Risk
2/15/2012
01:00 PM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

DoD Taps PARC To Help Detect Insider Threats

PARC, famous for its innovations, will develop technology for the Department of Defense that aims to identify inside security threats, using behavioral data, social networks, and other sources.

Slideshow: Next Generation Defense Technologies
Slideshow: Next Generation Defense Technologies
(click for larger image and for full slideshow)
The Department of Defense (DoD) has tapped PARC to create technology that can automatically identify the possibility of a security threat coming from inside the department's network.

PARC, which is owned by Xerox, is spearheading a new effort called the Graph Learning for Anomaly Detection using Psychological Context (GLAD-PC). The project will leverage large-scale behavioral data sets as well as information from social networks and other sources to determine when someone inside the military could pose a security risk.

GLAD-PC is a sub-project within the Defense Advanced Research Project Agency's Anomaly Detection at Multiple Scales (ADAMS) program, which will produce technology that can sift through the behavioral signs that someone might turn on the military or his or her cohorts, and prevent the action before it happens.

The DoD has awarded PARC $3.5 million for its role in the project, and the technology developed could have commercial potential after it's deployed within the government.

[ Anonymous claims responsibility for a recent attack on the CIA's website. Read more at CIA Website Hacked, Struggles To Recover. ]

After last year's Wikileaks debacle--in which military intelligence analyst Bradley Manning was arrested for leaking reams of classified data to the whistleblower site--the DoD's sensitivity to insider threats has intensified. The leak eventually led to an international incident dubbed Cablegate, which called attention to the apparent insecurity of U.S. military networks.

In addition to ADAMS, DARPA also has another project with a similar focus called the Cyber Insider Threat program, or CINDER. That program also aims to detect insider threats before they happen, but takes an approach that assumes systems and networks already have been compromised and seeks to mitigate the damage.

So far, technological attempts to detect insider threats have faced challenges because of the large amounts of data that must be analyzed quickly, according to PARC. Using detection based only on structural anomalies has created too many false positives, and there currently is a lack of technology to automatically interpret data semantically, the company said.

PARC said it was chosen for the job of solving these problems because of its expertise in machine learning and anomaly detection, psychological modeling, ethnography, and social network analysis, as well as its experience in working with and analyzing terabyte-sized data sets.

Because the scope of its work will be complex, however--touching on human psychology, data analysis, anomaly detection, and social network analysis, among other practices--the company also will have subcontracting help, including some from another government agency.

The NASA Ames Research Center will provide graph structure analysis and anomaly detection for the graph learning feature of the technology, while the Human Resources Research Organization (HumRRO) will provide expertise in dynamic psychological modeling, the psychology of insider attacks, and the connection between personality traits and behavior, according to PARC. Stony Brook University, which has experience in semantic information network analysis and graph theory, also is contributing to GLAD-PC.

InformationWeek and InformationWeek Government are conducting a survey on IT security and cybersecurity in U.S. federal government agencies. Upon completion of our survey, you will be eligible to enter a drawing to receive an Apple 16-GB iPad 2. Take our Federal Government Cybersecurity Survey now. Survey ends Feb. 24.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-5704
Published: 2014-04-15
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."

CVE-2013-5705
Published: 2014-04-15
apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.

CVE-2014-0341
Published: 2014-04-15
Multiple cross-site scripting (XSS) vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script or HTML via the title field to (1) templates_internal/pages.tpl, (2) templates_internal/home.tpl, or (3) templates_internal/entries.tpl; (4) an event field to ob...

CVE-2014-0342
Published: 2014-04-15
Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .php or (2) .php# extension, and then accessing it via unspecified vectors.

CVE-2014-0348
Published: 2014-04-15
The Artiva Agency Single Sign-On (SSO) implementation in Artiva Workstation 1.3.x before 1.3.9, Artiva Rm 3.1 MR7, Artiva Healthcare 5.2 MR5, and Artiva Architect 3.2 MR5, when the domain-name option is enabled, allows remote attackers to login to arbitrary domain accounts by using the corresponding...

Best of the Web