Visualizing adversaries : transparent pooling approaches for decision support in cybersecurity

Abstract

Using coevolutionary algorithms to find solutions to problems is a powerful search technique but once solutions are identified it can be difficult for a decision maker to select a solution to deploy. ESTABLO runs multiple competitive coevolutionary algorithm variants independently, in parallel, and then combines their test and solution results at the final generation into a compendium. From there, it re-evaluates each solution, according to three different measurements, on every test as well as on a set of unseen tests. For a decision maker, it finally identifies top solutions using various metrics and visualizes them in the context of other solutions. However, it can be difficult to decide on which coevolutionary algorithms to run individually or use in ESTABLO. A coevolutionary variant, POOLING, was then created using this same principle of combining multiple variants. POOLING runs competitive coevolutionary algorithm variants, combines their solutions after every generation, and seeds the next generation with the top solutions found. ESTABLO (with POOLING as one of its variants) is demonstrated on multiple cyber security related problems. We found that using ESTABLO was beneficial to most problems as different variants dominated in different scenarios. We also found that POOLING was able to consistently produce individuals that performed well against adversaries and in the context of all of their peers.