CADE
A forensic analysis tool for cyber-technical
and cyber-social attacks
A forensic analysis tool for cyber-technical and cyber-social attacks
Cyber Adversary Discovery Engine (CADE)
CADE from Charles River Analytics delivers an AI-based tool that analysts can use to visualize and test their hypotheses about the tactics, techniques, and procedures (TTPs) that threat actors adopt.
As cyber warfare ramps up, analysts need effective forensic analyses of cyberattacks on IT infrastructure (cyber technical) and social media operations spreading disinformation (cyber social). Unfortunately, cyberattacks have become increasingly complex with explicit obfuscation techniques to avoid being detected. Worse, actors change strategies dynamically in reaction to real-time events. As a result of these complexities, forensic analysis, especially of cyber-social attacks, have largely been conducted manually.
“With CADE, we are developing a thought accelerator system that works with the complex reasoning that analysts are already doing in their heads. Having an analyst put their thoughts down in terms of visualizations helps them put the puzzle pieces together more effectively.”
Dr. Bryan Loyall
Director of Technology Innovation and Principal Scientist on the CADE effort
Efficiency with limited resources
Such a tool is especially useful at a time when trained cybersecurity analysts are a precious resource and hard to come by.
Thorough forensic analysis through AI requires three components:
- A way to model complex and multitiered TTPs from threat actors
- A way to recognize and interpret attacker behaviors in the data
- A tool that can enable analysts to visualize the complex layers and test their hypotheses easily; the tool would also alert analysts of changes in threat actor TTPs, which could signal a new front in the attack
CADE addresses all three pillars: it represents the sophisticated TTPs of today’s cyberattackers, helps find attacks in forensic data, and collaborates with analysts to identify goals, behaviors, and changes in TTPs. The system also identifies individual threat actors by tracking their signature TTPs and their evolution over time.
The R&D funding for CADE is provided by the Office of Naval Research Small Business Technology Transfer (STTR) program, which is intended to foster transitions of joint efforts between qualified small businesses and research institutions. Charles River is partnering with the University of California, Santa Cruz, led by Professor Magy Seif El-Nasr. Dr. Seif El-Nasr’s research focuses on using machine learning and visualization systems to understand and track behavior through analytics.
Phase I of the project designed and demonstrated the feasibility of CADE. The project is now in Phase II, which will develop a prototype that helps identify and understand adversary behavior, tracks changes over time, and flags those that do not result from known events. CADE is developed with cognitive models and probabilistic programming language-based machine learning, which can build robust models even from small amounts of data.
Future iterations of CADE will enable analysts to turn certain events “on” and “off” in visualization panels, so analysts can eliminate confirmation bias or test-drive competing hypotheses and match those against the data. CADE accounts for multiple factors such as time and space so analysts can see patterns they might not have easily seen before.
Contact us to learn more about CADE and our capabilities in cybersecurity.
This material is based upon work supported by the Office of Naval Research under Contract No. N68335‑20‑C‑0401. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the Office of Naval Research.
