Human-in-the-Loop Approach in Lawful Interception

我们的目标是进一步提高与合法拦截(LI)相关的技术能力，以满足快速变化和发展的世界的需求。我们的目标是通过我们的合作伙伴提供当前最先进的技术，并研究如何改进这一技术，以满足数字世界日益增长的需求，以确保在不损害他人的情况下检测到威胁。我们将与我们的项目合作伙伴SS8合作，在虚拟环境中推进他们的硬件提供的当前最先进的技术，将高速探测器与所谓的智能探测器技术相结合。在这项工作中，我们还将利用我们与Palo Alto Networks的关系和IXIA解决方案来创建一个强大而现实的测试环境，能够模拟真实世界网络情况下的流量。作为这个项目的结果，我们希望大大增加我们对该领域的了解，以及该领域适应技术和使用模式新变化的整体能力。通过我们与行业和政府的联系，另一个目标是利用我们在这个项目中发现的信息来提供信息并制定有价值的指导方针，帮助该领域继续适应并进一步将这些指导方针提供给标准委员会以及总部设在英国的机构。我们这项研究的计划是能够将研究概念带入“现实世界”，在安全问题变得明显时开发解决方案。这不仅将为安全部门提供宝贵的创新，还将允许研究员和他的团队的发展，以及公司进入一个如果没有英国政府的支持就不可能进入的领域。博士学位只有一个背景研究和问题理解，有三个关键领域：人与系统的交互，解决这个问题的最先进的机器学习方法，以及熟悉利益相关者使用的特定技术。研究具有挑战性的背景，了解参与其中的人。在不同级别的决策中，人的参与。我们必须首先了解相关人员是谁，以及他们如何为这条管道做出贡献。他们的专业水平如何？他们有多少时间和能力来解释-或与系统交互？哪些类型的解释或通过互动进行的解释是合适的？例如：通过提供洞察力和决策来改进算法的学习，将人类包括在循环中，这种方法对时间要求较低，并且可以脱机。相比之下，由于要处理的数据量非常大，在线交互和解释更加困难，可能会更专注于指导计算时间或丢弃数据，例如过滤物联网流量，专注于某些IP地址或通信类型，所有这些都基于当前的情报。这项研究将导致方法和设计的形式化，其中人被适当地嵌入决策系统。第二年的原型系统设计，速度快，可以通过交互向用户提供准确的见解。在第一种情况下，学生将训练一个离线模型，并比较各种技术，以确定从两个关键的最佳选项它是快速的预测，并可以在定制的硬件，可以工作在ITSUS系统。此外，这一原型阶段将有助于改进社会技术决策-例如对手检测-通过循环中的人的主动学习和理解通过洞察交互支持对这个海量数据集的主动学习，我们将需要能够与运营商合作，为数据和验证预测找到合适的标签。我们将部署一个主动学习框架，以确定信息量最大的数据点，并从操作员那里获得有关其性质的反馈。3改进评估和写作

We aim to further the capability of the technologies related to Lawful Intercept (LI) to match the needs of a rapidly changing and developing world. We aim to build on the current state of the art technology, which will be provided through our partner, and investigate ways that this can be improved to match the increasing demands of the digital world to ensure threats are detected without detriment to others. We will be working with our project partners SS8 to advance the current state-of-the-art techniques provided by their hardware in a virtualised environment to combine high speed probes with so-called smart probe technology. In this endeavour, we will also leverage our relationships with Palo Alto Networks, and IXIA solutions to create a robust and realistic test environment, capable of simulating traffic experienced in a real-world network situation. As a result of this project, we hope to have greatly increased our understanding of the field, and the overall capacity of the field to adapt to new changes in technology and usage patterns. Through our ties to industry and government it is another goal to use what we discover in this project to inform and produce valuable guidelines that will help this field continue to adapt and further provide these to the standards committees as well as UK based institutions. Our plan for this research is to be able to take the research concepts into the "real world" developing solutions to security problems as they become apparent. This will not only provide valuable innovation for the security sector but will also allow for development of the fellow and his team, and the company moving into a field that would not be possible without the support of the UKRI.The PhD.Year one - background research and problem understanding to which there are three key areas: human interaction with the system, state-of-the-art machine learning approaches tothis problem and familiarisation with the specific technology used by the stakeholder. Researching the challenging context and understanding the humans involved.There is human involvement at different levels of decision making. We have to first understand who the relevant people are and how they are contributing to this pipeline. What is their level of expertise? How much time and capacity do they have to interpret - or interact with the system? What types of interpretation or explanation through interaction are suitable? Forexample: inclusion of humans in the loop by providing insight and decisions to improve the algorithm's learning, this approach is less time critical and can be moved off-line. In contrastin-line interaction and interpretation is more difficult due to the very high volumes of data being processed and might focus more on directing computation time or discarding data e.g.filtering IoT traffic, focussing on certain IP addresses or types of communication all based on current intelligence. This research will lead to formalisations of approaches and designswhere the human is appropriately embedded in decision-making systems. Year two Prototyping system designs that are fast and can provide accurate insights to users through interaction. In the first instance, the student will train an offline model and compare various techniques to identify the best option form two key it is fast in producing predictions, and can be implemented in custom hardware that can work on ITSUS systems. Furthermore, this prototyping phase will serve to improve the social-technical decision making - e.g. adversary detection - through human in the loop active learning and understanding through insight interaction Supporting active learning on this massive dataset, we will need to be able to work with operators to find appropriate labels for data and verifying predictions. We will deploy an active learning framework to identify the most informative data point and get feedback on its nature from the operators.Year 3Refining evaluations and writing