Cyber Center, Raytheon using AI to detect malicious attacks

OCTOBER 27, 2020 — Researchers in UTSA’s College of Business Cyber Center for Security and Analytics have partnered with Raytheon Intelligence & Space to study the use of artificial intelligence to detect malicious attacks.

The project, funded by a $447,000 grant from Raytheon Intelligence & Space, is being led by Nicole Beebe, professor and chair of UTSA’s Department of Information Systems and Cyber Security; Paul Rad, associate professor of information systems and cyber security; and Eric Bachura, assistant professor of information systems and cyber security. Luis Selvera, a graduate student, is also assisting with the project.

“Today’s security analysts and threat hunters are overloaded with data and mired down by manual processes,” said Beebe. “Automation, cyber analytics, machine learning, artificial intelligence and other enabling technologies need to be integrated into current concepts of operations in order to allow them to spend time on higher-priority mission activities. We are very excited to partner with Raytheon to solve these challenging problems.”

“Our partnership with UTSA demonstrates our commitment to leading innovation and to continued development of expertise.”

“Raytheon Technologies is proud to partner with UTSA’s world-class faculty who will bring cutting-edge artificial intelligence and machine learning techniques to tackle urgent cyber challenges facing our nation’s computer systems,” said John DeSimone, vice president of Cyber, Training and Services at Raytheon Technologies. “Our partnership with UTSA demonstrates our commitment to leading innovation and to continued development of expertise for our nation’s cyber workforce.”

Identifying abnormal behavior automatically to detect attacks on systems based on operational system and network logs could function as a powerful proactive security tool, especially during a pandemic, since more people are working remotely online.

The joint research with Raytheon Intelligence & Space resulted in anomaly detection from system and network logs using transformer-based AI system, an automated way of detecting abnormal behavior from log files.

“By combining natural language-based learning models, the anomaly detection framework parses the information stored in log data, learns normal behavior from the parsed log data and detects abnormal behaviors from new log entries,” said Rad.

Building upon previous work conducted by Cyber Center faculty, the team built a natural language processing model for detecting time-series patterns on logs. The model’s architecture consists of three components: parsing, training and detection. Then, the team trained the model using “normal” behavior patterns and known threats for predicting future threats.

“With our language model, we wanted to determine if system log files and network logs could be treated similar to finding misinformation in text files or social networks,” said Rad. “Using transformer models, we learned the distribution of good versus bad behavior, which would almost be undetectable to the human eye.”

In phase 2 of the project, which began this fall, the researchers will expand their approach to multimodal log files and build a federated AI algorithm as well as develop a spectral feature based approach to anomaly detection.

UTSA’s Cyber Center for Security and Analytics conducts high-impact, applied cyber security and data science research, development, operations and training to address imperative societal issues and national challenges.

— Wendy Frost