SEI Cyber Talks

Ritwik Gupta and Anusha Sinha discuss SEI work on NetFlow that aims to distinguish human-generated flows from machine-generated flows to identify human actors on networks and potential network threats more easily.

With millions of flows on a given network a day, clustering and labeling them becomes challenging. For analysts to be able to take action on potential network threats, it is critical to label flows as quickly and efficiently as possible—often in near-real time. In this SEI Cyber Talk Episode, Ritwik Gupta and Anusha Sinha discuss SEI work on NetFlow that aims to find the most effective way of clustering flows for determining which are generated by humans and which are generated by machines. The work involves constructing a graph that establishes server IPs as nodes, and then formulates the flow partitioning problem as an instance of max-flow using two super nodes and various similarity metrics between server IPs. Partitioning is then accomplished by finding a minimum cut in the graph. Ritwik and Anusha discuss sparsification of the abstract flow network via spectral similarity of graph Laplacians as a technique for improving the algorithm's efficiency. The ability to quickly label human-generated flows and machine-generated flows could assist analysts in identifying potential network threats as well as with network profiling efforts.

Currently, there is an enormous amount of interest in machine learning and artificial intelligence and what these new technologies can create for the present and future. In this SEI Cyber Talk episode, Rotem Guttman and April Galyardt discuss how machine learning fits into the bigger picture of artificial intelligence. They describe some of the current applications for machine learning as well as some of its limitations, including examples of machines reaching unexpected results, producing miscalculations because of contextual changes in the data they analyze, and introducing bias into their calculations. The participants also discuss possible use cases for and changes to machine learning that could occur in the mid to near future, including how machine learning might describe and explain its analyses for users to take appropriate action or to learn why the machine made certain decisions.

In today's market, chipmakers design and fabricate chips using supply chains, labor forces, locations, and processes that they don't always monitor or control as closely as customers with high-security requirements need them to. Without proper security or visibility into how companies fabricate chips, a malicious actor could insert something into the hardware that would provide a way for attackers to target and exploit high-profile organizations that use it. In this SEI Cyber Talk episode, Rotem Guttman and Gabe Somlo discuss the benefits of using open source software and hardware, which can help to prevent such issues because open source products provide visibility into what they contain. Additionally, to give government and commercial organizations confidence that their systems are built correctly, Rotem and Gabe also discuss how they might build a computer on their own to ensure that outside sources have not purposely introduced ways of subverting it.

In this SEI Cyber Talk episode, Ritwik Gupta, Daniel Justice, and Jason Larkin explain what quantum computing is and how it works, and they discuss the benefits that quantum computing can offer, such as increasing the speed at which computers can solve certain algorithms. In the near term, however, quantum computing is limited because quantum computers still present high error rates. Ritwik, Daniel, and Jason explain how these computers must dedicate some of their architecture to error correction. Given this and other limitations, they discuss the kind of applications that are currently plausible for this technology, such as leveraging quantum chips as co-processors and accelerators for classical computers to speed up certain tasks that the quantum architecture is better equipped to handle. They also discuss possibilities they see for quantum computing in the long term, including improving error correction so that quantum computers can address larger problems, such as Shor's algorithm.

For the sake of security and safety, exercise environments where cyber operators train often need to be disconnected from real networks. To make these environments more realistic, the Software Engineering Institute (SEI) developed software that simulates the public Internet to give trainees the sense that they are in a real environment. In this SEI Cyber Talk episode, Rotem Guttman and Gabe Somlo explain how this software works to replicate common websites that users see on the Internet and make them as realistic as possible, which includes the addition of a DNS server infrastructure and making the websites appear as if they are hosted in different geographic locations. Rotem and Gabe also discuss how the software supports less common, but important, use cases like performing cryptocurrency transactions or running onion nodes.

Recently, the Department of Homeland Security (DHS) released a warning about DNS hijacking and how website owners can protect themselves against it. To explain what DNS hijacking is and how adversaries use it to steal sensitive information, Elli Kanal and Daniel Ruef give a high-level overview of how DNS and network traffic work. They discuss how servers communicate with each other, what kind of information servers send to each other and why, and how adversaries can hijack that information. Finally, Elli and Daniel give some advice about what website owners might do to monitor their websites to make sure that adversaries have not hijacked their DNS.

In this SEI Cyber Talk, Emerging Technology Center interns Dominick Gurnari and Sandra Sajeev discuss what it's like to intern at the SEI, a DoD federally funded research and development center. We discuss what's cool about working in a research lab, what's not, and how the internship differs from traditional industry internships.

This SEI Cyber Talk episode explains how inverse reinforcement learning can be effective for teaching agents to perform complex tasks with many states and actions.

Inverse reinforcement learning (IRL) is a formalization of imitation learning, which involves learning a task by observing how it is done. The difference between IRL and simple imitation learning is that, in addition to taking note of the actions and decisions needed to perform a task, IRL also associates those actions with the intrinsic rewards of taking them. By doing so, IRL can teach agents to apply the decisions it makes when performing certain actions to other states that the agent might not yet have observed. The participants in this SEI Cyber Talk episode give an overview of how this learning concept works, and they discuss the potential of using IRL to develop technologies such as self-driving cars as well as some of its limitations.

This SEI Cyber Talk episode introduces the concept of cyber hygiene, which bears an analogy to the concept of hygiene in the medical profession. Like the practice of washing hands to prevent infections, cyber hygiene addresses simple sets of actions that users can take to help reduce cybersecurity risks. The participants in this Cyber Talk episode discuss what some of those practices are, such as implementing password security protocols, and how organizations can determine which practices to implement. Finally, they discuss the special case of phishing—which is a form of attack that can bypass technical safeguards and exploit people's weaknesses—and how changes in behavior, understanding, and technology might address this issue.