Search

Cyber threats increasingly target mission-critical systems in the military and private sectors. CMIA has emerged to mitigate such cyber threats and assure the resilience of critical missions. Existing approaches merely provide partial, manual analysis methods to support CMIA and lack the ability to provide optimal defense measures. In this paper, we propose a novel CMIA framework enabling a streamlined, automated CMIA procedure, based on the Bayesian Stackelburg game. Unlike conventional approaches, our framework provides the most probable cyber threat and the optimal defense, i.e., countermeasures against the cyber threat in a given mission environment, securing the resilience of mission-critical systems.

As operations previously undertaken only in physical space in the past have changed to operations that include cyberspace, it is crucial to define the concept of “cyber missions” clearly. In this study, “cyber mission” refers to any military operation or process that utilizes cyber systems to perform actions in accordance with orders delivered to them. Because a weapon system that utilizes a cyber system executes actions based on the commands transmitted to the cyber system, it is necessary to analyze how attacks from cyberspace affects such a weapon system. To this end, it would be meaningful to analyze the tools used to analyze the mission impact of physical weapon systems linked to cyber-attacks. The US military’s Joint Munitions Effectiveness Manual (JMEM), which contains the results of analyzing the effects of weapon systems, does not include analysis results for the effects of weapon systems on cyber-attacks. In this study, based on the analysis of the effectiveness of physical warfare, the damage to cyber assets was quantified and associated to calculate the cyber index for the analysis of operational efficiency. In connection with JMEM, the results of combat in cyberspace and the effects of physical operations were compared and analyzed to propose a framework to judge the impact of missions, and the performance was tested. To verify the effectiveness of the proposed framework, domestic and foreign operational scenarios were analyzed and designed, assets were defined, and experiments were conducted. These experiments showed that a greater decrease in the cyber mission effect value was related to a greater effect on physical operations. This framework could be used in a variety of operations to predict the physical impact of a cyber-attack and will help determine the next step in an operation.

It is difficult to assess the business impact of a cyberattack and implement appropriate strategies or policies to enhance cyber resilience and counter future attacks. Penetration testing, which is currently gaining popularity, has been employed to assess cyber defense levels in actual operating environments. However, it is expensive and time-consuming and only reveals the current state of a problem without providing insights into potentially better alternative strategies. To overcome these limitations, cybersecurity modeling and simulation (M&S) research, which includes the crucial component of cyber-defense modeling, is being actively conducted. Most cyber defense modeling approaches only model defenses as a response to cyberattacks, neglecting to consider the complexities in the actual cyber defense activities of organizations. Consequently, the intended aim to evaluate and enhance cyber defense capabilities through analysis cannot be met. In this study, we present a cyber defense process model that models the entire lifecycle of cyber defense activities as the following five phases: prevention, monitoring and detection, initial response, attack analysis, and recovery response. This model not only accounts for defense steps that had been neglected in previous studies but also offers improvements to previously introduced defense steps. Additionally, we present a framework for applying initial and recovery response models by progressively integrating a unit response behavior model to counter cyberattacks. The applicability of the proposed model was verified by using a constructed prototype. The results of this study can be applied to developing an M&S-based experimental environment for assessing the sustainability of missions/businesses that have faced cyberattacks.