Bayesian Analysis of Competing Cyber Hypotheses

在国际政府的最高层，网络安全被认为是重要的。奥巴马总统曾表示，“网络威胁是美国作为一个国家所面临的最严重的经济和国家安全挑战之一”。即便是英国《网络安全战略》附带的6.5亿英镑的额外资金，与英国经济每年因网络犯罪而付出的代价相比，也相形见绌。此外，我们还看到与“跨国有组织犯罪”(网络犯罪有利可图且普遍存在)、“恐怖主义”(国家支持的网络战正在增加)和“意识形态和信仰”(反建制黑客活动人士，如匿名者也在诉诸网络攻击来表达他们的观点)的联系。惠普等公司帮助受到网络攻击的组织保护其资产和信息免受此类攻击。这些网络防御公司使用硬件和软件的组合，再加上人的努力，实现了这一点。将人力分配给活动是至关重要的，因为不适当的分配可能会导致浪费人力时间或攻击不受挑战。时间压力、模棱两可的信息的存在以及涉及的高风险可能会降低与这种分配过程相关的人的判断。心理学家理解，这种压力会降低人的决策能力，而且已经发现在其他领域也存在类似的问题。事实上，珍珠港事件和古巴导弹危机都是情报过程失败的结果，情报过程可以追溯到教育决策的人类分析错误。在这种经历的激励下，中央情报局在20世纪70年代开发了一种技术--“竞争假说分析”，鼓励分析人员和决策者避免可能与情报分析相关的陷阱。这项技术包括考虑对所观察到的东西进行多种候选解释。然后，使用观察结果评估(并迭代改进)这些假设，以区分可能的和不可能的假设。虽然这项技术已经证明了它的实用性，但为了使它有效地发挥作用，重要的是所考虑的假设包括“可能的”而不仅仅是“可能的”解释。不幸的是，“可能”和“可能”在本文中没有准确的定义。但是，统计学文献中的一个最新进展--“序贯蒙特卡罗采样器”--显示了许多与竞争假说分析相同的特征。顺序蒙特卡罗采样器通常应用于计算机(而不是人)生成假设并对其进行评估的环境中。然而，就像竞争假说的分析一样，他们考虑一组假说，根据数据进行评估，然后反复使用来产生新的假说组。重要的是，与“可能”和“可能”假设的概念相似的概念既定义良好，也得到了很好的理解。我们建议采用序贯蒙特卡罗采样器作为竞争假设分析的一部分。我们还建议在一个可操作的网络安全环境中应用和演示该技术的工具。如果成功，该项目将开发技术，以确保在可操作的网络安全环境中做出的决策具有良好的动机。如果这些决定涉及将人力分析员资源分配给活动，这将提高网络安全业务的效率。这项技术将使英国在这一高优先级应用领域处于最先进的前沿。

Cyber security is recognised as important at the highest levels of international government. President Obama has said that "the Cyber threat is one of the most serious economic and national security challenges [the US] face as a nation". Even the £650M in additional funding that accompanied the UK's Cyber Security Strategy is dwarfed by the >£10B estimated annual cost of cyber-crime to the UK economy. Additionally, we see links to "transnational organised crime" (cyber-crime is lucrative and widespread) as well as "Terrorism" (state-sponsored cyber-warfare is increasing) and "Ideologies and beliefs" (anti-establishment hacktivists, eg Anonymous, are also resorting to cyber-attack to express their views).Companies such as HP help organisations who are subjected to cyber attacks to protect their assets and information from such attacks. These cyber defence companies achieve this using a combination of hardware and software augmented with human effort. Allocating human effort to activity is critical since inappropriate allocation can result in human time being wasted or attacks going unchallenged. Time pressure, the presence of ambiguous information and the high stakes involved can then degrade the human judgement associated with this allocation process.Psychologists understand that such pressures degrade human decision making and similar issues have been found to exist in other domains. Indeed, Pearl Harbour and the Cuban Missile Crisis were each the result of failures in the intelligence process that can be traced back to human analysis errors educating decision making. Motivated by such experiences, in the 1970s, the CIA developed a technique, "Analysis of Competing Hypotheses" which encourages analysts and decision makers to avoid the pitfalls that can be associated with intelligence analysis. This technique involves consideration of multiple candidate explanations for what is being observed. The hypotheses are then assessed (and iteratively refined) using the observations to discriminate between likely and unlikely hypotheses. While the technique has proven its utility, for it to work effectively, it is important that the hypotheses considered include the "possible" not just the "probable" explanations. Unfortunately, "possible" and "probable" aren't precisely defined in this context.However, a recent advance in the statistics literature, "Sequential Monte Carlo Samplers", exhibits many of the same features as Analysis of Competing Hypotheses. Sequential Monte Carlo samplers are typically applied in contexts where a computer (not a person) generates the hypotheses and assesses them. However, just like Analysis of Competing Hypotheses, they consider a population of hypotheses, assessed against data and then iteratively used to spawn a new population of hypotheses. Crucially, the analogous concept to the notion of "possible" and "probable" hypotheses is both well defined and well understood.We propose to adapt Sequential Monte Carlo samplers to become part of Analysis of Competing Hypotheses. We further propose to apply and demonstrate a tool embodying the technique in an operational cyber security context.If successful, this project would develop techniques that would ensure that decisions made in operational cyber security settings were well motivated. Where those decisions relate to the allocation of human analyst resources to activities, this would improve the efficiency of cyber security operations. The technology will position the UK at the forefront of the state-of-the-art in this high priority application domain.