EAGER: Collaborative: A Criminology-Based Simulation of Dynamic Adversarial Behavior in Cyberattacks

2016年，网络威胁格局展示了先进的攻击技术、不断升级的攻击频率和高水平的对手复杂性。传统的网络攻击管理是响应驱动的，组织将工作重点放在检测威胁上，而不是预测敌对行动。这种被动的方法效果有限，因为它不能捕获高级和复杂的对手、变异或未知的恶意软件、生活在陆地上的技术或正在部署的新变体。因此，迫切需要在网络安全领域实现范式转变。安全专家呼吁采取预见性或前瞻性的防御措施，重点关注敌对行为和移动。本研究旨在开发一种捕获网络犯罪动态的犯罪学理论和相应的模拟器，以生成适应不断变化和多样化的网络漏洞、防御和对手战术的攻击场景。这项研究有两个相互关联的目标：(1)开发(和评估)一个集成的动态例行活动理论(DRAT)，该理论在蒙特卡洛模拟的帮助下考察了犯罪者、目标和监护人(OTG)之间沿着网络攻击轨迹不断变化的交互作用；(2)了解OTG的变化如何影响动态对抗性攻击轨迹。具体地说，如何测量、建模和模拟这些变化和变化的数量，以及这些变化可能对DRAT意味着什么--了解对手攻击轨迹，以及如何破坏这些轨迹以影响对手，将有助于理解预见性网络防御，并最终有助于向主动网络安全的范式转变。这项探索性的多学科研究将犯罪学和计算机工程这两个学科结合在一起，推动了主动网络安全的研究前沿。这一突破性的交叉将产生新的犯罪学理论知识、混合方法创新和理论上知情的模拟，为防御者准备先发制人的全面知识和工具，以应对适应性强和复杂的对手。

In 2016, the cyberthreat landscape showcased advanced attack techniques, escalated attack frequency, and high levels of adversarial sophistication. Conventional cyberattack management is response-driven, with organizations focusing their efforts on detecting threats, rather than anticipating adversarial actions. This reactive approach has limited efficacy, as it does not capture advanced and sophisticated adversaries, mutating or unknown malware, living-off-the-land techniques or new variants being deployed. There is thus an immediate need for a paradigm shift in the area of cybersecurity. Security experts are calling for anticipatory or proactive defense measures that focus on adversarial behavior and movement. This research aims to develop a criminological theory that captures the dynamics of cybercrime and a corresponding simulator to generate attack scenarios that adapts to ever changing and diverse cyber vulnerabilities, defense, and adversary tactics. This research has two connected objectives: (1) Develop (and evaluate) an integrated Dynamic Routine Activities Theory (DRAT), which examines the continually changing interaction between offender, target, and guardian (OTG) along cyberattack trajectories aided by Monte-Carlo simulation; and (2) Understand how variations in OTG impact dynamic adversarial attack trajectories. Specifically, how can these variations and amounts of variations be measured, modeled and simulated, and what might these variations imply for DRAT -- Understanding adversarial attack trajectories, and how these can be disrupted to impact adversaries, will be instrumental in comprehending anticipatory cyber defense and ultimately contribute to the paradigm shift towards proactive cybersecurity. This exploratory, multidisciplinary research marries the two disciplines of criminology and computer engineering to push the research frontier on proactive cybersecurity. This groundbreaking intersection will generate new criminological theoretical knowledge, mixed-method innovations, and theoretically-informed simulation that prepare defenders with preemptive and comprehensive knowledge and tools in facing adaptive and sophisticated adversaries.