  The North Atlantic Treaty Organization (NATO) Exploratory Team meeting,
"Model-Driven Paradigms for Integrated Approaches to Cyber Defense," was
organized by the NATO Science and Technology Organization's (STO) Information
Systems and Technology (IST) panel and conducted its meetings and electronic
exchanges during 2016. This report describes the proceedings and outcomes of
the team's efforts.
  Many of the defensive activities in the fields of cyber warfare and
information assurance rely on essentially ad hoc techniques. The cyber
community recognizes that comprehensive, systematic, principle-based modeling
and simulation are more likely to produce long-term, lasting, reusable
approaches to defensive cyber operations.
  A model-driven paradigm is predicated on creation and validation of
mechanisms of modeling the organization whose mission is subject to assessment,
the mission (or missions) itself, and the cyber-vulnerable systems that support
the mission. This by any definition is a complex socio-technical system (of
systems), and the level of detail of this class of problems ranges from the
level of host and network events to the systems' functions up to the function
of the enterprise. Solving this class of problems is of medium to high
difficulty and can draw in part on advances in Systems Engineering (SE). Such
model-based approaches and analysis could be used to explore multiple
alternative mitigation and work-around strategies and to select the optimal
course of mitigating actions. Furthermore, the model-driven paradigm applied to
cyber operations is likely to benefit traditional disciplines of cyber defense
such as security, vulnerability analysis, intrusion prevention, intrusion
detection, analysis, forensics, attribution, and recovery.
