You are here

Cyber Adversary Discovery Engine (CADE)

Award Information
Agency: Department of Defense
Branch: Navy
Contract: N68335-20-C-0401
Agency Tracking Number: N19A-021-0127
Amount: $1,999,915.00
Phase: Phase II
Program: STTR
Solicitation Topic Code: N19A-T021
Solicitation Number: 19.A
Solicitation Year: 2019
Award Year: 2020
Award Start Date (Proposal Award Date): 2020-05-04
Award End Date (Contract End Date): 2024-04-29
Small Business Information
625 Mount Auburn Street
Cambridge, MA 02138-4555
United States
DUNS: 115243701
HUBZone Owned: No
Woman Owned: No
Socially and Economically Disadvantaged: No
Principal Investigator
 Bryan Loyall
 (617) 491-3474
Business Contact
 Erica Hartnett
Phone: (617) 491-3474
Research Institution
 Northeastern University Professional Advancement Network
 Magy Seif El-Nasr
360 Huntington Ave
Boston, MA 02115-0000
United States

 (617) 373-3928
 Nonprofit College or University

Cyber warfare is a rapidly expanding, critical battlefield for the US Navy. Attacks on infrastructure, ship systems, and sailors themselves can significantly reduce operational readiness and deployment time, and can be very costly. To prepare and successfully defend this rapidly evolving battlefield, defensive cyberspace operations (DCOs) must analyze and forensically investigate attacks, but few tools support this analysis. Skilled analysts must manually and forensically analyze attacker behaviors, which requires significant investments in staff, time, and money, and limits the breadth and depth of the possible analyses. These constraints limit situation awareness of critical adversary behaviors, defensive preparedness, and the ability to defend critical assets. To address this need, Charles River Analytics conducted a Phase I effort to design and demonstrate the feasibility of the Cyber Adversary Discovery Engine (CADE) for forensic cyber analysis. CADE combines expressive behavioral modeling technology with machine learning to automatically recognize adversary behaviors, goals, and tactics, techniques and procedures (TTPs). CADE also automatically recognizes changes in adversary TTPs that occur in forensic data, and provides a collaborative AI-based partner to enable analysts to deeply understand the behaviors, goals and TTPs of attackers. We propose a Phase II effort to develop a full-scope CADE system, which will include: (1) the Cyber Behavioral Modeling System, which models the dynamic and adaptive cyber attacker behaviors; (2) algorithms and methods, based on probabilistic programming, that infer behaviors, goals, and TTPs from data; and (3) the Interactive Cyber Visualization and Exploration system, which visualizes complex cyber data, as well as the inferred behaviors, goals, and TTPs. Under a Phase II effort, we will demonstrate and evaluate this system under realistic conditions to elicit feedback and assess functionality to ensure CADE meets the expectations of end users. Ultimately, CADE’s cutting-edge behavioral analysis will help analysts in Government and commercial markets understand the higher level TTPs and goals of adversaries, and will advance the technology used to perform forensic cyber analysis for cyber-social and cyber-technical attacks. Understanding the behaviors of adversaries will support a wide range of defensive strategies that are key to our national security, and will help create simulation environments to bolster our nation’s defense against subtle and pervasive attacks on social media platforms and computer systems.

* Information listed above is at the time of submission. *

US Flag An Official Website of the United States Government