AI Institute for Agent-based Cyber Threat Intelligence and Operation

Computer systems are increasingly central to national infrastructure in the financial, medical, manufacturing, defense, and other domains. This infrastructure is at risk from sophisticated cyber-adversaries backed by powerful nation-states, whose capabilities rapidly evolve, demanding equally rapid responses. This calls for advances in artificial intelligence and autonomous reasoning that are tightly integrated with advanced security techniques to identify and correct vulnerabilities, detect threats and attribute them to adversaries, and mitigate and recover from attacks.

The ACTION Institute will develop novel approaches that leverage artificial intelligence–informed by and working with experts in security operations–to perform security tasks rapidly and at scale, anticipating the moves of an adversary and taking corrective actions to protect the security of computer networks as well as people’s safety. The Institute will function as a nexus for the AI and cybersecurity communities, and its research efforts will be complemented by innovation in education from K-12 to postdoctoral students, the development of new tools for workforce development, and the creation of new opportunities for collaboration among the Institute’s organizations and with external industry partners.

The AI Institute will initiate a revolutionary approach to cybersecurity, in which AI-enabled intelligent security agents cooperate with humans across the cyber-defense life cycle to jointly improve the security posture of complex computer systems over time. Intelligent security agents will follow a new paradigm of continuous, lifelong learning both autonomously and in collaboration with human experts, supported by a shared knowledge bank and an integrated AI stack that provides novel fundamental primitives for (1) reasoning and learning that incorporates domain knowledge, (2) human-agent interaction, (3) multi-agent collaboration, and (4) strategic gaming and tactical planning.

Over time, these intelligent security agents will improve their domain knowledge, becoming increasingly robust and effective in the face of changes in the adversaries’ modes of operation, composing defense strategies and tactical plans in the presence of uncertainty, collaborating with each other and with humans for mutually complementary teaming, and adapting to unfamiliar and novel attacks.

The Department of Homeland Security and IBM are partnering with NSF to provide funding for this Institute.

This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.