Method and system for determining policies, rules, and agent characteristics, for automating agents, and protection

Abstract

A method of automating an agent for environment includes loading an action determination model that indicates an action option, determining whether the action determination model indicates a next action option, and if so, determining an action based on the action determination model, determining whether an execution data model has been stored, and if so, obtaining data pertaining to the determined action, executing the action, determining a result of the action, storing the data pertaining to the result in an execution data model. Then, until the environment or agent reach an end state, the following are repeated: determining whether the action determination model indicates the next action option, and if so, determining the action based on the action determination model, and determining whether the execution data model has been stored, and if so, obtaining the data pertaining to the determined action.

What is claimed is: 
     
         1 . A method of automating at least one agent for at least one environment including an agent action determination and action execution implementation, the method comprising:
 loading, via a processor, from a data storage or a memory, at least one action determination model for the at least one agent that indicates at least one action option to be executed by the at least one agent, the indication being determined by at least one objective of the at least one agent;   determining, via the processor, whether the at least one action determination model indicates at least one next action option to be executed by the at least one agent, and if so, determining, by a processor, from the at least one action option, an action to be executed based on the action determination model;   determining, via the processor, whether an execution data model has already been stored, and if so, obtaining from the execution data model data pertaining to the at least one determined action on the at least one environment, if the at least one action requires at least one precondition;   executing, via the processor, the at least one action on the at least one environment;   determining, via the processor, at least one result of the at least one action;   storing the data pertaining to the at least one result, if available, in an execution data model; and   repeating, until the environment or agent reach at least one end state:
 determining, via the processor, whether the at least one action determination model indicates the at least one next action option to be executed by the at least one agent, and if so, determining, via the processor, from the at least one action option, the action to be executed based on the action determination model; and 
 determining, via the processor, whether the execution data model has already been stored, and if so, obtaining execution from the execution data model the data pertaining to the at least one determined action on the at least one environment, if the at least one action requires the at least one precondition. 
   
     
     
         2 . The method according to  claim 1 , wherein the at least one action determination model is at least one of a neural network, rule engine, model transformation, model execution, statistical model, stochastic model, probabilistic model, artificial reasoning model, reinforcement learning model, inference model, program, fuzzy logic, or decision tree. 
     
     
         3 . The method according to  claim 1 , wherein the at least one action determination model defines the at least one next action to select in at least one given context. 
     
     
         4 . The method according to  claim 1 , wherein the at least one action determination model determines at least one of an attacker action, an attack action, an exploit action, a defender action, a defending action, a detection action, a mitigation action, a prevention action, an alarm/alert action, a monitoring action, an evaluator action, a tester action, a penetration testing action, a vulnerability assessment action, a recommendation for human users, a configuration action for machines, a policy based action, a rule-based action, a user input action, a user output action, a data ingestion action, a repair action, assembly/disassembly action, a preparing action, a use action, a disposal action, a maintenance action, a directing action, an informational action, an entertaining action, a diagnosing action, transaction action, a purchasing action, a selling action, decision action, training action, education action, buying action, notification action, deception action, distraction action, timing action, delay action, support action, redirect action, or a transfer action. 
     
     
         5 . The method according to  claim 1 , wherein determining the at least one action option is partly or fully based on success likelihood of the at least one action. 
     
     
         6 . The method according to  claim 1 , wherein the at least one result of the at least one action includes at least one of an environment effect, an agent effect, console output, data returned by the action, data returned by the environment, context data, metadata, or data returned by the agent. 
     
     
         7 . The method according to  claim 1 , wherein executing, via the processor, the at least one action on the at least one environment comprises executing logic on at least one IT system. 
     
     
         8 . The method according to  claim 1 , wherein the at least one objective of the at least one agent includes successful attacking, defending, preventing, assessing, testing, evaluating, alarming, monitoring of the environment, providing a service, maintaining, updating, analyzing, deceiving, action execution, action sequence execution. 
     
     
         9 . The method according to  claim 1 , wherein the at least one end state includes success or failure of the at least one objective of the at least one agent. 
     
     
         10 . A method of automatically configuring at least one action determination model for at least one agent that indicates at least one action option to be executed on at least one environment by the at least one agent, the method comprising:
 determining, via a processor, at least one environment model for the at least one environment which indicates attributes and behaviors of the environment and/or its context, and/or agents;   determining, via the processor, the at least one action determination model for the at least one agent that indicates the at least one action option to be executed by the at least one agent, the indication being determined by at least one objective of the at least one agent;   determining, via the processor, whether the at least one action determination model indicates at least one next action option to be executed by the at least one agent, and if so, determining, via the processor, from the at least one action option, at least one action to be executed based on the action determination model;   simulating, via the processor, at least one execution of the at least one action across the environment model, and obtaining at least one simulated result of the simulated execution;   adjusting, via the processor, the at least one action determination model based on a difference between the at least one objective and the at least one simulated result; and   repeating, via the processor, until the environment or the at least one agent reach at least one end state:
 determining whether the at least one action determination model indicates the at least one next action option to be executed by the at least one agent, and if so, determining from the at least one action option, the at least one action to be executed based on the action determination model; 
 simulating the at least one execution of the at least one action across the environment model, and obtaining the at least one simulated result of the at least one simulated execution; and 
 adjusting the at least one action determination model based on the differences between the at least one objective and the at least one simulated result. 
   
     
     
         11 . The method according to  claim 10 , wherein the at least one end state is reached when the differences between the at least one expected result and the at least one simulated result are below a threshold. 
     
     
         12 . The method according to  claim 10 , wherein simulating, via the processor, the at least one execution of the at least one action across the environment model comprises simulating the effects of executing logic on at least one IT system. 
     
     
         13 . The method according to  claim 10 , wherein adjusting via the processor, the at least one action determination model based on the difference between the at least one objective and the at least one simulated result involves optimizers, machine learning, or reinforcement learning. 
     
     
         14 . The method according to  claim 10 , wherein the at least one action determination model is at least one of a trained neural network, rule engine, model transformation, model execution, statistical model, stochastic model, probabilistic model, artificial reasoning model, reinforcement learning model, inference model, program, fuzzy logic, or decision tree. 
     
     
         15 . The method according to  claim 10 , wherein the at least one action determination model defines the at least one next action to select in at least one given context. 
     
     
         16 . The method according to  claim 10 , wherein the at least one action determination model determines at least one of an attacker action, an attack action, an exploit action, a defender action, a defending action, a detection action, a mitigation action, a prevention action, an alarm/alert action, a monitoring action, an evaluator action, a tester action, a penetration testing action, a vulnerability assessment action, a recommendation for human users, a configuration action for machines, a policy based action, a rule-based action, a user input action, a user output action, a data ingestion action, a repair action, assembly/disassembly action, a preparing action, a use action, a disposal action, a maintenance action, a directing action, an informational action, an entertaining action, a diagnosing action, transaction action, a purchasing action, a selling action, decision action, training action, education action, buying action, notification action, deception action, distraction action, timing action, delay action, support action, redirect action, or a transfer action. 
     
     
         17 . The method according to  claim 10 , wherein determining the at least one action option is partly or fully based on success likelihood of the at least one action. 
     
     
         18 . The method according to  claim 10 , wherein the at least one result of the at least one action includes at least one of an environment effect, an agent effect, console output, data returned by the action, data returned by the environment, context data, metadata, or data returned by the agent. 
     
     
         19 . The method according to  claim 10 , wherein the at least one objective of the at least one agent includes successful attacking, defending, preventing, assessing, testing, evaluating, alarming, monitoring of the environment, providing a service, maintaining, updating, analyzing, deceiving, action execution, action sequence execution. 
     
     
         20 . The method according to  claim 10 , wherein the at least one end state includes success or failure of the at least one objective of the at least one agent.