Doers, Not Watchers: Intelligent Autonomous Agents Are a Path to Cyber Resilience
Alexander Kott, Paul Théron
Abstract
Today's cyberdefense tools are mostly watchers. They are not active doers. To be sure, watching is a demanding affair also. These tools monitor traffic and events; detect malicious signatures, patterns, and anomalies; may classify and characterize what they observe; and issue alerts. They might even learn while doing all this. But they don't act. They do little to plan and execute responses to attacks, and they do not plan and execute recovery activities. Response and recovery-core elements of cyber resilience <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sup> -are left to human cyberanalysts, incident responders, and system administrators. A recent report <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> reviews the implications of artificial intelligence for cybersecurity and offers no examples of its applications to response and recovery.