Cybersecurity as a Tic-Tac-Toe Game Using Autonomous Forwards (Attacking) And Backwards (Defending) Penetration Testing in a Cyber Adversarial Artificial Intelligence System

Abstract

In this paper, we investigate the potential behavior of Artificial Intelligence (AI) black hat hackers and the ability of ethical human hackers to defend against them. To this end, we develop an adversarial AI testbed, which marries game board play to the cyber realm by employing a statistical AI algorithm that maps every move made on the tic-tac-toe game board to an attack or defensive move made in the cyber realm. Our work demonstrates that this approach is an effective means of constraining the possible cybersecurity state space for autonomous forwards (i.e., attacking) and backwards (i.e., defending) penetration testing. Our results suggest that welltrained AI hackers may be nearly impossible to beat by human defenders unless prior knowledge of their possible attack strategies are known; however, for humans, this approach quickly becomes intractable. Also, we have observed that different AI algorithms used to search (play) the game state space (and thus the cyber state space) behave as different AI hacker personalities, which illustrates how forwards and backwards penetration testers with varying skills and knowledge would exploit or defend network vulnerabilities.