Chief Strategy Officer at MixMode.
getty
Spoiler alert: This article will cover events from the recent Netflix TV adaptation of the sci-fi book by Liu Cixin: The 3 Body Problem.
Chaos.
It happens when you can’t predict what’s coming next. This is true in many aspects of life, but it's especially true for cybersecurity professionals trying to stop the next new unknown and novel attack on an organization. When cyberattacks happen and can’t be stopped, chaos ensues and damage is done.
Having tools to be able to accurately predict what comes next has been a major part of how civilization has advanced for millennia. Forecasting the weather or knowing when to plant and harvest crops are hugely important to avoiding chaos.
It is why observing the sky to predict the movement of the sun and stars has been a driving force for scientific breakthroughs over the years.
It was Copernicus in the 1500s who discovered that the earth travels around the sun, building the heliocentric model of the solar system. Johannes Kepler in the 17th Century advanced that discovery by showing that the earth goes around the Sun in an elliptical, not circular, shaped orbit. Mapping observations to various theories until things matched, he wrote three rules for planetary bodies orbiting a star.
This process of taking evidence and trying to write rules is not that dissimilar from the cybersecurity industry, which takes successful attacks and tries to write rules for detection, hoping that these rules will be effective in detecting future, not-yet-seen attacks.
What Kepler was trying to solve can generically be called the “two-body problem.” This is how two massive objects interact with each other over time in an idealized system. After Newton and his equations for gravity showed up, it turns out we have a full solution (technically, a closed-form solution, but stick with me) to this problem.
We can take any two bodies and a starting condition and accurately predict where each body will be at a given time in the future. Being able to predict accurately helps avoid chaos.
This takes us to the Netflix series 3 Body Problem (light spoilers ahead).
The titular problem of the series is what plagues an advanced alien civilization that contacts Earth. Unfortunately, this civilization evolved on a planet around not one star but three stars. These three stars would influence the orbit of their planet, causing brief eras of stability and prosperity followed by seemingly random chaotic eras of droughts and ice ages, causing the population to need to effectively hibernate to survive.
This led to a focus of these aliens on discovering science and technology to try to see a pattern and predict forthcoming chaotic eras in order to prepare for them to lessen the damage. Each time they thought they would get closer to having a rule or equation that would predict accurately, a chaotic era would surprise them, restarting their civilization. Eventually, they fled their homeworld to seek out a new home, hence their interest in Earth.
In the series, we see how scientists on Earth are presented with the nature of this alien world while playing a virtual reality game. It is a test to see which players are smart enough to figure out what is happening and how to formulate a prediction of stable and chaotic eras. Many fail due to the extremely complicated nature of trying to decipher patterns from their observations. One protagonist, theoretical physicist Jin Cheng, wins the game by figuring out the alien world is in a three-star, or three-body, system with no explainable pattern.
Back here on Earth, after Kepler and Newton, scientists naturally thought that they could evolve the same approach of the two-body solution and just account for another planet or body. Basically, just extend the formulas from two to three, and voila!
Surprisingly, though, even to this day, the complexity of the interactions in a three-body system are too chaotic to predict with any rule. As said in the VR game from the series: “There is no solution to the three-body problem”
Physicists describe the three-body problem as a chaotic dynamical system with no solution and different numerical methods are needed to simulate. Rules and formulas are unable to be used to predict a given point in the future. Instead, you must simulate time step by time step, marching into the future to see what will happen. The noted dynamical system nature of this problem means that new tools and methods that can handle this complexity must be used.
What does this have to do with cybersecurity?
The cybersecurity industry as a whole has historically been viewing the world through the lens that the problem of cyberattacks can be solved the same way that Kepler solved how a planet orbits a star—that we just need to look at observed history and write another rule or two to perfectly capture how things seem to work and we can then detect the next forthcoming attack.
Unfortunately, the never-ending list of reports of the latest successful cyberattack shows that this rules-based approach isn’t working and will never work due to the limitations of accurately accounting for complex, dynamic environments.
Chaos rears its head again.
Looking at the problem through the lens of the three-body problem, though, a new mechanism can be used. Recent breakthroughs in dynamical systems-powered AI can be used to constantly simulate large network environments in real time, constantly updating the simulation to march forward in time, step by step, to accurately predict what’s next in the system.
New novel attacks being used against organizations will then stand out against this simulation and give cybersecurity professionals the threat detection they need in order to prevent damage being done.
Cybersecurity professionals have been faced with an “unsolvable” problem for years, banging their heads against the wall trying to detect new novel attacks. Sometimes it takes a radically different approach based on a fundamental scientific understanding to move things forward and avoid chaos.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
