CALDERA: A Red-Blue Cyber Operations Automation Platform

Ron Alford, Dean Lawrence, Michael Kouremetis

Abstract: Live evaluation of cybersecurity defenses, or red team engagements, can be costly, difficult to commission, and inconsistent in scope, detail, and results. This high overhead prevents many organizations from fully using them despite their benefits. CALDERA enables automated assessment of a network’s susceptibility to an adversary being successful, essentially allowing an organization to see their network through the eyes of attackers on demand. CALDERA features an adversary model that maps to the MITRE ATT&CK® framework and an extensible planning system able to select and execute techniques. Inspired by automated planning methodologies, CALDERA provides a flexible, mature platform for developing adaptive and intelligent cyber agents.