Neuromorphic Data Microscope

Transcription

1 Neuromorphic Data Microscope CLSAC 16 October 28, 2016 David Follett Founder, CEO Lewis Rhodes Labs (LRL) Slide 1

2 History Neuroscience Neuronal Spiking Models STPU Sandia LDRD State Density Behavior Prediction HAANA Neuromorphic Signal Processing Image/video Mixed Telemetry Neuronal Information Theory Pre-Attentive Processing $/Performance >100,000x Behavioral Lexicon Pervasive Analysis Dynamic Reconfiguration $/Performance Power Weight >100,000x <100,000x <1,000,000x Behavioral Analysis Forensics (aka learning) Prediction Neuromorphic Filters/Sensors ->Cyber<- Big Data Telemetry Slide 2

3 Vision Neuromorphic Processing Units (s) stunningly power efficient at pattern matching Data Center & Cloud Impact profoundly changes economics Slide 3

4 Why Neuromorphic? Power/op & Cost/op 1 GbE >500 IDS Servers 500,000 W 14,000 lbs $2,500,000 1 GbE 40 GbE 5 FPGA Neuromorphic Cyber Microscopes All 4,036 Emerging Threats PCREs (1/16) Pervasive examination (no directives) 2,500 W 200 lbs $125,000 1 ASIC Neuromorphic Cyber Microscope Performance Gains Power/op: Cost/op: 50 W, 1 lb $500 > 1M > 1M Slide 4

5 Control Unit Neuromorphic is very Different Memory Input Input Legacy Von Neumann Architecture (CPU) Arithmetic Logic Unit Mapping/Efficacy Memory Temporal/Spatial Memory Integrators Output Output Complex processor Extraordinarily flexible Data processing via sequential instructions Simple memory Neuromorphic Processing Unit () Simple processor Massively parallel integrators Complex memory Data processing via efficacy & temporal/spatial mapping Processing is multi-dimensional Slide 5

6 Computer Science Perspective (Un)Structured Input Stream(s) Neuromorphic Processor PCIe Structured Output Policy Recognition: Find Ex n, n>>1 Behavioral: Find!Ex n, n>>1 Metadata Stream Behavior Match Classification Filter Prediction Pipeline Slide 6

7 Some Interesting Features integrates key mission requirements, ex., Context switching Dynamic programmability Behavioral characterization Time & Order invariance Pervasive analysis Basic statistical operations Current device uses a single neuron type Can extend HW architecture through novel neurons Example: more complex statistical operations Slide 7

8 Scalability Device Bandwidth x Expressions = Constant System Arbitrary Depth & Width FPGA 2.5 Gb/s x 1,000 Expressions 5 Gb/s x 500 Expressions 10 Gb/s x 250 Expressions etc. ASIC 20 Gb/s x 20,000 Expressions 40 Gb/s x 10,000 Expressions 80 Gb/s x 5,000 Expressions etc. Input Stream Output Stream Control Output Slide 8

9 Latest Product 6 or 7 PCRE Compiler IDS Patches Neuromorphic Data Microscope Version 4.0 Neuromorphic Processor Intrusion Detection System ex. WaterSlide, Proprietary Commodity Server DMA Driver PCIe Slide 9

10 Standards Hide Complexity PCI Card Application (Suricata, etc.) APIs Result DMA Driver Data Stream Cmd & Cntl Neuro Compiler Config Loader PCIe Bus Control Logic Sandia ported to Quiz Kid (aka WaterSlide) Signatures Regex, etc. {A,B,C, } Compiler Compiled Elements A=[a.1,a.2,a.3 ] B=[b.1] C=[c.1,c.2,c.3] Slide 10

11 Throughput Efficiency 250 Measured Throughput vs Block Size Thoughput (MB/s) Theoretical max 1Gb/s Enet, Full Gabe DMA ,000 10, ,000 Block Size (Bytes) Note 1: Theoretical Max bounded by context switching Note 2: Un-optimized generic Altera DMA Interface Note 3: CUDA style DMA planed for next generation Slide 11

12 Graph Analytics Scaling Example Cloud Database /Switch Control & Configuration Graph Analytics Computers Integrated Filters Integrated Switches Data Streams Parallel Application Support Applications completely Independent No performance degradation Integrated cloud extremely scalable Slide 12

13 CYBER APPLICATION Slide 13

14 Exemplar Intel Community IDS Facility B NAS Blade Servers Software Sensors Blade Servers Facility A NAS Network Security Internet Policy Control Suricata, etc. Alerts Operational Intelligence Splunk, etc. analysts Slide 14

15 Practical Considerations Hardware sensor cost extremely high ex. 10GbE IDS >$100k Cost limits number & resolution of HW sensors Software sensors often resource intensive ex. ROP detectors require most of the CPU Cost limits number & resolution of SW sensors Analyst s priority, reduce False Negatives Achieved by detuning sensors, ie. large # of False Positives Major source of noise, direct result of sensor cost Detuned sensors are more vulnerable to attack Spoofing & Flooding are common Slide 15

16 Analyst s Top Priority Signal/Noise is killing analyst community Network Internet Hardware Sensors Operational Intelligence Splunk, etc. analysts Servers Cloud Software Sensors Storage NAS, SAN False Positives must be Reduced True Positive False Positive False Negative Slide 16

17 Root Cause: Resolution True Positives (TP) Potential False Positives (FP) Expression Coverage State-of-the-Art Sensors ex. Suricata Cost limits resolution TPs identified but Many FPs captured Splunk database, Low Accuracy Poor signal/noise ratio It s still a haystack S/N is killing the analysts Slide 17

18 Neuro: Resolution Cyber Microscope Neuromorphic Speed creates resolution Same number of TPs Dramatically fewer FPs Greater Accuracy Higher Signal/Noise ratio Profound impact on analysts True Positives (TP) Potential False Positives (FP) Expression Coverage Slide 18

19 Analyst s Second Priority Reduce False Negatives Network Internet Servers Cloud Hardware Sensors Software Sensors Operational Intelligence Splunk, etc. analysts Behavioral Prediction Required Storage NAS, SAN True Positive False Positive False Negative Slide 19

20 Root Cause: Temporal Variance Simplest form of behavior prediction Attack Vector Classes Temporal Variants True Positives (TP) Temporal Variants, Potential (FN) Expression Coverage State-of-the-Art Sensors ex. Suricata Temporal variance is common Shifting offsets Re-ordering Easily implemented by attacker Very costly to address Pervasive analysis Associative analysis Slide 20

21 Neuro: Temporal Variance Attack Vector Classes Temporal Variants True Positives (TP) Temporal Variants, Potential (FN) Expression Coverage Neuromorphic Pervasive analysis is innate Evaluates every byte Limiting this costs resources Associative analysis is innate Metadata reordering Reduced False Negatives FN Behavioral Prediction Profound impact on Analysts Slide 21

22 Neuro Addresses Core Issues Internet Network Neuro Sensors Operational Intelligence Splunk, etc. analysts Servers Cloud Storage NAS, SAN Reduced False Positives Reduced False Negatives Increased True Positives True Positive False Positive False Negative Slide 22

23 Operational Control Application cyber, image/video analysis, novel event detection, graph analytics, speech recognition, etc. Behavioral Identify!t n, n>>1 ex., syscall graph Recognition Find t n, n>>1 ex., signatures Data Stream(s) Result(s) Slide 23

24 IC Analyst s Vision Facility B Facility A NAS Blade Servers Blade Servers NAS Network Security Policy Control Suricata, etc. Internet Alerts Operational Intelligence Splunk, etc. analysts Slide 24

25 Cyber Microscope Product Rollout 1 st Generation (FPGA) 2 nd Generation (ASIC) 3 nd Generation (ASIC) Intrusion Detection System Acceleration IDS IDS System on Chip Security Alert Management Acceleration SAM Host Behavioral Analysis Behavioral Slide 25

26 Conclusions Neuromorphic will revolutionize cyber defense Dramatic reductions in power/op FPGA, >1,000x ASIC, >1,000,000x Plethora of powerful novel features Order & time invariant, Sessionization, Behavioral prediction Operational readiness is close Compatible with existing standards & infrastructure Sandia ported Quiz Kid (aka WaterSlide), 4 week effort 4 rd gen FPGA systems available in November Slide 26