GreatNorthCollective/greatnorth-us-federal-ai-inventory-2024 huggingface dataset:
2_use_case_name: HTS Classifier
3_agency: Department of Homeland Security
3_abr: DHS
4_bureau: CBP
8_topic_area: Law & Justice
10_commercial_ai: None of the above.
11_purpose_benefits: CBP’s HTS Classifier improves trade compliance and enhances cargo risk assessment by streamlining the classification of goods, enabling better integration with machine learning systems, and refining entity risk evaluations. It identifies potential threats linked to specific cargo types and prior violations by categorizing goods based on their descriptions and attributes. These improvements contribute to faster, more accurate classification and risk-based targeting, which strengthens security and facilitates trade.
12_outputs: The HTS Classifier produce outputs that map cargo commodity descriptions to their most probable tariff codes, enhancing classification accuracy. These outputs integrate seamlessly into broader threat-specific risk models, providing features to support predictive risk assessments in cargo security.
16_dev_stage: Operation and Maintenance
17_impact_type: Neither
18_date_initiated: 10/1/2020
19_date_acq_dev_began: 10/1/2020
20_date_implemented: 10/1/2020
22_dev_method: Developed with contracting resources.
24_hisp_support: No
27_public_info: No
29_contains_pii: Yes
30_saop_review: Yes
31_data_catalog: Yes
33_agency_data: This model leverages data provided by carriers within the Automated Commercial Environment (ACE), as well as transformations of that data within the Automated Targeting System (ATS).
34_data_docs: Documentation is complete: Documentation exists regarding the maintenance, composition, quality, and intended use of the training and evaluation data, as well as any statistical bias across model features and protected groups. 
37_custom_code: Yes
38_code_access: Yes – agency has access to source code, but it is not public.
40_has_ato: Yes
41_system_name: Automated Targeting System (ATS)
42_dev_tools_wait: Less than 6 months
43_infra_provisioned: Yes
45_compute_request: Yes
47_timely_resources: Yes
49_existing_reuse: Use of existing data platforms: This use case is being developed on existing enterprise data and analytics platforms within the agency rather than procuring additional platforms or SaaS to operate.
50_internal_review: Documentation has been developed: Complete documentation detailing model performance across a range of benchmarks, architecture, relevant features and information regarding the appropriate use of the model for predictive tasks has been created.
2_use_case_name: CISAChat
3_agency: Department of Homeland Security
3_abr: DHS
4_bureau: CISA
8_topic_area: Mission-Enabling
10_commercial_ai: None of the above.
11_purpose_benefits: Currently, multiple CISA program offices are using contractor staff to review pre-production content and other internal materials to develop summaries, key themes, and improve clarity. Leveraging a Generative AI solution improves internal agency Customer Experience (CX) and saves staff time. 
12_outputs: LLM generated response to the questions posed on uploaded content.  
16_dev_stage: Implementation and Assessment
17_impact_type: Neither
18_date_initiated: 12/13/2023
19_date_acq_dev_began: 1/1/2024
22_dev_method: Developed with both contracting and in-house resources.
23_contract_piids: CEEOSS-Task Order No.- 70RCSJ23FR0000001 DSS-70RCSJ24FC0000018 - IT O&M
24_hisp_support: No
27_public_info: No
29_contains_pii: No
30_saop_review: Yes
31_data_catalog: Other
31_question_type: CISA maintains an agency-wide data asset inventory, but it was not needed for this use case as CISAChat only currently operates on content that will be publicly posted.
33_agency_data: Current data used is pre-publication content that has already been approved.
34_data_docs: Documentation has been partially completed: Some documentation exists (detailing the composition and any statistical bias or measurement skew for training and evaluation purposes), but documentation took place within this use case’s development.
37_custom_code: Yes
38_code_access: Yes – agency has access to source code, but it is not public.
40_has_ato: No
42_dev_tools_wait: Less than 6 months
43_infra_provisioned: Yes
45_compute_request: Yes
47_timely_resources: Yes
49_existing_reuse: None: This use case does not re-use any internally developed tooling or managed infrastructure from any other AI development efforts within the agency.
50_internal_review: Limited documentation for review: Some information regarding the model’s performance on specific benchmarks are available or have been shared with specific stakeholders within the agency.
2_use_case_name: Critical Infrastructure Network Anomaly Detection
3_agency: Department of Homeland Security
3_abr: DHS
4_bureau: CISA
8_topic_area: Mission-Enabling
10_commercial_ai: None of the above.
11_purpose_benefits: This use case delivers improved internal government tools for hunting and detection of malicious threat actors on critical infrastructure networks. It automates manual data fusion and correlation processes and highlights potential anomalies, allowing CISA analysts to focus more  time on hunting adversaries.

12_outputs: An interface is provided for analysts to query cybersecurity data, and dashboards are provided with potential cybersecurity alerts, including anomalies detected through predictive models and rule-based heuristics.
16_dev_stage: Initiated
17_impact_type: Neither
18_date_initiated: 10/1/2022
2_use_case_name: Malware Reverse Engineering
3_agency: Department of Homeland Security
3_abr: DHS
4_bureau: CISA
8_topic_area: Mission-Enabling
10_commercial_ai: None of the above.
11_purpose_benefits: This use case delivers improved internal government tools for reverse engineering of malware and speeding the development of cyber threat intelligence that can be shared across the government and with CISA partners.  Threat actors can leverage the same malware for long periods of time, so having the ability to improve analysis and generation of shareable cyber threat intelligence forces threat actors to spend more resources generating new malware. Machine learning and other analytical tools are leveraged to guide malware analysts and automate elements of the manual reverse engineering process. Automation of tasks such as triage and indicator extraction allow threat hunting analysts to meet high demand and focus more on adversary response.

12_outputs: A report is generated from malware samples submitted to the analysis pipeline that is then used by human analysts to facilitate the malware triage process. Additional recommendations are displayed via plugins to reverse engineering tools.

16_dev_stage: Initiated
17_impact_type: Neither
18_date_initiated: 10/1/2022
2_use_case_name: Draft Tailored Summaries of Media Materials for Different Publication Channels
3_agency: Department of Homeland Security
3_abr: DHS
4_bureau: CISA
8_topic_area: Mission-Enabling
10_commercial_ai: None of the above.
11_purpose_benefits: The Large Language Models (LLMs) will summarize information from historical publications and pre-production documents intended for external publication.
12_outputs: An interface is provided for pre-publication documents to be uploaded. The system will then automatically generate appropriate messaging using approved templates and  tag the documents for review prior to publication.

16_dev_stage: Initiated
17_impact_type: Neither
18_date_initiated: 11/1/2023
2_use_case_name: Security Information and Event Management (SIEM) Alerting Models
3_agency: Department of Homeland Security
3_abr: DHS
4_bureau: CISA
10_commercial_ai: None of the above.
11_purpose_benefits: CISA Threat hunting and Security Operations Center (SOC) analysts are provided with terabytes of log data per day. Manually developed detection alerts and automatic correlation in Security Information and Event Management (SIEM) tools are common, but not comprehensive. Many cyber attacks can be probabilistically determined given sufficient training data and time. Analysts use automated tooling to further refine the alerts they receive and produce additional automated alerts based on aggregated information and curated subject matter expertise. This can be further supported by the development of AI-assisted agents. Analysts can interact with such agents in a conversational manner to produce the input needed for complex search queries for behaviors or patterns in traffic that the agent then rapidly creates. This tooling allows CISA analysts to comb through security data in an automated fashion with mathematically and probabilistically based models to ensure high-fidelity anomalies are detected in a timely manner. 
12_outputs: This use case is inactive. Please see the "intended purpose and expected benefits" for a full description of this use case.

16_dev_stage: Retired
18_date_initiated: 10/1/2022
21_date_retired: N/A -Consolidated into another use case.
2_use_case_name: Advanced Analytic Enabled Forensic Investigation
3_agency: Department of Homeland Security
3_abr: DHS
4_bureau: CISA
10_commercial_ai: None of the above.
11_purpose_benefits: CISA deploys forensic specialists to analyze cyber events at Federal Civilian Executive Branch (FCEB) departments and agencies, as well as other State, Local, Tribal, Territorial, and Critical Infrastructure partners. Forensic analysts can utilize advanced analytic tooling, in the form of Artificial Intelligence (AI) implementations, to better understand anomalies and potential threats. This can be further supported by the development of AI-assisted agents. Analysts can interact with such agents in a conversational manner to produce the input needed for complex search queries for behaviors or patterns in traffic that the agent then rapidly creates. Such tooling allows forensic specialists the capabilities to comb through event data in an automated fashion with mathematically and probabilistically based models to ensure high-fidelity anomalies are detected in a timely manner. 
12_outputs: This use case is inactive. Please see the "intended purpose and expected benefits" for a full description of this use case.

16_dev_stage: Retired
18_date_initiated: 10/1/2022
21_date_retired: N/A - Use case is in a pre-initation phase.
2_use_case_name: Advanced Network Anomaly Alerting
3_agency: Department of Homeland Security
3_abr: DHS
4_bureau: CISA
10_commercial_ai: None of the above.
11_purpose_benefits: Threat hunting and Security Operations Center (SOC) analysts are provided terabytes per day of data from the National Cybersecurity Protection System's (NCPS’s) Einstein sensors. Manually developed detection alerts and automatic correlation via off the shelf tooling are common, but not comprehensive. Many network attacks can be probabilistically determined given sufficient training data and time. Analysts use automated tooling to further refine the alerts they receive and produce additional automated alerts based on aggregated information and backed in subject matter expertise. This tooling allows CISA analysts the capabilities to comb through data in an automated fashion with mathematically and probabilistically based models to ensure high-fidelity anomalies are detected in a timely manner.
12_outputs: This use case is inactive. Please see the "intended purpose and expected benefits" for a full description of this use case.

16_dev_stage: Retired
18_date_initiated: 10/1/2022
21_date_retired: N/A -Consolidated into another use case.
2_use_case_name: Cyber Threat Intelligence Feed Correlation
3_agency: Department of Homeland Security
3_abr: DHS
4_bureau: CISA
10_commercial_ai: None of the above.
11_purpose_benefits: Cyber Data Feed Correlation uses AI enabled capabilities to provide accelerated correlation across multiple incoming information feeds. This enables more timely enrichment to improve the externally shared information feeds. AI allows the algorithm to use the information items and results to learn the most efficient ways to perform the task. Additionally, tailored algorithms could be created to provided sustained surveillance of threat actor Tactics, Techniques, and Procedures (TTPs).
12_outputs: This use case is inactive. Please see the "intended purpose and expected benefits" for a full description of this use case.

16_dev_stage: Retired
18_date_initiated: 10/1/2022
21_date_retired: N/A - Use case is in a pre-initation phase.
2_use_case_name: Cyber Incident Reporting
3_agency: Department of Homeland Security
3_abr: DHS
4_bureau: CISA
10_commercial_ai: None of the above.
11_purpose_benefits: Cyber incident handling specialists utilize advanced automation tools to process data received through various threat intelligence and cyber incident channels. These tools leverage machine learning (ML) and Natural Language Processing (NLP) to increase the accuracy and relevance of data filtered and presented to human analysts and decision-makers. ML techniques also assist in aggregating the information in reports for presentation and further analysis, including data received through covered Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) entities. Such tools can leverage current dashboards and reports to cluster vulnerabilities by entity and sector, identifying trends in exposure and remediation. These solutions can also correlate vulnerabilities to existing frameworks (such as MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK)) and other incidents to understand attackers’ techniques and improve modeling.
12_outputs: This use case is inactive. Please see the "intended purpose and expected benefits" for a full description of this use case.

16_dev_stage: Retired
18_date_initiated: 10/1/2022
21_date_retired: N/A -Consolidated into another use case.
2_use_case_name: Cyber Vulnerability Reporting
3_agency: Department of Homeland Security
3_abr: DHS
4_bureau: CISA
10_commercial_ai: None of the above.
11_purpose_benefits: Vulnerability analysts require advanced automation tools to process data received through various vulnerability reporting channels, as well as aggregate the information for automated sharing. These tools leverage machine learning (ML) and Natural Language Processing (NLP) to increase the accuracy and relevance of data that is filtered and presented to human analysts and decision-makers. ML techniques also assist to aggregate the information in reports for presentation and further analysis. This includes data in the Known Exploited Vulnerabilities (KEV) and Common Vulnerabilities and Exposures (CVE) databases.
12_outputs: This use case is inactive. Please see the "intended purpose and expected benefits" for a full description of this use case.

16_dev_stage: Retired
18_date_initiated: 10/1/2022
21_date_retired: N/A - Use case is in a pre-initation phase.
2_use_case_name: AI Security and Robustness
3_agency: Department of Homeland Security
3_abr: DHS
4_bureau: CISA
10_commercial_ai: None of the above.
11_purpose_benefits: Frameworks, processes, and testing tools are developed to govern the acquisition, development, deployment, and maintenance of AI technologies. Technology integrators within CISA, as well as the rest of the federal enterprise, use AI-enhanced tools to ensure the trustworthy, robust, and secure operation of their AI systems. These tools use machine learning (ML) and Natural Language Processing (NLP) to enhance the assessment of AI technology within the agency by speeding up data processing. 
12_outputs: This use case is inactive. Please see the "intended purpose and expected benefits" for a full description of this use case.

16_dev_stage: Retired
18_date_initiated: 10/1/2022
21_date_retired: N/A - Active as R&D only.
2_use_case_name: Operational Activities Explorer
3_agency: Department of Homeland Security
3_abr: DHS
4_bureau: CISA
10_commercial_ai: None of the above.
11_purpose_benefits: The integration of an AI tool into a dashboard to analyze cyber and physical incidents affecting critical infrastructure from all-source reporting could assist with maintaining operational clarity and centralized situational awareness. However, CISA decided not to move forward from the conceptual phase due to the nuances of event data and resource constraints. 
12_outputs: This use case is inactive. Please see the "intended purpose and expected benefits" for a full description of this use case.

16_dev_stage: Retired
18_date_initiated: 10/1/2021
21_date_retired: N/A - This use case was never initiated and never formally retired.
2_use_case_name: Security Operation Center (SOC) Network Anomaly Detection
3_agency: Department of Homeland Security
3_abr: DHS
4_bureau: CISA
8_topic_area: Mission-Enabling
10_commercial_ai: None of the above.
11_purpose_benefits: This use case delivers improved internal government tools for hunting and detection of malicious threat actors on federal civilian networks. It automates manual data fusion and correlation processes and highlights potential anomalies, allowing CISA analysts to focus more on hunting adversaries.

12_outputs: An interface is provided for analysts to query cybersecurity data, and dashboards are provided with potential cybersecurity alerts, including anomalies detected through predictive models and rule-based heuristics.

16_dev_stage: Operation and Maintenance
17_impact_type: Neither
18_date_initiated: 9/4/2020
19_date_acq_dev_began: 9/4/2020
20_date_implemented: 8/22/2023
22_dev_method: Developed in-house.
24_hisp_support: No
27_public_info: No
29_contains_pii: No
30_saop_review: Yes
31_data_catalog: Yes
33_agency_data: Cybersecurity cloud, network and host logs, Cybersecurity threat intelligence (CTI)

34_data_docs: Documentation has been partially completed: Some documentation exists (detailing the composition and any statistical bias or measurement skew for training and evaluation purposes), but documentation took place within this use case’s development.
37_custom_code: Yes
38_code_access: Yes – agency has access to source code, but it is not public.
40_has_ato: Yes
41_system_name: Cyber Analytics and Data System Analytics Environment
42_dev_tools_wait: More than 12 months
43_infra_provisioned: No
45_compute_request: Yes
47_timely_resources: No
49_existing_reuse: Use of existing data platforms: This use case is being developed on existing enterprise data and analytics platforms within the agency rather than procuring additional platforms or SaaS to operate.
50_internal_review: Limited documentation for review: Some information regarding the model’s performance on specific benchmarks are available or have been shared with specific stakeholders within the agency.
2_use_case_name: Automated Detection of Personally Identifiable Information (PII) in Cybersecurity Data
3_agency: Department of Homeland Security
3_abr: DHS
4_bureau: CISA
8_topic_area: Mission-Enabling
10_commercial_ai: None of the above.
11_purpose_benefits: Automated PII Detection and Review Process uses analytics to identify and manage potential PII in submissions. If PII is flagged, the submission is sent to CISA analysts, who are guided by AI to review and confirm or reject the detection, redacting information if necessary. Privacy experts monitor the system and provide feedback. The system learns from this feedback, ensuring compliance with privacy regulations and improving efficiency by reducing false positives. Regular audits ensure the process remains trustworthy and effective.

12_outputs: The system sends flagged data rows with potential PII to humans for review.

16_dev_stage: Operation and Maintenance
17_impact_type: Neither
18_date_initiated: 2/1/2020
19_date_acq_dev_began: 9/1/2020
20_date_implemented: 12/1/2020
22_dev_method: Developed with contracting resources.
23_contract_piids: 70QS0124C00000002
24_hisp_support: No
27_public_info: No
29_contains_pii: Yes
30_saop_review: Yes
31_data_catalog: Yes
33_agency_data: Cybersecurity indicators of compromise (IOCs), Cybersecurity threat intelligence (CTI)

34_data_docs: Documentation has been partially completed: Some documentation exists (detailing the composition and any statistical bias or measurement skew for training and evaluation purposes), but documentation took place within this use case’s development.
37_custom_code: Yes
38_code_access: Yes – agency has access to source code, but it is not public.
40_has_ato: Yes
41_system_name: Trusted Automated eXchange of Indicator Information server
42_dev_tools_wait: Less than 6 months
43_infra_provisioned: No
45_compute_request: Yes
47_timely_resources: Yes
49_existing_reuse: Use of existing data platforms: This use case is being developed on existing enterprise data and analytics platforms within the agency rather than procuring additional platforms or SaaS to operate.
50_internal_review: Limited documentation for review: Some information regarding the model’s performance on specific benchmarks are available or have been shared with specific stakeholders within the agency.
2_use_case_name: Confidence Scoring for Cybersecurity Threat Indicators
3_agency: Department of Homeland Security
3_abr: DHS
4_bureau: CISA
8_topic_area: Mission-Enabling
10_commercial_ai: None of the above.
11_purpose_benefits: The confidence scores produced by this use case via an AI-driven decision tree process allow CISA's Automated Indicator Sharing (AIS) partners to contextualize the indicator information they are receiving so that they can ingest the data accordingly on their systems.

12_outputs: A set of confidence scores is included along with the other fields in the indicator data set.

16_dev_stage: Operation and Maintenance
17_impact_type: Neither
18_date_initiated: 6/1/2020
19_date_acq_dev_began: 7/1/2020
20_date_implemented: 7/1/2021
22_dev_method: Developed with contracting resources.
23_contract_piids: 70QS0124C00000002
24_hisp_support: No
27_public_info: Yes
28_iqa_compliance: Data is shared only with government and critical infrastructure partners that have signed CISA's sharing agreements for the AIS program. IQA concerns are handled through that process.
29_contains_pii: Yes
30_saop_review: Yes
31_data_catalog: Yes
33_agency_data: Cybersecurity indicators of compromise (IOCs), Cybersecurity threat intelligence (CTI)

34_data_docs: Documentation has been partially completed: Some documentation exists (detailing the composition and any statistical bias or measurement skew for training and evaluation purposes), but documentation took place within this use case’s development.
37_custom_code: Yes
38_code_access: Yes – agency has access to source code, but it is not public.
40_has_ato: Yes
41_system_name: Trusted Automated eXchange of Indicator Information Server
42_dev_tools_wait: Less than 6 months
43_infra_provisioned: No
45_compute_request: Yes
47_timely_resources: Yes
49_existing_reuse: Use of existing data platforms: This use case is being developed on existing enterprise data and analytics platforms within the agency rather than procuring additional platforms or SaaS to operate.
50_internal_review: Limited documentation for review: Some information regarding the model’s performance on specific benchmarks are available or have been shared with specific stakeholders within the agency.