Adaptive Autonomous Secure Cyber Systems

Preface
Acknowledgments
Contents
Reference Architecture of an Autonomous Agent for Cyber Defense of Complex Military Systems
	1 Future Military Systems and the Rationale for Autonomous Intelligent Cyber Defense Agents
	2 NATO\'s AICA Reference Architecture: A Concept for Addressing the Need for an Autonomous Intelligent Cyber Defense of Military Systems
		2.1 Sensing and World State Identification
			2.1.1 Sensing
			2.1.2 World State Identification
		2.2 Planning and Action Selection
			2.2.1 Planning
			2.2.2 Action Selector
		2.3 Collaboration and Negotiation
		2.4 Action Execution
			2.4.1 Action Effector
			2.4.2 Execution Monitoring
			2.4.3 Effects Monitoring
			2.4.4 Execution Adjustment
		2.5 Learning and Knowledge Improvement
			2.5.1 Learning
			2.5.2 Knowledge Improvement
	3 Use Cases
	4 Discussion and Future Research Directions
		4.1 Agents\' Integrity
		4.2 Agent Communications\' Security
		4.3 The Inclusion of Cyber Defense TechniquesSuch as Deception
		4.4 Identifying and Selecting the Right Actions
	5 In Conclusion
	References
Defending Against Machine Learning Based Inference Attacks via Adversarial Examples: Opportunities and Challenges
	1 Introduction
	2 Related Work
		2.1 Inference Attacks
		2.2 Defenses
	3 Problem Formulation
		3.1 User
		3.2 Attacker
		3.3 Defender
	4 Design of AttriGuard
		4.1 Overview
		4.2 Phase I: Finding ri
		4.3 Phase II: Finding M*
	5 Discussion, Limitations, and Future Work
	6 Conclusion
	References
Exploring Adversarial Artificial Intelligence for Autonomous Adaptive Cyber Defense
	1 Introduction
	2 Background
		2.1 Coevolutionary Search Algorithms
		2.2 Nash Equilibrium
			2.2.1 Nash Averaging
		2.3 Modeling and Simulation with Coevolutionary Algorithms
	3 Method
		3.1 Coevolutionary Algorithms—AI Search Heuristic
		3.2 Engagement Environment
		3.3 Adversary Representation
		3.4 Decision Support
	4 Experiments
		4.1 Internal Reconnaissance in Software Defined Networks—Dark Horse
		4.2 Availability Attacks on Segmented Networks—AVAIL
		4.3 DOS Attacks on Peer-to-Peer Networks—Diffracted
			4.3.1 Mobile Asset Placement Problem
			4.3.2 Settings
			4.3.3 Results for MAP
			4.3.4 Compendium
	5 Summary and Future Work
	References
Can Cyber Operations Be Made Autonomous? An Answer from the Situational Awareness Viewpoint
	1 Introduction
		1.1 Overview of Today\'s CSOCs
		1.2 Can Cyber Operations Be Made Autonomous?
		1.3 Organization of the Rest of the Paper
	2 Cyber Operations in CSOCs
		2.1 Human-in-the-Loop Data Analysis in CSOCs
		2.2 Difficulties in Data Triage Process
			2.2.1 Massive and Rapidly Changing Data
			2.2.2 Weakness and Strength of Human Processing
		2.3 Autonomous Approaches
	3 Case Study: Leveraging Analysts\' Operation Traces for Autonomous Data Triage in CSOCs
		3.1 Approach Overview
		3.2 Formalizing Data Triage Operations
			3.2.1 Analysts\' Data Triage Operations
			3.2.2 Characteristic Constraint Graph
		3.3 Computer-Aided Tracing of Human Data Triage Operations
		3.4 The Mining Algorithm
			3.4.1 Step 1: Identifying Data Triage Operations
			3.4.2 Step 2: Constructing Characteristic Constraint Graph
			3.4.3 Step 3: Mining Characteristic Constraint Graphs
			3.4.4 Step 4: Constructing Finite State Machines
		3.5 Evaluation
		3.6 Experiment Dataset
			3.6.1 ARSCA Traces Collected from a Lab Experiment
			3.6.2 Task Data Sources
		3.7 Evaluation of DT-SM Construction
			3.7.1 Data Triage Operation Identification
			3.7.2 Attack Path Pattern Construction
		3.8 Performance of DT-SM
		3.9 Effect of Analysts\' Task Performance on the DT-SM\'s Performance
			3.9.1 Worst Case Analysis
	4 Lessons Learned
	5 Conclusion
	References
A Framework for Studying Autonomic Computing Models in Cyber Deception
	1 Introduction
	2 Overview of ACyDS
		2.1 ACyDS Architecture
		2.2 ACyDS Design
		2.3 Network View Generation
		2.4 Honeypot Support
		2.5 Fake Broadcast Message
		2.6 Dynamic View Change
	3 Need for Autonomic Computing Models
		3.1 Autonomic Computing
		3.2 Modeling Challenges
		3.3 Architectural Challenges
	4 Overview of MAPE-K
	5 A2CyDS: Realizing Autonomic Element in ACyDS
		5.1 Overhead Cost Analysis
	6 Conclusions and Future Work
	References
Autonomous Security Mechanisms for High-Performance Computing Systems: Review and Analysis
	1 Introduction
	2 HPC Overview
		2.1 HPC Architecture
		2.2 HPC Management Platform
		2.3 HPC Programming Model
		2.4 Key Differences Between HPC and General Computer
	3 HPC Security Objectives and Threats
		3.1 HPC Security Requirements
		3.2 Potential Security Threats and Vulnerabilities
		3.3 Case Studies
	4 Defense Techniques and Protection Mechanisms for HPC systems
		4.1 Static Analysis and Dynamic Analysis
		4.2 Access Control
		4.3 Behavior Monitoring
		4.4 Randomization
		4.5 Control Flow Integrity
		4.6 Multi-execution
		4.7 Fault Tolerance
		4.8 Summary and Discussion
	5 Conclusions
	References
Automated Cyber Risk Mitigation: Making Informed Cost-Effective Decisions
	1 Introduction
	2 Network Configuration and Threat Model
		2.1 Security Compliance State
		2.2 Threat Model
	3 Risk Assessment
		3.1 Network Threat Resistance
		3.2 Threat Exposure
		3.3 Risk Estimation
	4 Automated Risk Mitigation
		4.1 Mitigation Objective
		4.2 Risk Mitigation Actions
			4.2.1 Service-Based Mitigation Actions
			4.2.2 Network-Based Mitigation Actions
			4.2.3 Decision Variables
		4.3 Mitigation Costs
		4.4 Risk Computation
		4.5 Constraints Formalization
		4.6 Continuous Risk Mitigation
	5 Implementation and Evaluation
		5.1 Real Network Case Study
		5.2 Mitigation Planner Scalability Evaluation
	6 Related Works
	7 Conclusions and Future Work
	References
Plan Interdiction Games
	1 Introduction
	2 A Simple Example
	3 Planning in AI
		3.1 Classical Planning
		3.2 Planning Under Uncertainty
	4 Plan Interdiction Problem
		4.1 Interdiction of Deterministic Plans
		4.2 Interdicting MDPs
		4.3 Interdicting Partially Observable MDPs
	5 Illustration: Threat Risk Assessment Using Plan Interdiction
		5.1 Model
		5.2 Implementing the Model
			5.2.1 Vulnerability Dictionary
			5.2.2 Vulnerability Profiles
			5.2.3 Host Generation
			5.2.4 Generation of PDDL
		5.3 Experimental Methods
			5.3.1 Generating Vulnerability Profiles
			5.3.2 Generating Network Architecture
		5.4 Experimental Study of Network Cyber Risk
			5.4.1 Erdos–Renyi Network Model
			5.4.2 Organizational Network Generative Model
		5.5 Cyber Risk Mitigation through Plan Interdiction
	6 Dynamic Plan Interdiction Games
	7 Conclusion
	References
Game Theoretic Cyber Deception to Foil Adversarial Network Reconnaissance
	1 Introduction
	2 Related Work
	3 Cyber Deception Game
		3.1 Systems and True Configurations
		3.2 Observed Configurations
		3.3 Defender Strategies
		3.4 Adversary Strategies
		3.5 Utilities
		3.6 Adversary Knowledge and Utility Estimation
	4 Optimal Defender Strategy Against Powerful Adversary
		4.1 Computational Complexity
		4.2 The Defender\'s Optimization Problem
		4.3 MILP Bisection Algorithm
		4.4 Greedy-Minimax Algorithm
		4.5 Solving for an Optimal Marginal Assignment n
	5 Optimal Defender Strategy against Naive Adversary
	6 Experiments
		6.1 Powerful Adversary: Scalability and Solution Quality Loss
		6.2 Comparing Solutions for Different Types of Adversaries
	7 Conclusion and Future Work
	References
Strategic Learning for Active, Adaptive, and AutonomousCyber Defense
	1 Introduction
		1.1 Literature
		1.2 Notation
		1.3 Organization of the Chapter
	2 Bayesian Learning for Uncertain Parameters
		2.1 Type and Multistage Transition
		2.2 Bayesian Update Under Two Information Structure
		2.3 Utility and PBNE
	3 Distributed Learning for Uncertain Payoffs
		3.1 Static Game Model of MTD
		3.2 Distributed Learning
			3.2.1 Security versus Usability
			3.2.2 Learning Dynamics and ODE Counterparts
			3.2.3 Heterogeneous and Hybrid Learning
	4 Reinforcement Learning for Uncertain Environments
		4.1 Honeypot Network and SMDP Model
		4.2 Reinforcement Learning of SMDP
	5 Conclusion and Discussion
	References
Online Learning Methods for Controlling Dynamic Cyber Deception Strategies
	1 Introduction
		1.1 Game Theory for Cyber Deception
		1.2 Online Learning for Cyber Deception
	2 Online Learning for Deception in a Dynamic Threat Environment
		2.1 Model
		2.2 Attacker Model
		2.3 Defender Strategies
		2.4 Baseline Defense Strategies
		2.5 Multi-Armed Bandits
		2.6 Experiments
	3 Online Learning Algorithms for Deception Against Humans
		3.1 Model
		3.2 Scenario
		3.3 Defenders
		3.4 Behavioral Results
	4 Conclusion
	References
Phishing URL Detection with Lexical Featuresand Blacklisted Domains
	1 Introduction
	2 Related Work
		2.1 URL Structure
		2.2 Content-Based Phishing URL Detection
		2.3 String-Based Phishing URL Detection
		2.4 Phishing URL Classification Algorithms
	3 Data Collection
	4 Lexical Features
	5 Blacklist of Domains
	6 Experiments
		6.1 Experimental Environments
			6.1.1 Datasets
			6.1.2 Phishing URL Detection Methods
		6.2 Experimental Results
		6.3 Feature Importance
	7 Conclusion and Future Work
	References
An Empirical Study of Secret Security Patch in Open Source Software
	1 Introduction
	2 System Overview
	3 Patch Database Collection
		3.1 Security Patch Dataset
		3.2 Non-security Patch Dataset
		3.3 Collected Database
	4 Security Patch Identification
		4.1 Feature Extraction
		4.2 System Modeling
	5 Evaluation
	6 Case Study
		6.1 Identified Secret Security Patches
		6.2 Observation and Insight
	7 Discussion and Limitations
	8 Related Work
	9 Conclusion
	References