2020 CACR AI/ML Lessons Learned Report

Abstract

Since Fall of 2019, the Indiana University Center for Applied Cybersecurity Research (CACR) has been exploring the application of machine learning to cybersecurity workflows with the intent of developing the applicable expertise necessary to maintain a commanding lead in the cybersecurity domain where machine learning solutions are expected to increasingly become the norm. In order to serve the objectives laid out in the project charter, CACR primarily worked in partnership with OmniSOC and researchers at Rochester Institute of Technology to explore the application of the ASSERT research prototype to SOC analyst workflows. The intent of this effort was to better understand both the utility of the ASSERT prototype and the challenges associated with the implementation of machine learning approaches to cybersecurity workflows more broadly.