Automated Intelligent Cyberdefense Agents (AICAs) that are part Intrusion
Detection Systems (IDS) and part Intrusion Response Systems (IRS) are being
designed to protect against sophisticated and automated cyber-attacks. An AICA
based on the ideas of Self-Adaptive Autonomic Computing Systems (SA-ACS) can be
considered as a managing system that protects a managed system like a personal
computer, web application, critical infrastructure, etc. An AICA, specifically
the IRS components, can compute a wide range of potential responses to meet its
security goals and objectives, such as taking actions to prevent the attack
from completing, restoring the system to comply with the organizational
security policy, containing or confining an attack, attack eradication,
deploying forensics measures to enable future attack analysis, counterattack,
and so on. To restrict its activities in order to minimize
collateral/organizational damage, such an automated system must have set Rules
of Engagement (RoE). Automated systems must determine which operations can be
completely automated (and when), which actions require human operator
confirmation, and which actions must never be undertaken. In this paper, to
enable this control functionality over an IRS, we create Rules of EngaGement
for Automated cybeR Defense (REGARD) system which holds a set of Rules of
Engagement (RoE) to protect the managed system according to the instructions
provided by the human operator. These rules help limit the action of the IRS on
the managed system in compliance with the recommendations of the domain expert.
We provide details of execution, management, operation, and conflict resolution
for Rules of Engagement (RoE) to constrain the actions of an automated IRS. We
also describe REGARD system implementation, security case studies for cyber
defense, and RoE demonstrations.

该研究提出了一种基于 Self-Adaptive Autonomic Computing Systems 的 Automated Intelligent Cyberdefense Agents (自适应自主计算系统的智能化自动防御代理程序) 体系，旨在通过 Intrusion Detection Systems 和 Intrusion Response Systems 的组合保护计算机和应用程序等受保护的系统，并提出了 Rules of Engagement (RoE) 来限制 IRS 对被管理系统的操作，以实现自动化防御需求。