Adaptive Software Attack Modeling System (ASAMS)

The pervasiveness of software is nowhere more evident than within DoD, the largest buyer of software systems and services in the world. The proliferation of the digital battlespace and the emergence of network-centric warfare concepts only seek to further DoD's reliance on software systems. Such a reliance provides an ample opportunity not only for the nefarious exploits of lone wolf computer hackers, but for more systematic software attacks from organized entities (e.g., hacker groups, trans-national terrorist organizations, nation-state cyber-warfare operations, etc.). While much success has been garnered and an on-going vigilance is prevalent to prevent and ameliorate network and OS attacks, a concomitant emphasis is required to address protection of mission critical software. Here, we propose an Adaptive Software Attack Modeling System (ASAMS). Our novel approach integrates an off-line mechanism for rapid construction of Bayesian belief network (BN) attack models with an on-line model adaptation and knowledge acquisition scheme. Model construction is supported via a cognitive task analysis based knowledge elicitation approach for identifying key domain requirements and a process for translating these requirements into a library of BN-based attack models. On-line attack modeling and knowledge acquisition is supported via BN evidence propagation and model parameter learning.