United States

NAML 2021

Detecting Cyber Invasions with DNS Analytics &amp; DGA Detection Leveraging Machine Learning

Naval Information Warfare Center Pacific is partnering with AFCEA San Diego chapter to host the workshop.

The NAML workshop is an opportunity for researchers from Navy research and development centers and our partner organizations to exchange technical ideas and to come together as a team.

The goals of NAML are:

* To spread awareness of current machine learning research relevant to Naval applications

* To connect machine learning researchers with experts in military requirements

* To build and strengthen collaborations within the defense research community

**Watch this video to hear about the AFCEA purpose.**

<iframe width=1280 height=706 frameborder="0" scrolling="no" src="https://screencast-o-matic.com/player/creleVVcvRh?v=6&ff=1&title=0&controls=1" allowfullscreen="true"></iframe>

Detecting Cyber Invasions with DNS Analytics & DGA Detection Leveraging Machine Learning

tutorial

This work describes the problems that can occur when Autonomous Systems have not been designed with security in mind. Examples are given of vulnerabilities found in Autonomous Systems - the risks that these systems face, both from malicious and naive users are described. Baseline security measures and advice are given for designing, and using Autonomous Systems in a way which minimises the risk of a vulnerability being exploited. This security advice does not cover “artificial Intelligence” attacks (such as adversarial inputs, or data poisoning), these attacks form another research topic entirely. Instead, we focus on basic software hygiene, as relevant to Autonomous Systems. Since these systems are typically network connected, this falls into the area of Cyber security hygiene, following best practice to enhance security. Cases of incorrect configurations, poor security choices and risky assumptions are all demonstrated. 
© Crown copyright (2021), Dstl.

How good Cyber Hygiene can help defend Autonomous Systems

Traditional machine learning pipelines require data to be centralized. For data that are collected and stored on multiple edge devices, or for data owned by multiple institutions that must not share their sensitive information, the traditional pipeline becomes impractical due to bandwidth bottlenecks and privacy concerns. Federated learning is a machine learning specialization that addresses these issues and allows for accurate, timely decision making on data that are not centrally available. Rather than aggregating distributed data into one centralized dataset, federated learning assumes that the data remain at the edge. By doing so, federated learning reduces the bandwidth strain over communication lines, allows institutions to share knowledge without giving up their data, and leverages distributed edge computing. In our current studies, we seek to develop a federated algorithm that converges quickly to an accurate model, that is practical for implementation on edge devices with limited processing capabilities, and that is bandwidth efficient. More specifically, we focus on federated optimization with one central server and many clients, and introduce our algorithm called Federated Kronecker-factored quasi-Newton. We are using Kronecker-factorization to make loss-curvature information available cheaply at the edge for federated training in this second-order optimization procedure, which to our knowledge, has not yet been done. We highlight the benefits and challenges of second order optimization in the federated setting and demonstrate preliminary performance curves that show improved model accuracy on smaller amounts of information exchanged and in less training time than some state-of-the-art algorithms. We also show that even though our algorithm is a second-order optimization technique, it is still practical to implement.

Second-Order Federated Optimization

We present federated reconnaissance, a new class of learning problems in which distributed clients learn new concepts independently and must be able to communicate that knowledge efficiently. In particular, we propose an evaluation framework and methodological baseline for a system in which each client is expected to learn a growing set of classes and communicate knowledge of those classes efficiently with other clients, such that, after knowledge merging, the clients should be able to accurately discriminate between classes in the superset of classes observed by the set of clients. We compare a range of learning algorithms for this problem and find that prototypical networks are a strong approach in that they are robust to catastrophic forgetting while incorporating new information efficiently. Furthermore, we show that the online averaging of prototype vectors is effective for client model merging and requires only a small amount of communication overhead, memory, and update time per class with no gradient-based learning or hyperparameter tuning. Additionally, to put our results in context, we find that a simple, prototypical network with four convolutional layers significantly outperforms complex, state of the art continual learning algorithms, increasing the accuracy by over 22% (absolute) after learning 600 Omniglot classes and over 33% (absolute) after learning 20 mini-ImageNet classes incrementally. These results have important implications for federated reconnaissance and continual learning more generally by demonstrating that communicating feature vectors is an efficient, robust, and effective means for distributed, continual learning.

Federated Reconnaissance: A New Framework for Distributed Continual Learning

Neural networks have shown to be extremely effective tools for machine learning in broad contexts, including natural language processing, image processing, and adversarial game playing such as Chess and Go. Despite their success in a wide variety of contexts, the design of a neural network (which is inescapably tied to its performance) is often a matter of iterated re-engineering to find an architecture that performs the best on a small set of predetermined metrics. As such, this leaves the parsimony of such systems vague at best.

Over the past few years it has become apparent that the mathematics of topology can be used to understand some theoretical fundamentals of neural networks. Roughly speaking, topology is the field of math that studies spaces that are considered to be ``the same'' up to a continuous stretching (i.e., homeomorphism). For that reason it is known as ``rubber sheet geometry.'' The main reason that topology has provided tools to study neural networks is that a deep neural network can be thought of as an iterated sequence of continuous transformations between spaces.

In this work we develop an algorithm for automatically generating a trainable deep neural network with information obtained from the geometric and topological properties of training data. Our approach first finds a dense ellipsoidal covering of the training data set that is consistent with the classification information. We then find an (approximately) minimum sub-cover that models the classification information. A neural network is constructed that approximates the structure of the minimum sub-cover and which encodes logical statements representative of the data geometry. We show empirically that after training, the neural network retains the imprinted geometric information, making each module in the neural network geometrically interpretable. Theoretical and experimental results provide information on this approach across a variety of data sets. In addition to this we show how the proposed approach, when combined with methods from topological data analysis (specifically homology), can be used to quantify the likelihood that any neural network classifier will perform well on a given binary classifier data set before neural network engineering takes place. All results are illustrated using multiple data sets.

Topological Data Analysis Methods for Data Set Characterization to Augment Machine Learning Methods

AFCEA Communities of Interest

"Each year at the Naval Postgraduate School (NPS), more than 1,600 active duty servicemembers attend a wide variety of resident and distance learning (DL) graduate and doctoral programs.  This student body represents some the most innovative and passionate minds currently serving the Department of Defense (DoD). Nearly all of these students must complete a capstone project or thesis as a requirement for graduation. However, typically only a small portion of the student body has insight into their services’ current capability development challenges or pressing research needs. While the student body struggles to find relative work that furthers the military’s research priorities, senior leaders across the DoD have no way of discovering the depth, breadth, and diversity of knowledge, experience, and skills represented by the officers attending graduate education nor seeing the research or innovation occurring at NPS and other military academic institutions like it.  To address this challenge, we are proposing a cloud-based, collaborative research platform that enables the discovery of completed, on-going, and future research opportunities for researchers, research sponsors, and leaders to connect, collaborate, and deliver timely, prioritized information to DoD leadership in order to support informed decision-making.  

The Vision: 
This platform, that we call Athena, is being built to leverage artificial intelligence techniques and machine learning to maximize both user experience and taxonomy development. The functional test version that our team has built includes: 
Primary Features:   
- Discover research databases that contain completed, on-going, and future/potential research topics 
- Connect users and organize Communities of Interest (COI) via an “idea marketplace”  
- Collaborate across the DoD and with Industry Partners on research and technologies  
- Deliver viable products that informs leadership decision-making and research prioritization"

Athena - The cloud-based Collaborative Research Tool

MIT Lincoln Labs Disaster Response Image Analysis

AWS Data Labs Disaster Response Imagery Training

Unmanned Undersea Systems (UUXs) often operate in communication-limited environments, which require some degree of autonomy in order to operate efficiently and effectively. Current autonomous systems often operate as “black boxes”, which may offer high performance but lack transparency. As such, the use of autonomous systems requires a high degree of trust from the user, which may be difficult to gain. Explainable artificial intelligence (XAI) may offer a way to build user trust in AI systems, by increasing transparency and offering explanations for anomalous behavior. Currently, XAI is used by researchers as an analytic tool to identify poor model performance and improve user interfacing. In this work, we propose that explainability can be transformed into a user-facing tool to foster understanding in both users and developers. We will demonstrate this concept by contextualizing a system’s actions within a restrictive environment, utilizing a simplified scenario with simulated sensor inputs. Success and failure will be defined by creating metrics for the succinctness and relevance of an explanation, including both the salience of provided context and the absence of important information. The
resulting explanations will piece together the environmental conditions, mission, behaviors, and operational status in order to deliver an intuitive explanation of the decisions of an autonomous system.

Exploring Trust and Explainability of Autonomous Systems in an Operational Environment

Event cameras utilize novel imaging sensors patterned after visual pathways in the animal brain that are responsive to low contrast, transient events. The pixels of Dynamic Vision Sensors react independently and asynchronously to changes in brightness, creating a stream of time-stamped events encoding the pixel location and sign of the brightness change.  Furthermore, they have extremely high dynamic range, low latency, and lower power requirements, making them ideal for persistent surveillance in varying light conditions on platforms where size, weight, and power (SWaP) are at a premium.  

Their output is fundamentally different from traditional frame-based cameras, where each pixel is sampled at the same time at a fixed rate.  As such, traditional methods of machine learning for computer vision cannot be directly applied.  We have been developing a maritime data set using these cameras for the purpose of automated ship detection, and employing methods based on optical flow for object detection and tracking. In this talk, we describe our data set and initial results.

Event-based Computer Vision for the Maritime Domain

technical paper

panel

https://s3.eu-west-1.amazonaws.com/underline.prod/cache/transcript/31194/subtitle/cd7cfc7e5cacba352c9033c99422fbaa.vtt?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAZP4XRUPAQFEPSF6P%2F20251128%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20251128T194918Z&X-Amz-Expires=900&X-Amz-SignedHeaders=host&X-Amz-Signature=89232dc947735d44351e7decc8177576309cfd9d58ab688e9789759e7ea05258

Downloads

Next from NAML 2021

How good Cyber Hygiene can help defend Autonomous Systems

Similar lecture

Resilient Distributed Adaptive Cyber-Defense Using Blockchain

Stay up to date with the latest Underline news!

PRESENTATIONS

CONFERENCES

COMPANY

RESOURCES

.css-70qvj9{display:-webkit-box;display:-webkit-flex;display:-ms-flexbox;display:flex;-webkit-align-items:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;}Downloads

Next from NAML 2021

How good Cyber Hygiene can help defend Autonomous Systems

Similar lecture

Resilient Distributed Adaptive Cyber-Defense Using Blockchain

Stay up to date with the latest Underline news!

PRESENTATIONS

CONFERENCES

COMPANY

RESOURCES

Downloads