Strategic Cyber Camouflage

One of the most fundamental tasks for an AICA agent will be to manipulate information that an adversary can observe, either about a network or the AICA agent itself. This includes taking actions to conceal or camouflage the agent or specific network assets and taking actions to deceive or otherwise affect the beliefs of an adversary conducting reconnaissance activities. In this chapter we provide an overview of tactics that have been proposed in the literature for implementing cyber camouflage and deception actions, as well as some foundational models in AI from game theory and machine learning that have been used to deploy these tactics strategically. We go into detail on three particular models; the first uses game theory to optimize the use of decoys or modified signals, the second uses game theory to consider the modification of features for both real and fake objects to confuse attackers, and the third applies machine learning methods to scale up feature modifications to create more effective deceptive objects at scale. All of these models can be customized to different types of strategic questions around effectively deploying camouflage to affect an adversary, and they serve as a starting point for implementing autonomous strategies that use camouflage tactics. We end by discussing some of the different ways that camouflage and deception have been evaluated so far in the literature, noting that more work is needed to assess AICA agents using these strategies in realistic environments.