Machine Learning: Preventing Network Abnormalities

The Department of Defense (DoD) developed and published multiple zero trust documents describing the zero trust principles that DoD organizations should achieve. The documents state that organizations will need to rely on Artificial Intelligence, machine learning, and automation to reduce the time a security practitioner needs to monitor, detect, and prevent unauthorized user and device access to network resources. The DoD operates endpoint devices and networks disconnected from the public internet, driving a need for disconnected machine learning models. The research paper outlines the potential for an on-premises machine learning algorithm at the endpoint device to analyze normal and abnormal network traffic and automatically implement Windows Defender Firewall rulesets. The research outlines the challenges to implementing this concept at the endpoint device instead of relying on centralized or cloud-based machine learning platforms.