Elastic Machine Learning Threat Detection (Phase 1)

Overview

Development stage

DeployedSource: c) Deployed – The use case is being actively authorized or utilized to support the functions or mission of an agency.

High-impact designation

Not reported

Impact justification

Not reported

Start date

Not reported

Withheld from public reporting

Not reported

Mission

Topic area

Cybersecurity

Operational functions

Cyber threat detection, Forecasting and prediction Derived by keyword rules; see methodology

Problem the AI is intended to solve

The AI is intended to solve the problem of identifying and detecting threats within system logs. By utilizing Elastic Machine Learning and Amazon SageMaker, the system performs time series analysis on log data to proactively identify potential security breaches or anomalies that might otherwise go unnoticed. This continuous analysis aims to enhance the overall security posture of GSA IT.

Expected benefits

Not reported

System outputs

Not reported

Technology

AI classification

Classical / predictive MLSource: Classical/Predictive Machine Learning: Models trained on data to make predictions or classifications based on identified patterns or relatio…

System name(s)

Not reported

Custom-developed code

Not reported

Public source code

Not reported

Sourcing

How it was built

Not reported

Vendor (as reported)

Not reported

Vendors (standardized)

None on the standard list

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII

Not reported

Privacy Impact Assessment

Not reported

Authorization to Operate

Not reported

Demographic features

Not reported

Training and evaluation data

Not reported

Federal Data Catalog

Not reported

Governance

0 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Potential impacts and how they were identified

Not reported