Risk
2/15/2012
01:00 PM
50%
50%

DoD Taps PARC To Help Detect Insider Threats

PARC, famous for its innovations, will develop technology for the Department of Defense that aims to identify inside security threats, using behavioral data, social networks, and other sources.

Slideshow: Next Generation Defense Technologies
Slideshow: Next Generation Defense Technologies
(click for larger image and for full slideshow)
The Department of Defense (DoD) has tapped PARC to create technology that can automatically identify the possibility of a security threat coming from inside the department's network.

PARC, which is owned by Xerox, is spearheading a new effort called the Graph Learning for Anomaly Detection using Psychological Context (GLAD-PC). The project will leverage large-scale behavioral data sets as well as information from social networks and other sources to determine when someone inside the military could pose a security risk.

GLAD-PC is a sub-project within the Defense Advanced Research Project Agency's Anomaly Detection at Multiple Scales (ADAMS) program, which will produce technology that can sift through the behavioral signs that someone might turn on the military or his or her cohorts, and prevent the action before it happens.

The DoD has awarded PARC $3.5 million for its role in the project, and the technology developed could have commercial potential after it's deployed within the government.

[ Anonymous claims responsibility for a recent attack on the CIA's website. Read more at CIA Website Hacked, Struggles To Recover. ]

After last year's Wikileaks debacle--in which military intelligence analyst Bradley Manning was arrested for leaking reams of classified data to the whistleblower site--the DoD's sensitivity to insider threats has intensified. The leak eventually led to an international incident dubbed Cablegate, which called attention to the apparent insecurity of U.S. military networks.

In addition to ADAMS, DARPA also has another project with a similar focus called the Cyber Insider Threat program, or CINDER. That program also aims to detect insider threats before they happen, but takes an approach that assumes systems and networks already have been compromised and seeks to mitigate the damage.

So far, technological attempts to detect insider threats have faced challenges because of the large amounts of data that must be analyzed quickly, according to PARC. Using detection based only on structural anomalies has created too many false positives, and there currently is a lack of technology to automatically interpret data semantically, the company said.

PARC said it was chosen for the job of solving these problems because of its expertise in machine learning and anomaly detection, psychological modeling, ethnography, and social network analysis, as well as its experience in working with and analyzing terabyte-sized data sets.

Because the scope of its work will be complex, however--touching on human psychology, data analysis, anomaly detection, and social network analysis, among other practices--the company also will have subcontracting help, including some from another government agency.

The NASA Ames Research Center will provide graph structure analysis and anomaly detection for the graph learning feature of the technology, while the Human Resources Research Organization (HumRRO) will provide expertise in dynamic psychological modeling, the psychology of insider attacks, and the connection between personality traits and behavior, according to PARC. Stony Brook University, which has experience in semantic information network analysis and graph theory, also is contributing to GLAD-PC.

InformationWeek and InformationWeek Government are conducting a survey on IT security and cybersecurity in U.S. federal government agencies. Upon completion of our survey, you will be eligible to enter a drawing to receive an Apple 16-GB iPad 2. Take our Federal Government Cybersecurity Survey now. Survey ends Feb. 24.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Register for Dark Reading Newsletters
Dark Reading Live EVENTS
INsecurity - For the Defenders of Enterprise Security
A Dark Reading Conference
While red team conferences focus primarily on new vulnerabilities and security researchers, INsecurity puts security execution, protection, and operations center stage. The primary speakers will be CISOs and leaders in security defense; the blue team will be the focus.
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: No, no, no! Have a Unix CRON do the pop-up reminders!
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.