Theory and Models for Cyber Situation Awareness

In this chapter, we provide an overview of Cyber Situational Awareness, an emerging research area in the broad field of cyber security, and discuss, at least at a high level, how to gain Cyber Situation Awareness. Our discussion focuses on answering the following questions: What is Cyber Situation Awareness? Why is research needed? What are the current research objectives and inspiring scientific principles? Why should one take a multidisciplinary approach? How could one take an end-to-end holistic approach? What are the future research directions? 1 What Is Cyber Situation Awareness Cyber operations – in the context of mission assurance – give rise – especially within large enterprises to the questions that are at the core of Cyber Situation Awareness (Cyber SA). Without loss of generality, the process of situational awareness can be viewed as a three-phase process: situation perception, situation comprehension, and situation projection. Perception gains awareness about the status, attributes, and dynamics of relevant elements within the enterprise networks. Comprehension of the situation encompasses how analysts combine, correlate, and interpret information. Projection of the situation into the near future encompasses the ability to make predictions based on the knowledge acquired through perception and comprehension. Figure 1 shows a simplified illustration of cyber operations in a large enterprise. Essentially, cyber operations are centered on answering four key questions whenever an adversary is launching a cyber-attack: • What has happened to the networked enterprise information systems (“enterprise networks” for short)? • What is the impact? © Springer International Publishing AG 2017 P. Liu et al. (Eds.): Cyber Sitation Awareness, LNCS 10030, pp. 3–25, 2017. DOI: 10.1007/978-3-319-61152-5_1 • Why did it happen? • What should we do? In our viewpoint, the first three questions form the “core” of Cyber SA, and Cyber SA serves as a key enabler for answering the last question, “What should we do”. In other words, Cyber SA is geared towards gaining awareness about what has happened or what the adversary has done, the impact of the cyber-attacks, and how the current situation was determined. Here, the impact includes at least two aspects: damage assessment and mission impact analysis. Regarding why the current situation is what it is, the security analysts should identify the exploited vulnerabilities. In many cases, the exploited vulnerabilities include both known and unknown vulnerabilities associated with the enterprise networks. From the perspective of “data to decisions,” Cyber SA can be viewed as a particular data triaging system. As illustrated in Fig. 2, the output of any sensor shown in Fig. 1 can be viewed as a data source. Because there are a large variety of sensors out there, there are actually many kinds of data sources. Here, we roughly classify the data sources as follows: • Class A: in-band data – A1: static data. In this class, the data are seldom updated. For example, network topology, naming data, routing tables, vulnerability scan data (e.g., NESSUS reports), attack graphs, and certain host configurations belong to this class. – A2: dynamic data. In this class, the data are either data streams or dynamically updated data. Each data item is explicitly or implicitly associated with a timestamp. The timestamps clearly show the stateful nature of cyber SA. What has happened?