On Estimating Cyber Adversaries’ Capabilities: A Bayesian Model Approach

Cyber adversaries refer to people or groups who do harm to the information system, such as hackers, espionage persons, and terrorists. Different Cyber adversaries have different motivations, and obviously, have different resources and attack techniques. The resource and attack techniques are referred to as adversaries’ capacities. Accurate estimation of adversaries’ capacities can help network administrator to use different approaches to prevent potential attacks or respond to emerging attacks. However, cyber adversaries’ capabilities are hidden, dynamic and difficult to observe directly. This poster aims to take a systemic approach to estimate adversaries’ capacities. Since we cannot obtain complete information about the adversaries, a reasonable approach is to estimate adversaries’ capabilities using partial information that has been observed. The estimation hypothesis, initially stating that the adversary has equal probabilities to have high level capacities and low level capacities, will be refined using Bayesian rules as we collect more evidences from network data.

Authors and Affiliations

1. National Engineering Research Center of Fundamental Software, Institute of Software, Chinese Academy of Sciences, Beijing, China

   Jianchun Jiang & Liping Ding

2. Dept. of Math and Computer Science, California University of PA, USA

   Weifeng Chen

Editors and Affiliations

1. Computer Sciences Department, University of Wisconsin, 53706, Madison, WI, USA

   Somesh Jha

2. International Computer Science Institute, 1947 Center Street, Suite 600, 94704, Berkeley, CA, USA

   Robin Sommer  & Christian Kreibich  & 

Reprints and permissions

© 2010 Springer-Verlag Berlin Heidelberg

Policies and ethics