Keesing said. “We then use an unsupervised anomaly detection methodology (developed by Leidos as part of DARPA’s Anomaly Detection at Multiple Scales (ADAMS) program) to infer the most likely history of events, leveraging our cyber security behavior model to overcome both the low signal-to-noise ratio and missing information observed through sensors. The sensors include regional indicators of intent, social and economic conditions, cultural modifiers, and relevant data from the Dark Web.”
A researcher at USC told C4ISRNET that given the program has just started, they don’t have any capabilities worth discussing yet.
Charles River Analytics did not respond for requests for information on their efforts under this contract.
WAITING FOR COMMENT FROM USAF RE PREDICTIVE ALG
