Cyber resilience usually refers to the ability of an entity to detect, respond to, and recover from cybersecurity attacks to the extent that the entity can continuously deliver the intended outcome despite their presence. This paper presents a method and system for providing cyber resilience by integrating autonomous adversary and defender agents, deep reinforcement learning, and graph thinking. Specifically, the proposed cyber resilience system first predicts the current and future adversary activities and then provides an automated critical asset protection and recovery by enabling agents to take appropriate reactive and pro-active actions for preventing and mitigating adversary activities. In particular, the automated cyber resilience system’s adversary agent makes it possible for cybersecurity adversary activities, patterns, and intentions to be identified and tracked more accurately and dynamically, based on the preprocessed cybersecurity measurements and observations. The automated system’s defender agent is designed to determine and execute cost-effective defensive actions against the adversary activities and intentions predicted by the adversary agent. The game of these adversary and defender agents employ deep reinforcement learning to play a zero-sum observations-aware stochastic game. The experiment results show that the agents perform their tasks efficiently, as the adversary agent is dynamically provided with the input data of infected asset predictions.
Assessing and quantifying cyber risk accurately in real-time is essential to providing security and mission assurance in any system and network. This paper presents a modeling and dynamic analysis approach to assessing cyber risk of a network in real-time by representing dynamically its vulnerabilities, exploitations, and impact using integrated Bayesian network and Markov models. Given the set of vulnerabilities detected by a vulnerability scanner in a network, this paper addresses how its risk can be assessed by estimating in real-time the exploit likelihood and impact of vulnerability exploitation on the network, based on real-time observations and measurements over the network. The dynamic representation of the network in terms of its vulnerabilities, sensor measurements, and observations is constructed dynamically using the integrated Bayesian network and Markov models. The transition rates of outgoing and incoming links of states in hidden Markov models are used in determining exploit likelihood and impact of attacks, whereas emission rates help quantify the attack states of vulnerabilities. Simulation results show the quantification and evolving risk scores over time for individual and aggregated vulnerabilities of a network.
In today’s highly mobile, networked, and interconnected internet world, the flow and volume of information is
overwhelming and continuously increasing. Therefore, it is believed that the next frontier in technological evolution and
development will rely in our ability to develop intelligent systems that can help us process, analyze, and make-sense of
information autonomously just as a well-trained and educated human expert. In computational intelligence,
neuromorphic computing promises to allow for the development of computing systems able to imitate natural neurobiological
processes and form the foundation for intelligent system architectures.
Attacks aim at exploiting vulnerabilities of a program to gain control over its execution. By
analyzing the program semantics, relational integrity, and execution paths, this paper presents a relationalintegrity
approach to enhance the effectiveness of intrusion detection and prevention systems for
malicious program traits. The basic idea is to first identify the main relational properties of program
statements with respect to variables and operations like load and store and, then, to decide which relations
could be checked through program statements or the guards inserted at the vulnerable points of program.
These relational statements are represented by ordered binary decisions diagrams that are constructed for
the entire program as well as the overlapping code partitions. When a host-based intrusion detection
system monitors the execution of a program by checking the system calls of a process or the function calls
of a driver, it may generate alerts for potential exploits. This paper also addresses data aggregation of
alerts by considering their attributes and various probability distribution functions, where the Dempster's
rule of combination is extended to aggregate data for dependent evidences as well.
As attackers get more coordinated and advanced in cyber attacks, cyber assets are required to
have much more resilience, control effectiveness, and collaboration in networks. Such a requirement makes it essential to take a comprehensive and objective approach for measuring the individual and
relative performances of cyber security assets in network nodes. To this end, this paper presents four techniques as to how the relative importance of cyber assets can be measured more comprehensively and objectively by considering together the main variables of risk assessment (e.g., threats, vulnerabilities),
multiple attributes (e.g., resilience, control, and influence), network connectivity and controllability among collaborative cyber assets in networks. In the first technique, a Bayesian network is used to
include the random variables for control, recovery, and resilience attributes of nodes, in addition to the random variables of threats, vulnerabilities, and risk. The second technique shows how graph matching and coloring can be utilized to form collaborative pairs of nodes to shield together against threats and vulnerabilities. The third technique ranks the security assets of nodes by incorporating multiple weights
and thresholds of attributes into a decision-making algorithm. In the fourth technique, the hierarchically well-separated tree is enhanced to first identify critical nodes of a network with respect to their attributes
and network connectivity, and then selecting some nodes as driver nodes for network controllability.
Access to the requested content is limited to institutions that have purchased or subscribe to SPIE eBooks.
You are receiving this notice because your organization may not have SPIE eBooks access.*
*Shibboleth/Open Athens users─please
sign in
to access your institution's subscriptions.
To obtain this item, you may purchase the complete book in print or electronic format on
SPIE.org.
INSTITUTIONAL Select your institution to access the SPIE Digital Library.
PERSONAL Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.