Machine Learning Analysis Applied to Cyber Threat Hunt Data

Overview

Development stage

In development or acquisitionSource: a) Pre-deployment – The use case is in a development or acquisition status.

High-impact designation

Presumed high-impact, determined notSource: b) Presumed high-impact, but determined not high impact

Impact justification

The AI outputs do not produce an action or serve as a principal basis for a decision that has the potential to significantly impact the safety of human-life or well-being, climate or environment, critical infrastructure, or strategic assets or resources. This use case detects anomalies or outliers, and also may be used to classify or categorize certain activity within data that has already been collected during an authorized cyber threat hunt operation within TSA’s networks. The AI outputs are reviewed by a human analyst team to determine if any of the patterns might be associated with unusual activity. The analyst would then continue to investigate further as during normal threat hunt operations.

Start date

Not reported

Withheld from public reporting

Not reported

Mission

Topic area

Cybersecurity

Operational functions

No function tag matched Derived by keyword rules; see methodology

Problem the AI is intended to solve

The Use Case addresses the problem of how to maximally assess available data to identify anomalies and other patterns that may inform the cyber threat hunt process.

Expected benefits

Cyber threat hunts typically involve a vast amount of data. Machine learning models can quickly and efficiently process this data as well as more effectively identify anomalous activity than humans. This could improve the efficiency and quality of cyber threat hunts by detecting suspicious behavior more quickly and increasing the amount of data that can be analyzed during a hunt.

System outputs

Currently it is a list of potential anomalies or outliers within the system, but development is still ongoing.

Technology

AI classification

Classical / predictive MLSource: Classical/Predictive Machine Learning: Models trained on data to make predictions or classifications based on identified patterns or relatio…

System name(s)

Not reported

Custom-developed code

Not reported

Public source code

Not reported

Sourcing

How it was built

Not reported

Vendor (as reported)

Not reported

Vendors (standardized)

None on the standard list

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII

Not reported

Privacy Impact Assessment

Not reported

Authorization to Operate

Not reported

Demographic features

Not reported

Training and evaluation data

Not reported

Federal Data Catalog

Not reported

Governance

0 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Potential impacts and how they were identified

Not reported