Towards Autonomous Cyber Defense: Predictions from a cognitive model

Abstract

We propose that cognitive models will help advance autonomous cyber defense. Congitive models, in contrast to many other sophisticated approaches, such as machine learning models, have the ability to represent human actions, account for human cognitive constraints, and make more accurate predictions of the decisions a human would make. The success of cyber defense largely depends on the ability to predict the attacker’s actions, and expert cyber defenders acquire such an ability through experience. We propose a cognitive model of a cyber defender and demonstrate the model’s predictions in a simple but realistic scenario against two types of attack strategies and under various conditions of noise and feedback frequency regarding the attacker’s actions. The results of the simulations illustrate the expected impact on defense losses when attackers are more knowledgeable,fast, and directed in their attacks compared to when an attacker meanders around; results show how losses increase in the presence of normal activity and how a defender can benefit from receiving feedback less often to reduce losses. We discuss the implications of these results for the future of autonomous cyber defense.

Classification of Experience for Proactive In-Car Function Recommendations Based on Customer Usage Data

“…Hypothesis 2. The second hypothesis tests the behavior of two red agents: the Beeline Red agent and the IBL T rained Red agent, against the IBL Blue agent (Du et al, 2022). IBL T rained Red is IBL Red pre-trained against Sleepy Blue for 2000 episodes.…”

“…We adapt the CAGE cyber defense scenario (Standen et al, 2021a) to perform experimental simulations using IBL agents as cyber defenders and cyber attackers. This framework was also presented in (Du et al, 2022;Prébot et al, 2022) and in the following we outline its main structural elements and the particularities of the cyber defense scenario.…”

“…Sleepy Blue passively Monitors the network and does not attempt to stop the Red agent. The IBL Blue , has been proposed and tested recently by Du et al (2022). This agent, also built according to IBLT, learns from experience and adapts its actions dynamically, according to the conditions of the environment and the actions of the red agent.…”

“…Cognitive models have been used as embedded computational agents to simulate human interactions with software and networks (Gonzalez et al, 2014;Mitsopoulos et al, 2021;Veksler et al, 2020). Previous work has focused independently on understanding defense behaviors and developing cognitive models of blue agents (Du et al, 2022;Dutt et al, 2011), or the attack preferences and biases of the attacker (Cranford et al, 2020). However, the attacker and the defender are influenced by each other in adversarial cyber scenarios (West & Lebiere, 2001), and such dynamics between attackers and defenders can make defenders more vulnerable to such adversarial actions compared to even random attackers (Moisan & Gonzalez, 2017).…”

“…Dutt et al (2011) proposed an IBL model that accurately represents the cyber situation awareness of a human analyst, making concrete predictions of the recognition and comprehension processes of a security expert in a cyber attack. A more recent model from Du et al (2022) uses a cyber security scenario in which the IBL agent learned to defeat the most aggressive deterministic attack strategy, called Beeline.…”