Exploring the Transition of Research-Derived Cyber-Threat Data

Sri International, Menlo Park CA

Investigators

Abstract

Transitioning later stage cybersecurity research into operational capabilities remains a national priority. Both the 2011 and 2016 Federal Cybersecurity Research and Development Strategic Plans, collaboratively authored by agencies which participate in the NITRD (Networking and Information Technology R&D) program, explicitly identify Transition to Practice (TTP) as a goal set by the Federal agencies that fund Cybersecurity research, including NSF. The 2016 Plan states that agencies should: "Assess barriers and identify incentives that could accelerate the transition of evidence-validated effective and efficient cybersecurity research results into adopted technologies, especially for emerging technologies and threats." This project considers the unique challenges in the transition of large-scale data or analytic results that are embodied as data feeds, distilled threat intelligence, or online portal services. With the growing attention by U.S. agencies in sponsoring cross-disciplinary research from the Data Science and cybersecurity research communities, the study is both timely and important. Novel security applications can be derived through the use of many newly emerging massively scalable machine learning technologies. Organized cyber-adversaries regularly mount sophisticated large-scale attacks and malware-driven campaigns that target large Universities, research organizations, industries, nations, and even the Internet itself. The dire need for deep reasoning cyber-threat-relevant applications now coincides with the growing availability of massive Internet datasets and the data mining solutions to capitalize on this data. This proposal explores the issues involved in transitioning the results of such large-scale data analytics into practical use.