Adversarial Resilient Cyber Effects for Decision Dominance Collaborative Research Program

Purpose: Research to expand theoretical and scientific understanding of cyberspace windows of superiority (CWoS), such that one can rapidly and reliably identify, predict, and create these windows to provide military and civil leadership with multiple courses of action. We also want to discover novel knowledge and advance the scientific foundations of multidomain cyber deception, cyber resilience, and machine learning for cybersecurity applications. To this end, we intend to fund collaborative research in two research thrusts: 1) Explore and define CWoS, and 2) Adversarial Resilient Cyber (ARC). Each of these research thrusts has separate but related topics. These research outcomes are intended to inform the public and private sectors so they can better protect critical infrastructure sectors and defend against state and non-state actors who threaten reliable access to the Internet. Background: The Army requires cyberspace superiority to successfully carry out multidomain operations. Cyberspace superiority is defined in Joint Publication 3-12[1] as, “The degree of dominance in cyberspace by one force that permits the secure, reliable conduct of operations by that force, and its related land, air, maritime, and space forces at a given time and place without prohibitive interference by an adversary.” While these windows are important in tactical operations, they also have similar applications in commercial applications like infrastructure, delivery fleets, etc. The US Army Combat Capabilities Development Command (DEVCOM) Army Research Laboratory (ARL) is focused on researching fundamental understanding and informing the art-of-the-possible for warfighter concepts through research to greatly improve the Army’s ability to use cyberspace windows of advantage to deter and defeat aggressive enemies. The (ARCEDD-CRP) is focused on developing and experimentally evaluating new algorithms and methodologies that contribute to understanding Cyberspace Windows of Superiority (CWoS) and Adversarial Resilient Cybersecurity (ARC). Research conducted in the ARCEDD-CRP is also applicable to applications in academia and industry. Cyberspace windows of superiority are contextually finite periods of time during which friendly forces assert cyberspace superiority. CWoS identification, prediction, and creation can help friendly forces plan and execute operations more efficiently and effectively by optimally leveraging periods of advantage. This applies even when operating in a disadvantaged state by composing and bringing to bear appropriate cyber-defense and resilience mechanisms, such as those under ARC. An in-depth discussion of CWoS can be found at https://www.arl.army.mil/cras/arcedd-crp. ARC can provide a large scope of specialized methods to resist malicious intrusion, deceive our adversary, adaptively learn adversaries’ beliefs and intent, provide an autonomous response that is robust to manipulation, and quickly recovers from cyber-attack. Cyber deception enables the defender to gain and maintain an advantage while increasing attackers’ uncertainties. Cyber deception also disrupts attackers’ reconnaissance and provides early warning to Intrusion Detection Systems (IDS). Cyber deception helps to misrepresent our systems to attackers by hiding critical systems or making important components appear trivial (camouflage) while making pretender hardware or software appear as real (decoy/honeypot). Cyber deception can influence the attacker’s perception of our network by showing a robust network when we are vulnerable and displaying a vulnerable network during a CWoS. Cyber resilience can be achieved in two steps. First, we must proactively design our systems to resist cyber-attack or minimize the probability of successful attack. Second, we must admit the imperfection of our cyber defense and develop schemes to fight through cyber-attack and recover capability quickly with minimum degradation. This should allow us to maintain our CWoS. Finally, game theory, machine learning and adversarial machine learning approaches provide a robust framework for an optimum cyber response in the presence of malicious agents. The ARCEDD-CRP will consist of two cycles executed through individual awards. Each thrust will be focused on addressing a different set of scientific topic areas which will support the research aims of an associated internal essential research program (ERP) or mission-funded program. The ARCEDD-CRP has been developed in coordination with other related ARL-funded collaborative efforts (see descriptions of ARL collaborative alliances at https://www.arl.army.mil/business/collaborative-alliances/) and shares a common vision of highly collaborative academia-industry-government partnerships. This program will be executed with a program model adapted from several ARL-funded collaborative efforts which established a new paradigm for collaborative research. Some key properties of this new approach are described below: • ARCEDD-CRP topics will be offered on a two-year cycle. Proposals will be solicited for a two-year period structured as seedling awards, followed by a consideration to receive funding for a single option for up to 3 years based upon progress assessed at the end of the seedling effort. The FOA may be amended annually to identify a specific problem statement and scope for that specific cycle. The topics for each cycle will be chosen to address a long-term program goal. • For each cycle, funding will be provided to those Recipients selected under a cooperative agreement (CA), described as the “seedling” award. • Enhanced Research Program funding from ARL or Other Government Agencies (OGAs) may become available during a cycle which provides a mechanism for growth and enhancement within the ARCEDD-CRP. A proposal should not include any discussion of the Enhanced Research Program. Recipients receiving a CA will be notified and provided details if the opportunity for Enhanced Research Program funding becomes available during their award period of performance. • There is no limitation on the place of performance although on-site collaboration at ARL government facilities and with ARL researchers as well as other seedling Recipients is encouraged. Individuals requiring access to ARL government facilities for purposes of collaborative research must be U.S. citizens in order to meet Government research facility access requirements. It is envisioned that Cyberspace Windows of Superiority identification, prediction, and creation, and Adversarial Resilient Cybersecurity research will employ autonomous multi-agent collaboration methods and machine learning (ML). Doing so supports achieving machine-speed operations that can improve with experience. However, it also increases the attack surface as ML is vulnerable to certain types of attacks (e.g., evasion, poisoning, inference). Thus, we require methods to defend ML implementations so that robust and resilient decisions can be produced even in a cyber-contested environment. Advanced cyber-defense and resilience techniques, such as multidomain deception, can play a major role in delaying adversary progress such that Army missions can succeed, despite an adversary’s actions. Applicants must remain cognizant of tactical network challenges and expected trends. Tactical network resource constraints include restricted processing power, low communications bandwidth, and rationed energy limits. Interconnectedness and interdependence of networks and systems and expected high data rates increase the complexity of network operations and understanding. These factors combine to create multiple opportunities for adversarial disruption. For each research thrust, assessment of theories and methodologies will be conducted via innovative experimentation methods. Data sets, network scenarios, system configurations, and machine learning models must be relevant to Army’s tactical and enterprise networks. Research results will be implemented and demonstrated by Recipients. Promising approaches will be further instantiated through collaborative efforts with Army researchers for internal evaluation on Army experimentation platforms, and modeling and simulation (M&S) systems. Applicants are to address one or both research thrusts but are not required to address both research thrusts, or all topics within a research thrust.
Categories: Science and Technology and other Research and Development.