AI-driven defensive cybersecurity strategy analysis and recommendation system

A system for automated cybersecurity defensive strategy analysis and recommendations, comprising:

• a plurality of programming instructions stored in a memory of, and operating on a processor of, a computing device, wherein the plurality of programming instructions, when operating on the processor, cause the computing device to:
• generate a cyber-physical graph of a target network by requesting packet capture data from endpoint agents and network packet capturing devices deployed on networked devices of the target network, wherein the cyber-physical graph is a directed graph comprising nodes representing network devices, users, and resources, and edges representing physical and logical connections between the nodes, and wherein the cyber-physical graph further incorporates deployed software version information and access privilege relationships is from the captured packet data;
• perform real-time attack tests on a simulated model of the target network that is based on the cyber-physical graph by:
• executing iterative adversarial attack simulations on the cyber-physical graph by composing attack sequences and applying said attack sequences to the cyber-physical graph, wherein the adversarial attack simulations are based, at least in part, on the deployed software version information and the access privilege relationships incorporated in the cyber-physical graph;
• updating a probability of success for each attack sequence based on a reward signal received for a successful exploitation of a node or edge in the cyber-physical graph;
• and
• outputting simulation results of the adversarial attack simulations, wherein the simulation results comprise probability distributions over the probability of success for each attack sequence;
• generate a cybersecurity improvement recommendation for the target network by:
• generating new hypothetical controls for the target network;
• analyzing the new hypothetical controls using the simulation results based on cost of implementation of the new hypothetical controls and benefit to be gained from implementation of the new hypothetical controls;
• and
• incorporating the new hypothetical controls in a subsequent iterative adversarial attack simulation to determine whether the new hypothetical controls will be successful;
• and
• upon determining that the new hypothetical controls will be successful, automatically reconfigure the target network using a distributed computational graph to send configuration data implementing the cybersecurity improvement recommendation to affected network devices.