The Cyber-Threat Analysis System (CTAS), A Decision Support Tool for Improving the Understanding of the Enemy in Cyber-Warfare

The only way to win a battle is to get ahead of the enemy's decision cycle. Traditional warfare has taught us this. Applied to the electronic battlefield, this means that we must first develop a coherent picture of who is attacking our networks and why. Wepropose to develop a tool that will help Air Force network security personnel see their own networks through the eyes of their potential enemies. The tool will show how attackers with different goals view, probe, penetrate, and navigate networks withdifferent configurations. It will guide security personnel in not only configuring their intrusion detection tools and developing mental models of attackers but also in effectively documenting patterns of attacks as they occur. This tool will be based on amodel of attacker behavior derived from a cognitive analysis of security personnel and skilled attackers, as well as from actual attacker behavior on a range of wargaming network configurations. Additionally, users will be able to document lessons learnedfrom attacks on their own systems, a noted shortcoming we discovered in our Phase I research.