Adaptive Deception using Linguistic Inference of Behaviors (AD-LIB)

As cyber attacks become increasingly and more effectively targeted, so must our cyber defenses become less"one size fits all."We need to develop active defenses that can adapt themselves to an attack in progress. This development will require not only improvements in our detection capabilities but also techniques to engage and out-game attackers. If we can develop robust models of attacks and attacker behaviors, we can then infer an attacker"s intentions and likely next moves. Most importantly, we can use this knowledge to our own advantage though use of targeted deceptionsthe more we can lead an attacker down paths of our own making, the more we can delay and deter him, and the more we can gain valuable insight into his missionwhat he believes he is accomplishing and why. We propose to research, design, and demonstrate a strategy and architecture for Adaptive Deception using Linguistic Inference of Behaviors (AD-LIB). AD-LIB uses techniques from natural language processing (NLP) and specifically systemic functional grammar (SFG) to generate targeted software deceptions to coax intent information from cyber attacks and attackers based on real-time understanding of their goals and most-probable next moves.