Critical Infrastructure Network Anomaly Detection

Overview

Development stage

DeployedSource: c) Deployed – The use case is being actively authorized or utilized to support the functions or mission of an agency.

High-impact designation

Not high-impactSource: c) Not high-impact

Impact justification

Not reported

Start date

2022-01-10 (day precision)Source: 2022-01-10T00:00:00

Withheld from public reporting

Not reported

Mission

Topic area

Cybersecurity

Operational functions

Cyber threat detection, Forecasting and prediction, Risk scoring and triage Derived by keyword rules; see methodology

Problem the AI is intended to solve

CyberSentry currently ingests hundreds of terabytes of data from Critical Infrastructure Partners every single day. At petabyte-scale over all collected network data, CyberSentry required a way to filter through the noise to be able to detect Advanced Persistent Threat (APT) and Nation State malicious activity happening within our Partners' networks. CyberSentry has developed numerous machine learning-based detections to identify trends, patterns, and anomalies in network data that ultimately result in both automated and manual triage by analysts.

Expected benefits

This use case delivers improved internal government tools for hunting and detection of malicious threat actors on critical infrastructure networks. It automates manual data fusion and correlation processes and highlights potential anomalies, allowing CISA analysts to focus more time on hunting adversaries.

System outputs

An interface is provided for analysts to query cybersecurity data, and dashboards are provided with potential cybersecurity alerts, including anomalies detected through predictive models and rule-based heuristics.

Technology

AI classification

Classical / predictive MLSource: Classical/Predictive Machine Learning: Models trained on data to make predictions or classifications based on identified patterns or relatio…

System name(s)

CISA Technical Engagement Network

Custom-developed code

Yes

Public source code

Not reported

Sourcing

How it was built

Developed in-houseSource: b) Developed in-house

Vendor (as reported)

Not reported

Vendors (standardized)

None on the standard list

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII

No

Privacy Impact Assessment

www.dhs.gov ↗

Authorization to Operate

Yes

Demographic features

Not reported

Training and evaluation data

Cybersecurity cloud, network and host logs; Cybersecurity threat intelligence (CTI)

Federal Data Catalog

Not reported

Governance

0 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Potential impacts and how they were identified

Not reported