Artificial Intelligence for Network Defense
Last week I visited University of Georgia. While there, an old friend from the Defense Department asked me about network performance assessment. He wanted to know how to assess and measure whether the “network” is “up” or “down” for a large enterprise?
I would reword this question a bit to mirror the factors that are most important to the company’s management or customers. The reworded question could take several forms:
- To what extent is your company’s network functional for important services?
- Is the network processing all of the requested work or are parts of the network overloaded?
- Has the network been attacked or hacked? Are unauthorized persons accessing the network for services or information?
These are good questions for any company that runs a network or networks. Answering these types of questions can pose some problems. In isolation, the applications that provide most network services have no way of knowing the broader intent of network use and therefore can’t report “inappropriate” requests and actions. The shear number of services and methods (for example, at the application layer, BGP, DHCP, DNS, FTP, GTP, HTTP, IMAP, IRC, Megaco, MGCP, NNTP, NTP, POP, RIP, RPC, RTP, RTSP, SDP, SIP, SMTP, SNMP, SOAP, SSH, Telnet, TLS/SSL, XMPP, and at the internet Layer, IP (IPv4, IPv6), ICMP, ICMPv6, IGMP, IPsec, and many others) available on a network add to the difficulty. In overcoming this difficulty, artificial intelligence approaches can be highly effective in assisting network managers in understanding activities on the network.
Whether you work for the U.S. Department of Defense or a smaller enterprise, there are a large number of tools and applications available to assist the IT professional with monitoring the network, attached hardware, services and usage. Network tools and testing schemes can and do generate large amounts (megabytes+) of data concerning low-level network performance measures such as response times, packet losses, logged entries, etc. If you don’t have an Army of technicians and analysts to study all this information, then artificial intelligence methods can help analyze and reduce the quantity of data that humans must review and can point toward the most important issues that a human analyst should attend to.
So what might be an example of how to use artificial intelligence tools in the context of network monitoring, diagnosis, and remediation? Naturally, there is an almost unlimited variety of designs and techniques that could be applied in a hypothetical case. So what follows is one example of what could be done. Of course, the specifics of an actual network, its services, its hardware, and the company’s objectives would dictate the most appropriate techniques that should be applied in an actual case.
Very simple agent components can serve as the basis for network instrumentation. The agents reside on network nodes such as mail, web, or database servers, or other types of devices. These installed agents poll their assigned service or protocol, do simple metric collection, and send reports to each other for cooperative reasons and report back to a repository agent to add to the collective information about the network.
A machine learning system or classifier operates on the main data repositories looking for regularities or clusters within the data. These classified patterns can form the basis of summary reports to IT professionals for further action.
The summary reports can also be used by an expert system or rule-based production system to suggest or even autonomously take action to remediate problems within the network. The summary reports feed into a “dashboard” status system. Many human managers will prefer to review a “dashboard” type of status report which shows top level indicators of network health and possibly contains colored (red, yellow, green) status summaries for network operational functions which are of concern to the network owners.
So, the artificial intelligence tools applied (specifically, agents, machine learning/classifiers, expert systems, and rule-based production systems) work together to collect desired measures and information, analyze and summarize key events and information, report appropriate information to managers and even take action to remediate issues that are detected on the network.
I hope this generates some thinking on how to apply artificial intelligence techniques on real world applications.
-Stu
Wednesday, April 1st, 2009

This morning we signed up as a sponsor for the International Conference on Cognitive Modeling 2009 in Manchester, UK.
Interesting article the other day at PhysOrg concerning artificial intelligence research and playing poker at the University of Alberta.
We were fortunate to have AFRL research scientist, Dr. Kevin Gluck, visit our new location last Thursday. During the meeting, we discussed our current project: math modeling of human performance in complex environments. Following our weekly teleconference with the research team and demonstrations of the Predictive Performance Optimizer software tool, we enjoyed some informal discussions over dinner.
As we continue to build our application development capability and processes, we are very happy that we have been accepted as a NetBeans’ Community Partner. You can find out more about the NetBeans Community Partner program at:
The MindModeling@Home site (
Today, we are kicking off our new forum that will hopefully scratch this itch. The new forum can be found at
Researchers at the National Institute of Standards and Technology (NIST) and the University of Texas, Arlington have released a variety of briefings, reports, and results concerning the automated combinatorial testing for software. Many of the major news feeds were carrying the stories yesterday.