United States

Advanced Persistent Threat (APT) and cyber criminals are known to utilize DNS protocol for command and control or beaconing or resolution of attacker domains, like the most recent Solarwinds breach. This is why academic researchers and industry groups advise security teams to collect and analyze DNS events to hunt, detect, investigate and respond to threats. 

We will discuss how to detect a remote access trojan using passive DNS (pDNS) and cyber threat intel at scale using ML/AI. We’ll review how to use open source technologies such as Delta and Spark to store and analyze TBs of passive DNS data. Additionally, we&#39;ll review ML to develop a model to detect domain generating algorithms (DGAs) and manage the ML lifecycle, from experiment tracking to training to production, using the open source project MLflow.

NAML 2021

DNS analytics and DGA detection with Apache Spark, Delta Lake and MLflow

mlflow

lakehouse

delta

data lake

siem

spark

cybersecurity

cyber

big data

machine learning

Naval Information Warfare Center Pacific is partnering with AFCEA San Diego chapter to host the workshop.

The NAML workshop is an opportunity for researchers from Navy research and development centers and our partner organizations to exchange technical ideas and to come together as a team.

The goals of NAML are:

* To spread awareness of current machine learning research relevant to Naval applications

* To connect machine learning researchers with experts in military requirements

* To build and strengthen collaborations within the defense research community

**Watch this video to hear about the AFCEA purpose.**

<iframe width=1280 height=706 frameborder="0" scrolling="no" src="https://screencast-o-matic.com/player/creleVVcvRh?v=6&ff=1&title=0&controls=1" allowfullscreen="true"></iframe>

Advanced Persistent Threat (APT) and cyber criminals are known to utilize DNS protocol for command and control or beaconing or resolution of attacker domains, like the most recent Solarwinds breach. This is why academic researchers and industry groups advise security teams to collect and analyze DNS events to hunt, detect, investigate and respond to threats. 

We will discuss how to detect a remote access trojan using passive DNS (pDNS) and cyber threat intel at scale using ML/AI. We’ll review how to use open source technologies such as Delta and Spark to store and analyze TBs of passive DNS data. Additionally, we'll review ML to develop a model to detect domain generating algorithms (DGAs) and manage the ML lifecycle, from experiment tracking to training to production, using the open source project MLflow.

technical paper

In this tutorial, we will use Python programming language to create an autoencoder model to automatically remove noise from signal recordings. Traditional preprocessing techniques to remove noise requires the analyst to feature engineer the unwanted patterns , which can be cost and time intensive. The goal of this exercise is to take an autoencoder, used for data compression, generation, and extraction to remove the unwanted artifacts from our signal. This tutorial highlights the following concepts used in a vanilla autoencoder design: * Structuring the input data representation of noisy signal; *Autoencoder architecture design; * Model training, evaluation, and visualization;

Denoising Signal with Autoencoder

In order for the next-generation of “smart” systems to deliver orders of magnitude improvement in energy-efficiency, they require a complete reimagining. Together with emerging machine learning algorithms, such intelligent systems can find wide applicability in areas like continuous spectrum monitoring and object targeting and tracking. We will discuss circuits and architectures that can become the foundation for a family of high-dynamic range mixed-signal parallel processors with applications to sensory data conditioning, RADAR, and smart receivers in cognitive communication networks. We will then discuss the advantages and challenges of using emerging devices within mixed-signal computing arrays. Finally, we will take a look at emerging methods of computation that use energy minimization to optimize. These architectures can form the basis of a unified platform that uses oscillators to both sense and compute using the same primitives to simultaneously do both.

Neuromorphic Computing, Sensing, and Communication in the Post Moore Era

Reinforcement learning is a powerful technique that can be used to learn incredibly complex behaviors, from self driving cars, airplanes, robots and other autonomous machines of varying complexity. It can also be used to solve challenging logistics and time series problems that can often be intractable in any other framework. It has a very flexible theoretical framework that can be applied to various environments, and many open source frameworks are now of sufficient maturity and robustness to make the technology readily accessible. We will discuss applications using frameworks such as TensorFlow, PyTorch, and OpenAI, along with the parallel framework Ray, which allows for large scale models to be run on HPC resources. Join us for a fascinating discussion of some of the most exciting AI technology being studied!

Reinforcement Learning: Frameworks and Applications

In our work, we apply subgraph matching methods for the purpose of adversarial activity detection in large transaction graphs. By modeling adversarial activity as a threat template in graph format, we seek matching subgraphs in the world graph which may be indicative of other potential threat instances. We show results on several synthetic transaction graphs created for the DARPA-MAA program.

Subgraph Isomorphisms for Security Applications

The deep extension of the restricted Boltzmann machine (RBM), known as the deep Boltzmann machine (DBM), is an expressive family of machine learning models which can serve as compact representations of complex probability distributions. 
However, jointly training DBMs in the unsupervised setting has proven to be a formidable task. A recent technique we have proposed, called mode-assisted training, has shown great success in improving the unsupervised training of RBMs. Here, we show that the performance gains of the mode-assisted training are even more dramatic for DBMs. In fact, DBMs jointly trained with the mode-assisted algorithm can represent the same data set with orders of magnitude lower number of total parameters compared to state-of-the-art training procedures and even with respect to RBMs, provided a fan-in network topology is also introduced. This substantial saving in number of parameters makes this training method very appealing also for hardware implementations.

Mode-Assisted Joint Training of Deep Boltzmann Machines

The machine “awareness” of individual entities in massive swarms is a challenge for most conventional approaches, as is the fundamental control of all entities to form these swarms. Such issues can be addressed through alternate mathematical approaches that use self-organizing topologies. One such topological approach
has been used by one author to model 20,000 entities and has shown effective control and awareness for individuals with both limited processing power and bandwidth. The control and awareness result from using an approach to information frequently used in nature - stigmergy, i.e., sparse data which is information-dense, that includes lightweight communications between all nodes allowing
them to self-organize into a MANET. In an earlier paper, one of the authors used a topological structure based upon deterministic chaos, specifically an adaptive fractal. By constraining the entities to “believe” that they exist only within the boundaries of an adaptive fractal forces their topological layout to map to topological clusters. The
invariant yet transformable features allow each node to compute the IFS (Iterative Function System) to effectively “know” the relative positions of all the other entities, and form adaptive, self-healing swarm clusters. In this paper, an in-depth mathematical description of this algorithmic topology is given, which computationally is of O(n).

The Mathematics Behind Massive Swarm Self-Awareness

Acoustic source localization is a long-standing and generically challenging problem in structural acoustics (Worden et al., 2001). Localizability depends on the frequency content of the driving force and the uncertainty in the position of the source, among other factors. Naval applications, such as predictive maintenance for dozens of machines attached to a single hull, require a limited number of sensors to detect a large variety of signals. 


Smart, sparse sensor placement on a 2D plate performs better than random placements, and is fast and automatic


Active learning in semi-supervised classification seeks to select points from the pool of unlabeled data to label that will in turn help to improve the underlying classifier's accuracy. Such potential for classifier improvement is quantified in a real-valued {\it acquisition function}. We present a ``model-change'' acquisition function for batch active learning in graph-based semi-supervised learning (SSL) for multiclass classification.

Multiclass Active Learning for Graph-Based Semi-Supervised Learning

Running machine learning analytics over geographically distributed datasets is a rapidly arising problem in the world of data management policies ensuring privacy and data security. Visualizing high dimensional data using tools such as t-distributed Stochastic Neighbor Embedding (tSNE) and Uniform Manifold Approximation and Projection (UMAP) became common practice for data scientists. Both tools scale poorly in time and memory.
While recent optimizations showed successful handling of 10,000 data points, scaling beyond million points is still challenging. We introduce a novel framework: Sketch and Scale (SnS). 
It leverages a Count Sketch data structure to compress the data on the edge nodes, aggregates the reduced size sketches on the master node, and runs vanilla tSNE or UMAP on the summary, representing the densest areas, extracted from the aggregated sketch. 


TSNE & UMAP: Sketch & Scale

The headline successes of reinforcement learning on video games like StarCraft and DOTA 2 beg questions about the future role of the technology in the Department of Defense. Military simulations seemingly have much in common with video games, and the lack of a strong human behavior model is arguably a limiting factor for their use in the current environment. Training exercises require that opposing forces and adjoining allied forces act intelligently, and human pucksters with appropriate backgrounds and the funding to pay for them is not always forthcoming. The scope of analytical simulations must currently be limited due to the lack of current behavior models that react flexibly and appropriately over a wide range of circumstances. And more aggressive use cases for simulation in operational decision support might become practical with better AI to serve as a sparring partner. It is this last use case that we focus on here.

AI can potentially provide operational decision support by being a competent opponent of the human planner in simulation. The human planner would control his own forces according to his proposed plan, and the AI would do its best to defeat the plan. The planner could then choose to alter the plan and fight the AI again until he is satisfied. But is it actually practical to develop strong players using reinforcement learning?

Previously, it has been shown that reinforcement learning is capable of learning optimal attacking behavior in simple ground combat scenarios [Boron, J and Darken, C. "Developing Combat Behavior through Reinforcement Learning in Wargames and Simulations", IEEE Conference on Games (CoG) 2020]. The primary examples studied were quite small (e.g. three units attacking two on a featureless plain, with all units being the same type, defenders stationary), but the Proximal Policy Optimization algorithm was able to learn provably optimal attacking behavior, and even find qualitatively different optimal solutions for the cases of an urgent attack (highly discounted rewards) and a more cautious one (less discounting). Still, this scenario is far short of the complexity that would be required for operational use.

In the proposed presentation, we will describe our ongoing and planned efforts to investigate the ability of reinforcement learning to learn strong attacking behavior in more complex scenarios, i.e. with more units of multiple types maneuvering through heterogeneous terrain, and with an actively maneuvering opponent. Our new training simulation for the AI, while still relatively simple, supports four different unit types and five different types of terrain. Maps are hexagonal grids of any size and the number of units per side is arbitrary. The simulation supports an AI Gym standard interface and is typically trained using the Stable Baselines 3 suite of PyTorch-based reinforcement learning algorithms.

The new training simulation represents the input features of the neural network in an image like manner, permitting the use of convolutional neural networks (CNNs). The spatially invariant nature of CNN kernels allows trained policies to learn optimal attacking behaviors against a retreating adversarial force, regardless of where the units are initially placed in the simulation. This feature promotes a more dynamically trained agent and increases the likelihood of achieving optimal behaviors in highly complex scenarios.

Premium content

DNS analytics and DGA detection with Apache Spark, Delta Lake and MLflow

Downloads

Next from NAML 2021

Denoising Signal with Autoencoder

Similar lecture

Feature Evaluation of Anomaly Detection Models for Cyber Data