PRODIGAL (proactive discovery of insider threats using graph analysis and learning) is a computer system for predicting anomalous behavior among humans, by
data mining
Data mining is the process of extracting and finding patterns in massive data sets involving methods at the intersection of machine learning, statistics, and database systems. Data mining is an interdisciplinary subfield of computer science and ...
network traffic such as emails, text messages and
server log
In computing, logging is the act of keeping a log of events that occur in a computer system, such as problems, errors or broad information on current operations. These events may occur in the operating system or in other software. A message or ...
entries.
It is part of
DARPA
The Defense Advanced Research Projects Agency (DARPA) is a research and development agency of the United States Department of Defense responsible for the development of emerging technologies for use by the military. Originally known as the Adva ...
's
Anomaly Detection at Multiple Scales
Anomaly Detection at Multiple Scales, or ADAMS was a $35 million DARPA project designed to identify patterns and anomalies in very large data sets. It is under DARPA's Information Innovation office and began in 2011 and ended in August 2014
The ...
(ADAMS) project.
The initial schedule is for two years and the budget $9 million.
It uses
graph theory
In mathematics and computer science, graph theory is the study of ''graph (discrete mathematics), graphs'', which are mathematical structures used to model pairwise relations between objects. A graph in this context is made up of ''Vertex (graph ...
,
machine learning
Machine learning (ML) is a field of study in artificial intelligence concerned with the development and study of Computational statistics, statistical algorithms that can learn from data and generalise to unseen data, and thus perform Task ( ...
, statistical
anomaly detection
In data analysis, anomaly detection (also referred to as outlier detection and sometimes as novelty detection) is generally understood to be the identification of rare items, events or observations which deviate significantly from the majority of ...
, and
high-performance computing
High-performance computing (HPC) is the use of supercomputers and computer clusters to solve advanced computation problems.
Overview
HPC integrates systems administration (including network and security knowledge) and parallel programming into ...
to scan larger sets of data more quickly than in past systems. The amount of data analyzed is in the range of
terabyte
The byte is a unit of digital information that most commonly consists of eight bits. Historically, the byte was the number of bits used to encode a single character of text in a computer and for this reason it is the smallest addressable un ...
s per day.
The targets of the analysis are employees within the government or defense contracting organizations; specific examples of behavior the system is intended to detect include the actions of
Nidal Malik Hasan
Nidal Malik Hasan (born September 8, 1970) is an American former United States Army major, physician, and mass murderer convicted of killing 13 people and injuring 32 others in the Fort Hood mass shooting on November 5, 2009. Hasan, an Army Me ...
and
WikiLeaks
WikiLeaks () is a non-profit media organisation and publisher of leaked documents. It is funded by donations and media partnerships. It has published classified documents and other media provided by anonymous sources. It was founded in 2006 by ...
source
Chelsea Manning
Chelsea Elizabeth Manning (born Bradley Edward Manning, December 17, 1987) is an American activist and whistleblower. She is a former United States Army soldier who was convicted by court-martial in July 2013 of violations of the Espionage ...
.
Commercial applications may include finance.
The results of the analysis, the five most serious threats per day, go to agents, analysts, and operators working in
counterintelligence
Counterintelligence (counter-intelligence) or counterespionage (counter-espionage) is any activity aimed at protecting an agency's Intelligence agency, intelligence program from an opposition's intelligence service. It includes gathering informati ...
.
Primary participants
*
Georgia Institute of Technology College of Computing
The College of Computing is a college of the Georgia Institute of Technology, a Public university, public research university in Atlanta, Georgia. It is divided into four schools: the Georgia Institute of Technology School of Computer Science, ...
*
Georgia Tech Research Institute
The Georgia Tech Research Institute (GTRI) is the nonprofit applied research arm of the Georgia Institute of Technology in Atlanta, Georgia (U.S. state), Georgia, United States. GTRI employs around 3,000 people, and was involved in nearly $1 ...
*
Defense Advanced Research Projects Agency
The Defense Advanced Research Projects Agency (DARPA) is a research and development agency of the United States Department of Defense responsible for the development of emerging technologies for use by the military. Originally known as the Adva ...
*
Army Research Office
The Army Research Office (ARO) is a directorate within the U.S. Army Combat Capabilities Development Command Army Research Laboratory (DEVCOM ARL) responsible for managing the Army’s extramural research program. Originally a standalone organ ...
*
Science Applications International Corporation
Science Applications International Corporation, Inc. (SAIC) is an American technology company headquartered in Reston, Virginia that provides government services and information technology support.
History 20th century
The original SAIC was cr ...
*
Oregon State University
Oregon State University (OSU) is a Public university, public Land-grant university, land-grant research university in Corvallis, Oregon, United States. OSU offers more than 200 undergraduate degree programs and a variety of graduate and doctor ...
*
University of Massachusetts Amherst
The University of Massachusetts Amherst (UMass Amherst) is a public land-grant research university in Amherst, Massachusetts, United States. It is the flagship campus of the University of Massachusetts system and was founded in 1863 as the ...
*
Carnegie Mellon University
Carnegie Mellon University (CMU) is a private research university in Pittsburgh, Pennsylvania, United States. The institution was established in 1900 by Andrew Carnegie as the Carnegie Technical Schools. In 1912, it became the Carnegie Institu ...
See also
*
Cyber Insider Threat
Cyber Insider Threat, or CINDER, is a digital threat method. In 2010, DARPA initiated a program under the same name (Cyber Insider Threat (CINDER) Program) to develop novel approaches to the detection of activities within military-interest networks ...
*
Einstein (US-CERT program)
The EINSTEIN System (part of the National Cybersecurity Protection System) is a network intrusion detection and prevention system that monitors the networks of US federal government departments and agencies. The system is developed and managed ...
*
Threat (computer)
In computer security, a threat is a potential negative action or event enabled by a vulnerability that results in an unwanted impact to a computer system or application.
A threat can be either a negative " intentional" event (i.e. hack ...
*
Intrusion detection
An intrusion detection system (IDS) is a device or software application that monitors a network or systems for malicious activity or policy violations. Any intrusion activity or violation is typically either reported to an administrator or collec ...
*
ECHELON
Echelon may refer to:
* A level formation
** A level or rank in an organization, profession, or society
** A military sub-subunit smaller than a company but larger than a platoon
** Echelon formation, a step-like arrangement of units
* ECHELO ...
,
Thinthread,
Trailblazer,
Turbulence
In fluid dynamics, turbulence or turbulent flow is fluid motion characterized by chaotic changes in pressure and flow velocity. It is in contrast to laminar flow, which occurs when a fluid flows in parallel layers with no disruption between ...
(NSA programs)
*
Fusion center
In the United States, fusion centers are designed to promote information sharing at the federal level between agencies such as the Federal Bureau of Investigation, the U.S. Department of Homeland Security, the U.S. Department of Justice, and sta ...
,
Investigative Data Warehouse
Investigative Data Warehouse (IDW) is a searchable database operated by the FBI. It was created in 2004. Much of the nature and scope of the database is classified. The database is a centralization of multiple federal and state databases, includ ...
(FBI)
References
Applied data mining
Georgia Tech Research Institute
DARPA
Parallel computing
{{software-stub
Cybersecurity engineering