A protocol for selecting a rule of combination for fusion of imprecise cyber sensor data

Abstract

There does not seem to be a day that goes by where there is not news of a new and potentially catastrophic cyber attack infecting computers and networks. In addition, even if it were possible to fully list all possible attacks, cyber sensors might not have the fidelity to correctly identify the type of attack. To further complicate things, it is more likely that these sensors must not only contend with quickly detecting known threats but also attacks which are new and unforeseen. Hence, modelling techniques are needed that will help take into account the possibility that the full possible range of potential threats may not be precisely represented as well model ambiguity and partial information. Dempster-Shafer Theory is one such framework because it not only deals with imprecision but there are also different combination rules which can be used depending on whether it is assumed that the full set of possible outcomes is known or not. Here, a protocol is provided to help the analyst select which combination rule should be used based on the assumptions he or she is making. The importance of these assumptions is illustrated through an example to show how results can vary according to the rule chosen.