An introductory preview of Autonomous Intelligent Cyber-defense Agent reference architecture, release 2.0

Abstract

The North Atlantic Treaty Organization (NATO) Research Task Group IST-152 developed a concept and a reference architecture for intelligent software agents performing active, largely autonomous cyber-defense actions on military assets. The group released a detailed report, briefly reviewed in this article, where such an agent is referred to as an Autonomous Intelligent Cyber-defense Agent (AICA). In a conflict with a technically sophisticated adversary, NATO military networks will operate in a heavily contested battlefield. Enemy malware will likely infiltrate and attack friendly networks and systems. Today’s reliance on human cyber defenders will be untenable on the future battlefield. Instead, artificially intelligent agents, such as AICAs, will be necessary to defeat the enemy malware in an environment of potentially disrupted communications where human intervention may not be possible. The IST-152 group identified specific capabilities of AICA. For example, AICA will have to be capable of autonomous planning and execution of complex multi-step activities for defeating or degrading sophisticated adversary malware, with the anticipation and minimization of resulting side effects. It will have to be capable of adversarial reasoning to battle against a thinking, adaptive malware. Crucially, AICA will have to keep itself and its actions as undetectable as possible, and will have to use deceptions and camouflage. The report identifies the key functions and components and their interactions for a potential reference architecture of such an agent, as well as a tentative roadmap toward the capabilities of AICA.

To Improve Cyber Resilience, Measure It

“…Thus, we cannot rely on remote recovery. The remaining solution is that resilience must depend on artificially intelligent agents residing onboard on-the-battlefield assets, and provide real-time response and recovery during the mission (Kott et al, 2019). Nevertheless, the acceptance of even recommended decision by such systems, not to mention allowing automated response to major compromises, requires the ability to provide a degree of confidence associated with AI-driven interventions to be actionable (as argued in Linkov et al, 2020), which is yet again require a good measures and metrics.…”

When Autonomous Intelligent Goodware Will Fight Autonomous Intelligent Malware: A Possible Future of Cyber Defense

“…It is also unrealistic to expect that the human warfighters residing on the platform, be they in a ground vehicle, an aircraft or a sea vessel, will have the necessary skills or time available to perform cyber-defense functions locally on the vehicle [14].…”

“… monitor a perimeter of a host system they are to defend, Provisions should be made for AICAs to collaborate with one agents residing on the same host system or other computers. However, in many cases, because communications might be impaired or observed by the enemy, the agents will have to avoid collaboration and operate alone [14].…”

“…AICAs could be implemented in three different ways [14], and each option would entail specific choices both in terms of technology and doctrine of use: 1) A society of specialized agents: This option refers to the distributed implementation of the reference agent's functional components as a group of specialized agents, each one owning/delivering one of the functions of AICA, and the sum of the agents delivering the entire reference agent's cyber-defense capability.…”

Doers, Not Watchers: Intelligent Autonomous Agents Are a Path to Cyber Resilience

“…Often, the response and recovery efforts need to be undertaken in absence of any human involvement, and with an intelligent consideration of risks and ramifications of such efforts. Recently an international team (the NATO Science and Technology Organization's Research Group IST-152) published a report that proposes a vision of an autonomous intelligent cyber defense agent (AICA) and offers a high-level reference architecture of such an agent (Kott et al 2019). Let's explore this vision.…”