Active cybersecurity: vision, model, and key technologies

Abstract

Noncooperative computer systems and network confrontation present a core challenge in cyberspace security. Traditional cybersecurity technologies predominantly rely on passive response mechanisms, which exhibit significant limitations when addressing real-world complex and unknown threats. This paper introduces the concept of “active cybersecurity,” aiming to enhance network security not only through technical measures but also by leveraging strategy-level defenses. The core assumption of this concept is that attackers and defenders, in the context of network confrontations, act as rational decision-makers seeking to maximize their respective objectives. Building on this observation, this paper integrates game theory to analyze the interdependent relationships between attackers and defenders, thereby optimizing their strategies. Guided by this foundational idea, we propose an active cybersecurity model involving intelligent threat sensing, in-depth behavior analysis, comprehensive path profiling, and dynamic countermeasures, termed SAPC, designed to foster an integrated defense capability encompassing threat perception, analysis, tracing, and response. At its core, SAPC incorporates theoretical analyses of adversarial behavior and the optimization of corresponding strategies informed by game theory. By profiling adversaries and modeling confrontation as a “game,” the model establishes a comprehensive framework that provides both theoretical insights into and practical guidance for cybersecurity. The proposed active cybersecurity model marks a transformative shift from passive defense to proactive perception and confrontation. It facilitates the evolution of cybersecurity technologies toward a new paradigm characterized by active prediction, prevention, and strategic guidance.

1. Introduction

The continuous advancement of global digital technologies has transformed cyberspace into a critical domain for national competition. As cyberspace becomes more important in politics, economics, and military matters, cybersecurity has become essential for protecting national interests and keeping society stable. In recent years, cyberattacks have become not only more frequent but also increasingly sophisticated. The advent of artificial intelligence (AI) and big data technologies (Kaur et al., 2023; Rajapaksha et al., 2023) has enabled the attacker to apply highly customized attacks that are more difficult to detect and are executed with greater speed, thus impacting a broader range of system (Han et al., 2021).

In response to the increased cybersecurity threats, various cybersecurity models have been proposed, providing not only theoretical foundation but also practical guidance for cybersecurity systems to counter evolving threats. These models are mainly defense-centric ones, focusing on enhancing the defensive capabilities (e.g., the protection, detection, and response (PDR) model (Schwartau, 1998), P2DR (Li DP et al., 2014), and PDR + recovery PDRR (Yang Y et al., 2024)) of cybersecurity systems in dynamic environments. However, these models focus mainly on how systems can defend themselves internally. They lack in-depth insights into the behaviors, motivations, and strategies of attackers. This places the defender in a passive position during attack–defense confrontations.

To break away from the traditional “defense-centric” mindset, several models centered on attack–defense confrontation have been developed. These models examine attacks from the perspective of the attacker, enabling the defender to gain a deeper understanding of the attack mechanisms. The “find, fix, track, target, engage, and assess” (F2T2EA) framework (Tirpak, 2000) shows how to quickly spot threats, stop them from spreading, and respond effectively. Building on this, the “seven-step kill chain” model (Sun S et al., 2023) helps the defender by breaking down the key stages in which an attack operates. The adversarial tactics, techniques, and common knowledge (ATT&CK) framework (Strom et al., 2020), created by the US-based Mitre Corporation, provides a detailed map of attack methods and behaviors.