2024人工智能在保护美国国防工业基础软件供应链中的应用

STATE-OF-THE-ART REPORT (SOAR)JANUARY 2024 APPLICATIONS OFARTIFICIAL INTELLIGENCE(AI) FOR PROTECTINGSOFTWARE SUPPLY CHAINS(SSCS) IN THE DEFENSEINDUSTRIAL BASE (DIB) By Abdul RahmanContract Number: FA8075-21-D-0001Published By: CSIAC DISTRIBUTION STATEMENT AApproved for public release: distribution unlimited. APPLICATIONS OF ARTIFICIALINTELLIGENCE (AI) FORPROTECTING SOFTWARE SUPPLYCHAINS (SSCS) IN THE DEFENSEINDUSTRIAL BASE (DIB) ABDUL RAHMAN ABOUT CSIAC The Cybersecurity & Information SystemsInformation Analysis Center (CSIAC) is aU.S. Department of Defense (DoD) IAC sponsoredby the Defense Technical Information Center(DTIC). CSIAC is operated by SURVICE EngineeringCompany under contract FA8075-21-D-0001 and isone of the three next-generation IACs transformingthe DoD IAC program: CSIAC, Defense SystemsInformation Analysis Center (DSIAC), andHomeland Defense & Security InformationAnalysis Center (HDIAC). State-of-the-art reports (SOARs)—one of CSIAC’sinformation products—provide in-depth analysis ofcurrent technologies, evaluate and synthesize thelatest technical information available, and provide acomprehensive assessment of technologies relatedto CSIAC’s technical focus areas. Specific topic areasare established from collaboration with the greatercybersecurity and information systems communityand vetted with DTIC to ensure the value-addedcontributions to Warfighter needs. CSIAC serves as the U.S. national clearinghousefor worldwide scientific and technical informationin four technical focus areas: cybersecurity;knowledge management and information sharing;modeling and simulation; and software dataand analysis. As such, CSIAC collects, analyzes,synthesizes, and disseminates related technicalinformation and data for each of these focus areas.These efforts facilitate a collaboration betweenscientists and engineers in the cybersecurity andinformation systems community while promotingimproved productivity by fully leveraging this samecommunity’s respective knowledge base. CSIACalso uses information obtained to generatescientific and technical products, includingdatabases, technology assessments, trainingmaterials, and various technical reports. CSIAC’s mailing address: CSIAC4695 Millennium DriveBelcamp, MD 21017-1505Telephone: (443) 360-4600 ABDUL RAHMAN, PH.D. Dr. Abdul Rahman is a subject matter expert in thedesign and implementation of cloud analytics andarchitectures that support situational awarenesstools for cybernetwork operations for commercialand government customers. He has over 25 yearsof information technology experience, includingsoftware development, network engineering,systems design, systems architecture, security,and network management. He has publishedwidely on topics in physics, mathematics, andinformation technology. Dr. Rahman holds Doctorof Philosophy degrees in mathematics and physics. The application of artificial intelligence (AI)to software supply chains (SSCs) within thedefense industrial base (DIB) holds promise toimprove cybersecurity posture, ensure strictercompliance with National Institute of Standardsand Technology (NIST) controls, and increase userconfidence in software built in part upon modulesand libraries from outside repositories. AI canprovide analysts with suggested frequencies for(re)scanning, supplement threat assessmentsof infrastructure, automate threat intelligenceprocessing, and expedite cybersecurity riskmanagement. Moreover, the security of SSCs inthe DIB can benefit from similar uses of AI as arecommendation engine for communicating theprobability of compromise. For U.S. Departmentof Defense cybersecurity analysts, AI-drivenautomation can provide insight into how closelysoftware capabilities deployed on military andgovernment networks adhere to NIST compliancestandards. The ability to reflect the most up-to-date set of vulnerabilities within a system securityplan could significantly improve upon the existingpractice of relying on manual internal scanning.AI can enable human-in-the-loop workflows tooptimize the integration of processed threatintelligence and better identify vulnerabilities persoftware and/or operating system. This reportpresents and discusses how AI can protect SSCspurpose-built for the DIB ecosystem. ACKNOWLEDGMENTS The author would like to thank the staff of theCybersecurity & Information Systems InformationAnalysis Center and SURVICE EngineeringCompany for their guidance and review of thisreport. EXECUTIVE SUMMARY Managing the intricate and diverse supply chainwithin the U.S. government involves a heavyreliance on an extensive and varied network ofsuppliers and vendors for software components.This dependence introduces a range of challengesin ensuring the security of these softwarecomponents. To address these software supplychain (SSC) security challenges effectively, acombination of technical solutions, robust securitypractices, collaboration among stakeholders, andadherence to industry standards is essential. AI models are