A woman touches a hot stove, but thanks to the nervous system, she snatches her hand away before she gets too hurt. A virus enters the body, but the immune system fends off the invader before it can cause too much damage. What if our computers and smartphones could respond to security threats in the same proactive way our bodies respond to health threats?

University of Arizona researchers are developing a form of cybersecurity inspired by these human biological systems that detect and address threats in their earliest stages. The team will also offer training and research opportunities to students from underrepresented backgrounds.

The Partnership for Proactive Cybersecurity Training project is funded by a three-year, $3 million grant from the National Nuclear Security Administration's Minority Serving Institution Partnership Program. The UA, which was designated as a Hispanic-Serving Institution in 2018, is collaborating with Howard University, Navajo Technical University and Argonne National Laboratory.

"I felt we could learn about how the body protects us by reacting to threats and maybe apply it to cyber by building a 'cyber immune system,'" said Salim Hariri, UA electrical and computer engineering professor and the project's principal investigator. "We're trying to build these abilities where, when somebody attacks your computer, these measures can detect the attack and act on it before you're even aware something is compromised."

The term "cybersecurity" might bring to mind images of government secrets and companies managing large quantities of information, but it's an important issue for anyone who owns a computer or smartphone.

"You carry around this phone that's networked to all kinds of servers, and your information is very vulnerable," said Tamal Bose, head of the Department of Electrical and Computer Engineering and co-investigator on the project. "Cyberspace is the domain where most wars are going to be fought in the future."

Machine Learning to Improve Security

Traditional approaches to cybersecurity have been reactive and ad-hoc. A device is attacked, or threatened, and then the cybersecurity system tries a handful of strategies to mitigate the damage or counter the attack. The team hopes to create a scientific approach that catalogs exactly which strategies attackers have at their disposal, almost like a playbook in football. Then, researchers can develop their own playbook of defense methods, carefully monitor the "vitals" of the cybersystem, and be ready to respond at the first sign of an attack.

"The moment we see abnormal behavior, we want to be able to say, 'Oh, that's play No. 5 and I already have a way to respond to it, and I can act on it quickly,'" Hariri said. "An attacker can reach hundreds of thousands of devices in a fraction of a second, so we need our ability to detect threats and protect a system to work just as quickly."

The team is using machine learning methods. In this type of artificial intelligence, machines teach themselves how to recognize patterns and learn new tasks, meaning humans don't have to step in and program the machines every time they want them to do something new.

To teach a machine to recognize a cactus, for example, a researcher would show the machine thousands of photos of cactuses until the machine learned to recognize the color, spines and size that make a cactus a cactus. Likewise, a machine exposed to thousands of examples of cybersecurity threats through machine learning techniques would come to recognize such threats on its own.

Machine learning is especially useful in a cybersecurity context because attackers, with a whole playbook of tactics at their disposal, often evolve their methods. How they attack a computer today might be different from the way they do it tomorrow, so the cybersecurity system must be able to learn as it goes along, detect changes in the environment and even anticipate changes before they occur.

Co-investigator and electrical and computer engineering assistant professor Gregory Ditzler continues the analogy of a hand on a hot stove. "Once you put your hand down on that stove, you know not to touch it again, because it's hot," he said. "But how can you be prepared to recognize other dangers, like putting your hand in a toaster? This is where machine learning comes in."

Training Opportunities for Underrepresented Groups

The grant takes a two-pronged approach to improving the science of cybersecurity. While researchers develop these new techniques, they'll also be training students from the UA, Howard University and Navajo Technical University – especially underrepresented minority groups and women – to become highly skilled members of the cybersecurity workforce.

"The hottest jobs, and some of the highest-paid jobs, today are in cybersecurity," Hariri said. "If I were a student who wanted job security, a high salary and the chance to make a big impact on our society, this is the field I would want to study."

The initiative will include an eight-week summer education program on the UA campus, set to begin in 2020, and a cybersecurity class that takes place in a virtual lab, which can be accessed from anywhere with internet connectivity. It will also provide students opportunities to do internships with the Department of Energy and in other government labs, where they will conduct research and learn about emerging technologies, preparing them to go on to jobs in the cybersecurity field. In addition, the team will integrate cybersecurity modules into existing UA courses.

"We hear a lot of stories about advances in computing or physical technology being used to improve human health," said UA President Robert C. Robbins. "But what makes the Fourth Industrial Revolution unique is the physical, biological and data sciences converging in unexpected ways. Researchers learning from human biological systems to inspire a new tool that improves cybersecurity is the kind of innovative thinking we need, and is characteristic of the UA's problem-solving culture. Involving underrepresented students makes this effort an even more powerful example of UA expertise creating real-world impact at the intersection of research and the student experience. We are building a highly skilled workforce that will continue tackling grand challenges well into the future."