CAREER: Applying a Criminological Framework to Understand Adaptive Adversarial Decision-Making Processes in Critical Infrastructure Cyberattacks

基础设施系统（如电力、水和银行）在过去十年经历了网络攻击的激增。这些攻击正变得越来越复杂和有弹性，这表明犯罪者是聪明的、坚定的和动态的。不幸的是，目前的网络防御措施是被动的，而且往往无效。防御者需要采取积极主动的方法，这将需要了解这些网络攻击背后的人的特征和行为。目前，在现有的网络攻击分析中缺乏人为因素是我们基础设施保护的一个根本弱点。该项目将整合现场网络安全演习的观察结果、对基础设施保护专家的采访以及实时网络攻击日志，以了解自适应对抗过程。本研究将汇集多学科学者以及国内和国际基础设施网络安全专家，为数字基础设施的保护提供新的认识。该项目将研究关键基础设施网络攻击中的适应性和不断发展的对抗决策（ADM）过程。具体来说，这个项目将应用犯罪学的角度来实现五个研究目标：(1)研究对抗者与防御者之间的相互作用，识别对抗性攻击路径；(2)了解攻击路径中断时的对抗性适应性；(3)研究攻击路径各阶段的重要性和特征；(4)确定攻击路径各阶段影响ADM的因素；(5)提高对抗性攻击路径的透明度、一致性和有效性。理性选择视角的犯罪学理论框架将被用来理解对手如何在目标选择上做出决定，利用犯罪环境，计划，设计和执行攻击，以及管理预防和反应措施。三种方法将被三角化来检查ADM:(i)与基础设施网络安全专家的访谈，以确定攻击路径和影响ADM的因素；（ii）观察攻击者-防御者（红队-蓝队）网络安全演习，以检查实时和适应性决策过程；（iii）实时网络攻击日志。这些数据集中的每一个都将产生ADM过程的独特视角，并将结合起来更好地捕捉网络攻击中的人为因素。

Infrastructure systems (such as power, water and banking) have experienced a surge in cyberattacks over the past decade. These attacks are becoming more sophisticated and resilient, suggesting that the perpetrators are intelligent, determined and dynamic. Unfortunately, current cyberdefense measures are reactive and frequently ineffective. Defenders need to move to a proactive approach, which will require an understanding of the human characteristics and behaviors of the people behind these cyberattacks. At present, this absence of the human element in existing cyberattack analysis is a fundamental weakness in our infrastructure protection. This project will integrate observations from live cybersecurity exercises, interviews with infrastructure protection experts, and logs from real-time cyberattacks to understand adaptive adversarial processes. This research will offer a new understanding to the protection of digital infrastructure by bringing together a diverse set of multidisciplinary academics and national and international infrastructure cybersecurity experts.This project will investigate the adaptive and evolving adversarial decision-making (ADM) process in critical infrastructure cyberattacks. Specifically, this project will apply a criminological perspective to achieve five research objectives: (1) Investigate adversary-defender interaction and identify adversarial attack paths, (2) Understand adversarial adaptability when attack paths are disrupted, (3) Investigate the importance and characteristics of the various stages in attack paths, (4) Identify which factors impact ADM at each stage of the attack path, and (5) Improve the transparency, consistency and validation of adversarial attack paths. The Rational Choice Perspective criminological theoretical framework will be exploited to comprehend how adversaries make decisions on target selection, exploit criminal environments, plan, design, and execute attacks, and manage preventative and reactive measures. Three methods will be triangulated to examine ADM: (i) interviews with infrastructure cybersecurity experts to identify attack paths and factors impacting ADM, (ii) observations of attacker-defender (red team-blue team) cybersecurity exercises to examine real-time and adaptive decision-making processes, and (iii) logs from real-time cyberattacks. Each of these datasets will yield unique perspectives on ADM processes and will be combined to better capture the human element in cyberattacks.