United States

Tracking user activity requires generating precise logs of each interaction a user has with a machine including initiating background processes, recorded events from an input device, or recording within a graphical user interface. Some activity logging tools offer a compact storage format and tabulated data structure, but the information within these logs can still be complex. Oftentimes logs generated by interactions with graphical user interfaces are organized hierarchically within the tabulated columns. To improve the accessibility and comprehension of information within these datasets, a standard approach to parsing is introduced that translates the raw format into uniformly structured nested JSON objects. This approach involves sanitizing the data and then recursively applying a structure translation to each level within the hierarchy until every tier has been successfully converted.

We explore collecting user activity data to infer cybersecurity workflows and demonstrate domain knowledge can be elicited from subject matter experts’ (SME) user activity to train an autonomous assistant capable of providing decision support relating to the workflow. To provide additional context when training this model, a programmatic technique for generating natural language summaries of the parsed datasets is also proposed. The implementation offers a context-rich overview of the logged user activity by combining the previously generated, easily accessible JSON objects with predefined templates. Efforts were also made to support quality management of the generated summaries. A filter was developed for extracting the most relevant records or omitting irrelevant ones from parsed datasets before summarizing them. Cleaning was also introduced for aggregating similar records into one or omitting duplicates. Lastly, a concatenation functionality allows for record grouping so that summaries can be generated in varying user defined lengths.

This context-rich user activity data was used to generate an interactive timeline to showcase a SME’s workflow and allow them to label its components. To support end users in understanding the distribution of labeled workflow components, supplementary visualizations, such as bar graphs and heat maps, were also generated for visualizing the frequency of these components. Two different density metrics were used to define the frequency: a count of how often a particular label, or workflow component, was mentioned within all labels or a count of the number of records a label encompasses within its corresponding dataset.

To conclude, tracking human-computer interactions results in complex datasets that can be utilized to support classification of SME workflows. Such workflows offer potential for automated decision assistance by simplifying the creation of user activity summaries, quality management methods, and a variety of visualizations. In the future, efforts would be aimed at providing more detail within the generated summaries and improving functionality of the user interface for the interactive timeline.

NAML 2025

Informing Cybersecurity Decision-Making: Parsing, Summarizing, and Visualizing User Activity Data

cybersecurity

visualization

natural language processing

poster

### Welcome to the 9th annual workshop on Naval Applications of Machine Learning!

NAML is the premier annual event showcasing current machine learning research relevant to Naval applications. We welcome participation from the defense community, industry, and academia. The NAML workshop is an opportunity for researchers from Navy research and development centers and our partner organizations to exchange technical ideas and to come together as a team. 
 Naval Information Warfare Center Pacific is partnering with AFCEA San Diego chapter to host the workshop.

The goals of NAML are:

* To spread awareness of current machine learning research relevant to Naval applications
* To connect machine learning researchers with experts in military requirements
* To build and strengthen collaborations within the defense research community

#### *"What we do as a Navy is a human business. Don’t pass up an opportunity to come together as a team. Don’t pass up leadership opportunities, and don’t outsource them to a PowerPoint. If you have an opportunity to come together as a team, to increase belonging, do it."*
Admiral John M. Richardson, 31st Chief of Naval Operations

Please log in to explore this event.You need to log in with the email address you registered with. Access credentials have been sent to your email. 

Please be sure to check your spam and other email folders if you do not see an email confirmation right away.

Please log in to explore this event.

**Get Your Tickets for NAML 2025 - Complimentary to students, government, and military**

Dive into the world of machine learning research relevant to Naval applications.

Now you can have access to all the lectures & posters and even engage with the speakers (send them emails, ask questions) on the Underline platform. 

We are offering a one-time only discounted on-demand access to this NAML 2025 content **for only $99** (complimentary to students, government, and military). 
 
**To register, please click** [**here**](https://naml25ondemand.paperform.co/)

Please register!

The 9th annual workshop on Naval Applications of Machine Learning is an opportunity for researchers from Navy research and development centers and our partner organizations to exchange technical ideas and to come together as a team. The goals of NAML are to spread awareness of current machine learning research relevant to Naval applications, to connect machine learning researchers with experts in military requirements and to build and strengthen collaborations within the defense research community.

INFAMI is an intelligence generation framework that automates certain processes to help analysts and operators prioritize relevant targets and improve decision-making timelines. 
* ATR Management: Managing & deploying a library of ATRs and analytics
* Fusing/correlating tracks from multiple INT sources including GEOINT, SIGINT, and AIS/ADS-B/Thresher
* Facilitating tasking air and space assets and sensors via M2M interfaces; automated cross-cue and target custody
* Prioritizing targets to defeat adversary CCD
* Leveraging existing, mature interfaces and messaging systems (including OMS/UCI) 
* Rapidly integrating new ATRs, analytics, and existing capabilities into the framework

INFAMI: Accelerating TCPED on the Edge

Understanding how Large Language Models (LLMs) store and retrieve knowledge is key to improving their transparency and reliability. This work explores four interpretability techniques: Attention Visualization, Probing Classifiers, Activation Patching, and Causal Tracing. These methods reveal how LLMs track dependencies, encode linguistic and factual knowledge, and store information across layers. The findings show that knowledge is distributed but can be localized, though key questions remain about how it is structured and disentangled. This research provides insights into model explainability and highlights areas for future study.

Interpretability of Large Language Models: Frameworks and Experimental Insights

Active sonar systems, composed of transmit and receive sonobuoys or other platforms, have been developed to provide effective anti-submarine warfare (ASW) performance against small, quiet, red-force submarines in the harsh clutter-saturated littoral and the deeper open ocean. The studies of sonar field performance are largely based on "acoustic" performance predictions via sonar equation modeling, when in fact, there are also "tactical" considerations which, though ignored, are sure to have significant impact on blue-and red-force mission effectiveness. Tactical behaviors for sonar operations need to be learned, understood and incorporated into sonar field performance studies. To address this need, this research develops a reinforcement learning (RL) algorithm to represent AI red-force submarine evasive behavior. The RL algorithm aims to determine a red-force submarine trajectory towards its goal while minimizing the detection vulnerability of the submarine in a monostatic sonar field in a CZ environment. While this research applies a modern reinforcement learning technique to model the submarine evasive behavior in a specific scenario, more complex and diverse scenarios need to be studied to fully understand the capabilities and limitations of the approach. Different assumptions on blue-force sensors being localizable by the red-force submarine will be tested in the performance evaluation.

RL Based Red-Force Submarine Trajectory Optimization in a Monostatic Sonar Field 

The pursuit to generate visually pleasing images that are good representatives of a given category has been one of the driving forces of developments in generative vision models. One such model that is based on Generative Adversarial Networks (GAN) is called the Auxiliary Classifier Generative Adversarial Networks (AC-GAN). AC-GAN uses an auxiliary classifier to enable sampling from a class conditional distribution and is known to generate high-quality aesthetically pleasing synthetic data. Due to its simplicity, it is one of the popular GAN architectures for generating data. However, it has been shown that AC-GANs tend to learn data distributions that are biased away from the decision boundary of the auxiliary classifier. This bias away from the decision boundary is the unwanted by-product of a loss term in the AC-GAN formulation that favors high image quality and visual class coherence. That is, the AC-GAN generator is rewarded for generating samples that are towards the center of the decision region and discouraged from sampling near the class boundaries defined by the auxiliary classifier. In this work, we propose using a boundary aware loss in conjunction with the AC-GAN losses to mitigate the bias. We show that the introduction of the boundary-aware loss into AC-GAN formulation provides better sampling coverage within the underlying data distribution, increasing data diversity and reducing bias

A Boundary Aware Loss for Mitigating the Boundary Bias in AC-GAN

Memory vulnerabilities allow adversaries to access memory and manipulate software to perform unintended actions. Memory vulnerabilities are commonly found in Memory Unsafe Languages(MULs), e.g. C and C++, which have been used to develop a wide range of software from personal use to critical systems. The Office of the National Cyber Director(ONCD) recommended developing future software with Memory Safe Languages (MSLs) to eliminate memory vulnerabilities introduced by MULs. Unfortunately, this does not address pre-existing software. One solution for pre-existing MUL based code is translating it from a MUL to MSL. However, this requires developers to have a strong understanding of both the MUL and MSL, as well as a considerable of time that is put into the translation and the follow up regression testing. 

Large Language Model (LLM) based Artificial Intelligence(AI) are now being used to support software development and can translate software written in a one language to another. LLM based translation could help reduce resource cost when translating MUL into am MSL to reduce memory-based software vulnerabilities. Although a review of the LLM translated code could mitigate these vulnerabilities, numerous peer reviewed articles have documented significant errors in AI translated code. The ACTA project will assess the efficacy of LLMs’ ability to translate software into MSL and, determine if they introduce other vulnerabilities during the process. The output of ACTA will be a report assessing the frequency and type of vulnerabilities produced for various LLMs which can be used to determine if LLMs can be used to assist in code translation. 


AI Code Translation Assessment (ACTA)

Title: "The Value of Multilingual Semantic Search for the U.S. Navy: Enhancing International Cooperation and Strategic Insights"

Abstract: The U.S. Navy's ability to operate in an increasingly globalized and interconnected world is dependent on its capacity to process and interpret vast amounts of multilingual information. Introducing multilingual semantic search technology significantly enhances the Navy's intelligence, surveillance, and reconnaissance capabilities. Oracle will present how Multilingual semantic search empowers sailors to conduct comprehensive searches across a multitude of foreign languages without having to declare what languages to search across, opening new avenues for international cooperation and strategic insights.

In today's complex geopolitical landscape, the U.S. Navy frequently engages in exercises and operations alongside partner Navies, emphasizing the need for seamless communication and information exchange. With multilingual semantic search, naval personnel can overcome language barriers and efficiently collaborate with allies. This capability enables the Navy to consolidate disparate pieces of information, identifying overarching trends and patterns hidden within vast datasets. 

Traditional workflows that rely entirely on machine translation often incorrectly translate documents and are cost prohibitive due to the scale of foreign language documentation. Multilingual semantic search can assist in identify trends through foreign language documentation that may otherwise be missed through traditional searches on machine translated text. 

By enabling sailors to query documentation in multiple languages, the multilingual semantic search helps uncovers hidden connections and facilitates a more comprehensive understanding of the situation at hand. The applications extend beyond international cooperation. Multilingual semantic search can aid in monitoring and analyzing global maritime trends, illegal activities, or emerging threats. It allows sailors to delve into foreign language sources, including local media, online forums, and international reports, potentially uncovering critical intelligence insights. By harnessing the power of semantic search, the Navy becomes better equipped to anticipate and respond to diverse scenarios, enhancing its situational awareness and strategic planning.

In summary, the implementation of multilingual semantic search represents a significant leap forward in the U.S. Navy's information management and analysis capabilities. It can support international collaboration, facilitates cultural understanding, and empowers sailors to make well-informed decisions in a multilingual world.

The Value of Multilingual Semantic Search for the U.S. Navy: Enhancing International Cooperation and Strategic Insights

Color correction is integral to the understanding and preservation of important underwater historical sites. The varying depths, as well as the inconsistent and artificial lighting of these sites, pose unique challenges that current state-of-the-art color correction algorithms are not able to successfully correct. These algorithms often overcompensate the red channel during inference, creating inaccurate and unrealistic images. In this paper, we use the depth map created by a monocular depth estimation algorithm to guide adjustments to the red channel of an underwater image prior to performing color correction. We test our methodology on four datasets; two open source, and two collected by Vulcan, LLC. This data was provided to us by the Naval Heritage and History Command (NHHC), as managers of Department of the Navy's sunken military craft, for the purposes of historical, archaeological, and educational research. Using our preprocessed images as the foundation, we are able to create more visually realistic images with true-to-life coloring. Finally, we create 3D reconstructions via Neural Radiance Fields (NeRFs) and Gaussian splats, with and without our preprocessing. We show that the inclusion of our preprocessing step produces more realistic images with fewer artifacts, resulting in a more accurate 3D reconstruction.

Color Correction of Deep Underwater Images Using Depth Maps

Naval tasking and new technologies often require intense cognitive engagement, but it has proven challenging to provide an objective evaluation of how these technological advances affect the warfighter user and thus how they affect decision-optimization. In this work, we address these challenges by using an AI/ML neuro-ergonomic approach that combines state-of-the-art concepts in brain computer interface (BCI) technology with cognitive state detection. We, the NeuroML Research Team of NIWC Pacific’s Intelligent Sensing Branch, build upon research in which we have addressed multiple key challenges contributing to the development of a passive BCI (pBCI), by developing a demonstration of a real-time cognitive workload classifier.

Real Time Cognitive Engagement Classification using CNNs

SeaVision is the U.S. Navy's unclassified data aggregation, data visualization, and sharing tool of tracks for maritime domain awareness (MDA), incorporating AIS, commercial satellite, RADAR, and other feeds into a unified picture. Currently, there is a need for higher-level sensemaking capabilities, including warning and event modules, to identify high-risk vessels and automate understanding of behaviors across an area of responsiblity (AOR). In this poster presentation, we demonstrate the process of identifying a high-risk vessel from a slice of historical data based on data processed from the SeaVision and highlight a hybrid-HPC/cloud development workflow that our team leverages to enable the cost-effective development and deployment of machine learning algorithms applied to these large-scale data. Finally, our team describes how system modeling techniques are leveraged to drive stakeholder engagment throughout the project.

MUSES: Multimodal Sensemaking in SeaVision

We investigate a real-time remote inference system where multiple correlated sources transmit observations over a communication channel to a receiver. The receiver utilizes these observations to infer multiple time-varying targets. Due to limited communication resources, the delivered observations may not be fresh. To quantify data freshness, we employ the Age of Information (AoI) metric. To minimize the inference error, we aim to design a signal-agnostic scheduling policy that leverages AoI without requiring knowledge of the actual target values or the source observations. This scheduling problem is a restless multi-armed bandit (RMAB) problem with a non-separable penalty function. Unlike traditional RMABs, the correlation among sources introduces a unique challenge: the penalty function of each source depends on the AoI of other correlated sources, preventing decomposition of the problem into multiple independent Markov Decision Processes (MDPs), a key step in applying traditional RMAB solutions. To address this, we propose a novel approach by approximating the penalty function of each source and establish an analytical bound on the approximation error. We then develop scheduling policies for two scenarios: (i) full knowledge of the penalty functions and signal distributions and (ii) no knowledge of the penalty functions and signal distributions. For the case of known penalty functions, we present a near-asymptotically optimal gain index-based policy. For the case of unknown penalty functions and signal distributions, we develop an online learning approach that utilizes feedback of the inference loss to learn an online Maximum Gain First (MGF) policy. Simulation results demonstrate the effectiveness of our proposed policies in minimizing inference error and achieving scalability in the number of sources.

Premium content

Informing Cybersecurity Decision-Making: Parsing, Summarizing, and Visualizing User Activity Data

Next from NAML 2025

INFAMI: Accelerating TCPED on the Edge

Stay up to date with the latest Underline news!

PRESENTATIONS

CONFERENCES

COMPANY

RESOURCES