Coactive Emergence as a Sensemaking Strategy for Cyber Operations

In this article we describe how we apply the concept of coactive emergence as a phenomenon of complexity that has implications for the design of sensemaking support tools involving a combination of human analysts and software agents. We apply this concept in the design of work methods for distributed sensemaking in cyber operations. Sensemaking is a motivated, continuous effort to understand, anticipate, and act upon complex situations. We discuss selected results of a macrocognitive work analysis that informed our focus for design and development of support tools. In that analysis, we identified seven target topics that would be the focus of our research: engaging automation as a full partner, reducing the volume of uncorrelated events, continuous knowledge discovery, more effective visualizations, collaboration and sharing, minimizing tedious work, and architecting scalability and resilience. In addressing the first target topic, we show how coactive emergence inspires an agent-supported threat understanding process that is consistent with Klein’s Data/Frame theory of sensemaking. In subsequent sections, we describe our efforts to address the remaining six target topics as part of design and development of a cyber operations framework called Sol. Specifically, we describe the use of agents, policies, and visualization to enable coactive emergence for taskwork and teamwork. We also show how policy-governed agents working collaboratively with people can help in additional ways. We introduce the primary implementation frameworks that provide the core capabilities of our Sol cyber framework: the Luna Software Agent Framework, and the KAoS Policy Services Framework. We describe areas for future development of Sol, including the incorporation of the VIA Cross-Layer Communications Substrate. Finally, we describe recent results and current plans for empirical studies addressing some of the issues raised in this article.