Collaborative Research: CISE-MSI: RCBP-RF: SaTC: Building Research Capacity in AI Based Anomaly Detection in Cybersecurity

该奖项全部或部分由《2021年美国救援计划法案》（公法117-2）资助。该合作项目由HBCU机构塔斯基吉大学（TU）和R1研究密集型机构宾夕法尼亚州立大学（PSU）共同开展，旨在通过研发先进的网络入侵检测解决方案，从而准确、快速地检测入侵攻击，从而共同推动网络安全领域的研究和教育卓越性。窃取有价值的资源和/或危害网络安全的网络上未经授权的活动。特别是，该团队的解决方案将基于基于人工智能的异常检测框架，将入侵攻击视为偏离其他观察结果的罕见或异常观察，利用机器学习，自然语言处理和数据科学技术的最新进展来检测这些偏差。基于研究成果和合作努力，项目团队将提高TU在网络安全，机器学习和数据科学方面的研究能力，并加强向TU和PSU的本科生和研究生教授这些主题和最新发现的课程。在这个项目中，该团队将探索如何在网络入侵检测的背景下，通过研究利用和推进数据科学和机器学习中最先进的方法，来推进现有的异常检测系统（ADS）。例如，该团队将探索PSU团队最近在使用先进技术（例如，通过生成对抗网络、共同关注网络、少量学习和对抗示例进行数据增强）检测微妙错误信息方面取得的成功，并将其扩展/应用于其他入侵检测任务。将要开发的改进的ADS将包括(1)用于收集、标记、增强和增加高级分析数据的新策略，(2)用于数据表示、特征/表示学习和系统行为分类的解决方案，以及(3)用于开发ADS工具的实现框架。该团队希望新技术能够帮助在低误报率的情况下实现最先进的网络入侵检测精度。此外，该项目将为计算机领域历史上代表性不足的群体提供研究机会，使学生能够在网络安全和机器学习方面进行研究生学习。本项目由计算机与信息科学与工程少数民族服务机构研究扩展计划（CISE-MSI）和促进竞争研究既定计划（EPSCoR）共同资助。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

This award is funded in whole or in part under the American Rescue Plan Act of 2021 (Public Law 117-2).This collaborative project between Tuskegee University (TU), a HBCU institution, and the Pennsylvania State University (PSU), an R1 research-intensive institution, is to jointly promote research and education excellence in cybersecurity through the research and development of advanced network intrusion detection solutions to accurately and quickly detect intrusion attacks -- i.e., unauthorized activities on a network that involve stealing valuable resources and/or jeopardize the security of the network. In particular, the team’s solutions will be based on an AI based anomaly detection framework, treating intrusion attacks as rare or anomalous observations that deviate from other observations, exploiting recent advancements in machine learning, natural language processing, and data science techniques to detect these deviations. Based on the research results and collaboration efforts, the project team will improve TU’s research capacity in cybersecurity, machine learning, and data science, and enhance the curriculum for teaching these topics and latest findings to undergraduate and graduate students at both TU and PSU.In this project, the team will explore how to advance existing anomaly detection systems (ADS) through investigating ways to exploit and advance state-of-the-art methods in data science and machine learning in the context of network intrusion detection. For instance, the team will explore the recent successes in detecting subtle misinformation using advanced techniques (e.g., data augmentation via generative adversarial networks, co-attention networks, few-shot learning, and adversarial examples) by the PSU team and extend/apply them to other intrusion detection tasks. The improved ADS to be developed will include (1) novel strategies for collecting, labeling, enhancing, and augmenting data for advanced analytics, (2) solutions for data representation, feature/representation learning, and classification of system behaviors, and (3) an implementation framework for developing ADS tools. The team expects the new techniques to help achieve state-of-the-art accuracy in network intrusion detection with low false-positive rates. Further, the project will provide research opportunities for people from historically underrepresented groups in computing that will enable students to pursue graduate studies in cybersecurity and machine learning.This project is jointly funded by the Computer and Information Science and Engineering Minority-Serving Institutions Research Expansion Program (CISE-MSI) and the Established Program to Stimulate Competitive Research (EPSCoR).This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.