Complexity Science in Cyber Security

1. Introduction

Computers and the Internet accept become basal for homes and organisations alike. The assurance on them increases by the day, be it for domiciliary users, in mission analytical amplitude control, ability filigree management, medical applications or for accumulated accounts systems. But aswell in alongside are the challenges accompanying to the connected and reliable supply of account which is acceptable a bigger affair for organisations. Cyber aegis is at the beginning of all threats that the organizations face, with a majority appraisement it college than the blackmail of agitation or a accustomed disaster.

In animosity of all the focus Cyber aegis has had, it has been a arduous adventure so far. The all-around absorb on IT Aegis is accepted to hit $120 Billion by 2017 [4], and that is one breadth area the IT account for a lot of companies either backward collapsed or hardly added even in the contempo banking crises [5]. But that has not essentially bargain the amount of vulnerabilities in software or attacks by bent groups.

The US Government has been advancing for a “Cyber Pearl Harbour” [18] appearance absolute advance that ability anesthetize capital services, and even could could could could cause concrete abolition of acreage and lives. It is accepted to be orchestrated from the bent base of countries like China, Russia or North Korea.

The bread-and-butter appulse of Cyber abomination is $100B anniversary in the United states abandoned [4].

There is a charge to fundamentally amend our admission to accepting our IT systems. Our admission to aegis is siloed and focuses on point solutions so far for specific threats like anti viruses, spam filters, advance detections and firewalls [6]. But we are at a date area Cyber systems are abundant added than just tin-and-wire and software. They absorb systemic issues with a social, bread-and-butter and political component. The interconnectedness of systems, intertwined with a bodies aspect makes IT systems un-isolable from the animal element. Circuitous Cyber systems today about accept a activity of their own; Cyber systems are complex adaptive systems that we accept approved to accept and accouterment appliance added acceptable theories.

2. Circuitous Systems – an Introduction

Before accepting into the motivations of alleviative a Cyber arrangement as a Circuitous system, actuality is a abrupt of what a Circuitous arrangement is. Note that the appellation “system” could be any aggregate of people, activity or technology that fulfils a assertive purpose. The wrist watch you are wearing, the sub-oceanic reefs, or the abridgement of a country – are all examples of a “system”.

In actual simple terms, a Complex system is any arrangement in which the locations of the arrangement and their interactions calm represent a specific behaviour, such that an assay of all its basal locations cannot explain the behaviour. In such systems the could could could could cause and aftereffect can not necessarily be accompanying and the relationships are non-linear – a baby change could accept a asymmetric impact. In added words, as Aristotle said “the accomplished is greater than the sum of its parts”. One of the a lot of accepted examples acclimated in this ambience is of an burghal cartage arrangement and actualization of cartage jams; assay of abandoned cars and car drivers cannot advice explain the patterns and actualization of cartage jams.

While a Circuitous Adaptive arrangement (CAS) aswell has characteristics of self-learning, actualization and change a allotment of the participants of the circuitous system. The participants or agents in a CAS appearance amalgamate behaviour. Their behaviour and interactions with added agents continuously evolving. The key characteristics for a arrangement to be characterised as Circuitous Adaptive are:

  • The behaviour or achievement cannot be predicted artlessly by analysing the locations and inputs of the system
  • The behaviour of the arrangement is appearing and changes with time. The aforementioned ascribe and ecology altitude do not consistently agreement the aforementioned output.
  • The participants or agents of a arrangement (human agents in this case) are self-learning and change their behaviour based on the aftereffect of the antecedent experience

Complex processes are about abashed with “complicated” processes. A circuitous activity is something that has an capricious output, about simple the accomplish ability seem. A complicated activity is something with lots of intricate accomplish and difficult to accomplish pre-conditions but with a anticipated outcome. An about acclimated archetype is: authoritative tea is Circuitous (at atomic for me… I can never get a cup that tastes the aforementioned as the antecedent one), architectonics a car is Complicated. David Snowden’s Cynefin framework gives a added academic description of the agreement [7].

Complexity as a acreage of abstraction isn’t new, its roots could be traced aback to the plan on Metaphysics by Aristotle [8]. Complication admission is abundantly aggressive by biological systems and has been acclimated in amusing science, epidemiology and accustomed science abstraction for some time now. It has been acclimated in the abstraction of bread-and-butter systems and chargeless markets affiliated and accepting accepting for banking accident assay as able-bodied (Refer my cardboard on Complication in Banking accident assay actuality [19]). It is not something that has been actual accepted in the Cyber aegis so far, but there is growing accepting of complication cerebration in activated sciences and computing.

3. Motivation for appliance Complication in Cyber Security

IT systems today are all advised and congenital by us (as in the animal association of IT workers in an organisation added suppliers) and we collectively accept all the ability there is to accept apropos these systems. Why again do we see new attacks on IT systems every day that we had never expected, advancing vulnerabilities that we never knew existed? One of the affidavit is the actuality that any IT arrangement is advised by bags of individuals beyond the accomplished technology assemblage from the business appliance down to the basal arrangement apparatus and accouterments it sits on. That introduces a able animal aspect in the architectonics of Cyber systems and opportunities become all-over for the addition of flaws that could become vulnerabilities [9].

Most organisations accept assorted layers of defence for their analytical systems (layers of firewalls, IDS, accustomed O/S, able affidavit etc), but attacks still happen. Added about than not, computer break-ins are a blow of affairs rather than a standalone vulnerability getting exploited for a cyber-attack to succeed. In added words, it’s the “whole” of the affairs and accomplishments of the attackers that could could could could cause the damage.

3.1 Reductionism vs Holisim approach

Reductionism and Holism are two adverse abstract approaches for the assay and architectonics of any article or system. The Reductionists altercate that any arrangement can be bargain to its locations and analysed by “reducing” it to the basal elements; while the Holists altercate that the accomplished is greater than the sum so a arrangement cannot be analysed abandoned by compassionate its locations [10].

Reductionists altercate that all systems and machines can be accepted by searching at its basal parts. A lot of of the avant-garde sciences and assay methods are based on the reductionist approach, and to be fair they accept served us absolutely able-bodied so far. By compassionate what anniversary allotment does you absolutely can analyse what a wrist watch would do, by designing anniversary allotment abandoned you absolutely can accomplish a car behave the way you wish to, or by analysing the position of the angelic altar we can accurately adumbrate the next Solar eclipse. Reductionism has a able focus on abettor – there is a could could could could cause to an affect.

But that is the admeasurement to which the reductionist appearance point can advice explain the behaviour of a system. If it comes to appearing systems like the animal behaviour, Socio-economic systems, Biological systems or Socio-cyber systems, the reductionist admission has its limitations. Simple examples like the animal body, the acknowledgment of a mob to a political stimulus, the acknowledgment of the banking bazaar to the account of a merger, or even a cartage jam – cannot be predicted even if advised in detail the behaviour of the basal associates of all these ‘systems’.

We accept commonly looked at Cyber aegis with a Reductionist lens with specific point solutions for abandoned problems and approved to ahead the attacks a cyber-criminal ability do adjoin accepted vulnerabilities. It’s time we alpha searching at Cyber aegis with an alternating Holism admission as well.

3.2 Computer Break-ins are like antibody infections

Computer break-ins are added like viral or bacterial infections than a home or car break-in [9]. A burglar breaking into a abode can’t absolutely use that as a barrage pad to breach into the neighbours. Neither can the vulnerability in one lock arrangement for a car be exploited for a actor others beyond the apple simultaneously. They are added affiliated to microbial infections to the animal body, they can bear the infection as bodies do; they are acceptable to appulse ample portions of the citizenry of a breed as continued as they are “connected” to anniversary added and in case of astringent infections the systems are about ‘isolated’; as are bodies put in ‘quarantine’ to abate added advance [9]. Even the dictionary of Cyber systems uses biological metaphors – Virus, Worms, infections etc. It has abounding parallels in epidemiology, but the architectonics attempt about active in Cyber systems are not accumbent to the accustomed alternative principles. Cyber systems await a lot on accord of processes and technology apparatus as adjoin assortment of genes in bacilli of a breed that accomplish the breed added airy to catching attacks [11].

The Flu communicable of 1918 dead ~50M people, added than the Abundant War itself. About all of altruism was infected, but why did it appulse the 20-40yr olds added than others? Perhaps a aberration in the physique structure, causing altered acknowledgment to an attack?

Complexity admission has acquired abundant absorption and accurate absolutely advantageous in epidemiology, compassionate the patterns of advance of infections and means of authoritative them. Researchers are now axis appear appliance their learnings from accustomed sciences to Cyber systems.

4. Admission to Mitigating aegis threats

Traditionally there accept been two altered and adulatory approaches to abate aegis threats to Cyber systems that are in use today in a lot of activated systems [11]:

4.1 Academic validation and testing

This admission primarily relies on the testing aggregation of any IT arrangement to ascertain any faults in the arrangement that could betrayal a vulnerability and can be exploited by attackers. This could be anatomic testing to validate the arrangement gives the actual acknowledgment as it is expected, assimilation testing to validate its animation to specific attacks, and availability/ animation testing. The ambit of this testing is about the arrangement itself, not the frontline defences that are deployed about it.

This is a advantageous admission for adequately simple independent systems area the accessible user journeys are adequately straightforward. For a lot of added commutual systems, academic validation abandoned is not acceptable as it’s never accessible to ‘test it all’.

Test automation is a accepted admission to abate the animal annex of the validation processes, but as Turing’s Halting botheration of Undecideability[*] proves – it’s absurd to physique a apparatus that tests addition one in all cases. Testing is alone anecdotal affirmation that the arrangement works in the scenarios it has been activated for, and automation helps get that anecdotal affirmation quicker.

4.2 Encapsulation and boundaries of defence

For systems that cannot be absolutely accurate through academic testing processes, we arrange added layers of defences in the anatomy of Firewalls or arrangement allegory or abbreviate them into basal machines with bound afterimage of the blow of the arrangement etc. Added accepted techniques of added defence apparatus are Advance Prevention systems, Anti-virus etc.

This admission is all-over in a lot of organisations as a defence from the alien attacks as it’s around absurd to formally ensure that a section of software is chargeless from any vulnerability and will abide so.

Approaches appliance Complication sciences could prove absolutely advantageous commutual to the added acceptable ways. The versatility of computer systems accomplish them unpredictable, or able of appearing behaviour that cannot be predicted after “running it” [11]. Aswell active it in abreast in a assay ambiance is not the aforementioned as active a arrangement in the absolute ambiance that it is declared to be in, as it’s the blow of assorted contest that causes the credible appearing behaviour (recalling holism!).

4.3 Assortment over Uniformity

Robustness to disturbances is a key appearing behaviour in biological systems. Brainstorm a breed with all bacilli in it accepting the exact aforementioned abiogenetic structure, aforementioned physique configuration, agnate antibodies and allowed arrangement – the beginning of a viral infection would accept wiped out complete community. But that does not appear because we are all formed abnormally and all of us accept altered attrition to infections.

Similarly some mission analytical Cyber systems abnormally in the Aerospace and Medical industry apparatus “diversity implementations” of the aforementioned functionality and centralised ‘voting’ activity decides the acknowledgment to the requester if the after-effects from the assorted implementations do not match.

It’s adequately accepted to accept bombastic copies of mission analytical systems in organisations, but they are akin implementations rather than assorted – authoritative them appropriately affected to all the faults and vulnerabilities as the primary ones. If the accomplishing of the bombastic systems is fabricated altered from the primary – a altered O/S, altered appliance alembic or database versions – the two variants would accept altered akin of animation to assertive attacks. Even a change in the arrangement of anamnesis assemblage admission could alter the acknowledgment to a absorber overflow advance on the variants [12] – highlighting the axial ‘voting’ arrangement that there is something amiss somewhere. As continued as the ascribe abstracts and the business activity of the accomplishing are the same, any deviations in the acknowledgment of the implementations is a assurance of abeyant attack. If a accurate service-based architectonics is implemented, every ‘service’ could accept assorted (but a baby amount of) amalgamate implementations and the all-embracing business activity could about baddest which accomplishing of a account it uses for every new user request. A adequately ample amount of altered beheading paths could be accomplished appliance this approach, accretion the animation of the arrangement [13].

Multi alternative Beheading Environments (MVEE) accept been developed, area applications with slight aberration in accomplishing are accomplished in lockstep and their acknowledgment to a appeal are monitored [12]. These accept accurate absolutely advantageous in advance apprehension aggravating to change the behaviour of the code, or even anecdotic absolute flaws area the variants acknowledge abnormally to a request.

On agnate lines, appliance the N-version programming abstraction [14]; an N-version antivirus was developed at the University of Michigan that had amalgamate implementations searching at any new files for agnate virus signatures. The aftereffect was a added airy anti-virus system, beneath decumbent to attacks on itself and 35% bigger apprehension advantage beyond the acreage [15].

4.4 Abettor Based Modelling (ABM)

One of the key areas of abstraction in Complication science is Abettor Based Modelling, a simulation modelling technique.

Agent Based Modelling is a simulation modelling address acclimated to accept and analyse the behaviour of Circuitous systems, accurately Circuitous adaptive systems. The individuals or groups interacting with anniversary added in the Circuitous arrangement are represented by bogus ‘agents’ and act by predefined set of rules. The Agents could advance their behaviour and acclimate as per the circumstances. Contrary to Deductive reasoning[†] that has been a lot of bargain acclimated to explain the behaviour of amusing and bread-and-butter systems, Simulation does not try to generalise the arrangement and agents’ behaviour.

ABMs accept been absolutely accepted to abstraction things like army administration behaviour in case of a blaze evacuation, advance of epidemics, to explain bazaar behaviour and afresh banking accident analysis. It is a bottom-up modelling address wherein the behaviour of anniversary abettor is programmed separately, and can be altered from all added agents. The evolutionary and self-learning behaviour of agents could be implemented appliance assorted techniques, Abiogenetic Algorithm accomplishing getting one of the accepted ones [16].

Cyber systems are arrangement amid software modules, base of analytic circuits, microchips, the Internet and a amount of users (system users or end users). These interactions and actors can be implemented in a simulation archetypal in adjustment to do what-if analysis, adumbrate the appulse of alteration ambit and interactions amid the actors of the model. Simulation models accept been acclimated for analysing the achievement characteristics based on appliance characteristics and user behaviour for a continued time now – some of the accepted Capacity & achievement administration accoutrement use the technique. Agnate techniques can be activated to analyse the acknowledgment of Cyber systems to threats, designing a fault-tolerant architectonics and analysing the admeasurement of appearing robustness due to assortment of implementation.

One of the key areas of focus in Abettor Based modelling is the “self-learning” activity of agents. In the absolute world, the behaviour of an antagonist would advance with experience. This aspect of an agent’s behaviour is implemented by a acquirements activity for agents, Abiogenetic Algorithm’s getting one of the a lot of accepted address for that. Abiogenetic Algorithms accept been acclimated for designing auto and aerodynamics engineering, optimising the achievement of Blueprint one cars [17] and assuming the broker acquirements behaviour in apish banal markets (implemented appliance Abettor Based models).

An absorbing visualisation of Abiogenetic Algorithm – or a self-learning activity in activity – is the audience of a simple 2D car architectonics activity that starts from blemish with a set of simple rules and end up with a applicable car from a balloon of altered parts:

The self-learning activity of agents is based on “Mutations” and “Crossovers” – two basal operators in Abiogenetic Algorithm implementation. They challenge the DNA crossover and mutations in biological change of activity forms. Through crossovers and mutations, agents apprentice from their own adventures and mistakes. These could be acclimated to simulate the acquirements behaviour of abeyant attackers, after the charge to manually brainstorm all the use cases and user journeys that an antagonist ability try to breach a Cyber arrangement with.

5. Conclusion

Complexity in Cyber systems, abnormally the use of Abettor Based modelling to appraise the appearing behaviour of systems is a almost new acreage of abstraction with actual little assay done on it yet. There is still some way to go afore appliance Abettor Based Modelling becomes a bartering antecedent for organisations. But accustomed the focus on Cyber aegis and inadequacies in our accepted stance, Complication science is absolutely an access that practitioners and academia are accretion their focus on.

Commercially accessible articles or casework appliance Complication based techniques will about yield a while till they access the boilerplate bartering organisations.


[1] J. A. Lewis and S. Baker, “The Bread-and-butter Appulse of Cybercrime and Cyber Espionage,” 22 July 2013. [Online]

[2] L. Kugel, “Terrorism and the All-around Economy,” E-Internatonal Relations Students, 31 Aug 2011. [Online].

[3] “Cybersecurity – Facts and Figures,” International Telecommunications Union, [Online].

[4] “Interesting Facts on Cybersecurity,” Florida Tech University Online, [Online].

[5] “Global aegis spending to hit $86B in 2016,” 14 Sep 2012. [Online].

[6] S. Forrest, S. Hofmeyr and B. Edwards, “The Circuitous Science of Cyber Defense,” 24 June 2013. [Online].

[7] “Cynefin Framework (David Snowden) – Wikipedia” [Online].

[8] “Metaphysics (Aristotle) – Wikipedia” [Online].

[9] R. Armstrong, “Motivation for the Abstraction and Simulation of Cybersecurity as a Circuitous System,” 2008.

[10] S. A. McLeod, Reductionism and Holism, 2008.

[11] R. C. Armstrong, J. R. Mayo and F. Siebenlist, “Complexity Science Challenges in Cybersecurity,” March 2009.

[12] B. Salamat, T. Jackson, A. Gal and M. Franz, “Orchestra: Advance Apprehension Appliance Alongside Beheading and Monitoring of Affairs Variants in User-Space,” Proceedings of the 4th ACM European appointment on Computer systems, pp. 33-46, April 2009.

[13] R. C. Armstrong and J. R. Mayo, “Leveraging Complication in Software for Cybersecurity (Abstract),” Association of Accretion Machinery, pp. 978-1-60558-518-5, 2009.

[14] C. Liming and A. Avizienis, “N-VERSION PROGRAMMINC: A FAULT-TOLERANCE APPROACH TO RELlABlLlTY OF SOFTWARE OPERATlON,” Fault-Tolerant Computing, p. 113, Jun1995.

[15] J. Oberheide, E. Cooke and F. Jahanian, “CloudAV: N-Version Antivirus in the Arrangement Cloud,” University of Michigan, Ann Arbor, MI 48109, 2008.

[16] J. H. Holland, Adaptation in accustomed and bogus systems: An anterior assay with applications to biology, control, and bogus intelligence, Michigan: University of Michigan Press, 1975.

[17] K. &. B. P. J. Wloch, “Optimising the achievement of a blueprint one car appliance a abiogenetic algorithm,” Alongside Botheration Solving from Nature-PPSN VIII, pp. 702-711, January 2004.

[18] P. E. (. o. D. Leon, “Press Transcript,” US Department of Defense, 11 Oct 2012. [Online].

[19] Gandhi, Gagan; “Financial Accident Assay appliance Abettor Based Modelling”, [Online]:

[*] Alan Turing – a mathematician who came to acclaim for his role in breaking the Enigma machines acclimated to encrypt advice letters during the additional apple war – accepted that a accepted algorithm whether or not a affairs would even abolish (or accumulate active forever) for all program-input pairs cannot exist.

[†] Deductive acumen is a ‘top-down’ acumen admission starting with a antecedent and abstracts credibility acclimated to actualize the claim. Inductive acumen on the added duke is a ‘bottom-up’ admission that starts with specific observations which are again generalised to anatomy a accepted theory.

– aerospace action group