Automated Adversary Emulation: A Case for Planning and Acting with Unknowns

By Douglas Miller , Ron Alford , Andy Applebaum , Henry Foster , Caleb Little , Blake Strom

The CALDERA team argues that the problem of automated adversary emulation is both a planning and acting problem, summarizing their research on applying automated planning to adversary emulation and describing challenges with existing solutions.

Download Resources

Adversary emulation assessments offer defenders the ability to view their networks from the point of view of an adversary. Because these assessments are time consuming, there has been recent interest in the automated planning community on using planning to create solutions for an automated adversary to follow. We deviate from existing research within the work under the CALDERA project, and instead argue that automated adversary emulationas well as automated penetration testingshould be treated as both a planning and an acting problem. Our argument hinges on the fact that adversaries typically have to manage unbounded uncertainty during assessments, which many of the prior techniques do not consider. To illustrate this, we provide examples and a formalism of the problem, and discuss shortcomings in existing planning modeling languages when representing this domain. Additionally, we describe our experiences developing solutions to this problem, including our own custom representation and algorithms. Our work helps  characterize the nature of problems in this space, and lays important groundwork for future research.​