Cognitive Support for Intelligent Survivability Management Partha Pal Rick Schantz, Franklin Webber BBN Technologies DSN HOT DEP 2007 June 26 2007

Context Cyber-Defense Survivable systems Automated … Self-improving…… Dependable systems must be dependable when attacked Cyber defense considerations increasingly affect dependable system design DARPA OASIS Dem/Val program demonstrated high level of resilience against sophisticated cyber attacks But needed considerable expert involvement in cyber-defense decision making Self-regenerative Survivable Systems– an emerging direction within the general cyber defense research Cyber-Defense Survivable systems Automated … Self-improving…… Our Focus: Automated interpretation of observation and response selection..

Challenges Goal: Automate the reasoning performed by expert cyber-defense administrators Effective, reusable, easy to port and retarget Challenges: Making sense of low-level information (alerts, observations) to drive low-level defense-mechanisms (block, isolate etc.) such that higher-level objectives (survive, continue to operate) are achieved Doing it as well as human experts Additional difficulties Rapid and real time decision-making and response Uncertainty due to incomplete and imperfect information Widely varying operating conditions (no alerts to 100s of alerts per second) New symptoms and changes in adversary’s strategy

Multi-Layer reasoning Approach Multi-perspective multi-hypothesis deliberation Keep all options open– delay the bindings Divide and conquer Current-utility as well as potential adversarial counter-response based response selection A simple “match” is insufficient against intelligent adversary Unpredictability to counter gaming Maintain while deliberate Fast containment response Buy time for higher level reasoning Interpret “Immunity” against repeats and variants Learning-based dynamic modification of defense parameters and strategies Multi-Layer reasoning OLC Select Response Learning ILC

High Level Reasoning Flow