Cyber Autonomy: Automating the Hacker- Self-healing, self-adaptive, automatic cyber defense systems and their impact to the industry, society and national security

Abstract

In 2016, the Defense Advanced Research Projects Agency (DARPA) hosted the Cyber Grand Challenge, a competition which invited participating finalist teams to develop automated cyber defense systems that can self-discover, prove, and correct software vulnerabilities at real-time. As the competition progressed, the systems were not only able to auto-detect and correct their software, but also able to attack other systems (other participants' machines) in the network. Even though the competition did not catch much mainstream media attention, the Cyber Grand Challenge proved the feasibility of cyber autonomy, stretched the imagination of the national and cyber security industries and created a mix of perceptions ranging from hope to fear. Since 2017, IT vendors started moving towards 'security automation' (as evidenced by the recent rise in automation vendors at the RSA conferences (2017, 2018) - the world's largest cyber security vendor trade show at San Francisco) – the first leap towards cyber autonomy. We also witnessed the increased effort towards automating active cyber defense tools, including situation awareness, deception, penetration testing and vulnerability assessment tools. Like other industries disrupted by automation, these trends have several implications on national security and the private industry. The trend created a major disruption to the currently in-demand penetration testing professional sector – changing manual penetration testing into a sunset industry overnight. While penetration testers still fetch relatively high salaries at the time of writing, the emergence of several cyber artificial intelligence (cyber-AI) techniques are starting to change business models and national security human resource planning: from needing to hire large teams of penetration testers and security assessment consultants (from junior to experienced staff) into a new business model which utilises so-called cyber-AI and automation tools managed by just a handful of extremely-skilled professionals. This chapter sets the context for the urgency for cyber autonomy, and the current gaps of the cyber security industry.