By Gary L. Klein

Computers can’t understand natural language well enough to read a newspaper, can’t be creative enough to develop a novel course of action, and can’t interpret an enemy’s intent from its movements. So how can computer simulations provide a useful model of cyber command decision making, or pilot behavior, or adversarial behavior, let alone useful models of units, battalions, and brigades? The answer lies not just in the intelligence of a new class of simulation models, but in our intelligent use of them.

MITRE has developed an adaptive agent-based simulation modeling technology that allows us to build, for example, simulated decision makers representing defenders and attackers of a computer system engaged in cyberwarfare in their simulated microworld. The adaptive adversaries co-evolve: attackers evolve new attack patterns and overcome cyber defenses, and defenders subsequently evolve new defensive patterns to the attacks. When we run these adaptive decision-making models, we see what looks like real-world behavior. These simulated attackers learn to time their attacks just as real-world hackers do with virus attacks. Simulated defenders soon catch on and resynchronize their defenses to match the timing of these attacks. Because it can automatically discover new behaviors beyond those that were initially built into the models, this adaptive simulation modeling can provide a more realistic simulation of intelligent behavior.

Paradigm Shifts in Simulation Modeling

Object-Oriented Simulation Modeling—A major shift in simulation modeling occurred with the widespread adoption of object-oriented programming in the mid-1980s. This paradigm and the programming environments that embody it allow us to represent real-world objects directly with software objects. These software objects, like their real-world counterparts, have attributes and behaviors respectively called variables and methods. The object-oriented programming environments make it easy for a programmer to define templates (called classes) of objects, which can be used like cookie-cutters easily to create many executable instances of that class of objects. For example, one can define a tree class that has variables for height, size, and location, and methods like catching fire and falling down. Building a forest is made easy by using the classes to create multiple instances of trees while varying the values of the variables. One can set fire to a tree by sending it a catch-fire message. The catching-fire method could cause the creation of spark objects that, when they get near to the location of a tree object, send it a message to catch fire. In this way, a forest fire can be simulated.

Agent-Oriented Simulation Modeling—In the 1990s the object-oriented simulation modeling paradigm was extended by adding new methods to objects. Some new methods made objects more lifelike by enabling them to perceive other objects in their environment; others enabled them to calculate the actions needed to achieve a specified goal-state. These smart objects are called autonomous agents. Object-oriented (now agent-oriented) programming environments can easily create multiple instances of these agents so societies of agents can be formed. In simulation, these agents can get input from their simulated environment, make decisions, and act on that environment without any intervention from outside their simulated world (that is, without control from you or me). This powerful paradigm now makes it possible to examine systematically how the behaviors of individuals affect the behavior of a society. There are many examples, including simulations of bacterial growth, insect colony behavior, and the effect of microeconomic behavior on macroeconomic outcomes. Yet these autonomous agents still do not learn or adapt to their environment and so are relegated to acting out the models their programmers give them.

Adaptive Agent Simulation Modeling—Recently, MITRE has begun making these agents even smarter by providing them with methods that allow them to perceive the results of their actions and then to modify their behaviors to improve their performance in achieving their goal-state. They are now capable of learning to go beyond their initial programming. A widely accepted term for these agents hasn’t yet been coined. The term “intelligent agent” has sometimes been used, but it has also been used interchangeably with “autonomous agent”. For the purposes of this article, we will call these new classes “adaptive agents” to distinguish them from the others.

This powerful new paradigm allows us to examine systematically how behaviors of adaptive individuals affect the evolution of the individuals and consequently of a society. If we simulate two societies with competing goals we can examine how they co-evolve. If we place adaptive agents on a simulated battlefield, then we have a simulated wargame where the parties are capable of adapting to their environment and to each other. This is how we developed the simulated cyberwargame described at the beginning of this article. Collaborative groups of these agents may form an organization, or (as in Minsky's The Society of Mind, 1988) a single mind of a decision maker.

Looking at it in another way, by enabling these agents to go beyond their original programming, we make them capable of extending our initial assumptions about how people behave in a given context. The agents can learn from and adapt to that context to best satisfy the goals we have given them.

Exploring the Applications of Adaptive Decision Modeling

Our first use of adaptive decision modeling was to simulate how air traffic decision makers would perform under a number of traffic flow management operational policies, ranging from no central traffic flow control to two forms of free-market control structures and strict central control.

It was reasonable to expect that rational decision makers would develop different strategies to deal with the different operational policies, and there is solid empirical research on which to build general models of human decision making. But we were dealing with hypothetical operational concepts, never tried in the field, and therefore there were no empirical data on which to develop specific models of decision making under each operational condition.

Adaptive decision modeling technology allowed us to do exploratory modeling. Our generic decision-making simulation models were placed in simulations of each condition, and allowed to explore automatically the strategies that best fit their conditions. Under each of the simulated conditions the adaptive models did indeed evolve differently, and that resulted in different relationships evolving between the airlines and central flow management. Consequently, these different relationships resulted in different levels of system and individual performance. Albeit in a simplified environment, these results and the nature of the evolved differences highlighted important factors that could affect the performance of traffic flow policies.

Because this was also a competitive situation, the simulated decision makers could only optimize their performance by either synchronizing their behavior (de facto cooperation) or by constantly changing their strategies as they sought to gain advantage over each other. In this controlled simulated environment, they were not allowed any direct communication (no collusion) with each other. Even so, in all but one experimental condition, our simulated decision makers learned to synchronize their behavior, and the pattern of synchronization changed over time. The results suggest that apparent cooperation can indeed evolve in a competitive situation without collusion.

The cyberwarfare model described at the beginning of this article is our latest application of adaptive decision modeling. In a warfare situation, the co-evolving adversarial relationship between attacker and defender is the primary focus of the research. With an adaptive decision modeling experimental paradigm we can systematically manipulate the context of the warfare (initial defensive configuration, information available to each side, available resources, etc.) and evaluate the effect on the adversarial relationship.

Extending Knowledge Through Simulation

Are these new simulation models useful? Unequivocally, yes. They allow us to extend our knowledge and models of human behavior and the behavior of complex adaptive systems, such as social systems, competitive markets, or adversarial behavior in combat. Adaptive agent technology provides automated discovery of behavioral models that would be impractical or impossible to search for with real-world experiments because of the size of the possible model space. Discovering these models in simulation will point us to significant variables and critical values of those variables that need to be examined under real-world conditions. Leveraging these discoveries will allow us then to use our real-world experiments more effectively to test, verify, and extend the knowledge made possible by these new simulation models.

---

For more information, please contact Gary Klein using the employee directory.

---