Collaborative Research: CISE-MSI: RCBP-RF: SaTC: Building Research Capacity in AI Based Anomaly Detection in Cybersecurity

该奖项由2021年美国救援计划法案提供全部或部分资金（公法117-2）。塔斯基吉大学（TU），HBCU机构和宾夕法尼亚州立大学（PSU），R1研究密集型机构之间的合作项目，通过研究和开发先进的网络入侵检测解决方案，共同促进网络安全方面的研究和教育准确快速地检测入侵攻击--即，网络上未经授权的活动，涉及窃取宝贵的资源和/或危及网络的安全。特别是，该团队的解决方案将基于基于人工智能的异常检测框架，将入侵攻击视为偏离其他观察的罕见或异常观察，利用机器学习，自然语言处理和数据科学技术的最新进展来检测这些偏差。基于研究成果和合作努力，项目团队将提高TU在网络安全，机器学习和数据科学方面的研究能力，并加强课程，为TU和PSU的本科生和研究生教授这些主题和最新发现。在这个项目中，该小组将探索如何通过研究利用和改进现有的异常检测系统（ADS）的方法，网络入侵检测背景下的数据科学和机器学习中的艺术方法。例如，该团队将探索最近使用先进技术（例如，通过生成对抗网络，共同注意力网络，少量学习和对抗示例进行数据增强），并将其扩展/应用于其他入侵检测任务。待开发的改进ADS将包括（1）用于收集、标记、增强和扩充高级分析数据的新策略，（2）用于数据表示、特征/表示学习和系统行为分类的解决方案，以及（3）用于开发ADS工具的实现框架。该团队希望新技术能够帮助实现最先进的网络入侵检测准确性，同时误报率较低。此外，本发明还该项目将为计算领域历史上代表性不足的群体提供研究机会，使学生能够攻读网络安全和机器学习方面的研究生课程。该项目由计算机和信息科学与工程少数民族服务机构研究扩展计划共同资助（CISE-MSI）和刺激竞争研究的既定计划（EPSCoR）该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查进行评估，被认为值得支持的搜索.

This award is funded in whole or in part under the American Rescue Plan Act of 2021 (Public Law 117-2).This collaborative project between Tuskegee University (TU), a HBCU institution, and the Pennsylvania State University (PSU), an R1 research-intensive institution, is to jointly promote research and education excellence in cybersecurity through the research and development of advanced network intrusion detection solutions to accurately and quickly detect intrusion attacks -- i.e., unauthorized activities on a network that involve stealing valuable resources and/or jeopardize the security of the network. In particular, the team’s solutions will be based on an AI based anomaly detection framework, treating intrusion attacks as rare or anomalous observations that deviate from other observations, exploiting recent advancements in machine learning, natural language processing, and data science techniques to detect these deviations. Based on the research results and collaboration efforts, the project team will improve TU’s research capacity in cybersecurity, machine learning, and data science, and enhance the curriculum for teaching these topics and latest findings to undergraduate and graduate students at both TU and PSU.In this project, the team will explore how to advance existing anomaly detection systems (ADS) through investigating ways to exploit and advance state-of-the-art methods in data science and machine learning in the context of network intrusion detection. For instance, the team will explore the recent successes in detecting subtle misinformation using advanced techniques (e.g., data augmentation via generative adversarial networks, co-attention networks, few-shot learning, and adversarial examples) by the PSU team and extend/apply them to other intrusion detection tasks. The improved ADS to be developed will include (1) novel strategies for collecting, labeling, enhancing, and augmenting data for advanced analytics, (2) solutions for data representation, feature/representation learning, and classification of system behaviors, and (3) an implementation framework for developing ADS tools. The team expects the new techniques to help achieve state-of-the-art accuracy in network intrusion detection with low false-positive rates. Further, the project will provide research opportunities for people from historically underrepresented groups in computing that will enable students to pursue graduate studies in cybersecurity and machine learning.This project is jointly funded by the Computer and Information Science and Engineering Minority-Serving Institutions Research Expansion Program (CISE-MSI) and the Established Program to Stimulate Competitive Research (EPSCoR).This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.