United States

Increasingly in cyber security, network traffic detection techniques leverage the advances of machine learning (ML) algorithms to gain significant improvement in performance. However, traditional ML based network traffic detection algorithms rely heavily on subject matter expertise for feature engineering (i.e., feature extraction). Restricting the ability of ML algorithms to identify patterns within the raw network traffic that are imperceptible to a human analyst. Therefore, we propose a novel ML based network traffic detection algorithm using the raw bytes of a network packet as features. Thus, minimizing the reliance on a subject matter expert for feature engineering.
Our prior work [1] demonstrates the feasibility of leveraging the raw bytes of a network packet as features for a 1D Convolutional Neural Network (CNN) and Feed Forward Neural Network (FNN) based network detection algorithm and respectively achieve an accuracy of 98.99% and 98.97%. However, neither the 1D CNN nor FNN foster a human analyst’s interpretability of the output prediction (i.e., malicious or benign). Thus, we propose the use of a Random Forest (RF) for prediction on raw bytes of a network packet. Similar to [2], the feature importance from our RF network classifier, assists the human analyst in interpretation of the output prediction. Furthermore, a structure is constructed, so that each value in a feature vector retains the same meaning (i.e., context) across all samples. Our feature vector is composed of select bytes from the TCP or UDP packet header. 
The UNSW-NB15 dataset is utilized to evaluate our novel RF network traffic classifier. Our Random Forest based raw network traffic detection achieves an accuracy of 98.96%. Additionally, the most important feature is the TCP offset header field. Thus, our method demonstrates the utility of using raw network traffic coupled with the RF reduces the need for a subject matter expert to perform feature engineering. Furthermore, the RF assists a human analyst in interpretation of the output prediction.

[1] M. De Lucia, P. E. Maxwell, N. D. Bastian, A. Swami, B. Jalaian, and N. Leslie, “Machine learning raw network traffic detection,” in Artificial Intelligence and Machine Learning for Multi-Domain Operations Applications III, Online Only, United States, Apr. 2021, p. 24. doi: 10.1117/12.2586114.
[2] J. Holland, P. Schmitt, N. Feamster, and P. Mittal, “New Directions in Automated Traffic Analysis,” in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, Virtual Event Republic of Korea, Nov. 2021, pp. 3366–3383. doi: 10.1145/3460120.3484758.

NAML 2022

Random Forest based Raw Network Traffic Detection

cyber security

network security

machine learning

Naval Information Warfare Center Pacific is partnering with AFCEA San Diego chapter to host the workshop.

The NAML workshop is an opportunity for researchers from Navy research and development centers and our partner organizations to exchange technical ideas and to come together as a team.

The goals of NAML are:

* To spread awareness of current machine learning research relevant to Naval applications

* To connect machine learning researchers with experts in military requirements

* To build and strengthen collaborations within the defense research community

**Watch this video to hear about the AFCEA purpose.**

<iframe width=1280 height=706 frameborder="0" scrolling="no" src="https://screencast-o-matic.com/player/creleVVcvRh?v=6&ff=1&title=0&controls=1" allowfullscreen="true"></iframe>

NAML 2021

technical paper

##### For full functionality of Underline, please SHUT OFF your VPN, or use a personal device.


Naval Information Warfare Center Pacific is partnering with AFCEA San Diego chapter to host the workshop.

The NAML workshop is an opportunity for researchers from Navy research and development centers and our partner organizations to exchange technical ideas and to come together as a team.

The goals of NAML are:

To spread awareness of current machine learning research relevant to Naval applications

To connect machine learning researchers with experts in military requirements

To build and strengthen collaborations within the defense research community


<figure class="video_container">
  <iframe src="https://s3.amazonaws.com/pf-user-files-01/u-59356/uploads/2022-03-22/hk13mxo/NAML_ReceptionWithtitle.mp4" width=826  height=526  frameborder="0" allowfullscreen="true"> </iframe>
</figure>

Naval Information Warfare Center Pacific is partnering with AFCEA San Diego chapter to host the workshop. The NAML workshop is an opportunity for researchers from Navy research and development centers and our partner organizations to exchange technical ideas and to come together as a team.

The goals of NAML are:

To spread awareness of current machine learning research relevant to Naval applications

To connect machine learning researchers with experts in military requirements

To build and strengthen collaborations within the defense research community



The Operational Safety Risk Indicator (OSRI) project, led by Commander, Naval Surface Forces (CNSF), seeks to aggregate disparate data sources across the Navy into DoN Jupiter, which is the Navy’s enterprise data environment enclave of Advana, and deploy predictive risk analytics/modeling to identify significant risk factors and enable better decision-making across all echelons of leadership. By leveraging advanced machine learning and artificial intelligence methodologies, coupled with robust data visualization tools, the OSRI project seeks to enhance operational safety and readiness across the Surface Force. 
Although the there is an abundance of relevant enterprise data to serve the OSRI project, the team has tapped into one of the most pertinent and relevant data sources available to date: Tactical Messages. These messages provide a wealth of information across many naval operations, including logistics, operations, personnel, medical, and maintenance. One such form of information within Tactical Messages that directly relates to operational safety risk indicators is destructive behaviors data. Currently this information is manually extracted in multiple ways from an enormous amount of Tactical Message traffic. How this information is extracted also depends on the command or operational function, which creates data management concerns. In addition, Tactical Messages vary widely in format, are largely unstructured, and may contain errors due to manual entry. Not only does the current data aggregation process result in redundancies and potential information loss, but it inhibits the ability to make real-time decisions and analysis, thus potentially impacting the Navy’s operational safety risk posture. As a result, the OSRI team developed a machine learning application that will enable faster processing and more timely delivery of insights drawn from a wealth of unstructured data. This application takes the raw Tactical Message data as input and—using Natural Language Processing techniques—classifies the type of destructive behaviors incident. This classifier provides a predictive capability that not only enables robust analytics in a streamlined fashion, but also helps to identify the factors that contribute to the occurrence of these events. Through timely delivery of this actionable information to leadership, the Navy can make better informed decisions that enact effective counter measures against destructive behaviors. The long-term gain for such a system is enhanced operational safety and improved performance outcomes.

Operational Safety Risk Indicators

The term “insider threat” can take many forms, ranging from an information security risk to the threat of an active shooter. Accordingly, it is beneficial to researchers and practitioners to understand the relationship between psychological factors and the different types of threats an insider may pose to an organization. This research advances this understanding. Specifically, we investigate the three-way relationship between user-generated text, psychological factors espoused in insider threat literature, and risk indicator categories used by the U.S. Government. We employ advancements in machine learning and Natural Language Processing to investigate this relationship. Specifically, we use Bidirectional Encoder Representations from Transformers (BERT) for word embedding and vector space modeling. Our results indicate that there are indeed associations between established risk categories and the psychological factors seen as predictive of malicious insiders. Our exploratory research also reveals that further research is warranted to advance the predictive capability of insider threat modeling.

Predicting the Threat: Investigating Insider Threat Psychological Factors With Advanced Natural Language Processing

The Financial Management Systems (FMS) Financial Management Data & Digital Transformation (FMDDT) Division under the Assistant Secretary of the Navy’s Financial Management and Comptroller’s Office (ASN FM&C) along with Deloitte GPS (Government & Public Services), has developed a data science solution for automating the mapping of financial management systems’ vendor data across several systems, identifying erroneous and missing data, and detecting duplicate information.
FMDDT is working with our partners to establish clear data governance in the ingestion, use, and modeling of data. We are working in close partnership with DON CDO and OSD’s ADVANA to leverage tools, data streams, and the analytics environment while establishing governance policies that foster trust in data through consistency and standardization.
As the Navy moves all financial systems under the Navy Enterprise Resource Planning (ERP) system there will be a need to improve the data quality and mapping as it is integrated from Navy and Marine Corp Standard Accounting, Budgeting, and Reporting System (SABRS) and Standard Financial & Reporting System – Field Level (STARS-FL).
The current Navy ERP vendor master list needed consolidation and mapping across SABRS and STARS-FL to provide insight into budget and financial analytics. As these systems migrate into a single financial system in FY22, an understanding of the historical data and how it maps between systems will be critical to the development of future data analytics and machine learning applications.
While using the System for Award Management (SAM) data as the authoritative data source and vendor naming convention, the Navy ERP, SABRS, and STARS-FL vendor names were matched to the SAM data source. The effort entails matching almost 3 million unique ERP, SABRS, and STARS-FL vendor name records against millions of SAM vendor name records resulting in over 3 trillion unique comparisons.
The effort used the Jupiter Databricks environment which leverages Apache Spark to optimize the vendor matching algorithm using techniques such as Local Similarity Hashing, Cosine Similarity, and Euclidean distance theorem which quickly processed millions of records and assigned a similarity score for each record. This approach clustered vendor names using cosine similarity into smaller groups with lower degrees of accuracy. This ensures a smaller likelihood of missing potential matches. The Euclidian distance of these clustered vendors provides a “smaller” group (< 3.6 trillion) and compares in greater detail by generating more features and using the cosine similarity approach.
This effort established data pipelines to ingest financial data on a regular cadence into a vendor identification and mapping algorithm to correct and detect deficiencies, enforce compliance and governance, and report new findings. FMDDT and our partners are leaning forward to increase the number of customer-focused, innovative, and easy-to-use data visualizations and tools.



Vendor Name Fuzzy Matching using Spark

Synthetic Data Generation & Cloud Based Robotics Simulation & Testing

Modern commercial navigation radars are cheap to purchase, however, with the use of DSP they can have high resolutions and complicated waveforms. This has lead them to proliferate across both civilian and military domains and to the RF band they operate in becoming increasingly congested. To improve situational awareness the ability to distinguish between different individual radars on a pulse-by-pulse basis is desired. This would provide the means to track military targets whilst ignoring civilian ones.
This work has investigated the application of SEI to this radar type, i.e. the ability to distinguish between individual commercial navigation radar. IQ data of a set of 30 radar from three common makes, 10 from each, were collected in an anechoic chamber using a wideband digitiser. Deep learning techniques were applied in order to perform classification. These techniques included the use of residual and inception networks, along with time-frequency transforms as a means of feature engineering. Results varied across the different makes with one make having a high F1 scores and two with considerably lower F1 scores; however, it is possible to distinguish between makes with ease.


Radar Specific Emitter Identification (SEI) Against Modern Commercial Navigation Radar

Many different complex physics-based algorithms can be used to predict the quality of channels in radio frequency (RF) communications with varying levels of fidelity across many parameters. High frequency (HF) channels are influenced by complicated, sparsely-measured processes including propagation (due to space, weather, platform movement, etc.), interference (due to human activity, automated processes, etc.), and receiver/transmitter hardware. We present the High Frequency Observability Generative Adversarial Network (HOGAN), a contextual GAN for HF channel modeling and data generation. GANs have demonstrated the capability to perform extremely complicated, difficult to quantify transforms without exhaustively curated datasets. HOGAN is currently trained using synthetic RadioML IQ data with the goal of training on over-the-air data collected in the field for passive forecasting of HF channels to estimate how transmitted signals will be received. HOGAN aims to build upon the success of the RFMLS program and other RF machine learning efforts at NIWC to lay the foundations for applied RF GANs.

HOGAN: High-Frequency Observability Generative Adversarial Network

High frequency (HF) is being re-invented across the DoD services as they envision a great power competition and evaluate the survivability of satellite systems. Maneuverability is key and an agile radio using artificial intelligence (AI) and machine learning (ML) could provide the agility needed across the HF spectrum. 

Specifically, the weakness of an automatic link establishment (ALE) systems [1] is that they only transmit on frequencies within a lookup table. If those frequencies are in use or jammed the ALE system will not connect. A solution is an ALE protocols that can scan the spectrum to find the best spectrum given an environmental condition. An environmental condition can be data collected from a radio receiver in a specific location (e.g., a ship sailing in a mission location). The data might include the information such as which frequencies are used, the patterns for when and how the frequencies are used, weather and terrain conditions for the location, and adversary activities such as jamming. Software defined radios (SDR) combined with recent AI/ML algorithms make it possible to define and adapt usable radio frequencies based on environment inputs. To meet the need, the objective of this proposal is to demonstrate an SDR system leveraging AI/ML algorithms such as predictive models, cognitive architecture, optimization algorithms, and game theory. For example, HF communications via the Ionosphere between 3-30 MHz is a dynamic part of the spectrum where ALE radio already exist. They use lookup tables and do not “see” the spectrum and cannot make choices base on the actual environment. The HF spectrum is the most challenging environment and could be the first users to adopt the concept.

Cognitive and Agile Radio

Cyber-attacks can escalate quickly, with serious ramifications. Once attackers have gained a foothold, they can exploit assets to move laterally within the network – often before human-led defence teams have had time to respond – gaining control of systems and information. ML/AI provides an opportunity to combat these attacks in a relevant time frame, through autonomous cyber defence.
Within Reinforcement Learning (RL), agents learn efficient strategies to win through their interaction with an environment and other agents. Behaviours do not need to be explicitly programmed – rather they are learned through multiple successes and failures. As such, RL lends itself well to complex problems where multiple courses of action could be appropriate or unknown to human operators.
CyberBattleSim (Microsoft) is an open-source experimentation platform and training environment for RL agents. It provides a high-level abstract simulation of enterprise networks in which Red and Blue team agents compete for control. Its simplicity allows the simulation to be readily modified to model new threats, vulnerabilities and attack patterns.
We report on the use of multi-agent RL to defend network infrastructure against an adversary attack within CyberBattleSim. We ground the abstract simulation in the real world using attack methodologies derived from APT threat groups and the MITRE ATT&CK framework. Red agents are rewarded for exploiting vulnerabilities and gaining control of nodes within the network. Blue agents can disrupt this by hardening or re-imaging nodes and are rewarded for maintaining control and availability of network resources. Blue agent collaboration is explored using centralized and decentralized communication strategies are explored to support effective multi-agent behaviour.

Autonomous network defence using Reinforcement Learning within CyberBattleSim

Machine learning requires large amounts of data. Despite the extensive availability of mission data collected from joint missions, military doctrine regularly compartmentalizes data to prevent accidental disclosure of operational details. Current procedures to consolidate data from different sources are manually intensive and vulnerable to insider manipulation. We desire solutions for cooperative secure learning that maintain accuracy while both protecting sensitive data sources and containing insider threats.

In this presentation, we describe a layered approach to secure, multi-party learning, in which each step in the learning process adds more security, and demonstrate its use on sensitive Security Operation Center (SOC) data. We will describe the components and flow through the system that allow for this layered security, for both single-party and multi-party learning. Our approach first combines automated anonymization and synthetic data generation to protect sensitive data with minimal loss in accuracy. We then extract feature embeddings that resist reverse engineering for sharing with the learning system via three options for privacy preserving models, and describe the training and testing process. Finally we show both performance and privacy metrics to prove this method's success in maintaining security without sacrificing performance. In most test cases, similar or better accuracy is achieved, with overall labeling accuracies ranging between 85% and 99%.

Finally, we conclude with discussion on how this work can be applied outside of cyber data, and how it can be used to make machine learning more robust in general.

Secure, Privacy-Preserving Machine Learning

Abstract – Using agent-based simulation and distributed cloud computing to test how massive, complex networks will react to scenarios that haven’t happened yet 

Studying complex systems that contribute to or impact the Navy mission is essential, but these systems cannot be fully understood by analyzing their individual components. If a complex system cannot be studied analytically, an alternative option is to explore the system through modeling and simulation. For government and commercial partners, Deloitte uses FutureScape as a modeling and simulation platform to create digital replicas of complex, real-world systems and test ways to improve them. 

In this presentation, we will hone-in on how to use FutureScape and build a controlled environment around Department of Defense and Navy use cases to answer what-if questions in an expeditious and cost-efficient manner. A few examples that we are actively working on with DoD partners include but are not limited to: 
-Create a digital testbed of the fuel supply chain network that enables the military to quantify the impact of disruptions on fuel supply and subsequently, readiness and mobilization times. 
-Model C4ISR and weapons systems and simulate and evaluate incursion scenarios to test the efficacy of layered defenses. 
-Model non-spatial networks to identify critical points in the network that, if disrupted, would have major cascading effects up or downstream. 

Recognizing there are significant investments being made by the DoD on modeling and simulation solutions for Naval Applications, our intent is to hone-in on a tested approach to generate data and insights about hypothetical scenarios. This will ultimately help sailors and Navy leadership evaluate the impact of potential disruptions, test strategies and contingency plans, mitigate risks, and make strategic choices impacting complex systems that make up their day-to-day operations.

Premium content

Random Forest based Raw Network Traffic Detection

Downloads

Next from NAML 2022

Operational Safety Risk Indicators

Similar lecture

Helicopter Video Dataset for Detecting and Tracking

Stay up to date with the latest Underline news!

PRESENTATIONS

CONFERENCES

COMPANY

RESOURCES