Adaptive Cyberdefense with Deception: A Human–AI Cognitive Approach

Abstract

Achieving a level of dynamic and adaptive autonomy in cyber defense is highly desirable to advance the capabilities of cyber defense to a whole new level of effectiveness. In such a futuristic cyber defense framework, human defenders, autonomy (Artificial Intelligence, AI), and cognitive models collaborate in a team to deploy the most effective defense strategies utilizing cyber deception. AI defenders have significantly larger capabilities than humans analysts, they can rapidly obtain activity throughout the network and predict potential vulnerabilities; cognitive models “clone” human memory (end users, attackers, and defenders) by tracing human actions and predict the next human decision. These capabilities are then transformed into explicit cyber defense strategies that the human defender can decide to deploy in the network. Such an ideal cyber defense framework is a vision of the future, and our current research program has achieved significant theoretical and empirical progress towards developing Human–AI teaming using cognitive models integrated into an Adaptive Cyber defense framework. In this chapter, we summarize our advances to the current generic and static techniques of cyber defense toward adaptive cyber defense using deception. We provide a high-level overview of the advances we have achieved by using a cognitive approach for modeling the attacker’s and end-user’s decisions; exploring various deception techniques; and performing empirical demonstrations of these deception techniques in tasks of increasing complexity and realism. We conclude with a discussion of the visionary framework of Human–AI Cognitive teaming for cyber defense, where we highlight the most important challenges ahead to achieve this vision.