Cognitive Approach to Cybersecurity: Causality Analysis and Situational Learning

The dynamic nature of physical environments by their very nature and the explosive growth of data volume call into question the ability of socio-cyber-physical systems to perform adequate management actions on controlled physical assets in many contexts. The current state of cybersecurity requires the use of cognitive methods due to the increasing complexity, dynamism, and adaptability of threats. To quantitatively assess system security levels, aggregate data, and calculate the impact of various factors on the resilience of a cyber system, an approach combining causality analysis and situational learning has been proposed. The convolution in this approach allows for an integrated security assessment, taking into account asset criticality, attack probability, and the effectiveness of countermeasure mechanisms. The practical benefit of this approach is reflected in a significant reduction in response time to attacks. The main achievement of this approach is the ability to implement proactive protection, which anticipates attacks before they occur rather than merely reacting to them post-factum.