Defensible Decisions Research Articles

Improved technique for order of preference by similarity to ideal solution method for identifying key terrain in cyberspace asset layer.

Reinforcing weak cyberspace assets is an urgent requirement to defend national cybersecurity. Cyberspace key terrain (CKT) is a theory recently proposed for sensing cyberspace posture. Identifying CKT in the asset layer is essential for supporting cyberspace defense decisions. Existing methods ignore the influence of the multi-attribute correlation of cyberspace nodes and cyber attack mission (CAM) diversity, which restricts the recognition accuracy of CKT. To improve the accuracy of CKT identification and explore the relationship between CKT and CAM, we propose an improved cosine similarity technique for order of preference by similarity to the ideal solution (CosS-TOPSIS) method to model CKT and construct a CAM based on the MITRE adversarial tactics, techniques, and common knowledge (ATT&CK) framework to examine the influence of different weighted CAM on modeling CKT. Based on the vulnerability value calculation method of the cyber system in the common vulnerability scoring system version 3.1 (CVSS 3.1), we evaluated the effectiveness of CosS-TOPSIS in identifying CKT using three metrics: correlation coefficient, root mean square error, and mean absolute error. Our experiments showed that, in comparison with the TOPSIS method, the accuracy of the proposed method for identifying CKT improved by 8.9%, and the root mean square error reduced by 16%; simultaneously, CAM was proven to be an essential factor in identifying CKT. The feasibility and reliability of CosS-TOPSIS in identifying CKT and the close relationship between CAM and CKT identification were demonstrated experimentally. In our work, we utilized cosine similarity and FAHP to improve the baseline method. We also introduced three indicators to evaluate the method's reliability. Drawing from ATT&CK, we recommend CAM as a tool for sensing changes in the cyberspace environment and explore its relationship with CKT. Our work has great application potential for identifying cyberspace vulnerabilities, supporting cyberspace defense, and securing national cyberspace facilities.

Transcriptomic and physiological shade avoidance responses in potato (Solanum tuberosum) plants.

Plants detect competitors in shaded environments by perceiving a reduction in photosynthetically active radiation (PAR) and the reduction between the red and far-red light (R:FR) ratio and blue photons. These light signals are detected by phytochromes and cryptochromes, which trigger shade avoidance responses such as shoot and petiole elongation and lead to increased susceptibility to pathogen attack. We studied morphological, anatomical, and photosynthesis differences in potato plants (Solanum tuberosum var. Spunta) exposed to sunlight or simulated shade in a greenhouse. We found that simulated shade strongly induced stem and internode elongation with a higher production of free auxin in stems and a lower production of tubers. The mesophyll thickness of the upper leaves of plants grown in simulated shade was lower, but the epidermis was wider compared with the leaves of plants cultivated in sunlight. In addition, the photosynthesis rate was lower in the upper leaves exposed to nonsaturated irradiances and higher in the basal leaves at saturated irradiances compared with control plants. RNA-seq analysis showed that 146 and 155 genes were up- and downregulated by shade, respectively. By quantitative reverse transcription polymerase chain reaction, we confirmed that FLOWERING LOCUS T (FT), WRKY-like, and PAR1b were induced, while FLAVONOL 4-SULFOTRANSFERASE was repressed under shade. In shaded plants, leaves and tubers were more susceptible to the necrotrophic fungus Botrytis cinerea attack. Overall, our work demonstrates configurational changes between growth and defense decisions in potato plants cultivated in simulated shade.

PART II: Whale Songs of Wars Not Yet Waged: The Demise of Natural-Born Killers through Human-Machine Teamings Yet to Come

Current human-machine dynamics in security affairs positions the human operator in the loop with artificial intelligence to conduct decisions and actions. As technological advancements in AI cognition, speed, and weapon sophistication increase, human operators are increasingly being shifted to an on the loop where AI takes more responsibility in warfare and defense decisions, whether tactical or even strategic. Human operators are also falling off the loop, trailing enhanced AI systems as the biological and physical limits because humans are not the same for artificial intelligence in narrow applications. Those likely will expand toward general AI in the coming decades, presenting significant strategic, organizational, and even existential concerns. Further, how natural humans respond and engage with increasingly advanced, even superintelligent AI as well as a singularity event will feature disruptive, transformative impacts on security affairs and even at a philosophical level discerning what war is.

Editorial: Toyota Production System practices asFast‐and‐Frugalheuristics

Editorial: Toyota Production System practices as<scp>Fast‐and‐Frugal</scp>heuristics

Pathways to Offense Charging: Examining Defense Decision-Making During Case Processing

Prosecutors are afforded significant discretionary power in the current justice system. While much attention has been given to the factors that influence charging decisions, little is known about decision-making in the charging process itself. Moreover, research has yet to examine the mechanisms used to initiate charging: grand jury indictments or the information. As these charging processes are characteristically different and may have significant implications for case processing and justice outcomes, it is important to explore what factors influence decision-making at this early stage. The current study addresses these shortcomings using case-processing data from a large urban jurisdiction. Results indicate significant differences between defendants charged via grand jury and information processes. In addition, charging pathways have important consequences for case outcomes.

Optimal management decisions are robust to unknown dynamics in an amphibian metapopulation plagued by disease

AbstractIdentifying conservation actions to recover threatened species can be challenging due to many ecological uncertainties. For example, major threats to a species' conservation are commonly known or suspected, but the specific impacts on population or metapopulation dynamics can be uncertain. This is frequently the case with emerging infectious diseases, including chytridiomycosis, a global driver of amphibian population declines caused by the fungal pathogens Batrachochytrium dendrobatidis (Bd) and Batrachochytrium salamandrivorans. While these diseases are known to cause amphibian declines and extirpations, the mechanisms of their landscape‐scale spread are still largely unknown. Such uncertainty can lead to inaction which may jeopardize timely recovery of a species. Decision analysis is a pragmatic approach to making transparent and defensible decisions while dealing with uncertainties. We investigated whether optimal actions aimed at recovering boreal toad (Anaxyrus boreas boreas) metapopulations in the southern Rocky Mountains are robust to the unknown dynamics of Bd spread using value of information and regret analyses. Value of information is a decision‐analytic tool for calculating the value of new information in terms of performance on management objectives, while regret measures the cost of acting under incorrect information. We further conducted a stochastic sensitivity analysis to identify the relative effects of metapopulation parameters on system dynamics. We found optimal actions were robust to the unknown dynamics of Bd spread. While boreal toad breeding occurrence is highly sensitive to Bd distribution, the optimal decision is not. Resolving the unknown dynamics of Bd spread would lead to a minimal gain of less than one breeding toad subpopulation at the end of 50 years, given the currently available management actions. Applying a decision‐analytic framework coupled with value of information and regret analyses can help frame how uncertainties affect decisions in a way that empowers decision makers.

Integrating Information Literacy with the Evidence-based Framework and Military Judgement and Decision Making: A Literature Review

This article offers a literature review that results in the introduction of three information literacy protocols. It is the third in a four-part series of articles that discusses the integration of the evidence-based framework (EBF) and military judgment and decision making (MJDM). The series is written as a conceptualization and implementation of the U.S. presidential memorandum on restoring faith in government dated 27 January 2021. The memorandum directs federal agencies to base policy- and decision-making processes on the best available evidence. Accordingly, the focus of the series is on integrating the EBF into defense planning and decision making as an operational art. This article focuses on information literacy—specifically, building a data set for systematic reviews. The current literature on information literacy reveals that specific protocols to enhance rigor, transparency, validity, and reliability in building a data set for systematic reviews are significantly underrepresented. In this article, the Stanford Design Thinking Process model was applied to address this underrepresentation. The Stanford model uses five phases of collaboration to develop new protocols. The results of these collaboration are three new protocols for building data sets that are specifically designed for an integration of the EBF and MJDM: the targeting search strategy protocol (TSSP); the research question variable synthesis protocol (RQVSP); and the human source query protocol (HSQP).

Interdicting Attack Plans with Boundedly Rational Players and Multiple Attackers: An Adversarial Risk Analysis Approach

Cybersecurity planning supports the selection of and implementation of security controls in resource-constrained settings to manage risk. Doing so requires considering adaptive adversaries with different levels of strategic sophistication in modeling efforts to support risk management. However, most models in the literature only consider rational or nonstrategic adversaries. Therefore, we study how to inform defensive decision making to mitigate the risk from boundedly rational players, with a particular focus on making integrated, interdependent planning decisions. To achieve this goal, we introduce a modeling framework for selecting a portfolio of security mitigations that interdict adversarial attack plans that uses a structured approach for risk analysis. Our approach adapts adversarial risk analysis and cognitive hierarchy theory to consider a maximum-reliability path interdiction problem with a single defender and multiple attackers who have different goals and levels of strategic sophistication. Instead of enumerating all possible attacks and defenses, we introduce a solution technique based on integer programming and approximation algorithms to iteratively solve the defender’s and attackers’ problems. A case study illustrates the proposed models and provides insights into defensive planning. Funding: A. Peper and L. A. Albert were supported in part by the National Science Foundation [Grant 2000986].

Early validity and reliability evidence for the American Board of Emergency Medicine Virtual Oral Examination.

The American Board of Emergency Medicine (ABEM) in-person Oral Certification Examination (OCE) was halted abruptly in 2020 due to the COVID-19 pandemic. The OCE was reconfigured to be administered in a virtual environment starting in December 2020. The purpose of this investigation was to determine whether there was sufficient validity and reliability evidence to support the continued use of the ABEM virtual Oral Examination (VOE) for certification decisions. This retrospective, descriptive study used multiple data sources to provide validity evidence and reliability data. Validity evidence focused on test content, response processes, internal structure (e.g., internal consistency and item response theory), and the consequences of testing. A multifaceted Rasch reliability coefficient was used to measure reliability. Study data were from two 2019 in-person OCEs and the first four VOE administrations. There were 2279 physicians who took the 2019 in-person OCE examination and 2153 physicians who took the VOE during the study period. Among the OCE group, 92.0% agreed or strongly agreed that the cases on the examination were cases that an emergency physician should be expected to see; 91.1% of the VOE group agreed or strongly agreed. A similar pattern of responses given to a question about whether the cases on the examination were cases that they had seen. Additional evidence of validity was obtained by the use of the EM Model, the process for case development, the use of think-aloud protocols, and similar test performance patterns (e.g., pass rates). For reliability, the Rasch reliability coefficients for the OCE and the VOE during the study period were all >0.90. There was substantial validity evidence and reliability to support ongoing use of the ABEM VOE to make confident and defensible certification decisions.

Security defense decision method based on potential differential game for complex networks

Most defense strategies in complex networks are developed from the defense perspective, overlooking the key attack-defense characteristics in cybersecurity. A defense decision algorithm is ineffective when dealing with dynamic attacking behaviors, and when based on attack-defense analysis, stochastic uniform network models are generally used to model the target network, while most networks are large and complex. Thus, the algorithms and their results do not well suit small-world, scale-free, and high-aggregation networks. In this study, considering the structural characteristics of complex networks and the attack-defense characteristics of cybersecurity, potential differential game theory is integrated with complex networks, and a global optimal defense decision algorithm is proposed according to the overall network defense objective. Based on the evolutionary analysis of network security states, a network attack-defense potential differential game model is constructed. Adversarial analysis is carried out on the overall attack-defense strategy, and a defense decision algorithm is designed based on a saddle point equilibrium strategy. Simulation tests are carried out on small-world and scale-free networks to evaluate the effectiveness of the proposed method by comparing its performance with that of random defense strategies and classic decision algorithms.

Moral dilemmas of defence decisions in situations of threats of physical aggression comparative analysis between 1999 and 2018

In this article, the author interprets the results of research on moral dilemmas of making decisions as to how to defend oneself against physical aggression. In one instance, aggression is directed against the respondent with the intent to kill, in the other, against a bystander with no clear intent. Research conducted by the author both in 1999 and in 2018 involved 1st year military school students (basic training period). The conducted comparative analysis of empirical data allows the author to conclude that the morality of decisions concerning defensive actions in situations of threats of physical aggression depends primarily on the person against whom the aggression is directed (respondent, bystander) and the intensity of aggression. The analysis also gives grounds for postulating a thesis that between 1999 and 2018, there has been a positive change in the moral awareness of candidates for the Officer Corps of the Polish Armed Forces.

A Network Security Prediction Method Based on Attack Defense Tree

Modern networks are vulnerable to coordinated assaults. To perform threat analysis on individual and combined attack behaviors, it is essential to establish a security situation analysis model based on offensive and defensive decisions. The standard attack tree model used in this study ignores the impact of defenses, and the defensive tree model is not well scalable. Game theory is introduced into the attack tree model to describe specific network attack and defense event scenarios. First, analyze the logical relationship of different levels of attack behaviors in the network, integrate the offensive and defensive trees corresponding to different levels of attack events, to obtain a complete network offensive and defensive behavior tree, and then build a network offensive and defensive behavior tree model. Second, the basic offensive and defensive behavior tree extends from network offensive and defensive behavior, network detection equipment, and network defense measures. Propose an algorithm for the success rate of the attack target and calculate its attack probability. Based on these findings, we assess the potential for an attack and investigate the current state of network defenses. An offensive and defensive behavior tree model based on the BGP (Border Gateway protoc01) attack tree was developed in order to test the viability and efficacy of the network offensive and defensive behavior tree model. The network attack and defensive behavior tree model brought out in this study is capable of performing a wide range of calculations. The effect of defensive measures, as well as the ability to add and delete offensive and defensive behaviors at any node, has strong scalability and can provide a scientific basis for decision-making for network managers and operators.

A differential game approach for real-time security defense decision in scale-free networks

The current network security defense decision method is based on the principle of attack–defense confrontation and generally uses a random network model to project the real network. Most of the existing complex network defense decision methods consider a single defender while ignoring the confrontation and dependence between network attack and defense behaviors. In addition, the pertinence and dynamics of the defense effect are also insufficient. This article comprehensively considers the structure of a scale-free network and characteristics of network attack and defense behavior and combines a complex network with differential game theory to study the real-time defense decision problem. First, a propagation model based on a scale-free network is designed to realize the real-time fluctuation analysis of a network security state. Then, the attack and defense strategy are described, and the calculation method of revenue based on the confrontation analysis of the attack and defense behavior and a change in the security state of the network nodes based on the saddle point equilibrium strategy are introduced. Finally, based on the average connection degree of the real word Internet, a simulated network is constructed to conduct experiments. By comparison with random defense strategies and several typical complex network defense decision methods, the effectiveness and advancement of the proposed method are verified.

Evolutionary game decision-making method for network attack and defense based on regret minimization algorithm

In view of the differences and limitations of the cognitive abilities of both sides of network security attack and defense, the current network defense decision-making methods using game theory are mostly based on the assumption that the participants of attack and defense are completely rational, which is difficult to apply to the actual network attack and defense scenarios, resulting in poor practicality of defense decision-making. In order to better fit with the scenario of imperfect rational attack and defense games, we apply evolutionary game theory to describe the evolution process of attack and defense games under imperfect rationality, and extend the static analysis in the traditional game into a dynamic evolution process. Regret minimization (RM) algorithm is used to optimize the strategy learning mechanism to ensure the randomness and convergence of the strategy learning. Therefore, an evolutionary game decision model of network attack and defense based on RM algorithm is constructed. The optimal defense decision method is given by solving the evolutionary stable equilibrium, and the evolutionary trajectory of the optimal strategy of both sides is described. The results of numerical experiments verify the science and effectiveness of the model and method, and analyze and summarize the evolution rules of different attack and defense strategies under different states. Meanwhile, compared with the network defense decision method based on traditional replication dynamics, the convergence rate of the optimal defense strategy is improved by 12.8%, which proves the superiority of the proposed method in learning rate.

A 3D mixed reality visualization of network topology and activity results in better dyadic cyber team communication and cyber situational awareness.

Cyber defense decision-making during cyber threat situations is based on human-to-human communication aiming to establish a shared cyber situational awareness. Previous studies suggested that communication inefficiencies were among the biggest problems facing security operation center teams. There is a need for tools that allow for more efficient communication of cyber threat information between individuals both in education and during cyber threat situations. In the present study, we compared how the visual representation of network topology and traffic in 3D mixed reality vs. 2D affected team performance in a sample of cyber cadets (N = 22) cooperating in dyads. Performance outcomes included network topology recognition, cyber situational awareness, confidence in judgements, experienced communication demands, observed verbal communication, and forced choice decision-making. The study utilized network data from the NATO CCDCOE 2022 Locked Shields cyber defense exercise. We found that participants using the 3D mixed reality visualization had better cyber situational awareness than participants in the 2D group. The 3D mixed reality group was generally more confident in their judgments except when performing worse than the 2D group on the topology recognition task (which favored the 2D condition). Participants in the 3D mixed reality group experienced less communication demands, and performed more verbal communication aimed at establishing a shared mental model and less communications discussing task resolution. Better communication was associated with better cyber situational awareness. There were no differences in decision-making between the groups. This could be due to cohort effects such as formal training or the modest sample size. This is the first study comparing the effect of 3D mixed reality and 2D visualizations of network topology on dyadic cyber team communication and cyber situational awareness. Using 3D mixed reality visualizations resulted in better cyber situational awareness and team communication. The experiment should be repeated in a larger and more diverse sample to determine its potential effect on decision-making.

(In)Stability of Test Scores

Both school and district administrators use the results of standardized, large-scale tests to inform decisions about the need for, or success of, educational programs and interventions. However, test results at the school level are subject to random fluctuations due to changes in cohort, test items, and other factors outside of the school’s control. This study examined year to year changes in school level results on standardized tests delivered in Ontario, Canada. G-theory analyses found that test scores are not stable enough for meaningful conclusions to be made based on year to year changes in school level results. For small and medium sized schools, years of data need to be collected before defensible decisions can be made about trends in test scores. The authors introduce a ‘bounce’ statistic that provides a simple, easy to interpret measure of test score stability.

Neurophysiological and emotional influences on team communication and metacognitive cyber situational awareness during a cyber engineering exercise.

Background: Cyber operations unfold at superhuman speeds where cyber defense decisions are based on human-to-human communication aiming to achieve a shared cyber situational awareness. The recently proposed Orient, Locate, Bridge (OLB) model suggests a three-phase metacognitive approach for successful communication of cyber situational awareness for good cyber defense decision-making. Successful OLB execution implies applying cognitive control to coordinate self-referential and externally directed cognitive processes. In the brain, this is dependent on the frontoparietal control network and its connectivity to the default mode network. Emotional reactions may increase default mode network activity and reduce attention allocation to analytical processes resulting in sub-optimal decision-making. Vagal tone is an indicator of activity in the dorsolateral prefrontal node of the frontoparietal control network and is associated with functional connectivity between the frontoparietal control network and the default mode network. Aim: The aim of the present study was to assess whether indicators of neural activity relevant to the processes outlined by the OLB model were related to outcomes hypothesized by the model. Methods: Cyber cadets (N = 36) enrolled in a 3-day cyber engineering exercise organized by the Norwegian Defense Cyber Academy participated in the study. Differences in prospective metacognitive judgments of cyber situational awareness, communication demands, and mood were compared between cyber cadets with high and low vagal tone. Vagal tone was measured at rest prior to the exercise. Affective states, communication demands, cyber situational awareness, and metacognitive accuracy were measured on each day of the exercise. Results: We found that cyber cadets with higher vagal tone had better metacognitive judgments of cyber situational awareness, imposed fewer communication demands on their teams, and had more neutral moods compared to cyber cadets with lower vagal tone. Conclusion: These findings provide neuroergonomic support for the OLB model and suggest that it may be useful in education and training. Future studies should assess the effect of OLB-ing as an intervention on communication and performance.

A Comparative Analysis of Emotion Detection Techniques

Emotion recognition from facial expressions has become an urgent necessity due to its numerous applications in artificial intelligence, such as human-computer interface, marketing, mental health screening, and sentiment analysis, to name a few areas where emotion detection has become essential. In this paper we present a comparative analysis that offers insightful information about two techniques in emotion detection with CK+ and FER2013 datasets in deep learning, assisting researchers, practitioners, and policymakers in making defensible decisions about the selection and application of different methods in diverse applications. It emphasizes how important it is to continue researching and developing in the field of emotion detection in order to make it more reliable, accurate, and equitable in a variety of real-world situations. We focused on the two emotion detection techniques and databases employed, and the contributions that were dealt with. The Cascade Classifier algorithm and the Random Forest technique are thoroughly compared in this research to provide light on their advantages, disadvantages, and suitability for use in various fields. Additionally, the study evaluates the performance of both the Cascade Classifier and Random Forest algorithm on FER2013 and CK+ datasets, considering metrics such as accuracy, precision, f1-score, etc. Finally, the assessment of these methods incorporating the review measures is reported and discussed.

Model Compression Hardens Deep Neural Networks: A New Perspective to Prevent Adversarial Attacks.

Deep neural networks (DNNs) have been demonstrating phenomenal success in many real-world applications. However, recent works show that DNN's decision can be easily misguided by adversarial examples-the input with imperceptible perturbations crafted by an ill-disposed adversary, causing the ever-increasing security concerns for DNN-based systems. Unfortunately, current defense techniques face the following issues: 1) they are usually unable to mitigate all types of attacks, given that diversified attacks, which may occur in practical scenarios, have different natures and 2) most of them are subject to considerable implementation cost such as complete retraining. This prompts an urgent need of developing a comprehensive defense framework with low deployment costs. In this work, we reveal that "defensive decision boundary" and "small gradient" are two critical conditions to ease the effectiveness of adversarial examples with different properties. We propose to wisely use "hash compression" to reconstruct a low-cost "defensive hash classifier" to form the first line of our defense. We then propose a set of retraining-free "gradient inhibition" (GI) methods to extremely suppress and randomize the gradient used to craft adversarial examples. Finally, we develop a comprehensive defense framework by orchestrating "defensive hash classifier" and "GI." We evaluate our defense across traditional white-box, strong adaptive white-box, and black-box settings. Extensive studies show that our solution can enormously decrease the attack success rate of various adversarial attacks on the diverse dataset.

DIVERGENCE: Deep Reinforcement Learning-Based Adaptive Traffic Inspection and Moving Target Defense Countermeasure Framework

Reinforcement learning (RL) is a promising approach for intelligent agents to protect a given system under highly hostile environments. RL allows the agent to adaptively make sequential defense decisions based on the perceived current state of system security aiming to achieve the maximum defense performance in terms of fast, efficient, and automated detection, threat analysis, and response to the threat. In this paper, we propose a deep reinforcement learning (DRL)-based adaptive traffic inspection and moving target defense countermeasure framework, called ‘DIVERGENCE,’ for building a secure networked system. The DIVERGENCE provides two main security services: (1) a DRL-based network traffic inspection mechanism to achieve scalable and intensive network traffic visibility for rapid threat detection; and (2) an address shuffling-based moving target defense (MTD) technique to defend against threats as a proactive intrusion prevention mechanism. Through extensive simulations and experiments, we demonstrate that the DIVERGENCE successfully caught malicious traffic flows while significantly reducing the vulnerability of the network through MTD.