DOE OSTI2018
Cyber Equations, Inc. is reporting on the results of its DOE SBIR Phase I project for the development of a Scalable HPC Insider Threat Monitoring System. This final report to the Department of Energy for Task DE-FOA-0001618 covers the period from 02/21/2017 to 02/20/2018 and summarizes the larger research accomplishments, which can be divided in theoretical and laboratory experiments. One of the many challenges for the U.S. Department of Energy (DOE) is the support of the high-performance computing (HPC) centers while providing quality information services, strategic vision, leadership, technical expertise, and capabilities necessary to enable the DOE to deliver effective, efficient, economical, and secure HPC services. In order to realize a secure DOE laboratory enterprise, DOE facilities operations must counter a wide range of cyber insider threats, from unsophisticated adversaries up to advanced, nation state sponsored actors. The DOE laboratories also presents an enormous insider attack surface of an ever-growing number of computers, networks, and devices all running a myriad of software. In addition, the DOE laboratories are connected to a variety of external organizations which multiplies the possibility of insider threat. During this SBIR project Cyber Equations developed a strategic combination of supervised and unsupervised machine learning techniques to control scale and classify whether entities, such as hosts, actors, or documents, are showing suspicious insider behavior. We conducted experiments using real cyber data to show that changes in observable behavior (e.g., changes in outbound traffic patterns) are indicative of attacks executing (e.g., insiders exfiltrating data, bots calling home, or an attack spreading). The features and methods we use, have been used in the anomaly detection research and development community for a significant amount of time and robust implementations are openly available. K-Means clustering, Decision Trees, and Support Vector Machine based classifiers are readily available through the R language and open source H20 machine learning framework. The Cyber Equations approach is novel in its use of these classifiers combined with Hadoop based parallel processing technology. The five stages of processing used by CyberInsider improve scalability and reduce the high number of false positives normally associated with network anomaly detection. In summary, the Cyber Equations has successfully accomplished all of its Phase I tasks and demonstrated the feasibility of the Insider Threat Monitoring System.
97 MATHEMATICS AND COMPUTING↗