System and method for collaborative cybersecurity defensive strategy analysis utilizing virtual network spaces

1. A system for collaborative cybersecurity defensive strategy analysis utilizing virtual network spaces, comprising:

an attack implementation engine comprising a first plurality of programming instructions stored in a memory of, and operating on a processor of, a computing device, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to:

execute a cyberattack on a network under test; and

gather system information about the operation of the network under test during the cyberattack, the system information comprising information about the sequence of events and response of affected devices during the cyberattack; and

a virtual network space manager comprising a second plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the second plurality of programming instructions, when operating on the processor, cause the computing device to:

receive a plurality of input data, the plurality of input data comprising at least one of:

cyber data, sensor data, enrichment data, third party data, cyber physical graph data, and analytic workflow data; and

combine the system information with the plurality of received input data to create a virtual network space model of the network under test; and

a machine learning simulator comprising a third plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the third plurality of programming instructions, when operating on the processor, cause the computing device to:

use the system information to initiate an iterative simulation of a cyberattack strategy sequence, each iteration comprising a simulated attack on the virtual network space model of the network under test and a simulated defense against the simulated attack, each simulated attack being generated by a first machine learning algorithm; and

obtain a simulation result comprising the cyberattack strategy sequence and a probability of success of the attack and the defense in each iteration; and

a simulated interaction engine comprising a fourth plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the fourth plurality of programming instructions, when operating on the processor, cause the computing device to:

connect two or more real or virtual actors to the virtual network space model;

capture a first interaction and a second interaction between the two or more real or virtual actors, wherein an interaction comprises an action and response; and

produce an update for at least one of the virtual network space model, the network under test, or the simulation of a cyberattack strategy based on the simulation result and the first and second interaction.

2. The system of claim 1 , wherein the system information further comprises system logs of one or more of the affected devices.

3. The system of claim 1 , wherein the first machine learning algorithm is a reinforcement learning algorithm.

4. The system of claim 1 , further comprising a second machine learning algorithm, wherein each simulated defense is generated by the second machine learning algorithm, such that the first and second machine learning algorithms compete against each other in the simulation.

5. The system of claim 4 , wherein the second machine learning algorithm is an evolutionary algorithm.

6. The system of claim 5 , wherein the iterative simulation is an online simulation and the evolutionary algorithm is a continual online evolutionary planning algorithm.

7. The system of claim 1 , wherein a cybersecurity improvement recommendation is implemented on the network under test.

8. The system of claim 6 , wherein the system is run iteratively, with each iteration resulting in a new cybersecurity improvement recommendation, which is implemented on the network under test prior to the next iteration.

9. The system of claim 1 , further comprising a recommendation engine comprising a fifth plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the fifth plurality of programming instructions, when operating on the processor, cause the computing device to:

compare the simulation result against one or more cost factors and one or more benefit factors; and

determine a cybersecurity improvement recommendation for the network under test based on the comparison.

10. A method for collaborative cybersecurity defensive strategy analysis utilizing virtual network spaces, the method comprising the steps of:

executing a cyberattack on a network under test;

gathering system information about the operation of the network under test during the cyberattack, the system information comprising information about the sequence of events and response of affected devices during the cyberattack;

receiving a plurality of input data, the plurality of input data comprising at least one of:

cyber data, sensor data, enrichment data, third party data, cyber physical graph data, and analytic workflow data;

combining the system information with the plurality of received input data to create a virtual network space model of the network under test;

using the system information to initiate an iterative simulation of a cyberattack strategy sequence, each iteration comprising a simulated attack on a model of the network under test and a simulated defense against the simulated attack, each simulated attack being generated by a first machine learning algorithm;

obtaining a simulation result comprising the cyberattack strategy sequence and a probability of success of the attack and the defense in each iteration;

connecting two or more real or virtual actors to the virtual network space model;

capturing a first interaction and a second interaction between the two or more real or virtual actors, wherein an interaction comprises an action and response; and

producing an update for at least one of the virtual network space model, the network under test, or the simulation of a cyberattack strategy based on the simulation result and the first and second interaction.

11. The method of claim 10 , wherein the system information further comprises system logs of one or more of the affected devices.

12. The method of claim 10 , wherein the first machine learning algorithm is a reinforcement learning algorithm.

13. The method of claim 10 , further comprising a second machine learning algorithm, wherein each simulated defense is generated by the second machine learning algorithm, such that the first and second machine learning algorithms compete against each other in the simulation.

14. The method of claim 13 , wherein the second machine learning algorithm is an evolutionary algorithm.

15. The method of claim 14 , wherein the iterative simulation is an online simulation and the evolutionary algorithm is a continual online evolutionary planning algorithm.

16. The method of claim 10 , wherein a cybersecurity improvement recommendation is implemented on the network under test.

17. The method of claim 16 , wherein the method is run iteratively, with each iteration resulting in a new cybersecurity improvement recommendation, which is implemented on the network under test prior to the next iteration.

18. The method of claim 10 , further comprising the steps of:

comparing the simulation result against one or more cost factors and one or more benefit factors; and

determining a cybersecurity improvement recommendation for the network under test based on the comparison.