Proactive Cyber Defense

摘要: There is great interest to develop proactive approaches cyber defense, in which future attack strategies are anticipated and these insights incorporated into defense designs. This chapter considers the problem of protecting computer networks against intrusions other disruptions a manner. We begin by leveraging coevolutionary relationship between attackers defenders derive two new filter-based methods for network defense. The first filters bipartite graph-based machine learning algorithm that enables information concerning previous attacks be “transferred” application novel attacks, thereby substantially increasing rate at systems can successfully respond attacks. second approach involves exploiting basic threat (obtained from, example, security analysts) generate “synthetic” data use appropriate actions, resulting defenses effective both current (near) utility demonstrated showing they outperform standard techniques task detecting malicious activity publicly available datasets. then consider anticipating characterizing impending events with sufficient specificity timeliness enable mitigating defensive actions taken, propose early warning method as solution this problem. based upon fact certain classes require coordinate their exploits signatures coordination provide warning. potential warning-based illustrated through case study involving politically motivated Internet