ADAM: Active Defense Algorithm and Model

1. ADAM: Active Defense Algorithm and Model Sergio Caltagirone University of Idaho scaltagi@acm.org

2. Active Defense • “Any action sequence performed by an individual or organization between the time an attack is detected and has completed, in an automated or non-automated fashion, to mitigate a threat against a particular asset.” • More than hacking back! • Firewall rules, Notifying Authorities, etc. (along with the other stuff)

3. Goals of ADAM • Provide a generalizable, extendable model for any organization • Completely model the risk of the threat and AD actions • Find best active defense solution for the threat (allow for automation) – maximize benefit, minimize risk • Provide legal (and ethical) due diligence • Why? • Current tools are inefficient and sometimes critically ineffective • If you want to respond to an attack, no way to determine which response is best

4. Active Defense Problems • Ethicalness • Legal • Unintended Consequences • Risk Valuation

5. Solutions Provided by ADAM • Ethicalness • Incorporates Teleological and Deontological ethical concerns • Legal • No precedent: minimal force, proportional force, immediate threat • Unintended Consequences • Statistical measure of confidence in action performing as expected • Risk Valuation • Provides statistical bounds for potential risk

6. Future and Upcoming Work • Current: (For Fun) Using competitive co-evolution to determine effective active defense strategies • Near Future (2-3 mo): Simulate Model for validation • Far Future (4-5 mo): Formal validation scaltagi@acm.org