Bayesian Analysis of Competing Cyber Hypotheses

网络安全在国际政府的最高层被视为重要。奥巴马总统曾表示，“网络威胁是美国作为一个国家面临的最严重的经济和国家安全挑战之一”。即使是伴随英国网络安全战略而来的6.5亿英镑的额外资金，与英国经济每年因网络犯罪而造成的超过100亿英镑的估计成本相比，也相形见绌。此外，我们看到与“跨国有组织犯罪”的联系（网络犯罪有利可图且广泛）以及“恐怖主义”（国家支持的网络战正在增加）和“意识形态和信仰”（反体制的黑客活动家，如匿名者，也在诉诸网络攻击来表达他们的观点）。惠普等公司帮助遭受网络攻击的组织保护他们的资产和信息免受此类攻击。这些网络防御公司使用硬件和软件的组合来实现这一点，并通过人工努力来增强。将人力分配给活动至关重要，因为不适当的分配可能导致浪费人力时间或攻击不受挑战。时间压力、模糊信息的存在和涉及的高风险会降低与分配过程相关的人类判断力。心理学家认为，这种压力会降低人类的决策能力，在其他领域也存在类似的问题。事实上，珍珠港事件和古巴导弹危机都是情报过程失败的结果，这些失败可以追溯到人类在决策过程中的分析错误。受这些经验的启发，在20世纪70年代，中情局开发了一种技术，“竞争假设分析”，鼓励分析师和决策者避免与情报分析相关的陷阱。该技术涉及对所观察到的事物的多个候选解释的考虑。然后，使用观察结果来评估（并迭代地细化）假设，以区分可能的假设和不可能的假设。虽然这项技术已经证明了它的实用性，但为了有效地发挥作用，重要的是考虑的假设包括“可能的”而不仅仅是“可能的”解释。不幸的是，“可能”和“可能”在这种情况下没有精确定义。然而，最近在统计文献中取得的进展，“序贯蒙特卡罗采样器”，表现出许多与竞争假设分析相同的特征。顺序蒙特卡罗采样器通常应用于计算机（而不是人）生成假设并对其进行评估的环境中。然而，就像竞争假设分析一样，他们考虑假设群体，根据数据进行评估，然后迭代地用于产生新的假设群体。至关重要的是，类似的概念，“可能的”和“可能的”假设的概念都很好地定义和理解。我们建议调整序贯蒙特卡罗抽样成为竞争假设分析的一部分。我们进一步建议应用和演示一个工具，体现在操作网络安全context.If成功的技术，该项目将开发技术，以确保在操作网络安全设置的决策是很好的动机。如果这些决策涉及将人力分析资源分配给活动，这将提高网络安全运营的效率。该技术将使英国在这一高优先级应用领域处于最先进的前沿。

Cyber security is recognised as important at the highest levels of international government. President Obama has said that "the Cyber threat is one of the most serious economic and national security challenges [the US] face as a nation". Even the £650M in additional funding that accompanied the UK's Cyber Security Strategy is dwarfed by the >£10B estimated annual cost of cyber-crime to the UK economy. Additionally, we see links to "transnational organised crime" (cyber-crime is lucrative and widespread) as well as "Terrorism" (state-sponsored cyber-warfare is increasing) and "Ideologies and beliefs" (anti-establishment hacktivists, eg Anonymous, are also resorting to cyber-attack to express their views).Companies such as HP help organisations who are subjected to cyber attacks to protect their assets and information from such attacks. These cyber defence companies achieve this using a combination of hardware and software augmented with human effort. Allocating human effort to activity is critical since inappropriate allocation can result in human time being wasted or attacks going unchallenged. Time pressure, the presence of ambiguous information and the high stakes involved can then degrade the human judgement associated with this allocation process.Psychologists understand that such pressures degrade human decision making and similar issues have been found to exist in other domains. Indeed, Pearl Harbour and the Cuban Missile Crisis were each the result of failures in the intelligence process that can be traced back to human analysis errors educating decision making. Motivated by such experiences, in the 1970s, the CIA developed a technique, "Analysis of Competing Hypotheses" which encourages analysts and decision makers to avoid the pitfalls that can be associated with intelligence analysis. This technique involves consideration of multiple candidate explanations for what is being observed. The hypotheses are then assessed (and iteratively refined) using the observations to discriminate between likely and unlikely hypotheses. While the technique has proven its utility, for it to work effectively, it is important that the hypotheses considered include the "possible" not just the "probable" explanations. Unfortunately, "possible" and "probable" aren't precisely defined in this context.However, a recent advance in the statistics literature, "Sequential Monte Carlo Samplers", exhibits many of the same features as Analysis of Competing Hypotheses. Sequential Monte Carlo samplers are typically applied in contexts where a computer (not a person) generates the hypotheses and assesses them. However, just like Analysis of Competing Hypotheses, they consider a population of hypotheses, assessed against data and then iteratively used to spawn a new population of hypotheses. Crucially, the analogous concept to the notion of "possible" and "probable" hypotheses is both well defined and well understood.We propose to adapt Sequential Monte Carlo samplers to become part of Analysis of Competing Hypotheses. We further propose to apply and demonstrate a tool embodying the technique in an operational cyber security context.If successful, this project would develop techniques that would ensure that decisions made in operational cyber security settings were well motivated. Where those decisions relate to the allocation of human analyst resources to activities, this would improve the efficiency of cyber security operations. The technology will position the UK at the forefront of the state-of-the-art in this high priority application domain.