Fuzzy sets based team decision-making for Cyber Situation Awareness

Cyber Situation Awareness (CSA) often requires the collaboration among a team of cyber analysts who work at different levels and/or different parts of the system. Each team member collects data such as intrusion alerts and network logs, generates his/her own awareness for the current cyber situation, and shares the awareness with other team members to generate the comprehensive understanding of the overall situation for the purpose of team decision-making. Since each team member may have his/her own personal expertise knowledge, experience, and opinions, it is difficult for the entire team to make consensus decision when having conflicting judgments on the types of cyber attacks. Furthermore, the complexity of cyber domain significantly exacerbates the situation awareness problems for the cyber analysts. Considering that human cyber analysts tend to use ambiguous linguistics to express their own cyber situation awareness during team collaboration, we propose a fuzzy set based method that allows cyber analysts to quantify their preference and reach consensus on the cyber attack types that are most acceptable by the entire team. Also, to facilitate collaboration among team cyber analysts across distances, we present a fuzzy sets based team CSA decision-making system to demonstrate how the proposed approach provides support for generating team CSA in a distributed manner with the ability of handling uncertain information.