Computer-implemented system and method for cybersecurity threat analysis using federated machine learning and hierarchical task networks
A system and method for cyber exploitation path analysis and response using federated networks to minimize network exposure and maximize network resilience, with the ability to simulate complex and large scale network traffic through the use of federated training networks, by gathering network entity information, establishing baseline behaviors for each entity, and monitoring each entity for behavioral anomalies that might indicate cybersecurity concerns. Further, the system and method involve incorporating network topology information into the analysis by generating a model of the network, annotating the model with risk and criticality information for each entity in the model and with a vulnerability level between entities, and using the model to evaluate cybersecurity risks to the network. Lastly, network attack path analysis and automated task planning for minimizing network exposure and maximizing resiliency is performed with machine learning, generative adversarial networks, hierarchical task networks, and Monte Carlo search trees.
1 . A system for cyber exploitation path analysis and response using federated networks, comprising:
a computing device comprising a memory and a processor;
a directed graph stored in the memory of the computing device, the directed graph comprising a representation of a computer network wherein:
nodes of the directed graph represent entities comprising the computer network; and
edges of the directed graph represent relationships between the entities of the computer network;
a machine learning engine comprising a plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the machine learning engine comprises multiple distributed generator instances operating as separate federated processes with independent neural network parameters and communicating through high level architecture (HLA) protocols, wherein the plurality of programming instructions, when operating on the processor, cause the computing device to:
receive information about a topology and setup of a network of entities, from the directed graph;
simulate fake computer network traffic through coordinated operation of the multiple distributed generator instances using runtime infrastructure (RTI) for inter-federated communication;
use machine learning techniques including neural networks to attempt to classify computer network traffic either as legitimate or as simulated fake computer network traffic; and
a hierarchical task network engine comprising a plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the plurality of programming instructions, when operating on the processor, cause the computing device to:
receive information about the topology and setup of the network of entities, from the directed graph;
receive information about simulated fake computer network traffic from a machine learning engine comprising the multiple distributed generator instances with independent neural network parameters; and
create an automated task plan for minimizing network exposure and maximizing network resilience against simulated fake network traffic generated by the coordinated multiple distributed generator instances operating through the HLA protocols and the RTI infrastructure.
2 . The system of claim 1 , further comprising a generative adversarial network engine, wherein the generative adversarial network engine is used to optimize the automated task plan created by a hierarchical task network engine.
3 . The system of claim 2 , wherein the generative adversarial network engine:
has multiple generators distributed across multiple software instances, called federates; and
wherein each federate may have different neural network structures or hyperparameters.
4 . A method for cyber exploitation path analysis and response using federated networks, comprising the steps of:
storing a directed graph in the memory of a computing device, the directed graph comprising a representation of a computer network wherein:
nodes of the directed graph represent entities comprising the computer network; and
edges of the directed graph represent relationships between the entities of the computer network;
receiving information about a topology and setup of a network of entities, from the directed graph, using a machine learning engine comprising multiple distributed generator instances operating as separate federated processes with independent neural network parameters and communicating through high level architecture (HLA) protocols;
simulating fake computer network traffic, using a machine learning engine through coordinated operation of the multiple distributed generator instances using runtime infrastructure (RTI) for inter-federated communication;
using machine learning techniques including neural networks to attempt to classify computer network traffic either as legitimate or as simulated fake computer network traffic, using a machine learning engine;
receiving information about the topology and setup of the network of entities, from the directed graph, using a hierarchical task network engine;
receiving information about simulated fake computer network traffic from a machine learning engine comprising the multiple distributed generator instances with independent neural network parameters, using a hierarchical task network engine; and
creating an automated task plan for minimizing network exposure and maximizing network resilience against simulated fake network traffic generated by the coordinated multiple distributed generator instances operating through the HLA protocols and the RTI infrastructure, using a hierarchical task network engine.
5 . The method of claim 4 , further comprising the step of optimizing the automated task plan created by a hierarchical task network engine, using a generative adversarial network engine.
6 . The method of claim 5 , wherein the generative adversarial network engine:
has multiple generators distributed across multiple software instances, called federates; and
wherein each federate may have different neural network structures or hyperparameters.
7 . The system of claim 1 , wherein each of the multiple distributed generators operates as a separate federate process with independent neural network parameters.
8 . The system of claim 1 , wherein the multiple distributed generators communicate through high level architecture (HLA) protocols.
9 . The system of claim 2 , wherein the generative adversarial network engine coordinates the multiple generators through a runtime infrastructure (RTI) to simulate coordinated multi-vector network attacks.
10 . A method for cyber exploitation path analysis and response using federated networks, comprising:
receiving network topology information from a directed graph representation;
deploying multiple distributed generator federates for simulating fake network traffic;
coordinating the multiple generator federates to generate diverse attack scenarios;
classifying network traffic using machine learning; and
generating automated task plans for network defense.