Human-in-the-Loop Approach in Lawful Interception

我们的目标是进一步提高与合法截获（LI）有关的技术的能力，以配合迅速变化和发展的世界的需要。我们的目标是建立在当前最先进的技术基础上，该技术将通过我们的合作伙伴提供，并研究可以改进的方法，以满足数字世界日益增长的需求，以确保在不损害他人的情况下检测到威胁。我们将与我们的项目合作伙伴SS8合作，在虚拟环境中推进当前最先进的硬件技术，将高速探头与所谓的智能探头技术相结合。在这项工作中，我们还将利用我们与帕洛阿尔托网络公司的关系，以及IXIA解决方案来创建一个强大而逼真的测试环境，能够模拟真实网络情况下的流量。作为这个项目的结果，我们希望大大增加我们对该领域的了解，以及该领域适应技术和使用模式新变化的整体能力。通过我们与行业和政府的联系，我们的另一个目标是利用我们在这个项目中发现的信息，并制定有价值的指导方针，帮助该领域继续适应，并进一步向标准委员会和英国机构提供这些指导方针。我们对这项研究的计划是能够将研究概念带入“现实世界”，开发安全问题的解决方案，因为它们变得明显。这不仅将为安全部门提供有价值的创新，而且还将允许研究员和他的团队发展，公司进入一个没有UKRI支持就不可能实现的领域。的博士学位。第一年-背景研究和问题理解，其中有三个关键领域：人类与系统的交互，解决该问题的最先进的机器学习方法以及对利益相关者使用的特定技术的熟悉。研究具有挑战性的环境，了解所涉及的人。在不同层次的决策中都有人类的参与。我们必须首先了解相关人员是谁，以及他们如何为这条管道做出贡献。他们的专业水平如何？他们有多少时间和能力来解释系统或与系统交互？哪些类型的解释或通过互动的解释是合适的？例如：通过提供洞察力和决策来改进算法的学习，将人类纳入循环中，这种方法对时间的要求较低，可以离线使用。相比之下，由于正在处理的数据量非常大，因此在线交互和解释更加困难，并且可能更侧重于指导计算时间或丢弃数据，例如过滤物联网流量，关注某些IP地址或基于当前智能的通信类型。这项研究将导致将人适当地嵌入决策系统的方法和设计的形式化。第二年原型系统设计快速，并能通过交互为用户提供准确的见解。在第一个实例中，学生将训练一个离线模型并比较各种技术，以从两个关键中确定最佳选择，它可以快速产生预测，并且可以在ITSUS系统上工作的定制硬件中实现。此外，这个原型阶段将通过人类在循环中的主动学习和通过洞察交互的理解来改善社会技术决策，例如对手检测。支持在这个庞大的数据集上的主动学习，我们将需要能够与运营商合作，为数据找到适当的标签并验证预测。我们将部署一个主动学习框架，以确定最具信息量的数据点，并从运营商那里获得有关其性质的反馈。完善评价和写作

We aim to further the capability of the technologies related to Lawful Intercept (LI) to match the needs of a rapidly changing and developing world. We aim to build on the current state of the art technology, which will be provided through our partner, and investigate ways that this can be improved to match the increasing demands of the digital world to ensure threats are detected without detriment to others. We will be working with our project partners SS8 to advance the current state-of-the-art techniques provided by their hardware in a virtualised environment to combine high speed probes with so-called smart probe technology. In this endeavour, we will also leverage our relationships with Palo Alto Networks, and IXIA solutions to create a robust and realistic test environment, capable of simulating traffic experienced in a real-world network situation. As a result of this project, we hope to have greatly increased our understanding of the field, and the overall capacity of the field to adapt to new changes in technology and usage patterns. Through our ties to industry and government it is another goal to use what we discover in this project to inform and produce valuable guidelines that will help this field continue to adapt and further provide these to the standards committees as well as UK based institutions. Our plan for this research is to be able to take the research concepts into the "real world" developing solutions to security problems as they become apparent. This will not only provide valuable innovation for the security sector but will also allow for development of the fellow and his team, and the company moving into a field that would not be possible without the support of the UKRI.The PhD.Year one - background research and problem understanding to which there are three key areas: human interaction with the system, state-of-the-art machine learning approaches tothis problem and familiarisation with the specific technology used by the stakeholder. Researching the challenging context and understanding the humans involved.There is human involvement at different levels of decision making. We have to first understand who the relevant people are and how they are contributing to this pipeline. What is their level of expertise? How much time and capacity do they have to interpret - or interact with the system? What types of interpretation or explanation through interaction are suitable? Forexample: inclusion of humans in the loop by providing insight and decisions to improve the algorithm's learning, this approach is less time critical and can be moved off-line. In contrastin-line interaction and interpretation is more difficult due to the very high volumes of data being processed and might focus more on directing computation time or discarding data e.g.filtering IoT traffic, focussing on certain IP addresses or types of communication all based on current intelligence. This research will lead to formalisations of approaches and designswhere the human is appropriately embedded in decision-making systems. Year two Prototyping system designs that are fast and can provide accurate insights to users through interaction. In the first instance, the student will train an offline model and compare various techniques to identify the best option form two key it is fast in producing predictions, and can be implemented in custom hardware that can work on ITSUS systems. Furthermore, this prototyping phase will serve to improve the social-technical decision making - e.g. adversary detection - through human in the loop active learning and understanding through insight interaction Supporting active learning on this massive dataset, we will need to be able to work with operators to find appropriate labels for data and verifying predictions. We will deploy an active learning framework to identify the most informative data point and get feedback on its nature from the operators.Year 3Refining evaluations and writing