Published on 17 August 2023

Research Program 3b - Cyber & Intelligence Analytics

In this day and age, cyberspace is of vital importance to civilian authorities, the private sector and also the Swiss Armed Forces. It connects systems all over the world and thus allows critical business processes to be recreated digitally. As a result, information can be exchanged in a timely manner. It therefore comes as no surprise that cyberspace and information-sharing environments are targets of direct attacks and are used to provide misinformation within hybrid warfare campaigns. Data technologies make it possible to protect these spaces by processing data efficiently with the aim of detecting any activities or threats at an early stage, for example. Artificial intelligence (AI) and Big Data systems utilise large volumes of data for intelligence analyses in order to identify connections and anomalies. The Cyber & Intelligence Analytics research program is focusing its efforts on new technologies and architectures with the aim of processing data in cyberspace for defence purposes and of ascertaining the opportunities and risks that come with AI.

Cyberspace — © DDPS

Today, information and communication systems (ICT) form the backbone of our society. On the one hand, authorities are automating administrative processes and armed forces are ramping up the digitisation of sensor intelligence collection and tactical reconnaissance network (SNFW). On the other hand, information is being increasingly shared and consumed via social media. Adversarial actors can exploit this situation to penetrate ICT systems, intercept and manipulate data and prevent access to services. AI systems that are increasingly being utilised for a wide range of applications are not isolated from such risks.

Data science and concepts based on artificial intelligence. The collection and evaluation of data can thus open up new opportunities that can provide a tactical advantage. In this context, suitable technologies make it possible to acquire information that uncovers suspicious activities in cyberspace and information-sharing environments, while also providing information about potential adversaries and their intentions.

The research program is focusing on improving skills and competences in data acquisition and analysis using novel KI concepts. The emergence of new algorithms and mathematical models is making it possible to identify more complex connections within data and to partially automate processes to a greater extent. However, these concepts are not only creating opportunities, but are also opening us up to new challenges that have to be constantly evaluated as well as new attack vectors for which we need to be prepared. AI is also vulnerable to a wide range of attacks and methods of manipulation that can negatively impact its behaviour and predictions, which may result in it making incorrect decisions with potentially serious implications. As a consequence, methods are being developed within the research program to increase the robustness and the general trustworthiness of AI.

The skills and competences acquired through this work are shared with the operational units of the Swiss Armed Forces in order to assist them in their intelligence and cyberdefence duties. To this end, large volumes of heterogeneous data need to be processed in the shortest time possible in order to identify key information that will provide decision makers with a tactical advantage. For this purpose, a wide range of high-performance computing are being evaluated and experiments are being carried out with innovative Big Data architectures.

Competence sectors

• Identification of activities and threats in cyberspace and information-sharing evironments

  

  Identification of activities — © DDPS

  Algorithms are being developed with cutting edge artificial intelligence with the aim of being able to identify and promptly respond to suspicious activities in ICT systems. Such activities may be attacks aimed at putting an ICT system or critical infrastructure out of operation, extracting sensitive data or gaining a strategic advantage. To this end, a wide range of cyber data sources are being used. Furthermore, it is also possible to identify threats and potential bad actors that aim to manipulate information and sway public opinion.

• Evaluation support for intelligence activities

  

  Evaluation support for intelligence activities — © DDPS

  A great many open sources of information are available nowadays. The task of quickly reviewing and processing large amounts of relevant information is exerting an ever-increasing amount of pressure on the analytical capabilities available to the Swiss Armed Forces. AI algorithms can be used in this situation as a tool to help prioritise and filter information quicker as well as to evaluate and make predictions about geopolitical situations, such as conflicts, insurgencies, riots and migration patterns. The methods developed provide for optimised information processing and a more accurate operational picture.

• Utilisation of Big Data technologies for efficient data management

  

  Big Data technologies — © DDPS

  Cyberspace generates huge volumes of data every minute. In addition to the training of AI models, these swathes of data are also processed in real time to gain an edge over competitors in terms of the knowledge possessed. However, this requires a Big Data infrastructure that enables the efficient storage and processing of what is typically a very large and heterogeneous volume of data. To make these systems more efficient, this competence sector is developing new hardware concepts as well as new architectures for the future. Within the context of defence, it is vital to be able to count on an efficient and secure internal solution that is not dependent on cloud services.

• Ensuring artificial intelligence is robust and secure

  

  Ensuring AI is robust and secure — © DDPS

  AI models are vulnerable to various forms of manipulation, such as falsified training data or through the addition of specifically controllable back doors. Furthermore, it is even possible to extract restricted non-public training data from a published AI model, which poses a huge risk to data privacy and confidentiality. AI provides for a larger area of attack in cyberspace, thus making it potentially vulnerable. For this reason, it is vital that each AI model be thoroughly assessed prior to integration with regard to its individual benefits and associated risks. To possess the necessary capabilities for this, this competence sector endeavours to develop methods with which the reliability of these models can be determined – whether in terms of performance or robustness.

Technology demonstrators

• Anticipation of conflicts

  

  Anticipation of conflicts — © DDPS

  The ability to anticipate conflicts can be of a huge tactical advantage for peace and political negotiation strategies. Using various public sources of data such as social networks and media, armasuisse S+T has developed algorithms that can evaluate and forecast the political stability of a country.

• Risks of automatic code generation

  

  Risks of automatic code generation — © DDPS

  There is an increasing number of tools such as ChatGPT and CoPilot available to developers. These tools can be used to automatically generate code from a description of the functions to be implemented. Although this process can be used to save time when compared with conventional application development methods, extensive security aspects have to be taken into consideration here. This project demonstrated that the automatic generation of code is not flawless and back doors can be hidden in such code.

• Collaborative detection of malware

  

  Collaborative detection of malware — © DDPS

  It is important to protect sensors and stakeholders in networks against malware – especially in Internet of Things environments. This harmful software could impair the sensor intelligence collection and tactical reconnaissance network (SNFW) and prevent the Swiss Armed Forces from carrying out its duties. For this reason, this project has developed a distributed approach based on machine learning to ensure that devices can identify such attacks and exchange knowledge of potential threats collaboratively among themselves.

• Misuse of generative AI for influencing activities

  

  Misuse of generative AI — © DDPS

  Thanks to generative AI, it is now really easy to generate images and even videos. Although these tools can be used for creative purposes, there is also a risk that they are misused, i.e. images can be generated and shared with the public with the aim of influencing public opinion and potentially destabilising democracy. It is therefore important to know how these tools work, e.g. the capability of identifying artefacts in images that make it possible to differentiate between genuine and fake images is particularly essential.

Network

Thanks to a partner network of experts from universities, industry and the government, the Cyber & Intelligence Analytics research program ensures the availability of the required technological competences.

Contact

Gerome Bovet — © DDPS

Gérôme Bovet, our «Cyber & Intelligence Analytics» research program manager is delighted at your interest.