On an August day in 2016, computer security gurus traveled to Las Vegas to prove that artificial intelligence, or AI, could find and fix flaws in software at machine speeds.<\/p>\n\n\n\n
There, teams battled for nearly 12 hours to see whose automated systems could best identify and patch vulnerabilities in software, with the top three prizes ranging from $750,000 to $2 million. Judges had winnowed a field of 100 teams to seven finalists for the Defense Advanced Research Projects Agency-hosted Cyber Grand Challenge (CGC) Final Event.<\/p>\n\n\n\n
Nearly 18 months later, DARPA officials and winnings contestants agree: AI is fast emerging as a way to give Department of Defense agencies the edge in the ongoing cat-and-mouse battle for cyber supremacy.<\/p>\n\n\n\n
\u201cCurrent computer security is just too complicated,\u201d said David Brumley. As CEO of Pittsburgh startup ForAllSecure, he helped lead the winning team. \u201cThere are too many processes involved. Downloading a patch, deciding to install it, making sure it doesn\u2019t crash things. We need to reduce the human timeline, to make these responses happen in minutes rather than in hours or days.\u201d<\/p>\n\n\n\n
In launching the cyber event, DARPA challenged researchers to envision cybersecurity that is enhanced and empowered by machine learning. It\u2019s an evolution that some outside the defense community have long been urging.<\/p>\n\n\n\n
\u201cTrading in stocks is now dominated by algorithms and human floor traders are largely superfluous. Why is this not a likely future for cyber conflict also and, if so, what are the implications for U.S. Cyber Command staffing and projects and overall U.S. cyber defense?\u201d said Jason Healey, a researcher at Columbia University\u2019s School of International and Public Affairs, in testimony last spring before the House Armed Services Committee.<\/p>\n\n\n\n
At DARPA\u2019s cyber event, the winning teams were able to implement AI as both an offensive and defensive tool. They taught the machines to quickly and accurately exploit known defenses in the systems of other teams, and also used machine intelligence to rapidly deploy appropriate patches to their own systems.<\/p>\n\n\n\n
The likelihood of AI working in a cyber scenario was \u201ca very open question\u201d prior to the competition, said Dustin Fraze, a program manager in DARPA\u2019s Information Innovation Office. \u201cWe didn\u2019t know if it would work, but the results of the CGC show that we are on the path to where automation can in fact identify vulnerabilities and find remediations.\u201d<\/p>\n\n\n\n
If that is so, it could have profound operational implications for military cyber operators who today find themselves too often playing catch-up in the face of a rapidly evolving threat landscape.<\/p>\n\n\n\n
In short, military leaders envision self-healing networks.<\/p>\n\n\n\n
Fraze described how CGC competitors tackled a typical scenario, in which an operator detects a vulnerability in software and uses it to attack an opponent\u2019s systems. The opponent deploys a patch and in the next round the aggressor identifies that patch and devises a counter-exploit.<\/p>\n\n\n\n
\u201cWithin 20 minutes we saw discovery, a patch, mitigation of that patch and a mitigation of that mitigation,\u201d Fraze said. In the field today, \u201csuch an interaction would take days or weeks or months, if it were done manually.\u201d<\/p>\n\n\n\n
This is not to suggest that AI is going to dramatically reshape military cyber tomorrow. More than a year after the DARPA challenge proved it could be done, researchers say they still need to make significant progress to be able to use machine learning in operations as a large-scale cyber asset.<\/p>\n\n\n\n
Brumley cautions that any military use of AI for cyber will have to take into account the possibility that the enemy will take a counter-AI approach: If our computers can learn, the adversary might try to teach them the wrong things.<\/p>\n\n\n\n
\u201cIf network security becomes about AI, then people will start to attack the AI. People will teach the AI bad things,\u201d he said. \u201cIf you give AI control and it learns bad things, it can easily spiral out of control.\u201d<\/p>\n\n\n\n
In addition, there are still some areas where AI struggles to learn quickly. A computer can be taught to see something that is broken, for example, but it\u2019s harder for a machine to recognize something that might<\/i> break.<\/p>\n\n\n\n
\u201cIf you have something like a logic error \u2014 something that is hard to quantify, where nothing has actually crashed \u2014 it can be difficult for an automated approach to see that,\u201d Fraze said. \u201cThere are also behaviors that are acceptable in one application, that would represent enormous flaws in another application. It depends on the context, which is something humans intuitively understand and machines don\u2019t.\u201d<\/p>\n\n\n\n
Despite the hurdles, researchers see promise in automating some of the routine work of cybersecurity. DARPA has no official program around AI in cyber right now, but with increasing acceptance of AI in the commercial world, researchers in DARPA and elsewhere continue to explore the possibilities.<\/p>\n","protected":false},"excerpt":{"rendered":"
DARPA’s Cyber Grand Challenge showed how artificial intelligence could give the Defense Department the edge in the ongoing cat-and-mouse network battles.<\/p>\n","protected":false},"author":7,"featured_media":39939,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":16,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[10,106,29,16,32],"tags":[],"coauthors":[2063],"class_list":["post-15931","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber","category-daily-brief","category-home","category-it-networks","category-newsletters"],"acf":{"subheadline":"","legacy_arc_id":"PFDQHES6MBCBRFBBAA3TNPDH54","arc_canonical_url":"\/it-networks\/2017\/12\/26\/how-darpa-sparked-dreams-of-self-healing-networks\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n