We present a method for controlling a swarm using its spectral decomposition—that is, by describing the set of trajectories of a swarm in terms of a spatial distribution throughout the operational domain—guaranteeing scale invariance with respect to the number of agents both for computation and for the operator tasked with controlling the swarm. We use ergodic control, decentralized across the network, for implementation. In the DARPA OFFSET program field setting, we test this interface design for the operator using the STOMP interface—the same interface used by Raytheon BBN throughout the duration of the OFFSET program. In these tests, we demonstrate that our approach is scale-invariant—the user specification does not depend on the number of agents; it is persistent—the specification remains active until the user specifies a new command; and it is real-time—the user can interact with and interrupt the swarm at any time. Moreover, we show that the spectral/ergodic specification of swarm behavior degrades gracefully as the number of agents goes down, enabling the operator to maintain the same approach as agents become disabled or are added to the network. We demonstrate the scale invariance and dynamic response of our system in a field-relevant simulator on a variety of tactical scenarios with up to 50 agents. We also demonstrate the dynamic response of our system in the field with a smaller team of agents. Lastly, we make the code for our system available.

Cyber defenders need automation tools that are intuitive, trustworthy, non-intrusive, and reusable. The Behavior-extracting Autonomous Resiliency Toolkit (BART) is such a tool. Its architecture combines existing results and AI techniques including workflow learning, mutli-agent frameworks, knowledge representation, and inference. A user study demonstrates that BART significantly shortens the required time to execute a cyber defense. The study also revealed three types of errors that an automated tool such as BART could prevent: typographical/syntax, procedural, and "hidden." We also describe an emerging application of BART.

This paper presents a formulation for swarm control and high-level task planning that is dynamically responsive to user commands and adaptable to environmental changes. We design an end-to-end pipeline from a tactile tablet interface for user commands to onboard control of robotic agents based on decentralized ergodic coverage. Our approach demonstrates reliable and dynamic control of a swarm collective through the use of ergodic specifications for planning and executing agent trajectories as well as responding to user and external inputs. We validate our approach in a virtual reality simulation environment and in real-world experiments at the DARPA OFFSET Urban Swarm Challenge FX3 field tests with a robotic swarm where user-based control of the swarm and mission-based tasks require a dynamic and flexible response to changing conditions and objectives in real-time.

As the organizations move towards more fully embracing agile software development and DevOps for mission-critical systems, the need to continuously and rapidly assess cyber security requirements will become increasingly important. Current security assessment tools currently focus on performing Cyber Vulnerability Analysis (CVA) on designs and software artifacts rather than requirements, missing critical steps to vet requirements and support design decisions early in the development lifecycle or as requirements change. This paper outlines the main concepts underlying a toolchain that would enable software developers to analyze cyber security requirements based on existing natural language requirement descriptions, without burdening the developer with learning new languages, models, or ontologies. The main contribution of this paper is a discussion of the concept of operations for automated security requirement analysis together with a discussion of the main functional components required to implement an automated analysis toolchain.

In this article, we present an approach for systematically improving complex processes, especially those involving human agents, hardware devices, and software systems. We illustrate the utility of this approach by applying it to part of an election process and show how it can improve the security and correctness of that subprocess. We use the Little-JIL process definition language to create a precise and detailed definition of the process. Given this process definition, we use two forms of automated analysis to explore whether specified key properties, such as security and safety policies, can be undermined. First, we use model checking to identify process execution sequences that fail to conform to event-sequence properties. After these are addressed, we apply fault tree analysis to identify when the misperformance of steps might allow undesirable outcomes, such as security breaches. The results of these analyses can provide assurance about the process; suggest areas for improvement; and, when applied to a modified process definition, evaluate proposed changes.

In this article, we present an approach for systematically improving complex processes, especially those involving human agents, hardware devices, and software systems. We illustrate the utility of this approach by applying it to part of an election process and show how it can improve the security and correctness of that subprocess. We use the Little-JIL process definition language to create a precise and detailed definition of the process. Given this process definition, we use two forms of automated analysis to explore whether specified key properties, such as security and safety policies, can be undermined. First, we use model checking to identify process execution sequences that fail to conform to event-sequence properties. After these are addressed, we apply fault tree analysis to identify when the misperformance of steps might allow undesirable outcomes, such as security breaches. The results of these analyses can provide assurance about the process; suggest areas for improvement; and, when applied to a modified process definition, evaluate proposed changes.

To improve the information assurance of mission execution over modern IT infrastructure, new cyber defenses need to not only provide security benefits, but also perform within a given cost regime. Current approaches for validating and integrating cyber defenses heavily rely on manual trial-and-error, without a clear and systematic understanding of security versus cost tradeoffs. Recent work on model-based analysis of cyber defenses has led to quantitative measures of the attack surface of a distributed system hosting mission critical applications. These metrics show great promise, but the cost of manually creating the underlying models is an impediment to their wider adoption. This paper describes an experimentation framework for automating multiple activities associated with model construction and validation, including creating ontological system models from real systems, measuring and recording distributions of resource impact and end-to-end performance overhead values, executing real attacks to validate theoretic attack vectors found through analytic reasoning, and creating and managing multi-variable experiments.

Cyber security remains one of the most serious challenges to national security and the economy that we face today. Systems employing well known but static defenses are increasingly vulnerable to penetration from determined, diverse, and well resourced adversaries launching targeted attacks such as Advanced Persistent Threats (APTs). Due to the heavy focus on cyber security technologies in both commercial and government environments over the last decade, an overwhelming array of cyber defense technologies have become available for cyber defenders to use. As the number and complexity of these defenses increase, cyber defenders face the problem of selecting, composing, and configuring them, a process which to date is performed manually and without a clear understanding of integration points and risks associated with each defense or combination of defenses. As shown in Figure 1, the current state-of-the-art approach for selecting and configuring cyber defenses is manual in nature and is often done without a clear understanding of security metrics associated with attack surfaces. Due to the talent Unknown& Security& Metrics Manual&Selection&and& Configuration&of&Cyber&Defenses

Cyber defense today relies heavily on teams of Subject Matter Experts (SMEs), e.g., Cyber Protection Teams (CPTs). Although simple tasks can be automated or scripted, complex decision processes-increasingly needed to counter cyber threats-require SME insight and manual execution. As a result, cyber-defense operations tend to emphasize collection and archiving of data over real-time decision making and response, postponing actionable analysis and response until later, where “later” is frequently “too late.” In contrast, adversaries are readily using automation tools to minimize manual work and encapsulate autonomous behaviors into botnets and viruses that adapt to changing conditions. This imbalance puts the adversary in a position of advantage, a situation the research presented in this paper aims to remedy. The scarcity of cyber SMEs and the high cost of involving them in manual cyber responses are among the main factors contributing to the imbalance. The approach we describe aims to reduce the reliance on human SMEs, drive down the cost, and increase the effectiveness of CPTs by capturing expert knowledge in a tool that will automate the identification of known and unknown threats and the launching of mitigations to counter ongoing attacks at system speeds.

VARIATION IN HUMAN-INTENSIVE SYSTEMS: A CONCEPTUAL FRAMEWORK FOR CHARACTERIZING, MODELING, AND ANALYZING FAMILIES OF SYSTEMS

The cyber security exposure of resilient systems is frequently described as an attack surface. A larger surface area indicates increased exposure to threats and a higher risk of compromise. Ad-hoc addition of dynamic proactive defenses to distributed systems may inadvertently increase the attack surface. This can lead to cyber friendly fire, a condition in which adding superfluous or incorrectly configured cyber defenses unintentionally reduces security and harms mission effectiveness. Examples of cyber friendly fire include defenses which themselves expose vulnerabilities (e.g., through an unsecured admin tool), unknown interaction effects between existing and new defenses causing brittleness or unavailability, and new defenses which may provide security benefits, but cause a significant performance impact leading to mission failure through timeliness violations. This paper describes a prototype service capability for creating semantic models of attack surfaces and using those models to (1) automatically quantify and compare cost and security metrics across multiple surfaces, covering both system and defense aspects, and (2) automatically identify opportunities for minimizing attack surfaces, e.g., by removing interactions that are not required for successful mission execution.

Software products are rarely developed without providing different sets of features to better meet varying user needs, whether through tiered products as part of a product line or different subscription levels for software as a service (SaaS). Software product line approaches for generating and maintaining a family of different variants of software products address such needs for variation quite well. Real-world human-intensive systems (HISs) display similar needs for families of variants. A key contribution of this paper is to show how many of these needs can be rigorously and systematically addressed by adapting established techniques from system and software product line engineering (SPLE). In this paper, we present an approach for creating such families by explicitly modeling variation in HISs. We focus on two kinds of variation we have previously described in other work---functional detail variation and service variation. We describe a prototype system that is able to meet the need for these kinds of variation within an existing modeling framework and present a case study of the application of our prototype system to generate a family in an HIS from the domain of elections. Our approach also demonstrates how to perform model-checking of this family to discover whether any variants in the family may violate specified system requirements.

The insider threat is one of the most pernicious in computer security. Traditional approaches typically instrument systems with decoys or intrusion detection mechanisms to detect individuals who abuse their privileges (the quintessential "insider"). Such an attack requires that these agents have access to resources or data in order to corrupt or disclose them. In this work, we examine the application of process modeling and subsequent analyses to the insider problem. With process modeling, we first describe how a process works in formal terms. We then look at the agents who are carrying out particular tasks, perform different analyses to determine how the process can be compromised, and suggest countermeasures that can be incorporated into the process model to improve its resistance to insider attack.

A process model, namely a formal definition of the coordination of agents performing activities using resources and artifacts, can aid understanding of the real-world process it models. Moreover, analysis of the model can suggest improvements to the real-world process. Complex real-world processes, however, exhibit considerable amounts of variation that can be difficult or impossible to represent with a single process model. Such processes can often be modeled better, within the restrictions of a given modeling notation, by a family of models. This paper presents an approach to the formal characterization of some of these process families. A variety of needs for process variation are identified, and suggestions are made about how to meet some of these needs using different approaches. Some mappings of different needs for variability to approaches for meeting them are presented as case studies.

This paper presents an approach for continuous process improvement and illustrates its application to improving the robustness of election processes. In this approach, the Little-JIL process definition language is used to create a precise and detailed model of an election process. Given this process model and a potential undesirable event, or hazard, a fault tree is automatically derived. Fault tree analysis is then used to automatically identify combinations of failures that might allow the selected potential hazard to occur. Once these combinations have been identified, we iteratively improve the process model to increase the robustness of the election process against those combinations that seem the most likely to occur. We demonstrate this approach for the Yolo County election process. We focus our analysis on the ballot counting process and what happens when a discrepancy is found during the count. We identify two single points of failure (SPFs) in this process and propose process modifications that we then show remove these SPFs.

This paper presents an approach that considers variation in systems and system architectures according to the kind of relation among the variants in the software family. The approach highlights why it is beneficial to consider such different variation relations separately and gives examples of what these relations may be. Two main categories of variation relations are presented, based on whether the system architecture remains constant ( architecture-based variation ), or whether the architecture itself is variable, i.e. the variants do not share a common architecture. The paper introduces several different kinds of variation families that seem to belong to these two categories, as well as yet other families comprising variants that do not neatly fit in either category, with only a subset of the variants sharing a common architecture. Each kind of variation relation is illustrated with an example software family from different domains, including operating systems (OS).