Comparing Strategic and Tactical Responses to Cyber Threats

The STRATUS project seeks to provide resilience against cyber threats to distributed systems. STRATUS is designed to anticipate, diagnose, and respond proactively to threats. It uses a reactive technique to respond to the latest events quickly and a more `strategic' technique that recognizes attack plans and responds to them proactively. We focus on a set of experiments where we approximate the behavior of STRATUS in order to evaluate its responses given a variety of missions and attacks. We show the relative merits of responding to threats using local, reactive responses versus strategically ones and present evidence that justifies combining the two approaches to system defense.