行动者，而不是观察者：智能自主智能体是实现网络弹性的途径
Doers, not Watchers: Intelligent Autonomous Agents are a Path to Cyber Resilience
摘要：
今天的网络防御工具大多是观察者。他们不是积极的行动者。当然，观看也是一件要求很高的事情。这些工具监控流量和事件;它们检测恶意签名、模式和异常;它们可能会对观察到的内容进行分类和描述;它们会发出警报，甚至可能在执行所有这些操作时进行学习。但他们没有行动。他们很少计划和执行对攻击的响应，也不计划和执行恢复活动。响应和恢复-网络弹性的核心要素留给人类网络分析师，事件响应者和系统管理员。我们认为事情应该改变。网络防御工具不应该仅仅是观察者。他们需要成为实干家--在维护系统抵御网络威胁的能力方面的积极战士。这意味着，它们的能力应包括高度的自主性和智能，以便对刚刚出现或已经成功的妥协作出快速反应，并迅速恢复，从而有助于整个系统的复原力。通常，应对和恢复工作需要在没有任何人参与的情况下进行，并明智地考虑到这些工作的风险和后果。最近，一个国际团队发表了一份报告，提出了一个自主智能网络防御代理（AICA）的愿景，并提供了这样一个代理的高级参考架构。在本文中，我们将探讨这一愿景。
英文摘要：
Today's cyber defense tools are mostly watchers. They are not active doers. To be sure, watching too is a demanding affair. These tools monitor the traffic and events; they detect malicious signatures, patterns and anomalies; they might classify and characterize what they observe; they issue alerts, and they might even learn while doing all this. But they don't act. They do little to plan and execute responses to attacks, and they don't plan and execute recovery activities. Response and recovery - core elements of cyber resilience are left to the human cyber analysts, incident responders and system administrators. We believe things should change. Cyber defense tools should not be merely watchers. They need to become doers - active fighters in maintaining a system's resilience against cyber threats. This means that their capabilities should include a significant degree of autonomy and intelligence for the purposes of rapid response to a compromise - either incipient or already successful - and rapid recovery that aids the resilience of the overall system. Often, the response and recovery efforts need to be undertaken in absence of any human involvement, and with an intelligent consideration of risks and ramifications of such efforts. Recently an international team published a report that proposes a vision of an autonomous intelligent cyber defense agent (AICA) and offers a high-level reference architecture of such an agent. In this paper we explore this vision.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
