Booz Allen Hamilton Inc.

Aaron Sant-Miller

Andre Tai Nguyen

William Hall Badart

Kevin Field

Peter Guerra

Rachel Allen

Jesse Shanahan

Patrick Beggs

Greg McCullough

Eric Smyth

James Blaha

Sarah Olson

Morris LaGrand

A method for detecting and/or identifying a cyber-attack on a network can include segmenting the network using a segmentation method with machine learning to generate one or more network segments; assigning a score to a data point within each network segment based on a presence or absence of an identified anomalous behavior of the data point; analyzing network data flow, via behavioral modeling, to provide a context for characterizing the anomalous behavior; combining, via a reinforcement learning agent, outputs of the segmentation method with behavioral modelling and assigned score to detect and/or identify a cyber-attack; providing one or more alerts to an analyst; receiving an analyst assessment of an effectiveness of the detection and/or identification; and providing the analyst assessment as feedback to the reinforcement learning agent.

System and method for detecting and identifying a cyber-attack on a network

A method for securing a network by applying one or more artificial intelligence (AI) models in a computing environment with a computing speed selected as a function of a bandwidth of the network. The method includes receiving data at a node associated with the network, and identifying a suspected cyber adversarial event at the network. The method includes applying an AI model on the data in real-time to enrich the data with information that indicates behavior associated with an exploitation of the network, and analyzing the enriched data as part of a cyber workflow for an indication of a compromise associated with the exploitation of the network.

Network security using artificial intelligence and high speed computing

A predictive engine for analyzing existing vulnerability information to determine the likelihood of a vulnerability being exploited by malicious actors against a particular computer or network of computers. The predictive engine relies on multiple data sources providing historical vulnerability information, a plurality of predictive models, and periodic retraining of the prediction ensemble utilizing predictive models. Modeling schemes may also be used when retraining the predictive models forming the prediction ensemble.

Automated machine learning scheme for software exploit prediction

Growing community of inventors

Arlington, VA, United States of America

Aaron Sant-Miller