automating cyber-defense management
Last year, we reported [1] our success in setting a new high-water mark for intrusion tolerance. That success can largely be attributed to our use of a "survivability architecture", which refers to the organization of a set of concrete defense mechanisms for preventing intrusion, and for detecting and responding to intrusions that cannot be prevented. The system defense-enabled with the DPASA survivability architecture [2] showed a high level of resistance to sustained attacks by sophisticated adversaries, but needed expert operators to perform the role of an "intelligent control loop"---interpreting the events reported by the survivable system as well as deciding in some cases which defense mechanisms to actuate. We took the position that the survivability architecture must be extended to include part, if not all, of the functionality of the intelligent control loop. This paper is a work in progress report of our current research attempting to introduce a cognitive control loop into survivability architectures.
survivability survivability architecture defense mechanisms defense-enabling intrusion-tolerance