Using a Cognitive Architecture to Automate Cyberdefense Reasoning

The CSISM project is designing and implementing an automated cyberdefense decision-making mechanism with expert-level ability. CSISM interprets alerts and observations and takes defensive actions to try to ensure the survivability of the computing capability of the network. The project goal is a difficult one: to produce expert-level response in real-time with uncertain and incomplete information. The authors' approach is to emulate human reasoning and learning abilities by using a cognitive architecture to embody the reasoning of human cyberdefense experts. This paper focuses on the cognitive reasoning component of CSISM.