CAREER: Applying a Criminological Framework to Understand Adaptive Adversarial Decision-Making Processes in Critical Infrastructure Cyberattacks

过去十年，基础设施系统(如电力、供水和银行)经历了网络攻击的激增。这些袭击正变得更加复杂和灵活，这表明肇事者是聪明、坚定和有活力的。不幸的是，目前的网络防御措施是被动的，而且往往无效。防御者需要采取积极主动的方法，这将需要了解这些网络攻击背后的人的特征和行为。目前，现有网络攻击分析中缺乏人的因素是我们基础设施保护的一个根本弱点。该项目将整合来自现场网络安全演习的观察结果、对基础设施保护专家的采访以及来自实时网络攻击的日志，以了解适应性对抗过程。这项研究将通过汇集不同的多学科学者以及国内和国际基础设施网络安全专家来对数字基础设施的保护提供新的理解。该项目将调查关键基础设施网络攻击中自适应和不断演变的对抗性决策(ADM)过程。具体地说，本项目将应用犯罪学的观点来实现五个研究目标：(1)调查对手与防御者的互动并识别对抗性攻击路径，(2)了解攻击路径被中断时的对抗性适应性，(3)调查攻击路径中各个阶段的重要性和特征，(4)确定在攻击路径的每个阶段影响ADM的因素，以及(5)提高对抗性攻击路径的透明度、一致性和有效性。将利用理性选择视角犯罪学理论框架来理解对手如何做出目标选择的决定，如何利用犯罪环境，计划、设计和执行攻击，以及管理预防和反应措施。将采用三种方法来检查ADM：(I)采访基础设施网络安全专家以确定攻击路径和影响ADM的因素；(Ii)观察攻击者-防御者(红队-蓝队)网络安全演习，以检查实时和自适应的决策过程；以及(Iii)实时网络攻击的日志。这些数据集中的每一个都将为ADM流程提供独特的视角，并将结合在一起，以更好地捕获网络攻击中的人为因素。

Infrastructure systems (such as power, water and banking) have experienced a surge in cyberattacks over the past decade. These attacks are becoming more sophisticated and resilient, suggesting that the perpetrators are intelligent, determined and dynamic. Unfortunately, current cyberdefense measures are reactive and frequently ineffective. Defenders need to move to a proactive approach, which will require an understanding of the human characteristics and behaviors of the people behind these cyberattacks. At present, this absence of the human element in existing cyberattack analysis is a fundamental weakness in our infrastructure protection. This project will integrate observations from live cybersecurity exercises, interviews with infrastructure protection experts, and logs from real-time cyberattacks to understand adaptive adversarial processes. This research will offer a new understanding to the protection of digital infrastructure by bringing together a diverse set of multidisciplinary academics and national and international infrastructure cybersecurity experts.This project will investigate the adaptive and evolving adversarial decision-making (ADM) process in critical infrastructure cyberattacks. Specifically, this project will apply a criminological perspective to achieve five research objectives: (1) Investigate adversary-defender interaction and identify adversarial attack paths, (2) Understand adversarial adaptability when attack paths are disrupted, (3) Investigate the importance and characteristics of the various stages in attack paths, (4) Identify which factors impact ADM at each stage of the attack path, and (5) Improve the transparency, consistency and validation of adversarial attack paths. The Rational Choice Perspective criminological theoretical framework will be exploited to comprehend how adversaries make decisions on target selection, exploit criminal environments, plan, design, and execute attacks, and manage preventative and reactive measures. Three methods will be triangulated to examine ADM: (i) interviews with infrastructure cybersecurity experts to identify attack paths and factors impacting ADM, (ii) observations of attacker-defender (red team-blue team) cybersecurity exercises to examine real-time and adaptive decision-making processes, and (iii) logs from real-time cyberattacks. Each of these datasets will yield unique perspectives on ADM processes and will be combined to better capture the human element in cyberattacks.