Intelligent Decision Support for Cybersecurity Incident Response Teams: Autonomic Architecture and Mitigation Search

Abstract

Critical infrastructures must be able to mitigate, at runtime, suspected ongoing cyberattacks that have eluded preventive security measures. To tackle this issue, we first propose an autonomic computing architecture for a Cyber-Security Incident Response Team Intelligent Decision Support System (CSIRT-IDSS) with a precise set of technologies for each of its components. We then zoom in on the component responsible for proposing to the CSIRT, automatically ranked sets of runtime actions to mitigate suspected ongoing cyber-attacks. We formalize its task as a Constraint Optimization Problem (COP). We then propose to implement it by a Constraint Object-Oriented Logic Program (COOLP) deployed as a containerized web service through the integration of three orthogonal extensions of Logic Programming (LP): Web Service Oriented LP (WSOLP) [34] Constraint LP (CLP) [10] and Object-Oriented LP (OOLP) [23]. This integration supports seamlessly reusing platform and task independent cybersecurity ontological knowledge to dynamically build a mitigation action search COP that is customized to an input suspected cyberattack action set. This customization then allows the COP, to be solved by a generic CLP engine efficiently enough to propose mitigation actions to the CSIRT team while they can still be effective. To validate this approach, we implemented a prototype called CARMAS (Cyber Attack Runtime Mitigation Action Search) and ran scalability tests on simulated attacks with various COP construction strategies.

Mission‐centric decision support in cybersecurity via Bayesian Privilege Attack Graph

“…We were inspired by these works in the creation of our own mission decomposition model presented in our earlier paper 4 . The model used in our work uses the AND/OR notation and is based on the constraint satisfaction problem 17,20,24,25 . The difference between our approach and the related work is that we do not consider mission capacity; functional requirements, that is, constraints, are a binary matter.…”

“…However, the paper's main contribution is a proposed stochastic optimization model to handle uncertainties in breach probability estimation. Correa et al 25 optimized the selection of countermeasures at runtime, formalized the attack mitigation search task as a constraint optimization problem, and proposed an autonomic computing architecture including a precise set of technologies for each of its components to mitigate suspected ongoing cyber attacks.…”

“…4 The model used in our work uses the AND/OR notation and is based on the constraint satisfaction problem. 17,20,24,25 The difference between our approach and the related work is that we do not consider mission capacity; functional requirements, that is, constraints, are a binary matter. The logic of the model used in our work allows selecting the most resilient configuration among all feasible ones, that is, to derive a Bayesian network of associated privileges including both critical targets and likely attacker positions and to calculate the resilience of the configuration.…”

Cybersecurity for Industrial Internet of Things: Architecture, Models and Lessons Learned

“…The Cyber-Attack Runtime Mitigation Action Search (CAR-MAS) component is presented in detail in [34]. It takes as input from the Advanced Visualization Toolkit (AVT), a set of detected attack actions, each accompanied with the business loss that they would bring about if left unmitigated.…”

“…The COP builder takes as parameter a heuristic function to build a COP that tailors relevant general knowledge that its reuses from the ontology to the specific attack input description received from AVT. In [34], we show that such heuristically built COP can then be solved by the COP solver in a few seconds even for large coordinated attacks involving up to 10 attack actions targeting up to 15 network assets.…”