1. Cognitive Support for Intelligent Survivability Management
Partha Pal
Rick Schantz, Franklin Webber
BBN Technologies
DSN HOT DEP 2007
June

2. Context Cyber-Defense Survivable systems Automated … Self-improving……
Dependable systems must be dependable when attacked
Cyber defense considerations increasingly affect dependable system design
DARPA OASIS Dem/Val program demonstrated high level of
resilience against sophisticated cyber attacks
But needed considerable expert involvement in cyber-defense decision making
Self-regenerative Survivable Systems– an emerging direction within the general cyber defense research
Cyber-Defense
Survivable systems
Automated …
Self-improving……
Our Focus: Automated interpretation of observation and response selection..

3. Challenges
Goal: Automate the reasoning performed by expert cyber-defense administrators
Effective, reusable, easy to port and retarget
Challenges:
Making sense of low-level information (alerts, observations) to drive low-level defense-mechanisms (block, isolate etc.) such that higher-level objectives (survive, continue to operate) are achieved
Doing it as well as human experts
Additional difficulties
Rapid and real time decision-making and response
Uncertainty due to incomplete and imperfect information
Widely varying operating conditions (no alerts to 100s of alerts per second)
New symptoms and changes in adversary’s strategy

4. Multi-Layer reasoning
Approach
Multi-perspective multi-hypothesis deliberation
Keep all options open– delay the bindings
Divide and conquer
Current-utility as well as potential adversarial counter-response based response selection
A simple “match” is insufficient against intelligent adversary
Unpredictability to counter gaming
Maintain while deliberate
Fast containment response
Buy time for higher level reasoning
Interpret
“Immunity” against repeats and variants
Learning-based dynamic modification of defense parameters and strategies
Multi-Layer reasoning
OLC
Select Response
Learning
ILC

5. High Level Reasoning Flow