Inference of Optimal Cyber Defense Strategies

It is becoming increasingly difficult to plan and implement an organization`s defense against the wide range and variety of todays cyber-threats. Current detection and mitigation systems offer little in terms of attack interpretation, which would help to better understand attacker motivations and objectives. Few existing threat models provide a means to map concrete system events as captured by intrusion detection systems (IDS) to a description, known system flaw, or definitive countermeasure. The questions of how specific attack techniques enable hostile actors of varying skill and motivation to achieve their malicious objectives and of which attack strategies/vectors can be considered the most dangerous for a given infrastructure are not comprehensively answered. In short, there is a distinct lack of models that are able to deal with the increasing complexity of cyber-attacks, which is a major obstacle to automated attack (risk) assessment, intrusion detection, and security testing. These challenges will be addressed by our proposed project. Researching the inference of cyber defense strategies through reinforced threat modelling, INODES focuses on methods of simulating attacker/defender behavior through the means of a strategy game that does not only consider the technical aspects of cyber-defense, but also actor motivation, assets deployed, and various organizational factors. By researching the application of both model checking and reinforcement learning techniques to our newly created model, we will be able to play through a wide range of possible attacks, thereby inferring optimal defender strategies that minimize the adversarys probability of success as well as the impact on an affected system. Using INODES, we seek to provide organizations with the foundation for a new and automated way of planning and testing their cyber-defense. At the same time, we work to bridge the gap between monitoring data and attack semantics by mapping IDS records directly to the model. This helps analysts and security operators by providing them with a short explanation about possible ongoing attacks and how they might be mitigated. INODES merges the domains of threat modeling, IT management and data analysis into one integrated concept. To facilitate this multifaceted approach, our research team is comprised of security experts with background in formal methods, machine learning, security management, digital forensics, as well as APT mitigation.

The INODES project set out to improve how cyber-attacks and defenses can be modeled, analyzed, and understood. Many current approaches in cybersecurity focus on detection and mitigation but lack the ability to explain attacker objectives or evaluate the effectiveness of defense strategies in a structured way. To address this, we developed a formal model that represents cyber-attacks as strategic interactions between attackers and defenders. The model goes beyond purely technical aspects by also incorporating factors such as attacker motivation, system assets, and organizational context. This allows for a more comprehensive understanding of how and why certain attacks succeed, and what defensive strategies can be effective under different conditions. We applied techniques from reinforcement learning and model checking to simulate various attack scenarios. Notably, we built our own reinforcement learning framework, PenQuestEnv, which serves as a training environment for the gamified model. PenQuestEnv allows agents to learn defensive (and offensive) strategies in varied game scenarios. These simulations were used to analyze the success rates of attacks, the cost and impact of various defense strategies, and the conditions under which specific defenses are most effective. The resulting data supports a more systematic and reproducible approach to security planning, testing, and evaluation. A key research output of the project is PenQuest, a gamified version of the INODES model. PenQuest abstracts the formal framework into an interactive format that makes it accessible for experimentation and learning. It has been used in educational and outreach contexts, including events with schools, university courses, and business audiences. The game is based on the same strategic principles as the formal model and serves both as a communication tool and a way to test the model's assumptions in practice. Throughout the project, we exchanged ideas and discussed research approaches with the ALFA group at Massachusetts Institute of Technology (MIT), focusing on topics such as agent-based systems and machine learning. Mutual lab visits during the project period supported this collaboration and encouraged ongoing academic exchange. In summary, INODES combines insights from threat modeling, formal methods, reinforcement learning, and cyber defense strategy. Its main result is a structured, analyzable framework for simulating and evaluating cyber-attacks and defensive responses. The model and its practical implementation PenQuest offer a foundation for more rigorous and explainable cybersecurity analysis.