1. ADAM: Active Defense Algorithm and Model Sergio Caltagirone University of Idaho scaltagi@acm.org

2. Active Defense  “Any action sequence performed by an individual or organization between the time an attack is detected and has completed, in an automated or non-automated fashion, to mitigate a threat against a particular asset.”  More than hacking back! Firewall rules, Notifying Authorities, etc. (along with the other stuff)

3. Goals of ADAM  Provide a generalizable, extendable model for any organization Completely model the risk of the threat and AD actions Find best active defense solution for the threat (allow for automation) – maximize benefit, minimize risk Provide legal (and ethical) due diligence  Why? Current tools are inefficient and sometimes critically ineffective If you want to respond to an attack, no way to determine which response is best

4. Active Defense Problems  Ethicalness  Legal  Unintended Consequences  Risk Valuation

5. Solutions Provided by ADAM  Ethicalness Incorporates Teleological and Deontological ethical concerns  Legal No precedent: minimal force, proportional force, immediate threat  Unintended Consequences Statistical measure of confidence in action performing as expected  Risk Valuation Provides statistical bounds for potential risk

6. Future and Upcoming Work  Current: (For Fun) Using competitive co- evolution to determine effective active defense strategies  Near Future (2-3 mo): Simulate Model for validation  Far Future (4-5 mo): Formal validation scaltagi@acm.org