Cognitive Modeling for Cyber Defense

The Cyber battlespace is extraordinarily dynamic, complex and challenging, with both human and automated adversaries (bots) acting alone and in concert to achieve the desired aims. Before Cyber defenders can act to guard against these attacks, they must first achieve and maintain a level of Situation Awareness (SA) that allows them to identify, understand, and anticipate evolving threats so they can implement strategies to defeat them. Cognitive modeling of Cyberspace SA can assist the Cyber defender in risk monitoring and mitigating activities, supporting an understanding of the effects of attacks on their own Cyber systems, along with the projected evolution of Cyber events and their impacts, and finally executing the proper decisions that are required to disrupt or defeat attacks. The cognitive modeling system proposed will support Cyber defenders in recognizing, characterizing, and responding to threats. CyberFACE uses fuzzy logic based cognitive modeling coupled with a learning-enabled neural network, to produce a cognitive engine built upon the knowledge representation structure of domain experts. Diagnostic outputs comprise recommended actions, targeted to the specific network, as well as the current threat posed by the most likely threat profile identified.