Mirage: Cyber Deception Against Autonomous Cyber Attacks
No ratings
Presented at BlackHat USA 2023 by
It was once thought to be impossible or simply decades away. But, in 2016, enhancements in search and neural network classifiers, as well as computing advancements, led to the creation of the AlphaGo system, which is capable of outperforming the world's best Go players. As such, observers in many domains may reasonably wonder: if a game with a branching factor of 250 can be conquered, how long until other "impossible" complex problems are also dethroned? For the complex problem of planning and executing offensive cyber operations, the advancement of AI search and automated planning may also hold significantly promising (read: scary) implications for the effectiveness and proficiency of an adversarial cyber actor. Consequently, battling an autonomous, AI-enabled adversary will demand no less than a cyber defense that specifically counters the competitive advantage resulting from an adversary's use of AI search and planning. One encouraging cyber defense tactic for countering of AI-enabled adversaries is that of cyber deception. While deception has been used in conflict for a millennia, the recent applications and defensive effects of cyber deception cannot be overstated. Cyber deception techniques can also be tailored to interact or engage with adversaries to achieve very precise detrimental effects.In this presentation, we will address a future cyber adversary whose actions and decisions are entirely controlled by an autonomous system (AI). This autonomous system uses automated planning algorithms and search techniques to drive its cyber-attack operations and achieve the desired objective(s). Given such a scenario, we ask: (1) can novel cyber deceptions be constructed and deployed in such a manner as to directly target weaknesses in the automated planning and search techniques; and (2) can an effective emulation system be implemented to evaluate real cyber deceptions, adversaries, and automated planning techniques at scale. To explore these questions, we present Mirage, a (fully implemented) cyber deception and autonomous cyber adversary experimentation system.