SUMMARY

Government organizations and large enterprises are faced with the challenge of defending massive amounts of data against the backdrop of increased large-scale cyberattacks, data breaches, ransomware attacks, espionage, and insider threats. As adversaries adopt advanced tools, the rapid innovation of cyber analytics is necessary to defend highly secure networks.

Patriot Labs is interested in scalable machine learning-based (ML) cyber analytics that incorporate sense-making and decision-making techniques for automated adaptive cyber defense with provable and measurable properties, while requiring minimal human involvement. Based on the inputs of system observation, network behavior, and data flows solutions should be capable of detecting threats before they impact a system. Demonstrable benefits should include prioritized alerts, automated threat intelligence, scalable behavioral analysis, proactive incident detection of likely future threat events, and improved forensic incident investigation by capturing event locations, sources, pathways, timelines, and affected assets.

For purposes of this CFI, solutions may incorporate technology that supports multiple detection modalities such as unsupervised, supervised, and detection correlation. Use case demonstrations of interest include: (1) analyzing user behavior to detect potentially suspicious patterns, (2) analyzing network traffic to pinpoint trends indicating potential attacks, (3) incident response integration and management, (4) preemptive social media threat analytics, and (5) application security penetration testing.

Approaches may include the use of algorithms, statistical analysis, behavioral analytics, machine learning, and other classes of analysis to detect, analyze, and mitigate cyberthreats. Special consideration given to solutions that use ML to investigate patterns of application-specific data or to proactively detect instances of data leakage beyond known data or when the communication is encrypted. Other characteristics of interest include the ability to identify analogous activity, and the prevention of attacks by understanding the normal behavior of humans, applications, and networks, rather than relying on historical threat signatures.