Machine Learning, Robust Optimisation, and Verification: Creating Synergistic Capabilities in Cybersecurity Research

应对网络安全威胁需要更好的支持，这是无可争议的。企业面临着越来越多的恶意软件和集成恶意软件攻击工具，对基础设施和服务的攻击企图，越来越多的内部攻击，以及针对高价资产的高级持续威胁。处理此类威胁要求组织拥有至少熟悉网络安全问题的ICT员工，并且无论这些员工的角色如何，最好都具有网络安全方面的实际技能。同样，管理层和决策者需要意识到网络安全问题，并在他们的行动中反映这些问题。大型组织通常设有首席信息安全官（CISO），负责处理其组织的网络安全运营和战略问题。但中小企业通常承担不起这样的网络安全监管角色，这使它们特别容易受到攻击。组织所面临的网络安全问题的规模和多样性意味着它不可能考虑其系统的每个单一漏洞，以应对每个可信或潜在的对手，这些对手的存在将漏洞变成实际威胁。但是，CISO或决策者需要对所有这些复杂性有一个相当抽象的视图，其中抽象的选择不是由技术方面驱动的，而是由风险、遵从性、服务可用性和策略等模式驱动的。这种观点通常必须考虑到外部或合作伙伴组织的网络安全，这是有问题的，因为组织不愿共享此类敏感信息。因此，CISO或决策者需要相关的内部或外部系统和服务的表示，以使他或她能够做出操作或战略性质的决策。在这种抽象中表达的不确定性通常是概率性的或本质上严格的。例如，根据过去的历史、机器的位置等，银行可能很清楚给定的柜员机具有损坏的外部接口的可能性，该接口会复制插入的银行卡。严格的不确定性通常与没有（或不足）历史信息可用来估计概率分布的威胁有关，或者它用于表示问题的组合性质，例如，可能安排关键任务的不同顺序。该项目汇集了机器学习、鲁棒优化、验证和网络安全领域的研究领导者，以探索满足网络安全需求的新建模和分析能力。该项目将研究建模和优化的新方法，通过这些方法，系统、过程和基础设施的网络安全可以在面对随机和严格的不确定性时进行更稳健的评估、监测和控制。将特别关注隐私：将创建保护隐私的新形式的数据分析和尊重隐私考虑的决策支持方法；在企业保密方面，我们将建立基础，使不同的组织能够模拟和分析跨组织的网络安全方面，同时通过建立适当的信息屏障，尊重组织机密信息固有的隐私类型。

The need for better support to deal with the threats of cybersecurity is undisputed. Organisations are faced with an ever growing number of malware and integrated malware attack tools, attempted attacks on infrastructure and services, an increasing number of insider attacks, and advanced persistent threats for high-priced assets. Dealing with such threats requires that organisations have ICT staff that is at least familiar with cybersecurity issues and preferably has actual skills in cybersecurity regardless of the role of such staff. Likewise, management and decision makers need to be aware of cybersecurity issues and reflect these in their actions. Large organisations often have a Chief Information Security Officer (CISO) who deals with the operational and strategic issues of cybersecurity for his or her organisation. But SMEs typically cannot afford a role with such oversight on cybersecurity, which makes them especially vulnerable.The scale and diversity of cybersecurity issues that an organisation faces means it cannot possibly consider each single vulnerability of its systems against each credible or potential adversary whose presence would turn a vulnerability into an actual threat. A CISO or decision maker, though, needs to have a fairly abstract view of all this complexity where the choice of abstraction is not driven by technical aspects but by modalities such as risk, compliance, availability of service, and strategy. This view often has to take into account the cybersecurity of external or partner organisations, which is problematic as organisations are reluctant to share such sensitive information. Therefore, a CISO or decision maker needs a representation of relevant internal or external systems and services that allows him or her to make decisions of either operational or strategic nature. The uncertainty expressed in such abstractions is typically probabilistic or strict in nature. For example, a bank may have a good idea of the probability that a given teller machine has a corrupted external interface that clones inserted bank cards, based on past history, location of the machine and so forth. Strict uncertainty often relates to threats for which no (or insufficient) historical information is available to estimate probability distributions, or it is used to express the combinatorial nature of a problem, for example the different orderings in which one may schedule critical tasks.This project brings together research leaders in machine learning, robust optimisation, verification and cybersecurity to explore new modelling and analysis capabilities for needs in cybersecurity. The project will investigate new approaches for modelling and optimisation by which cybersecurity of systems, processes, and infrastructures can be more robustly assessed, monitored, and controlled in the face of stochastic and strict uncertainty. Particular attention will be paid to privacy: new forms of privacy-preserving data analytics will be created and approaches to decision support that respect privacy considerations; for corporate confidentiality, we will invent foundations that enable different organisations to model and analyse cross-organisational cybersecurity aspects whilst respecting the type of privacy inherent in organisations' confidential information by establishing appropriate information barriers.