As a part of the Cyber Command and Control (CC2) initiative within the Information Assurance and Survivability program, DARPA is sponsoring development of a prototype Intelligence Preparation of the Information Battlespace (IPIB) application. This effort attempts to map the kinetic warfare Intelligence Preparation of the Battlespace (IPB) process to cyber defense. This project addresses three i...

Anticipatory cyber defense requires understanding of how cyber adversaries make decisions and adapt as cyberattacks unfold. This paper uses a dataset of qualitative observations conducted at a force on force (“paintball”) exercise held at the 2015 North American International Cyber Summit (NAICS). By creating time series representations of the observed data, a broad range of data mining tools c...

Recently the FBI reported that computer crime has skyrocketed costing over $67 billion in 2005 alone and affecting 2.8M+ businesses and organizations. Attack sophistication is unprecedented along with availability of open source concomitant tools. Private, academic, and public sectors invest significant resources in cyber security. Industry primarily performs cyber security research as an inves...

Critical infrastructures rely on cyber and physical components that are both subject to natural, incidental or intentional degradations. Game theory has been used in studying the strategic interactions between attackers and defenders for critical infrastructure protection, but has not been extensively used in complex cyber-physical networks. This paper fills the gap by modeling the probabilitie...

The distribution automation system (DAS) is vulnerable to cyber-attacks due to the widespread use of terminal devices and standard communication protocols. On account of the cost of defense, it is impossible to ensure the security of every device in the DAS. Given this background, a novel quantitative vulnerability assessment model of cyber security for DAS is developed in this paper. In the as...

This paper describes a study on how cyber security experts assess the importance of three variables related to the probability of successful remote code execution attacks: (i) nonexecutable memory, (ii) access and (iii) exploits for High or Medium vulnerabilities as defined by the Common Vulnerability Scoring System. The rest of the relevant variables were fixed by the environment of a cyber de...

International cyber conflicts will become more frequent and intense. Several current trends prompt this pessimism: ongoing quantitative and qualitative cyber arms races among state actors, the proliferation of cyber weapons among state and non-state actors, a widely shared conventional wisdom that these weapons favor offense over defense, and no broadly accepted definition of the cyber attacks ...

Cyber attacks are becoming increasingly complex, practically sophisticated and organized. Losses due to such attacks are important, varying from the loss of money to business reputation spoilage. Therefore, there is a great need for potential victims of cyber attacks to deploy security solutions that allow the identification and/or prediction of potential cyber attacks, and deploy defenses to f...

Internet-based computer information systems play critical roles in many aspects of the modern society. However, these systems are constantly under cyber attacks that can cause catastrophic consequences. In order to defend these systems effectively, it is necessary to measure and predict the effectiveness of cyber defense mechanisms. In this paper, we investigate how to measure and predict the e...

In this paper, we establish a zero-sum, hybrid state stochastic game model for designing defense policies for cyber-physical systems against different types of attacks. With the increasingly integrated properties of cyber-physical systems (CPS) today, security is a challenge for critical infrastructures. Though resilient control and detecting techniques for a specific model of attack have been ...