Centripetal Networks, Inc. — Department of Homeland Security SBIR Phase II: H-SB010.2-003

Description

Conventional cyber-analysis is a manual process that is often ineffective. Major obstacles to improvement include the massive size of the cyber-threat, the associated volumes of cyber event data, and the lack of skilled analysts. The emerging markets of threat intelligence providers and threat intelligence gateways that enable near real-time awareness have improved productivity by an order of magnitude. This is the number of threat event investigations completed per unit time (e.g., one work day). The improvements in cyber analyst workflows has driven a market for managed security services. However, this improvement is still insufficient to counter the threat. To fill the gap, Centripetal intends to accelerate cyber analysts' productivity by another order of magnitude by researching & developing machine learning and intelligence automation techniques. These new workflow acceleration technologies "AI-Analyst" -- will be productized and commercialized by deploying them into CNI's security service. An important part of analyst acceleration is collaboration. There is an extreme shortage of analysts. It is difficult for any organization to recruit analysts to match the threat surface and workload. A number of Centripetal's customers are large financial services organizations. Even these extremely well resourced enterprises are subject to critical shortages in personnel and productivity when compared to the threat. The technical approach detailed in this proposal can reverse this mismatch by leveraging a community of cyber analysts and productizing their work hours. The analytical work product can then be used to train the AI-analyst algorithms for the benefit of the entire community of subscribers.