HDTRA124C0050

Small Business Innovation Research Program (SBIR) Phase II

Virtualitics AI-based Anomalous Activity Threat Detection and Intelligent Monitoring

Application of Machine Learning, Artificial Intelligence, and Data Science techniques to improve NL Data Management and Application Services

The Nuclear Logistics Technical Division (NLT) maintains vital databases and application services for the national nuclear stockpile. These contain sensitive data requiring continuous monitoring for cybersecurity threats. This proposal seeks to develop an automated anomaly detection system for NLT databases, utilizing recent advancements in machine learning (ML), artificial intelligence (AI), and data science (DS). The system will analyze user activity data in real-time to promptly identify and mitigate potential cybersecurity risks, ensuring the security of the national nuclear stockpile. The proposed solution incorporates various ML/AI/DS techniques, including supervised algorithms (e.g., support vector machines, neural networks, rule-based techniques) and unsupervised and statistical algorithms (e.g., principal component analysis, clustering). These algorithms can be trained on large datasets and deployed in real-time, surpassing traditional heuristic approaches. Analysts' expertise will be leveraged in feature generation, model design, and training to enhance the performance of the ML/AI/DS methods. The models will continuously learn and adapt with additional event data, improving their effectiveness over time. Moreover, ML/AI/DS methods can identify complex trends and insights missed by rule-based protocols. To address the challenge of coding expertise, low-code application environments supporting in-database machine learning will be used. These platforms empower end-users, expedite development cycles, and increase productivity. Integrating ML/AI/DS modules within the low-code environment enhances analytical capabilities, allowing analysts to explore and gain deeper insights. This approach reduces cybersecurity risks associated with custom code deployment, ensuring resilience against threats. Virtualitics, an experienced SBIR award winner specializing in cybersecurity threat identification and low-code platform development, proposes to build upon Phase I efforts. The objectives for Phase II include deploying the Virtualitics AI Platform (VAIP) to the production network, developing an Extract, Transform, and Load (ETL) pipeline for processing real-time data, refining and training anomaly detection models on production data, and creating network activity and anomaly detection dashboards. The aim is to have a fully deployed ML algorithm capable of automatically identifying anomalous activities to support network security investigations. The refined models will be evaluated for additional processing, storage, and network requirements. By implementing this system, the NLT will enhance its ability to protect critical nuclear stockpile data and proactively respond to cybersecurity threats.

The goal of phase II is to continue the R&D efforts initiated in Phase I. Funding is based on the results achieved in Phase I and the scientific and technical merit and commercial potential of the project proposed in Phase II.

DTRA222-001

T2-0481

22.2

Anthony D Daubach