Abstract:The North Atlantic Treaty Organization (NATO) Exploratory Team meeting, "Model-Driven Paradigms for Integrated Approaches to Cyber Defense," was organized by the NATO Science and Technology Organization's (STO) Information Systems and Technology (IST) panel and conducted its meetings and electronic exchanges during 2016. This report describes the proceedings and outcomes of the team's efforts. Many of the defensive activities in the fields of cyber warfare and information assurance rely on essentially ad hoc techniques. The cyber community recognizes that comprehensive, systematic, principle-based modeling and simulation are more likely to produce long-term, lasting, reusable approaches to defensive cyber operations. A model-driven paradigm is predicated on creation and validation of mechanisms of modeling the organization whose mission is subject to assessment, the mission (or missions) itself, and the cyber-vulnerable systems that support the mission. This by any definition is a complex socio-technical system (of systems), and the level of detail of this class of problems ranges from the level of host and network events to the systems' functions up to the function of the enterprise. Solving this class of problems is of medium to high difficulty and can draw in part on advances in Systems Engineering (SE). Such model-based approaches and analysis could be used to explore multiple alternative mitigation and work-around strategies and to select the optimal course of mitigating actions. Furthermore, the model-driven paradigm applied to cyber operations is likely to benefit traditional disciplines of cyber defense such as security, vulnerability analysis, intrusion prevention, intrusion detection, analysis, forensics, attribution, and recovery.

The Human Role Model of Cyber Counterwork

How Effective Are the Prevailing Attack-Defense Models for Cybersecurity Anyway?

Modeling of the Mimic Defense Based on Heterogeneous Redundancy

Simulations in Cyber-Security: A Review of Cognitive Modeling of Network Attackers, Defenders, and Users

Learning to Defend by Attacking (and Vice-Versa): Transfer of Learning in Cybersecurity Games

Cybersecurity Software Tool Evaluation Using a 'Perfect' Network Model

Markov Decision Process For Automatic Cyber Defense

Dynamic defenses in cyber security: Techniques, methods and challenges

Human Cognition through the Lens of Social Engineering Cyberattacks

Mitigating the Risk of Advanced Cyber Attacks: The Role of Quality, Covertness and Intensity of Use of Cyber Weapons

Formal Mental Models for Human-Centered Cybersecurity

Modeling and Analysis of the Decentralized Interactive Cyber Defense Approach

Cyber Defense as a Complex Adaptive System: A model-based approach to strategic policy design

Design and Analysis of Decentralized Interactive Cyber Defense Approach based on Multi-agent Coordination.

A Two-Dimension Security Assessing Model for CMDs Combined with Generalized Stochastic Petri Net

Learning About Simulated Adversaries from Human Defenders using Interactive Cyber-Defense Games

Toward Personalized Deceptive Signaling for Cyber Defense Using Cognitive Models

Recommendations for Model-Driven Paradigms for Integrated Approaches to Cyber Defense

Optimal Strategy for Cyberspace Mimic Defense Based on Game Theory

A method of network attack-defense game and collaborative defense decision-making based on hierarchical multi-agent reinforcement learning

Towards a Cognitive Theory of Cyber Deception