Cyber Threat Enrichment

Overview

Development stage

DeployedSource: c) Deployed – The use case is being actively authorized or utilized to support the functions or mission of an agency.

High-impact designation

Not high-impactSource: c) Not high-impact

Impact justification

Not available.

Start date

Not reported

Withheld from public reporting

NoSource: a) No

Mission

Topic area

Other

Operational functions

Translation and transcription, Cyber threat detection Derived by keyword rules; see methodology

Problem the AI is intended to solve

Cyber threat analysis

Expected benefits

Enrich emerging cyber threat data with recent and past analysis data curated from the DOE-CESER Geo Threat Observable project and grid modernization project Deep Learning Malware using TBs of well structured cyber threat. Input vulnreability, weakness, malware inforamtion to find connections to well analyzed cyber threat including attack patterns, known exploited, spast mitigations and detections. When firmware binaries are analyzed and translated to structured threat used to create codified attack surfaces and Firmware or Software Bill of Materials (SBOM) for supply chain tracking

System outputs

Structured Threat Information Expression (STIX) data format providing actionable and implementable codified contextual data for use in cyber security products or if firmware binaries analyzed and translated to STIX output is codified attack surfaces and SBOM.

Technology

AI classification

Other

System name(s)

Not reported

Custom-developed code

Yes

Public source code

Not available.

Sourcing

How it was built

Developed in-houseSource: b) Developed in-house

Vendor (as reported)

Not reported

Vendors (standardized)

None on the standard list

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII

No

Privacy Impact Assessment

Not reported

Authorization to Operate

No

Demographic features

Not reported

Training and evaluation data

Open source threat intelligence collected, NLP used to scrape information off of cyber incident reports and websites, some data from cyber sensors, threat feeds and some data from manual threat analysis activities.

Federal Data Catalog

Not available.

Governance

0 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Potential impacts and how they were identified

Not reported