Risk
2/15/2012
01:00 PM
Connect Directly
RSS
E-Mail
50%
50%

DoD Taps PARC To Help Detect Insider Threats

PARC, famous for its innovations, will develop technology for the Department of Defense that aims to identify inside security threats, using behavioral data, social networks, and other sources.

Slideshow: Next Generation Defense Technologies
Slideshow: Next Generation Defense Technologies
(click for larger image and for full slideshow)
The Department of Defense (DoD) has tapped PARC to create technology that can automatically identify the possibility of a security threat coming from inside the department's network.

PARC, which is owned by Xerox, is spearheading a new effort called the Graph Learning for Anomaly Detection using Psychological Context (GLAD-PC). The project will leverage large-scale behavioral data sets as well as information from social networks and other sources to determine when someone inside the military could pose a security risk.

GLAD-PC is a sub-project within the Defense Advanced Research Project Agency's Anomaly Detection at Multiple Scales (ADAMS) program, which will produce technology that can sift through the behavioral signs that someone might turn on the military or his or her cohorts, and prevent the action before it happens.

The DoD has awarded PARC $3.5 million for its role in the project, and the technology developed could have commercial potential after it's deployed within the government.

[ Anonymous claims responsibility for a recent attack on the CIA's website. Read more at CIA Website Hacked, Struggles To Recover. ]

After last year's Wikileaks debacle--in which military intelligence analyst Bradley Manning was arrested for leaking reams of classified data to the whistleblower site--the DoD's sensitivity to insider threats has intensified. The leak eventually led to an international incident dubbed Cablegate, which called attention to the apparent insecurity of U.S. military networks.

In addition to ADAMS, DARPA also has another project with a similar focus called the Cyber Insider Threat program, or CINDER. That program also aims to detect insider threats before they happen, but takes an approach that assumes systems and networks already have been compromised and seeks to mitigate the damage.

So far, technological attempts to detect insider threats have faced challenges because of the large amounts of data that must be analyzed quickly, according to PARC. Using detection based only on structural anomalies has created too many false positives, and there currently is a lack of technology to automatically interpret data semantically, the company said.

PARC said it was chosen for the job of solving these problems because of its expertise in machine learning and anomaly detection, psychological modeling, ethnography, and social network analysis, as well as its experience in working with and analyzing terabyte-sized data sets.

Because the scope of its work will be complex, however--touching on human psychology, data analysis, anomaly detection, and social network analysis, among other practices--the company also will have subcontracting help, including some from another government agency.

The NASA Ames Research Center will provide graph structure analysis and anomaly detection for the graph learning feature of the technology, while the Human Resources Research Organization (HumRRO) will provide expertise in dynamic psychological modeling, the psychology of insider attacks, and the connection between personality traits and behavior, according to PARC. Stony Brook University, which has experience in semantic information network analysis and graph theory, also is contributing to GLAD-PC.

InformationWeek and InformationWeek Government are conducting a survey on IT security and cybersecurity in U.S. federal government agencies. Upon completion of our survey, you will be eligible to enter a drawing to receive an Apple 16-GB iPad 2. Take our Federal Government Cybersecurity Survey now. Survey ends Feb. 24.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7877
Published: 2014-10-30
Unspecified vulnerability in the kernel in HP HP-UX B.11.31 allows local users to cause a denial of service via unknown vectors.

CVE-2014-3051
Published: 2014-10-29
The Internet Service Monitor (ISM) agent in IBM Tivoli Composite Application Manager (ITCAM) for Transactions 7.1 and 7.2 before 7.2.0.3 IF28, 7.3 before 7.3.0.1 IF30, and 7.4 before 7.4.0.0 IF18 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof s...

CVE-2014-3668
Published: 2014-10-29
Buffer overflow in the date_from_ISO8601 function in the mkgmtime implementation in libxmlrpc/xmlrpc.c in the XMLRPC extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) via (1) a crafted first argument t...

CVE-2014-3669
Published: 2014-10-29
Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an argument to the unserialize function ...

CVE-2014-3670
Published: 2014-10-29
The exif_ifd_make_value function in exif.c in the EXIF extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 operates on floating-point arrays incorrectly, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly exec...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.