United States

Cyber-attacks can escalate quickly, with serious ramifications. Once attackers have gained a foothold, they can exploit assets to move laterally within the network – often before human-led defence teams have had time to respond – gaining control of systems and information. ML/AI provides an opportunity to combat these attacks in a relevant time frame, through autonomous cyber defence.
Within Reinforcement Learning (RL), agents learn efficient strategies to win through their interaction with an environment and other agents. Behaviours do not need to be explicitly programmed – rather they are learned through multiple successes and failures. As such, RL lends itself well to complex problems where multiple courses of action could be appropriate or unknown to human operators.
CyberBattleSim (Microsoft) is an open-source experimentation platform and training environment for RL agents. It provides a high-level abstract simulation of enterprise networks in which Red and Blue team agents compete for control. Its simplicity allows the simulation to be readily modified to model new threats, vulnerabilities and attack patterns.
We report on the use of multi-agent RL to defend network infrastructure against an adversary attack within CyberBattleSim. We ground the abstract simulation in the real world using attack methodologies derived from APT threat groups and the MITRE ATT&amp;CK framework. Red agents are rewarded for exploiting vulnerabilities and gaining control of nodes within the network. Blue agents can disrupt this by hardening or re-imaging nodes and are rewarded for maintaining control and availability of network resources. Blue agent collaboration is explored using centralized and decentralized communication strategies are explored to support effective multi-agent behaviour.

NAML 2022

Autonomous network defence using Reinforcement Learning within CyberBattleSim

cyber security

autonomous

reinforcement learning

Naval Information Warfare Center Pacific is partnering with AFCEA San Diego chapter to host the workshop.

The NAML workshop is an opportunity for researchers from Navy research and development centers and our partner organizations to exchange technical ideas and to come together as a team.

The goals of NAML are:

* To spread awareness of current machine learning research relevant to Naval applications

* To connect machine learning researchers with experts in military requirements

* To build and strengthen collaborations within the defense research community

**Watch this video to hear about the AFCEA purpose.**

<iframe width=1280 height=706 frameborder="0" scrolling="no" src="https://screencast-o-matic.com/player/creleVVcvRh?v=6&ff=1&title=0&controls=1" allowfullscreen="true"></iframe>

NAML 2021

Cyber-attacks can escalate quickly, with serious ramifications. Once attackers have gained a foothold, they can exploit assets to move laterally within the network – often before human-led defence teams have had time to respond – gaining control of systems and information. ML/AI provides an opportunity to combat these attacks in a relevant time frame, through autonomous cyber defence.
Within Reinforcement Learning (RL), agents learn efficient strategies to win through their interaction with an environment and other agents. Behaviours do not need to be explicitly programmed – rather they are learned through multiple successes and failures. As such, RL lends itself well to complex problems where multiple courses of action could be appropriate or unknown to human operators.
CyberBattleSim (Microsoft) is an open-source experimentation platform and training environment for RL agents. It provides a high-level abstract simulation of enterprise networks in which Red and Blue team agents compete for control. Its simplicity allows the simulation to be readily modified to model new threats, vulnerabilities and attack patterns.
We report on the use of multi-agent RL to defend network infrastructure against an adversary attack within CyberBattleSim. We ground the abstract simulation in the real world using attack methodologies derived from APT threat groups and the MITRE ATT&CK framework. Red agents are rewarded for exploiting vulnerabilities and gaining control of nodes within the network. Blue agents can disrupt this by hardening or re-imaging nodes and are rewarded for maintaining control and availability of network resources. Blue agent collaboration is explored using centralized and decentralized communication strategies are explored to support effective multi-agent behaviour.

technical paper

##### For full functionality of Underline, please SHUT OFF your VPN, or use a personal device.


Naval Information Warfare Center Pacific is partnering with AFCEA San Diego chapter to host the workshop.

The NAML workshop is an opportunity for researchers from Navy research and development centers and our partner organizations to exchange technical ideas and to come together as a team.

The goals of NAML are:

To spread awareness of current machine learning research relevant to Naval applications

To connect machine learning researchers with experts in military requirements

To build and strengthen collaborations within the defense research community


<figure class="video_container">
  <iframe src="https://s3.amazonaws.com/pf-user-files-01/u-59356/uploads/2022-03-22/hk13mxo/NAML_ReceptionWithtitle.mp4" width=826  height=526  frameborder="0" allowfullscreen="true"> </iframe>
</figure>

Naval Information Warfare Center Pacific is partnering with AFCEA San Diego chapter to host the workshop. The NAML workshop is an opportunity for researchers from Navy research and development centers and our partner organizations to exchange technical ideas and to come together as a team.

The goals of NAML are:

To spread awareness of current machine learning research relevant to Naval applications

To connect machine learning researchers with experts in military requirements

To build and strengthen collaborations within the defense research community



Problem(s): HM&E maintenance and operations onboard US Navy surface ships continues to be an operator-intensive process, solely reliant on humans to integrate information and make decisions. This has caused repeated return to “maximal manning” despite numerous programs designed to reduce human workload through automation. Currently HM&E systems lack the sensors and infrastructure to support a comprehensive data collection effort that would enable the development of the necessary tools to begin addressing this problem. The MUSV and LUSV programs have renewed and amplified the need for rapid progress in addressing this shortfall, with the ultimate goal of introducing autonomy that can support “sparse supervisory” operation of a USV HM&E plant.

Opportunity: 4 In-service USVs; 3 USVs currently in construction/outfitting. Potential support for additional sensorization/integration to support enhanced data-collection to explore the “possible” in ML applications to predictive maintenance, failure analysis, and operator support.

Predictive Maintenance Utilizing Machine Learning for the Surface Fleet

Coding medical data involves analyzing unstructured text fields, including lengthy clinical narratives, physician and nurse notes, lab reports, discharge summaries, scanned documents, and medications. These clinical data are found in Subjective, Objective, Assessment, and Plan (SOAP) notes. Unstructured text data typically requires extensive resources to annotate, describe, analyze, and convert into meaningful and actionable information. This research project’s long-term objective is to transition translated coded data using machine learning and natural language processing into an automated clinical encounter repository to augment the clinical repositories that have missing or miscoded data. Machine learning model development involved a two-step process. The initial model was obtained using 11,304 records from the Expeditionary Medical Encounter Database (EMED) data and matched to the TMDS data which resulted in an overall accuracy of 73% when estimating 3-digit codes just using the clinical data. An additional step included the true positive cases from the TMDS data and machine learning predictions which significantly improved the accuracy and number of records from 73% to 89% and 11,304 to 44,257 records. The final assessment of the machine learning model and the main objective of this abstract will be to describe the accuracy of the 10,286 records from the TMDS that do not have a valid ICD-9 code. Preliminary results indicate that several thousand records will be automatically coded at the 3-digit level. A random selection of records will be reviewed and described. The limitation of this study is the lack of training data, which limits the prediction of billable ICD-9 codes. However, providing 3-digit ICD-9 codes is still a major finding that will greatly assist medical coders and augment the medical data repositories such as EMED and TMDS. 

Disclaimer: I am a military service member or employee of the U.S. Government. This work was prepared as part of my official duties. Title 17, U.S.C. §105 provides that copyright protection under this title is not available for any work of the U.S. Government. Title 17, U.S.C. §101 defines a U.S. Government work as work prepared by a military service member or employee of the U.S. Government as part of that person’s official duties.
This work was supported by Defense Medical Research and Development Program under work unit no. N1214. The views expressed in this article are those of the authors and do not necessarily reflect the official policy or position of the Department of the Navy, Department of Defense, nor the U.S. Government. 
The study protocol was approved by the Naval Health Research Center Institutional Review Board in compliance with all applicable Federal regulations governing the protection of human subjects. Research data were derived from an approved Naval Health Research Center, Institutional Review Board protocol number NHRC.2003.0025.


Development of the Automated Clinical Encounter Repository: Using natural language processing algorithms to medically code clinical notes in the electronic health record

ARISE - Using Similarity for Recommendations
Scott, Alicia

Data analysts such as Reliability Engineers and Operations Research Analysts
manually group records to identify trends and summarize subsets of their
data. However, when datasets grow beyond human capability to effectively
track and organize, the number of errors and time to analyze data also
increase. To reduce human error and manual work, the Automated
Recommendation Investigator for Systems Engineering (ARISE) was developed to
identify similarity between records within a dataset to assist in providing
possible solutions to maintenance records using Natural Language Processing
(NLP) and machine learning methods. Using specific data preprocessing
techniques for text data as well as other data types separately and cosine
similarity ranking, ARISE is able to find potential solutions from already
created maintenance records with a full perspective of the data and not just
a few or single column sorting.

ARISE - Using Similarity for Recommendations

The Operational Safety Risk Indicator (OSRI) project, led by Commander, Naval Surface Forces (CNSF), seeks to aggregate disparate data sources across the Navy into DoN Jupiter, which is the Navy’s enterprise data environment enclave of Advana, and deploy predictive risk analytics/modeling to identify significant risk factors and enable better decision-making across all echelons of leadership. By leveraging advanced machine learning and artificial intelligence methodologies, coupled with robust data visualization tools, the OSRI project seeks to enhance operational safety and readiness across the Surface Force. 
Although the there is an abundance of relevant enterprise data to serve the OSRI project, the team has tapped into one of the most pertinent and relevant data sources available to date: Tactical Messages. These messages provide a wealth of information across many naval operations, including logistics, operations, personnel, medical, and maintenance. One such form of information within Tactical Messages that directly relates to operational safety risk indicators is destructive behaviors data. Currently this information is manually extracted in multiple ways from an enormous amount of Tactical Message traffic. How this information is extracted also depends on the command or operational function, which creates data management concerns. In addition, Tactical Messages vary widely in format, are largely unstructured, and may contain errors due to manual entry. Not only does the current data aggregation process result in redundancies and potential information loss, but it inhibits the ability to make real-time decisions and analysis, thus potentially impacting the Navy’s operational safety risk posture. As a result, the OSRI team developed a machine learning application that will enable faster processing and more timely delivery of insights drawn from a wealth of unstructured data. This application takes the raw Tactical Message data as input and—using Natural Language Processing techniques—classifies the type of destructive behaviors incident. This classifier provides a predictive capability that not only enables robust analytics in a streamlined fashion, but also helps to identify the factors that contribute to the occurrence of these events. Through timely delivery of this actionable information to leadership, the Navy can make better informed decisions that enact effective counter measures against destructive behaviors. The long-term gain for such a system is enhanced operational safety and improved performance outcomes.

Operational Safety Risk Indicators

The term “insider threat” can take many forms, ranging from an information security risk to the threat of an active shooter. Accordingly, it is beneficial to researchers and practitioners to understand the relationship between psychological factors and the different types of threats an insider may pose to an organization. This research advances this understanding. Specifically, we investigate the three-way relationship between user-generated text, psychological factors espoused in insider threat literature, and risk indicator categories used by the U.S. Government. We employ advancements in machine learning and Natural Language Processing to investigate this relationship. Specifically, we use Bidirectional Encoder Representations from Transformers (BERT) for word embedding and vector space modeling. Our results indicate that there are indeed associations between established risk categories and the psychological factors seen as predictive of malicious insiders. Our exploratory research also reveals that further research is warranted to advance the predictive capability of insider threat modeling.

Predicting the Threat: Investigating Insider Threat Psychological Factors With Advanced Natural Language Processing

The Financial Management Systems (FMS) Financial Management Data & Digital Transformation (FMDDT) Division under the Assistant Secretary of the Navy’s Financial Management and Comptroller’s Office (ASN FM&C) along with Deloitte GPS (Government & Public Services), has developed a data science solution for automating the mapping of financial management systems’ vendor data across several systems, identifying erroneous and missing data, and detecting duplicate information.
FMDDT is working with our partners to establish clear data governance in the ingestion, use, and modeling of data. We are working in close partnership with DON CDO and OSD’s ADVANA to leverage tools, data streams, and the analytics environment while establishing governance policies that foster trust in data through consistency and standardization.
As the Navy moves all financial systems under the Navy Enterprise Resource Planning (ERP) system there will be a need to improve the data quality and mapping as it is integrated from Navy and Marine Corp Standard Accounting, Budgeting, and Reporting System (SABRS) and Standard Financial & Reporting System – Field Level (STARS-FL).
The current Navy ERP vendor master list needed consolidation and mapping across SABRS and STARS-FL to provide insight into budget and financial analytics. As these systems migrate into a single financial system in FY22, an understanding of the historical data and how it maps between systems will be critical to the development of future data analytics and machine learning applications.
While using the System for Award Management (SAM) data as the authoritative data source and vendor naming convention, the Navy ERP, SABRS, and STARS-FL vendor names were matched to the SAM data source. The effort entails matching almost 3 million unique ERP, SABRS, and STARS-FL vendor name records against millions of SAM vendor name records resulting in over 3 trillion unique comparisons.
The effort used the Jupiter Databricks environment which leverages Apache Spark to optimize the vendor matching algorithm using techniques such as Local Similarity Hashing, Cosine Similarity, and Euclidean distance theorem which quickly processed millions of records and assigned a similarity score for each record. This approach clustered vendor names using cosine similarity into smaller groups with lower degrees of accuracy. This ensures a smaller likelihood of missing potential matches. The Euclidian distance of these clustered vendors provides a “smaller” group (< 3.6 trillion) and compares in greater detail by generating more features and using the cosine similarity approach.
This effort established data pipelines to ingest financial data on a regular cadence into a vendor identification and mapping algorithm to correct and detect deficiencies, enforce compliance and governance, and report new findings. FMDDT and our partners are leaning forward to increase the number of customer-focused, innovative, and easy-to-use data visualizations and tools.



Vendor Name Fuzzy Matching using Spark

Synthetic Data Generation & Cloud Based Robotics Simulation & Testing

Modern commercial navigation radars are cheap to purchase, however, with the use of DSP they can have high resolutions and complicated waveforms. This has lead them to proliferate across both civilian and military domains and to the RF band they operate in becoming increasingly congested. To improve situational awareness the ability to distinguish between different individual radars on a pulse-by-pulse basis is desired. This would provide the means to track military targets whilst ignoring civilian ones.
This work has investigated the application of SEI to this radar type, i.e. the ability to distinguish between individual commercial navigation radar. IQ data of a set of 30 radar from three common makes, 10 from each, were collected in an anechoic chamber using a wideband digitiser. Deep learning techniques were applied in order to perform classification. These techniques included the use of residual and inception networks, along with time-frequency transforms as a means of feature engineering. Results varied across the different makes with one make having a high F1 scores and two with considerably lower F1 scores; however, it is possible to distinguish between makes with ease.


Radar Specific Emitter Identification (SEI) Against Modern Commercial Navigation Radar

Many different complex physics-based algorithms can be used to predict the quality of channels in radio frequency (RF) communications with varying levels of fidelity across many parameters. High frequency (HF) channels are influenced by complicated, sparsely-measured processes including propagation (due to space, weather, platform movement, etc.), interference (due to human activity, automated processes, etc.), and receiver/transmitter hardware. We present the High Frequency Observability Generative Adversarial Network (HOGAN), a contextual GAN for HF channel modeling and data generation. GANs have demonstrated the capability to perform extremely complicated, difficult to quantify transforms without exhaustively curated datasets. HOGAN is currently trained using synthetic RadioML IQ data with the goal of training on over-the-air data collected in the field for passive forecasting of HF channels to estimate how transmitted signals will be received. HOGAN aims to build upon the success of the RFMLS program and other RF machine learning efforts at NIWC to lay the foundations for applied RF GANs.

HOGAN: High-Frequency Observability Generative Adversarial Network

High frequency (HF) is being re-invented across the DoD services as they envision a great power competition and evaluate the survivability of satellite systems. Maneuverability is key and an agile radio using artificial intelligence (AI) and machine learning (ML) could provide the agility needed across the HF spectrum. 

Specifically, the weakness of an automatic link establishment (ALE) systems [1] is that they only transmit on frequencies within a lookup table. If those frequencies are in use or jammed the ALE system will not connect. A solution is an ALE protocols that can scan the spectrum to find the best spectrum given an environmental condition. An environmental condition can be data collected from a radio receiver in a specific location (e.g., a ship sailing in a mission location). The data might include the information such as which frequencies are used, the patterns for when and how the frequencies are used, weather and terrain conditions for the location, and adversary activities such as jamming. Software defined radios (SDR) combined with recent AI/ML algorithms make it possible to define and adapt usable radio frequencies based on environment inputs. To meet the need, the objective of this proposal is to demonstrate an SDR system leveraging AI/ML algorithms such as predictive models, cognitive architecture, optimization algorithms, and game theory. For example, HF communications via the Ionosphere between 3-30 MHz is a dynamic part of the spectrum where ALE radio already exist. They use lookup tables and do not “see” the spectrum and cannot make choices base on the actual environment. The HF spectrum is the most challenging environment and could be the first users to adopt the concept.

Autonomous network defence using Reinforcement Learning within CyberBattleSim

Downloads

Next from NAML 2022

Predictive Maintenance Utilizing Machine Learning for the Surface Fleet

Similar lecture

SpikePropamine: Meta-Learning Synaptic Plasticity for Spiking Neural Networks

Stay up to date with the latest Underline news!

PRESENTATIONS

CONFERENCES

COMPANY

RESOURCES