  Securing enterprise networks presents challenges in terms of both their size
and distributed structure. Data required to detect and characterize malicious
activities may be diffused and may be located across network and endpoint
devices. Further, cyber-relevant data routinely exceeds total available
storage, bandwidth, and analysis capability, often by several orders of
magnitude. Real-time detection of threats within or across very large
enterprise networks is not simply an issue of scale, but also a challenge due
to the variable nature of malicious activities and their presentations. The
system seeks to develop a hierarchy of cyber reasoning layers to detect
malicious behavior, characterize novel attack vectors and present an analyst
with a contextualized human-readable output from a series of machine learning
models. We developed machine learning algorithms for scalable throughput and
improved recall for our Multi-Resolution Joint Optimization for Enterprise
Security and Forensics (ESAFE) solution. This Paper will provide an overview of
ESAFE's Machine Learning Modules, Attack Ontologies, and Automated Smart Alert
generation which provide multi-layer reasoning over cross-correlated sensors
for analyst consumption.
