Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

DoD Taps PARC To Help Detect Insider Threats

PARC, famous for its innovations, will develop technology for the Department of Defense that aims to identify inside security threats, using behavioral data, social networks, and other sources.

Slideshow: Next Generation Defense Technologies
Slideshow: Next Generation Defense Technologies
(click for larger image and for full slideshow)
The Department of Defense (DoD) has tapped PARC to create technology that can automatically identify the possibility of a security threat coming from inside the department's network.

PARC, which is owned by Xerox, is spearheading a new effort called the Graph Learning for Anomaly Detection using Psychological Context (GLAD-PC). The project will leverage large-scale behavioral data sets as well as information from social networks and other sources to determine when someone inside the military could pose a security risk.

GLAD-PC is a sub-project within the Defense Advanced Research Project Agency's Anomaly Detection at Multiple Scales (ADAMS) program, which will produce technology that can sift through the behavioral signs that someone might turn on the military or his or her cohorts, and prevent the action before it happens.

The DoD has awarded PARC $3.5 million for its role in the project, and the technology developed could have commercial potential after it's deployed within the government.

[ Anonymous claims responsibility for a recent attack on the CIA's website. Read more at CIA Website Hacked, Struggles To Recover. ]

After last year's Wikileaks debacle--in which military intelligence analyst Bradley Manning was arrested for leaking reams of classified data to the whistleblower site--the DoD's sensitivity to insider threats has intensified. The leak eventually led to an international incident dubbed Cablegate, which called attention to the apparent insecurity of U.S. military networks.

In addition to ADAMS, DARPA also has another project with a similar focus called the Cyber Insider Threat program, or CINDER. That program also aims to detect insider threats before they happen, but takes an approach that assumes systems and networks already have been compromised and seeks to mitigate the damage.

So far, technological attempts to detect insider threats have faced challenges because of the large amounts of data that must be analyzed quickly, according to PARC. Using detection based only on structural anomalies has created too many false positives, and there currently is a lack of technology to automatically interpret data semantically, the company said.

PARC said it was chosen for the job of solving these problems because of its expertise in machine learning and anomaly detection, psychological modeling, ethnography, and social network analysis, as well as its experience in working with and analyzing terabyte-sized data sets.

Because the scope of its work will be complex, however--touching on human psychology, data analysis, anomaly detection, and social network analysis, among other practices--the company also will have subcontracting help, including some from another government agency.

The NASA Ames Research Center will provide graph structure analysis and anomaly detection for the graph learning feature of the technology, while the Human Resources Research Organization (HumRRO) will provide expertise in dynamic psychological modeling, the psychology of insider attacks, and the connection between personality traits and behavior, according to PARC. Stony Brook University, which has experience in semantic information network analysis and graph theory, also is contributing to GLAD-PC.

InformationWeek and InformationWeek Government are conducting a survey on IT security and cybersecurity in U.S. federal government agencies. Upon completion of our survey, you will be eligible to enter a drawing to receive an Apple 16-GB iPad 2. Take our Federal Government Cybersecurity Survey now. Survey ends Feb. 24.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  12/5/2019
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-4428
PUBLISHED: 2019-12-09
IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session....
CVE-2019-4611
PUBLISHED: 2019-12-09
IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 168519.
CVE-2019-4612
PUBLISHED: 2019-12-09
IBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal. Attackers can make use of this weakness and upload malicious executable files into the system and it can be sent to victim for performing further attacks. IBM X-Force ID: 168523.
CVE-2019-4621
PUBLISHED: 2019-12-09
IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is enabled. A remote attacker could use this account to gain unauthorised access to the BMC. IBM X-Force ID: 168883.
CVE-2019-19230
PUBLISHED: 2019-12-09
An unsafe deserialization vulnerability exists in CA Release Automation (Nolio) 6.6 with the DataManagement component that can allow a remote attacker to execute arbitrary code.