Cybercom seeing successes with Panoptic Junction artificial intelligence capability

An AI tool developed to help defend Defense Department networks has been effective during its pilot phase and it may be expanded in the future, according to a senior U.S. Cyber Command official.

The capability, known as Panoptic Junction, is part of an effort undertaken by Army Cyber Command, a service component command of Cybercom.

“ARCYBER is piloting an AI, machine learning platform that will enable scalable, continuous security monitoring of networks and platforms. It analyzes system compliance, threat intelligence and streaming cyber event data, which will enable advanced detection of adversary activity, malware and anomalies at speeds that human analysts would not come close to. But not only is it fast, it’s agile. It is rapidly taking the pulse of networks and assimilating threat information simultaneously, protecting networks in real time. And it is performing these security assessments in the lens of what is most applicable to the specific architecture” that it’s supporting, Morgan Adamski, executive director of Cybercom, said Wednesday at CyberTalks.

A series of assessments kicked off in April.

Adamski told DefenseScoop that officials have already seen “a lot of great successes” with the technology.

“It’s increased efficiencies in operations and maintenance. It’s improved our ability to identify risk and detect adversary activity. It’s … provided real -time hardening recommendations and improved the technical ability of our force,” she said on the sidelines of the conference.

“Part of the purpose of creating these pilots is to test out the efficiency of it and then determine whether or not it’s applicable to that enterprise-wide approach, which shows a lot of promise,” Adamski added. “Our hope is that we’ll continue to see good things come out of it and then we can make that determination, and then we can roll it into the larger enterprise funding aspect of it.”

Cybercom stood up its AI Task Force within the Cyber National Mission Force a few months ago. The CNMF is a sub-unified command under Cybercom made up of 39 joint teams and thought to have the DOD’s most talented cyber operators.

The task force intends to explore applications within the context of operational execution, in real time, and allow AI capabilities to be employed for immediate use in 90-day windows, according to Adamski.

“We came to find that we needed operational use cases, real-world practice of how we wanted to leverage AI so that we can learn and better inform our way forward,” she said during her keynote at the conference.

The Department of Defense Information Network (DODIN) is massive, with more than 3 million users globally on any given day. And it frequently comes under digital attack, Adamski noted.

AI technology is seen as a solution for quickly analyzing potential threats to the network and rapidly deploying defenses.

The task force is keeping an eye on a number of efforts across the enterprise, such as Panoptic Junction.

“The Cyber National Mission Force oversees the AI Task Force, and the AI Task Force is responsible for seeing all of these pilot activities across the cyber mission force. So it can be specific to the Cyber National Mission Force, but it also can be specific to the cyber components,” Adamski explained, adding that the task force is responsible for “herding and capturing all the great things happening across the [services’] cyber components,” including ARCYBER.

Members of the task force, which is still small right now, have high technical skills, she noted.

“We are building that team as quickly as possible, and we’re also partnering with [federally funded research-and-development centers], research labs, private sector. So we’re looking to augment that technical talent as quickly as possible,” Adamski told DefenseScoop.