Towards a theory of autonomous reconstitution of compromised cyber-systems

Effective reconstitution approaches for cyber systems are needed to keep critical infrastructure operational in the face of an intelligent adversary. The reconstitution response, including recovery and adaptation, may require significant reconfiguration of the system at all levels to render the cyber-system resilient to ongoing and future attacks or faults while maintaining continuity of operations. A theoretical basis for optimal dynamic reconstitution is needed to address the challenge of ensuring that dynamic reconstitution is optimal with respect to resilience metrics, and is being developed and evaluated in this project. Such a framework provides the technical basis for evaluating cyber-defense and reconstitution approaches. This paper describes a preliminary framework that may be used to develop and evaluate concepts for effective autonomous reconstitution of compromised cyber systems.