Cybersecurity Threat Management, Detection, and Response

Overview

Development stage

DeployedSource: c) Deployed – The use case is being actively authorized or utilized to support the functions or mission of an agency.

High-impact designation

Not high-impactSource: c) Not high-impact

Impact justification

Not reported

Start date

2021-03-16 (day precision)Source: 2021-03-16T00:00:00

Withheld from public reporting

Not reported

Mission

Topic area

Administrative Functions

Operational functions

Summarization, Cyber threat detection Derived by keyword rules; see methodology

Problem the AI is intended to solve

This use case intends to solve the problem of detecting and responding to cybersecurity threats in a timely manner.

Expected benefits

These AI capabilities provide security analysts with modern tools to identify and respond to threats much more quickly than previously possible, minimizing potential damage to systems and data.

System outputs

CD&I uses several AI-enabled cybersecurity tools to analyze this data. Machine learning (ML) models, such as classification and regression models, are used to analyze historical data and detect emerging threats through pattern recognition. Other ML capabilities include continuous monitoring of ICE cybersecurity data and the algorithmic identification of real-time cyber threats. This includes recognizing phishing patterns, malware signatures, or abnormal network traffic patterns across a variety of tools. Additionally, CD&I is in the process of integrating its open-source intelligence cybersecurity threat analysis platform with an LLM. This integration will allow platform users to summarize open-source intelligence on cybersecurity threats and more easily research and respond to potential cybersecurity events.

Technology

AI classification

Classical / predictive MLSource: Classical/Predictive Machine Learning: Models trained on data to make predictions or classifications based on identified patterns or relatio…

System name(s)

Xploitation Platform Leveraging Offensive Information Technology, Phishing Defense Solution, Audit Log Management Solution (ALMS), Endpoint Detection and Response, EMVEC

Custom-developed code

No

Public source code

Not reported

Sourcing

How it was built

Purchased from vendorSource: a) Purchased from a vendor

Vendor (as reported)

Illumio; AttackIQ; Cofense; Splunk; Crowdstrike; Polarity

Vendors (standardized)

SSplunkCCrowdStrike

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII

Yes

Privacy Impact Assessment

Not reported

Authorization to Operate

Yes

Demographic features

Not reported

Training and evaluation data

The cybersecurity solutions use commercially available large language models that have been trained on the public domain by their providers. There was no additional training using agency data on top of what is available in the models’ base set of capabilities. During operation, the AI models interact with ICE production data from multiple sources, including data from Microsoft Defender for Office (Polarity) and suspected malicious reported emails from ICE personnel (Triage).

Federal Data Catalog

Not reported

Governance

0 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Potential impacts and how they were identified

Not reported