Decision Engine for Evolving Cyber Defenses

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Cyber defenders face challenges in selecting and configuring effective cyber defenses due to the complexity of integrating and managing Moving Target Defenses (MTDs), which are often manually performed without clear understanding of integration points and risks, leading to vulnerabilities and inefficiencies in defending against sophisticated cyber attacks.

Innovation Solution

A decision engine is developed, comprising a genetic algorithm framework, a parallelized reasoning framework, and a user interface, which automates the selection and configuration of cyber defenses by using a knowledge base, attack surface reasoning algorithms, and human feedback to optimize security and cost tradeoffs, enabling continuous improvement of defense configurations.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If manual selection and configuration of cyber defenses is performed, then flexibility in customization is maintained, but the complexity of integrating and managing multiple defenses increases and efficiency decreases

Engineering Contradiction:

Improveefficiency of defense configurationVSAvoidcomplexity of integrating and managing defenses

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The system enables self-service through automated defense configuration where the computer automatically selects, integrates, and manages cyber defenses based on analyzed threat data, eliminating the need for manual intervention while maintaining adaptability to changing threat landscapes

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent replaces the manual mechanical process of defense configuration with an automated computational system that uses algorithms to analyze threats, select appropriate defenses, and configure them automatically, thereby increasing efficiency while managing complexity

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If more cyber defenses are deployed to improve security, then protection against sophisticated attacks increases, but the cost and complexity of managing these defenses increase

Engineering Contradiction:

Improvesecurity protection levelVSAvoidcomplexity of managing defenses

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system applies partial action by deploying only the necessary subset of available cyber defenses that are most effective against the specific threats identified, rather than implementing all possible defenses, thereby maintaining security while reducing management complexity and cost

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The system dynamically changes parameters of defense configurations based on threat analysis results, adjusting which defenses are active and how they are configured to optimize security effectiveness while minimizing the number of defenses that need to be managed simultaneously

Inventive Principle:

Principle #35Parameter changes

3Ease of manufacture

If manual configuration of cyber defenses is performed without clear understanding of integration points, then implementation is simpler, but vulnerabilities and risks increase

Engineering Contradiction:

Improveease of defense implementationVSAvoidsecurity vulnerability level

Core Design Contradiction:

Ease of manufactureVSReliability

Solution Approach 1:

The system introduces an intermediary automated configuration process that mediates between simple implementation and secure integration, using algorithms to analyze integration points and configure defenses correctly without requiring manual expertise, thereby maintaining ease of implementation while eliminating vulnerabilities

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11438385B2User interface supporting an integrated decision engine for evolving defenses

Publication Date: 2022.09.06 RTX BBN TECH INC

AI summary

A decision engine includes: a genetic algorithm framework including a knowledge base of standard configurations, a candidate selector generator and a selector to select a candidate configuration from a plurality of preferred standard configurations in response to the candidate selector generator; a parallelized reasoning framework including an attack surface reasoning algorithm module to compute the security and cost tradeoffs of an attack surface associated with each candidate configuration; and a user interface framework including a web service engine where users can interact and provide feedback on direction of an evolution used in a genetic algorithm search for evolving defenses.