Using AI/ML to gain situational understanding from passive network observations
This work addresses network security and management challenges for government or organizational IT teams, but it appears incremental as it combines existing domain knowledge with machine learning techniques.
The paper tackles the problem of limited situational understanding from network traffic in government buildings by developing an AI/ML system that converts passive observations into actionable insights, resulting in capabilities such as device characterization, unauthorized device detection, and sensitive information leakage identification.
The data available in the network traffic fromany Government building contains a significant amount ofinformation. An analysis of the traffic can yield insightsand situational understanding about what is happening inthe building. However, the use of traditional network packet inspection, either deep or shallow, is useful for only a limited understanding of the environment, with applicability limited to some aspects of network and security management. If weuse AI/ML based techniques to understand the network traffic, we can gain significant insights which increase our situational awareness of what is happening in the environment.At IBM, we have created a system which uses a combination of network domain knowledge and machine learning techniques to convert network traffic into actionable insights about the on premise environment. These insights include characterization of the communicating devices, discovering unauthorized devices that may violate policy requirements, identifying hidden components and vulnerability points, detecting leakage of sensitive information, and identifying the presence of people and devices.In this paper, we will describe the overall design of this system, the major use-cases that have been identified for it, and the lessons learnt when deploying this system for some of those use-cases