1. Research Task / Overview Overview1 Goals & Objectives
Cybersecurity Decision Patterns
as Adaptive Knowledge Encoding
in Cybersecurity Operations
Keith D. Willett, PhD Candidate, Enterprise Security Architect, DoD
Advisor: Dr. Mark Blackburn
Research Task / Overview
Overview1
Goals & Objectives
Computational Methods
Define and elaborate on a method for knowledge management in cybersecurity operations with the intent of knowledge reuse for:
Introduce and continually improve security automation.  hypothesis
People to people knowledge sharing (people-enhanced cognition (PEC)).
Machine use of knowledge in real-time operations.
Foundation from which to train artificial intelligence (machine-enhanced cognition (MEC)).
Imagine you are a cybersecurity analyst newly prepared with best practices of the day. You are excited to perform good work for a good cause. Fast forward six months when you realize you are constrained by best practices and 98% of what you do are rote tasks with little to no time to explore new, unique scenarios.
Cybersecurity Decision Patterns… more of what works, faster!
Cybersecurity Decision Patterns (CDPs): capture and reuse knowledge
…for processing anomalies in 11 workflow phases
…to increase quantity of known-known anomalies processed
A cybersecurity operations framework conducive to identify the role, fit, function, and impact of any cybersecurity solution
System dynamics modeling as a surrogate to people to test hypothesis
Experiment Design:
Control group: anomaly processing without CDPs
Treated group: anomaly processing with CDPs
Data & Analysis
Methodology
Quantitative: CDP affect on quantity of anomalies processed
Qualitative: cybersecurity tactical framework to analyze operations
Approach: system dynamics modeling of cybersecurity operations to test the role, fit, function, and impact of using CDPs to introduce and continually improve security automation.
Tactical Context
Dynamic interaction of cybersecurity domain
Elaborate on and quantify the tactical focus (e.g. quantity of anomalies)
Hypothesis Test for KK Characterize
Conclusion: CDPs do significantly improve the quantity of known-known (KK) anomalies processed within the characterize workflow phase.
Hypothesis Test for KK Notify
Conclusion: CDPs do significantly improve the quantity of known-known anomalies processed within the notify workflow phase.
Tactical Focus
Hypothesis Test for KK Escalate
Conclusion: CDPs do not significantly improve the quantity of known-known anomalies processed within the escalate workflow phase.
Hypothesis Test for KK Triage
Conclusion: CDPs do significantly improve the quantity of known-known anomalies processed within the triage workflow phase.
Elaboration of Tactical Framework (Cybersecurity Operations Workflow)
Monitor: ongoing observation with intent to raise awareness
Detect: indicator of anomaly
Characterize: known-known, known-unknown, unknown-unknown, unknown-known
Notify: first tier support
Triage: determine priorities
Escalate: send to subject matter expert(s)
Isolate: contain threat or threat effects
Restore: restore effective operations even at diminished efficiency
Root Cause Analysis: identify root cause of problem
Recover: recover effective & efficient operations to desired performance level
Feedback: minimize recurrence and effects of recurrence
Hypothesis Test for KK Restore
Conclusion: CDPs do significantly improve the quantity of known-known anomalies processed within the restore workflow phase.
Hypothesis Test for KK Isolate
Conclusion: CDPs do significantly improve the quantity of known-known anomalies processed within the isolate workflow phase.
Future Research
Operationalize:
Cybersecurity Decision Patterns (CDPs) as a foundation from which to train artificial intelligence in the domain of cybersecurity operations; and,
Cybersecurity Decision Pattern Language (CDPL) as a repository from which to identify and apply knowledge in the form of people-enhanced cognition (PEC) and machine-enhanced cognition (MEC).
Hypothesis Test for KK Recover
Conclusion: CDPs do not significantly improve the quantity of known-known anomalies processed within the recover workflow phase.
Conclusions
CDPs have significant affect on most workflow phases. Exceptions:
Detect: purposely not included
Escalate:
Root Cause Analysis: manual only
Feedback: manual only
Contacts/References
Imagine you are a new cybersecurity analyst… fast forward six months when you realize CDPs help free you from rote tasks and provide you time to constantly explore new, unique scenarios.
Keith D. Willett;
Dr. Mark Blackburn;
SERC Sponsor Research Review, November 17, 2016