Towards operational resilience for AI-based cyber in multi-domain operations

There is a growing orientation of cyber systems, technologies, and processes away from notions of cybersecurity and towards notions of cyber resilience. In multi-domain operation settings, such as joint all-domain command and control (JADC2), the scale and evolvability of networks makes resilience an especially useful concept for cyber operations, as the attack surface is simply too complex to secure. Generic design patterns for cyber resilience in cyber-physical systems have been difficult to identify. This is due in part to the generality of cyber-physical systems (CPS). Artificial intelligence and machine learning (AI/ML), however, are more specific than CPS, typically serving as a component or subsystem within a CPS, and thereby offer a more promising opportunity to define general resilience concepts for AI/ML-based cyber systems. In this paper, we introduce resilience concepts for AI/ML-based cyber systems. We consider the measurability and testability of resilience, as well as suggest possible requirements for resilience. To illustrate and contextualize the discussion of resilience, we use a notional example of AI/ML-based network defense analysis in a JADC2 setting. With the aid of the JADC2 example, we discuss the difficulties in engineering AI/ML for cyber resilience. Although AI/ML often have learning processes embedded, that does not make them resilient, as the learning processes are dependent on other systems, technologies, and processes. This paper concludes that to extend cyber resilience to an AI/ML-based cyber systems, one can use generic design patterns to identify resilience mechanisms and to associate them with testable, measurable requirements.