SKYNET (surveillance program)

Last updated

SKYNET is a program by the U.S. National Security Agency that performs machine learning analysis on communications data to extract information about possible terror suspects. The tool is used to identify targets, such as al-Qaeda couriers, who move between GSM cellular networks. Specifically, mobile usage patterns such as swapping SIM cards within phones that have the same ESN, MEID or IMEI number are deemed indicative of covert activities. [1] [2] Like many other security programs, the SKYNET program uses graphs that consist of a set of nodes and edges to visually represent social networks. [3] The tool also uses classification techniques like random forest analysis. Because the data set includes a very large proportion of true negatives and a small training set, there is a risk of overfitting. [1] Bruce Schneier argues that a false positive rate of 0.008% would be low for commercial applications where "if Google makes a mistake, people see an ad for a car they don't want to buy" but "if the government makes a mistake, they kill innocents." [1]

Contents

Participation and partnerships

NSA directorates participating: [2]

It has partnerships with TMAC/FASTSCOPE, MIT Lincoln labs and Harvard. [4]

Controversy

The SKYNET project was linked with drone systems, thus creating the potential for false-positives to lead to deaths. [1] [5]

According to NSA, the SKYNET project is able to accurately reconstruct crucial information about the suspects including their social relationships, habits, and patterns of movements through graph-based visualization of GSM data. [3] However, scholars criticize that current security literature conflate statistical discrepancies with behavioral abnormalities and that the anomaly detection methodology SKYNET perpetuates the self/other binary. [6] For example, Al-Jazeera's bureau chief in Islamabad, Ahmad Zaidan, was wrongly identified as the most probable member of al-Qaeda and the Muslim Brotherhood on their records. [1] [5] [7]

See also

Related Research Articles

Data mining is the process of extracting and discovering patterns in large data sets involving methods at the intersection of machine learning, statistics, and database systems. Data mining is an interdisciplinary subfield of computer science and statistics with an overall goal of extracting information from a data set and transforming the information into a comprehensible structure for further use. Data mining is the analysis step of the "knowledge discovery in databases" process, or KDD. Aside from the raw analysis step, it also involves database and data management aspects, data pre-processing, model and inference considerations, interestingness metrics, complexity considerations, post-processing of discovered structures, visualization, and online updating.

An intrusion detection system (IDS) is a device or software application that monitors a network or systems for malicious activity or policy violations. Any intrusion activity or violation is typically either reported to an administrator or collected centrally using a security information and event management (SIEM) system. A SIEM system combines outputs from multiple sources and uses alarm filtering techniques to distinguish malicious activity from false alarms.

Machine learning (ML) is a field of study in artificial intelligence concerned with the development and study of statistical algorithms that can learn from data and generalize to unseen data, and thus perform tasks without explicit instructions. Advances in the field of deep learning have allowed neural networks to surpass many previous approaches in performance.

<span class="mw-page-title-main">Antivirus software</span> Computer software to defend against malicious computer viruses

Antivirus software, also known as anti-malware, is a computer program used to prevent, detect, and remove malware.

VoIP spam or SPIT is unsolicited, automatically dialed telephone calls, typically using voice over Internet Protocol (VoIP) technology.

In data analysis, anomaly detection is generally understood to be the identification of rare items, events or observations which deviate significantly from the majority of the data and do not conform to a well defined notion of normal behavior. Such examples may arouse suspicions of being generated by a different mechanism, or appear inconsistent with the remainder of that set of data.

Hassan Ghul, born Mustafa Hajji Muhammad Khan, was a Saudi-born Pakistani member of al-Qaeda who revealed the kunya of Osama bin Laden's messenger, which eventually led to Operation Neptune Spear and the death of Osama Bin Laden. Ghul was an ethnic Pashtun whose family was from Waziristan. He was designated by the Al-Qaida and Taliban Sanctions Committee of the Security Council in 2012.

Artificial intelligence (AI) has been used in applications throughout industry and academia. In a manner analogous to electricity or computers, AI serves as a general-purpose technology. AI programes emulate perception and understanding, and are designed to adapt to new information and new situations. Machine learning has been used for various scientific and commercial purposes including language translation, image recognition, decision-making, credit scoring, and e-commerce.

The following outline is provided as an overview of and topical guide to cryptography:

Fraud represents a significant problem for governments and businesses and specialized analysis techniques for discovering fraud using them are required. Some of these methods include knowledge discovery in databases (KDD), data mining, machine learning and statistics. They offer applicable and successful solutions in different areas of electronic fraud crimes.

In network theory, link analysis is a data-analysis technique used to evaluate relationships between nodes. Relationships may be identified among various types of nodes, including organizations, people and transactions. Link analysis has been used for investigation of criminal activity, computer security analysis, search engine optimization, market research, medical research, and art.

graph-tool is a Python module for manipulation and statistical analysis of graphs. The core data structures and algorithms of graph-tool are implemented in C++, making extensive use of metaprogramming, based heavily on the Boost Graph Library. Many algorithms are implemented in parallel using OpenMP, which provides increased performance on multi-core architectures.

PRODIGAL is a computer system for predicting anomalous behavior among humans, by data mining network traffic such as emails, text messages and server log entries. It is part of DARPA's Anomaly Detection at Multiple Scales (ADAMS) project. The initial schedule is for two years and the budget $9 million.

Anomaly Detection at Multiple Scales, or ADAMS was a $35 million DARPA project designed to identify patterns and anomalies in very large data sets. It is under DARPA's Information Innovation office and began in 2011 and ended in August 2014

Eclipse Deeplearning4j is a programming library written in Java for the Java virtual machine (JVM). It is a framework with wide support for deep learning algorithms. Deeplearning4j includes implementations of the restricted Boltzmann machine, deep belief net, deep autoencoder, stacked denoising autoencoder and recursive neural tensor network, word2vec, doc2vec, and GloVe. These algorithms all include distributed parallel versions that integrate with Apache Hadoop and Spark.

<span class="mw-page-title-main">Salvatore J. Stolfo</span> American computer scientist

Salvatore J. Stolfo is an academic and professor of computer science at Columbia University, specializing in computer security.

Endpoint security or endpoint protection is an approach to the protection of computer networks that are remotely bridged to client devices. The connection of endpoint devices such as laptops, tablets, mobile phones, and other wireless devices to corporate networks creates attack paths for security threats. Endpoint security attempts to ensure that such devices follow compliance to standards.

<span class="mw-page-title-main">Artificial intelligence for video surveillance</span> Overview of artificial intelligence for surveillance

Artificial intelligence for video surveillance utilizes computer software programs that analyze the audio and images from video surveillance cameras in order to recognize humans, vehicles, objects, attributes, and events. Security contractors program the software to define restricted areas within the camera's view and program for times of day for the property being protected by the camera surveillance. The artificial intelligence ("A.I.") sends an alert if it detects a trespasser breaking the "rule" set that no person is allowed in that area during that time of day.

This glossary of artificial intelligence is a list of definitions of terms and concepts relevant to the study of artificial intelligence (AI), its subdisciplines, and related fields. Related glossaries include Glossary of computer science, Glossary of robotics, and Glossary of machine vision.

The following outline is provided as an overview of, and topical guide to, machine learning:

References

  1. 1 2 3 4 5 Grothoff, Christian; Porup, J. M. (16 February 2016). "The NSA's SKYNET program may be killing thousands of innocent people". Ars Technica UK .
  2. 1 2 "SKYNET: Applying Advanced Cloud-based Behavior Analytics". The Intercept . 8 May 2015. Archived from the original on 1 January 2020. Retrieved 17 February 2016.
  3. 1 2 NSA. "SKYNET: Courier Detection via Machine Learning". Snowden Doc Search. Archived from the original on 2019-12-08. Retrieved December 7, 2019.
  4. ↑ Crockford, Kade (8 May 2015). "MIT and Harvard Worked with NSA on SKYNET Project". Privacy SOS.
  5. 1 2 Robbins, Martin (18 February 2016). "Has a rampaging AI algorithm really killed thousands in Pakistan?". The Guardian .
  6. ↑ Aradau, Claudia; Blanke, Tobias (February 2018). "Governing others: Anomaly and the algorithmic subject of security". European Journal of International Security. 3 (1): 1–21. doi:10.1017/eis.2017.14. ISSN   2057-5637. S2CID   58923172.
  7. ↑ http://cdn.arstechnica.net/wp-content/uploads/sites/3/2016/02/skynet-courier-detection-via-machine-learning-p17-normal.gif [ bare URL image file ]
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.