United States

Reinforcement learning (RL) has been demonstrated suitable to develop agents that play complex games with human-level performance. However, it is not understood how to effectively use RL to perform cybersecurity tasks. To develop such understanding, it is necessary to develop RL agents using simulation and emulation systems allowing researchers to model a broad class of realistic threats and network conditions. Demonstrating that a specific RL algorithm can be effective
for defending a network under certain conditions may not necessarily give insight about the performance of the algorithm when the threats, network conditions, and security goals change. FARLAND is a novel framework to facilitate the development of RL network defenders that are robust against attacks aimed at the agent’s learning. Our contributions include an architecture and implementation of FARLAND, as well as threat modeling concepts that should be considered when designing an AI-driven network defender. We discuss examples that illustrate FARLAND’s advantages for developing RL-enabled defenders against realistic adversaries.


NAML 2021

FARLAND (Framework for Advanced Reinforcement Learning for Autonomous Network Defense)

autonomy

cybersecurity

reinforcement learning

Naval Information Warfare Center Pacific is partnering with AFCEA San Diego chapter to host the workshop.

The NAML workshop is an opportunity for researchers from Navy research and development centers and our partner organizations to exchange technical ideas and to come together as a team.

The goals of NAML are:

* To spread awareness of current machine learning research relevant to Naval applications

* To connect machine learning researchers with experts in military requirements

* To build and strengthen collaborations within the defense research community

**Watch this video to hear about the AFCEA purpose.**

<iframe width=1280 height=706 frameborder="0" scrolling="no" src="https://screencast-o-matic.com/player/creleVVcvRh?v=6&ff=1&title=0&controls=1" allowfullscreen="true"></iframe>

technical paper

In recent years there has been a significant increase in the amount of disclosed cybersecurity vulnerabilities resulting in lengthy analysis delays, allowing for cyber-attacks to exploit these vulnerabilities before pertinent data can be published to inform cybersecurity professionals. This data includes impact metrics, vulnerability types, and applicability statements. Previous research has focused on predicting the common vulnerability scoring system (CVSS) score calculated from impact metrics, as shown in the National Vulnerability Database (NVD), using methods such as term frequency-inverse document frequency (TF-IDF). This research utilizes natural language processing (NLP) and topic modeling to derive meaning from NVD vulnerability description texts to classify the vulnerabilities, with a predictive model trained with previous years’ data, as related to applications, hardware devices, and/or operating systems. From this classification the total analysis time of future vulnerabilities will be reduced, and cybersecurity professionals will be able to make more informed decisions regarding vulnerability management of assets to aid in preventing future cyber-attacks.

Categorization of Cybersecurity Vulnerabilities Utilizing Machine Learning Methods for Vulnerability Management

This talk consists of four parts as follows: (1) (15min) An overview of the Navy sponsored, ORNL administrated AI ATAC Prize Challenges 1 & 2 will be given. These two challenges were large-scale experiments to evaluate market-leading cybersecurity tools that leverage AI/ML for endpoint malware detection (Challenge 1) and network traffic analysis to detect multi-step adversarial campaigns (Challenge 2). (2) (10min) The second part of this talk gives a deep-dive on how CORR (ORNL's Cyber Operation Research Range), a cybersecurity testbed, was designed and stood-up to host these and other evaluations. (3) (5min) The third portion of the talk gives a brief overview of the machine learning and software engineering task to create D2U, the Data-Driven User Emulator. This allows orchestration of hundreds of VMs on CORR that, guided by trained probabilistic generative models, take actions as real users. (4) (10 min) Finally, the fourth and final portion gives an overview of a cost-benefit framework for simulating how SOCs will use the cybersecurity tools in the test. It allows integration of the many statistical measures (precision, recall, time-to-detect, etc.) into a single comparable metric (cost) for ranking and reasoning about tradeoff's when considering cybersecurity tools.

Artificial Intelligence Applications to Cybersecurity (AI ATAC) Prize Challenges I&II

Forecasting the weather over the oceans of the Earth is a necessary but difficult requirement of US Navy operations around the globe. Before computer science formally existed as a discipline, meteorologists were using the first computers to explore the possibilities of Numerical Weather Prediction (NWP) to support this forecasting. The foundation of NWP is a fluid dynamics model of the atmosphere interacting with a multitude of physical processes that drive the spatiotemporal vector fields of wind and scalar fields of pressure, temperature, and water vapor mixing ratio. Because the spatial domain of the model is essentially the entire Earth and practical forecasting operates on a cadence of updating every six hours, the computational constraints are formidable and require a number of compromises in formulating the model.
The Naval Research Laboratory (NRL) has over a few decades developed the Navy’s primary NWP model called the Coupled Ocean-Atmosphere Mesoscale Prediction System (COAMPS). COAMPS has effectively supported naval operations at the Fleet Numerical Meteorology and Oceanography Operations Center (FNMOC) for the past 20 years but is going to be replaced by a more advanced model called Neptune in the next few years. As a part of this process, NRL has a project to understand how Machine Learning (ML) might be used to improve the forecasting accuracy and computational efficiency of this new system. In particular, there has recently been significant progress in applying ML to model turbulence in fluid dynamics. Since proper representation of turbulence in NWP models has been identified as a weakness, the opportunity of using ML to improve weather forecasting has focused on this aspect of the problem.
To support a data-driven ML approach to improving the NWP model, a series of Large Eddy Simulations (LES) have been performed at spatial resolutions not possible with operational NWP models to provide “ground truth” data for how turbulence behaves in the atmosphere. The goal is to learn both the relevant combinations of state variables and the partial differential equations of the spatial dynamics for insertion into the NWP model. This approach requires data and model compression to find useful state variables (or feature vectors) via unsupervised learning since not all quantities available in the LES data can be represented by the low resolution NWP model. Given a suitable space of feature vectors, a supervised learning step finds the partial differential equations for the NWP model that match the dynamics of the LES data. The talk will emphasize the broader issues of how ML can be used in the scientific domain when complex modeling choices can be better resolved with a data-driven approach.


Using Machine Learning to Improve Weather Forecasting for Naval Operations

The traditional approach to photonic design (the inverse problem) is to generate a solution based on intuition and expert knowledge, evaluate how closely it approximates the desired result by electromagnetic simulation (forward problem), and optionally optimize over a few input parameters. However, this approach is limited in what areas of the design space it can reach.. Alternatively, we may computationally optimize over many parameters simultaneously, effectively parameterizing the entire design space, but algorithms for doing so require many costly evaluations of the forward problem. In this work we apply a neural network to approximate simulation output, making the forward problem less costly to solve and the inverse problem more tractable. The neural network is used to assist traditional gradient descent in finding the optimum solution for a given design target. We consider the design of a non periodic grating as a proof of concept. Combining the neural network with gradient-based optimization, our algorithm designs a grating with a spectrum matching a target from the test set with R^2=.99 and an arbitrary spectrum with R^2=.91. These results serve as useful proof of concept for this technique and an opportunity to apply it to new problems in photonic design. 


Deep Inverse Design of a Photonic Structure

Simulating a fluid flow involving chemical reactions is critical to many scientific problems, from climate modeling to propulsion system design. Since chemical reactions can occur very quickly, these simulations typically solve the fluid state separately from the chemical state, syncing up at regular intervals. Unfortunately, the chemistry is a significant bottleneck in many practical problems: it scales very poorly as reactions get more complex. As a result, many useful simulations are computationally prohibitive, forcing researchers to rely on low-fidelity reduced order models, very small-scale simulations, or even forego the problem altogether. Deep learning is gaining traction as a way to develop data-driven surrogate models that are accurate and fast enough to overcome these bottlenecks; however, little work has been done to apply this to chemical kinetics. Today, we will present our work evaluating a broad spectrum of surrogate modeling approaches for stiff chemical kinetics. We discuss the strengths and weaknesses of different modeling and training strategies, highlighting the unique challenges of stiff time-series forecasting and recommending several promising paths forward. Finally, we will discuss the potential for machine learning for developing surrogate chemistry solvers in practical CFD.

Introducing Machine Learning Solutions for Chemically Reacting Flow Simulations

SpaceNet 6 was a geospatial data science challenge centered on foundational mapping from multimodal data. It was one in a series of challenges organized by SpaceNet, which accelerates geospatial deep learning by releasing open datasets, organizing deep learning challenges, and open-sourcing the resulting algorithms and analysis.

SpaceNet 6 introduced a new dataset covering the vicinity of the port of Rotterdam in the Netherlands. The multimodal dataset includes building footprint polygons, electro-optical imagery, and synthetic aperture radar (SAR). The high resolution of the SAR (processed at 0.5m for the challenge, the same resolution as the corresponding optical data) makes the dataset especially valuable. SAR works under nighttime and cloudy conditions when visible satellite imagery cannot be acquired. To make the challenge mimic such a real-world scenario, participants were permitted to use the SAR and electro-optical data for training but were only provided SAR for testing. The specific task was to identify building footprints in the SAR imagery.

An analysis of the winning models from SpaceNet 6 provides many lessons about using deep learning with SAR. Winning models significantly outperformed a baseline model by using EfficientNet architectures and incorporating pretrained weights. The ability to detect buildings varies with building size and height, with similar trends seen across models. Layover, a geometric effect intri

SpaceNet 6: Results from a Geospatial Deep Learning Challenge with Synthetic Aperture Radar Imagery

Threat Evaluation algorithms are designed for aiding in identifying which incoming tracks are threats to the surface fleet. The use of Artificial Intelligence (AI) and Machine Learning (ML) algorithms will speed up the threat identification process, allowing more time for coordinating defensive measures. Currently, the threat evaluation process is performed through verbal communication by a set of human operators making real time decisions on tracks as seen on the radar console. There are many factors that can be considered in threat evaluation; the data load and data processing rate required for an optimal real-time assessment far exceed human capacity. The conversion of as-received data to informed decisions can be performed faster with AI/ML. One such AI/ML approach that can be used is the Random Forest Classifier algorithm. This is not only more efficient but also more accurate than the current threat evaluation process because it can be accomplished with a series of measurements happening at machine speeds instead of human processing time. The Random Forest Classifier is chosen for this analysis because unlike most AI/ML algorithms, its process is transparent. It consists of a series of decision trees, so an operator can look at the decisions being made by the algorithm and make a final decision. In Random Forest implementations, each decision tree runs on a subset of all the features that are provided and evaluates the split of data made on those features using a mathematical equation. The equation implemented in this iteration of Random Forest is a Gini Impurity split measurement. This measurement takes into consideration the probability of a particular feature being wrongly classified when the data is split. This equation is able to handle both numerical and categorical data and performs well with large data sets. As with any AI model, Random Forest needs to be trained. The current iteration of the Random Forest Classifier was first run on a known set of Sonar Data obtained from open sources and correctly identified those data points 84% of the time. Next, training data was obtained by using the Ship Air Defence Model (SADM) and the Joint Cognitive Opertional Research Environment (JCORE) running multiple scenarios containing both threat and non-threat air entities to create radar and Electronic Support track data. This paper provides the results of running the Random Forest Classifier on test sets selected from the training data. The results are then discussed and plans for future work are presented. 
Classification: UNCLASSIFIED
Distribution Statement: Distribution Statement A



Evaluation of Threat Level Using Artifical Intelligence

Techniques to identify an RF emitter and key characteristics of the waveform being transmitted are critical when determining whether a transmission is intended to interfere with communications. In the specific case of space communications, there are many internationally owned transmitters attempting to communicate with spacecraft in a congested frequency band. There are approximately 6-8 thousand active spacecraft on orbit with many new commercial constellations being launched where all are competing to use the same ~100 MHz of bandwidth. For this reason, it’s critical to be able to distinguish between various signals and identify distinguishing characteristics within those signals. Techniques such as fingerprinting transmit signals of interest, machine learning for modulation classification of the observed signal, and pattern matching and identification methods on the resulting data stream are important for distinguishing signals.

The work presented here focuses on applying machine learning to unknown signals in order to classify the modulation. We have focused on three of the most common modulation types - Frequency Shift Keying (FSK), Phase Shift Keying (PSK), and Quadrature Amplitude Modulation (QAM). In particular, software-defined radio (SDR) systems are used to transmit and then receive signal bursts. We then use Mean-Teacher, a method that averages model weights, for semi-supervised training of four signal characteristics (Frequency, Angle, Magnitude, and Power Spectral Density (PSD)) of the received signals. We use a tiered approach, first training the high-level modulation types (FSK, PSK, and QAM) and then training for the specific modulations within each type (GMSK, MSK, 2FSK, 4FSK, 8FSK, OQPSK, QPSK, 8PSK, BPSK, 16QAM, 64QAM, 256QAM). We will present where we have found it beneficial to use semi-supervised learning, and compare the results of the 12-class classifier vs the tiered approach.

Mean Teacher Technique Applied to RF Modulation Classification

A Signal of Interest (SOI) is a signal that has been recorded for further analysis. This is driven by mission requirements for both known and anomaly signals. Identifying anomalies/SOIs is reliant on the system operator’s knowledge which can be prone to human error. The objective of this project is to improve situational awareness by automating the identification of SOIs with Machine Learning/Artificial Intelligence techniques. In year one, data science techniques were applied and proved the daily emitter and frequency distributions in the Hampton Roads area have a consistent subset of emitter traffic. Anomalies were identified based on this fingerprint, and an ANN algorithm was implemented in an application which provides a graphic highlighting anomalies/SOIs. During year two, the algorithm was validated, the data collection method was improved, and prototype functionality was successfully integrated into the tactical system that streams live Radio Frequency into a real-time Graphical User Interface and predicts potential anomalies/SOIs in real-time.

The Application of Machine Learning to Signal Processing for the Detection and Identification of Signals of Interest and Anomalies

In recent years, the concept of Digital Twin (DT) has come up to play a massive role in the efficient functioning of various Industry and Manufacturing sectors. Originally designed for the aerospace sector, the benefits of the framework were soon recognised for other arenas. One particularly exciting avenue for this concept is for healthcare where DTs of Human Beings can have applications for the prognosis of muscle injuries and diseases and rehabilitation of patients, while also providing the ability of virtually testing solutions before they are actually implemented. A type of a DT of Human Beings are those of Human Musculo-Skeletal (MSK) systems which require multiple muscle parameters and muscle excitation signals, traditionally found by solving a system identification problem through optimisation. In this work, a framework for the system identification of a DT of a Human MSK system is proposed where the problem is solved using Physics Informed Recurrent Neural Networks (PI-RNNs) to identify the equation parameters and predict the muscle excitation signals, given the recorded motion data and the system of equations governing the rigid body movement of the Human MSK system. PI-RNNs have been formulated by enhancing traditional Recurrent Neural Networks (RNNs) with physics-based constraints such as residuals of the differential equation and/or time integration schemes for differential equations. RNNs are extensively used to model sequential time series data and adding the physics-based residuals as a regularisation term to the loss function allows for a robust system identification procedure while modern machine learning architectures lend a computationally efficient framework to solve for system parameters and signals. The future work in uniting various data streams of the subject including motion capture data (position, velocity, and acceleration) and wearable sensor data (kinetic and kinematic data of the muscle groups) for a more accurate solution and connecting the system identification of the multi-body dynamics of the MSK DT to the patient specific muscle mechanical properties is also highlighted.

Premium content

FARLAND (Framework for Advanced Reinforcement Learning for Autonomous Network Defense)

Downloads

Next from NAML 2021

Categorization of Cybersecurity Vulnerabilities Utilizing Machine Learning Methods for Vulnerability Management

Similar lecture

Learning to Both Observe and Act