DARPA takes on cyber defense with hackathons

Developing proven cyber defense tools is a top priority for the Defense Advanced Research Projects Agency. The agency is trailblazing with its Cyber-Hunting at Scale program that seeks to develop capabilities that can protect multiple DOD enterprise networks.

FCW sat down with Jennifer Roberts, the CHASE program manager in DARPA's Information Innovation Office at the agency's inaugural AI Colloquium March 7 to talk about what cyber capabilities are in the works.

The following interview has been edited for length and clarity.

FCW: Looking in the future, what can we expect from CHASE program? What milestones are you trying to hit?

Roberts: If you look at cyber defense across multiple enterprise networks, what you'll find very quickly is maybe on the order of a dozen networks, and the folks who are using those networks already generating cyber defense-relevant data.

But then, if you aggregate the amount of data storage that we [need] in order to process that data and detect who is attacking our networks, we have a fraction of that. Often it's on the order of 100 petabytes aggregate, and it depends on the network. That means the cyber-relevant data that can tell us who's attacking the network is an order of magnitude larger than our storage capabilities every single month. So we can't catch up.

We also have a constraint where algorithmically we can only process a very small fraction of the data in front of a human analyst.

The essence of the program is how do you get the right data from the right device at the right time in order to really bolster our security in our networks.

FCW: Cyber defense is something that DOD wants solved yesterday. And you've outlined some of the challenges, how far are you from surmounting them and making CHASE fieldable?

Roberts: There are a number of technical areas, and there's also a balanced portfolio where we have some technologies that we expect to be up and running more quickly.

On the detection characterization piece, once we collect data, how do we more accurately detect who's attacking the network and [find] what's unusual? There's also the feedback loop where if we didn't collect the right information the first time, we can go back and adjust our sensors to get clarification.

Think of a computer acting as a VPN. We might want to adapt our sensors so that we can now have the analyst say, "Yeah, that is weird." But more than that, have the algorithm say, "Well I actually want these three log types from that host to be able to provide more information from the analyst" and really dive in quickly and identify what to do next. Do you isolate the device? Do you move it to a honey pot? What do you do?

As we look across the programs, some of these technologies are essentially ready to have impact for people in the DOD networks today. Some of them we're continuing to develop and expect to have a steady stream of capabilities over the next four years.

FCW: How are these "ready" capabilities are being utilized?

Roberts: We're really focusing the program on the development of components that could be applicable to a number of different scenarios, [including] where we have a security operation center operating 24/7 and we have some DOD partners that are connecting our performers with real-time data feeds so that we can do demonstrations.

We just kicked off that effort last week and expect to have some more impressive demonstrations by June. Those partners would take the results and decide which to integrate into their platforms.

We're also partnering with folks that do triage, the cyber protection teams where they're going out and trying to improve the defense of the network on a short time frame.

FCW: Is there consideration of taking these capabilities outside of DOD?

Roberts: We're exploring partnerships with other government agencies. We're very interested in sharing the technology broadly in whatever way makes sense.

FCW: From that standpoint, how long do you think it would take to hit those corners of the federal government?

Roberts: That's a goal that's not achieved by DARPA alone. DARPA is focused on R&D.... But in order to get to where we have some type of platform that's deployed to hundreds of parts of government networks, that requires investments from the agencies that are building platform and deployment technology and providing the long-term maintenance.

What we end up doing is forming partnerships with the organizations that might shelter the technology long-term. And during the course of the program we're working to establish these partnerships with the folks that will be responsible for maintenance and the second half of development, working alongside the researchers, so we can really build the technologies to be used by many folks ... and make it easier for analysts to protect their networks.

FCW: How have you dealt with the pressure for new tech and capabilities with budget fluctuations?

Roberts: There's some very nice leadership that's coming out of U.S. Cyber Command right now that is really thinking deeply and thoughtfully about these issues. So I think there's a lot of interest in the coordination and trying to make sure we have a technical vision that makes sense for everyone.

From the DARPA side, we had a hackathon last week with representatives from five different parts of the DOD community who were interested in trying to help us with test and evaluation of the technology in a mission or operational context.

We also have ongoing conversations with the folks who are in charge of the mission processes that make it so that we can figure out some long-term support once the DARPA program concludes.

We're about six months in, and we're having a lot of conversations to figure out who are the right people do the sustainability plan. That's something we're working on very early in the program so that we can set up these partnerships ... so we can build technology people will want to use.

FCW: Was this your first hackathon?

Roberts: The first in-person one for the CHASE program. We kicked off in July and we had an online workshop to get people acclimated to the computing infrastructure in October or November timeframe. And then we had our first in-person one last week.

FCW: Any more planned for this year?

Roberts: Right now, folks are working on data demonstrations on a large data feed that's enterprise-sized, and we're hoping to have another event in the June timeframe with close family and friends given the nature of the data. And we're going to do demonstrations that will push on things like scalability and whether the algorithms can really operate at the size they would need to in order to protect DOD networks.