Cyber auto tactics techniques and procedures multiple hypothesis engine

Abstract

Disclosed is an exemplary multiple hypothesis engine that provides situation assessment capabilities regarding cyber auto tactics techniques and procedures. Dynamic cyber adversarial operations are evaluated via a combination of techniques using a Bayesian multiple hypothesis tree, or graph, as a framework. A top-down probability propagation mechanism solves different aspects of the problem in a round-robin fashion. The top-down probability propagation mechanism comprises the Hypothesis Refinement Engine. A model-based abductive reasoner comprising The Hypothesis Validator is used to confirm or refute the refined hypothesis. A model-based learning engine comprising Behavior Model Trainer is used to incrementally augment the knowledge base of behavior models as new adversarial TTPs are discovered. These three techniques behave in a cooperative manner by operating upon the Bayesian multiple hypothesis tree framework.