Advanced Adversaries Research Articles

To compete or strategically retreat? The global diffusion of reconnaissance strike

The reconnaissance strike complex is synonymous with modern military power, and prominent realist theories would have predicted rapid proliferation after its successful debut in the Gulf War. Instead, the complex has proliferated slowly. To explain this puzzle, we theorize that interstate security threats significantly impact proliferation, but not in the way traditionally presumed. Although the literature on weapons proliferation has largely assumed a monotonically increasing relationship should hold between the capabilities of a state’s adversaries and a state’s own capability, we draw from the economics literature and game theoretic insights from political science to argue that the relationship should resemble an inverted-U. When states have rivals with moderate reconnaissance strike capabilities, they have security incentives to compete with them. However, when states face highly advanced adversaries, it becomes more difficult to escape or match their competition, making symmetrical acquisition less appealing. While most prior research focuses on narrower aspects of the reconnaissance strike complex like missiles or smart bombs, we test our theory on a novel dataset tracking country-level acquisition of eight aspects of the complex from 1980 to 2017: Ballistic missiles; bombers; cruise missiles; fighter aircraft; intelligence, surveillance, and reconnaissance assets; precision-guided munitions; satellites; and submarines. We find strong support for our inverted-U argument. States that have rivals with moderate reconnaissance strike capabilities have over double the reconnaissance strike capabilities themselves than states that have rivals with very low or very high capabilities. Our findings hold for broader measures of the complex that closely proxy a state’s general military capabilities, narrower measures of the complex, and alternative measures of general military sophistication, indicating our theory has broad applicability. This article explains why some states invest heavily in conventional capabilities despite an already-large lead over their adversaries, and why other states instead opt to invest in alternatives rather than balancing symmetrically.

Proactive threat hunting to detect persistent behaviour-based advanced adversaries

Persistence behavior is a tactic advanced adversaries use to maintain unauthorized access and control of compromised assets over extended periods. Organizations can efficiently detect persistent adversaries and reduce the growing risks posed by highly skilled cyber threats by embracing creative techniques and utilizing sophisticated tools. By taking a proactive stance, businesses may increase their entire cybersecurity posture by anticipating and mitigating possible risks before they escalate. Security analysts perform thorough investigations and extract meaningful insights from large datasets with greater technical advantage by using Elasticsearch in conjunction with a variety of linguistic tools. This research presents a novel methodology for proactive threat intelligence to identify and mitigate advanced adversaries that use persistent behaviors. The authors designed and set up an Elasticsearch-based advanced Security Information and Event Management platform to offer a proactive threat-hunting strategy. This enables comprehensive analysis and detection by integrating Lucene, Kibana, and domain-specific languages. The goal of this research is to locate hidden advanced enemies who exhibit persistent behavior during cyberattacks. The framework can help improve the organization’s resilience to identify and respond to threats by closely examining activities like boot or logon auto-start execution in registry keys, tampering with system processes and services, and unauthorized creation of local accounts on compromised assets. This study emphasizes proactive actions over reactive reactions, which advances danger detection techniques. This technical study provides security practitioners seeking to improve defenses against new advanced attacks to stay ahead in a dynamic threat landscape.

Threat Modeling for Cyber Warfare Against Less Cyber-Dependent Adversaries

Cyber warfare poses a substantial threat in today's interconnected world, where digital attacks can transcend physical boundaries and affect targets globally. Technologically, less advanced adversaries, such as smaller nations or organizations with limited resources, face unique challenges in defending against sophisticated cyber attacks from more advanced entities. This paper explores the threat landscape for these adversaries and proposes a tailored threat modeling framework to address their specific vulnerabilities and needs. By examining the evolution of cyber warfare, including historical incidents and the increasing sophistication of cyber attacks, the study highlights the limitations of existing threat modeling approaches like the Cyber Kill Chain, MITRE ATT&CK Framework, and SWOT analysis when applied to less advanced adversaries. A comprehensive literature review underscores the gaps in current research, particularly the necessity for frameworks tailored to asymmetric technological capabilities. Employing a mixed methods approach, the research combines qualitative and quantitative data from primary sources, such as interviews with cybersecurity experts, and secondary sources, including existing literature and case studies. The proposed framework focuses on asset identification and classification, vulnerability assessment, threat analysis, and risk assessment. Proactive measures, such as basic cyber hygiene practices, advanced threat detection systems, and collaboration with technologically advanced allies, are recommended alongside reactive measures like incident response planning and disaster recovery. The importance of international cooperation and information sharing is also emphasized. Case studies of cyber incidents involving less advanced adversaries, such as the attacks on Estonia, Georgia, and Ukraine, validate the framework and demonstrate its practical application. The findings indicate that the tailored threat modeling framework effectively addresses the unique challenges faced by less advanced adversaries, enhancing their ability to mitigate risks and improve their cybersecurity posture. This study provides valuable insights and offers a practical framework to bolster defenses against cyber warfare, with future research needed to explore emerging threats and technologies further.

ADAPT: Adaptive Camouflage Based Deception Orchestration For Trapping Advanced Persistent Threats

Honeypots serve as a valuable deception technology, enabling security teams to gain insights into the behaviour patterns of attackers and investigate cyber security breaches. However, traditional honeypots prove ineffective against advanced adversaries like APT groups due to their evasion tactics and awareness of typical honeypot solutions. This paper emphasises the need to capture these attackers for enhanced threat intelligence, detection, and protection. To address this, we propose the design and deployment of a customized honeypot network based on adaptive camouflaging techniques. Our work focuses on orchestrating a behavioral honeypot network tailored for three APT groups, with strategically positioned attack paths aligning with their Tactics, Techniques, and Procedures, covering all cyber kill chain phases. We introduce a novel approach, deploying a camouflaged chatterbox application within the honeypot network. This application offers a regular chat interface while periodically tracking attacker activity by enabling periodic log transfers. Deployed for 100 days, our orchestrated honeypot recorded 13,906,945 hits from 4,238 unique IP addresses. Our approach categorizes attackers, discerning varying levels of sophistication, and identifies attacks from Hong Kong with similarities to known Chinese threat groups. This research significantly advances honeypot technology and enhances the understanding of sophisticated threat actors’ strategies in real operating networks.

A Decentralized and Self-Adaptive Intrusion Detection Approach Using Continuous Learning and Blockchain Technology

The landscape of cyber threats is constantly in flux, which can cause traditional intrusion detection systems (IDS) to fall behind the rapid evolution of attacks. This can result in delayed detection and devastating consequences. The proposed system leverages continuous learning and self-adaptive neural networks to transcend the limitations of traditional IDS. It takes a proactive approach by continuously analyzing intrusion logs, using a Long Short-Term Memory (LSTM) core to identify emerging patterns and refine its understanding of threats in real time. This eliminates the static limitations of traditional models and encourages continuous improvement. The system's neural network is distributed across each block of the blockchain, creating a decentralized 'brain' that develops defenses against advanced adversaries. Secure enclaves are located within Trusted Execution Environments (TEEs), ensuring tamper-proof operation and reliable threat detection. The system's superior performance is demonstrated through rigorous evaluations of established datasets, such as NSL-KDD. The model demonstrates a high level of accuracy of 0.9994 with a minimal false positive rate of 0.06, indicating its ability to differentiate between legitimate network activity and malicious intrusions. Embracing continuous learning and a decentralized architecture creates a dynamic and resilient system that proactively adapts to the ever-changing threat landscape. This approach has several advantages over traditional solutions, including enhanced precision, increased security, and real-time adaptability.

Guest Editorial: Security of Communication Protocols in Industrial Control Systems (ICSs)

Over the past decade, the cyber security community has witnessed a trend in which advanced adversaries – such as nation-state actors and cybercriminal groups – are increasingly shifting their exploitation efforts from IT systems to OT and Industrial Control Systems (ICSs). This trend stems from the fact that a compromise of an ICS can have far greater consequences than that of a traditional IT system – potentially resulting not only in financial losses but also losses of human life and/or major environmental disasters.

Randomized Moving Target Approach for MAC-Layer Spoofing Detection and Prevention in IoT Systems

MAC-layer spoofing, also known as identity spoofing, is recognized as a serious problem in many practical wireless systems. IoT systems are particularly vulnerable to this type of attack as IoT devices (due to their various limitations) are often incapable of deploying advanced MAC-layer spoofing prevention and detection techniques, such as cryptographic authentication. Signal-level device fingerprinting is an approach to identity spoofing detection that is highly suitable for sensor-based IoT networks but can be also utilized in many other types of wireless systems. Previous research works on signal-level device fingerprinting have been based on rather simplistic assumptions about both the adversary’s behavior and the operation of the defense system. The goal of our work was to examine the effectiveness of a novel system that combines signal-level device fingerprinting with the principles of Randomized Moving Target Defense (RMTD) when dealing with a very advanced adversary. The obtained results show that our RMTD-enhanced signal-level device fingerprinting technique exhibits far superior defense performance over the non-RMTD techniques previously discussed in the literature and, as such, could be of great value for practical wireless systems subjected to identity spoofing attacks. We have also introduced a novel proof-of-concept adaptive parameter tuning approach for system practitioners with the ability to encode their risk profile and compute the most efficient hyper-parameters of our proposed defense system.

BTH: Behavior-Based Structured Threat Hunting Framework to Analyze and Detect Advanced Adversaries

Organizations of every size and industry are facing a new normal. Adversaries have become more sophisticated and persistent than ever before. Every network is facing never-ending onslaughts. Yet many organizations continue to rely on signature-based reactive threat detection and mitigation solutions as the primary line of defense against new-age, cutting-edge attacks. Even conventional attacks can bypass such security solutions. This means legacy protection solutions leave the organization’s data vulnerable to damage, destruction, and theft. Adversarial attacks are like ocean waves: they are very persistent and keep coming like attack campaigns. Sometimes the waves, in our case, attacks, look the same, where indicators of compromise (IoCs) effectively detect the attacks, while sometimes, the waves or attacks change and continue to look different, especially over a while. If somehow the defenders can recognize what is making those attacks or waves and the conditions, then detecting threats and attacks can have a longer-lasting effect of success. This study focuses on the behavior and habits of the attackers that can provide better and long-lasting results when matching adversarial profiles instead of using just IoCs. The paper presents a unique framework for behavior-based structured threat hunting to deliver rapid, consistent remediation against emerging threats and malware on systems and networks.

A Provable Secure Session Key Distribution Protocol Based on NSSK for In-Vehicle CAN Network

Many CAN-based session key sharing approaches are based on the group key scheme, which can easily lead advanced adversaries to infiltrate all ECUs (electronic control units) in the network if the sharing key is leaked. To address the above problem, we propose a provable secure session key distribution protocol based on the improved NSSK (Needham–Schroeder shared key) protocol for the in-vehicle CAN network. We applied the mechanisms of message authentication and digital signature to fix the defects of the original NSSK regarding its lack of resistance to the Denning–Sacco attack. Then, we analyzed the provable security of the proposed protocol on the random oracle model and verified the security goals of the protocol by using the simulation tools AVISPA and Tamarin Prover; the results reflect that the protocol met the security requirements for key distribution such as session key secrecy, injective agreement, and known key secrecy. Finally, we compared our new protocol with other key distribution protocols in CAN bus communication to evaluate the performance of the new protocol in actual scenarios. The result shows that the protocol is secure against many payload-based attacks and is practical for in-vehicle CAN networks.

Rethinking the adversary and operational characteristics of deniable storage

Aim: With the widespread adoption of disk encryption technologies, it has become common for adversaries to employ coercive tactics to force users to surrender encryption keys. For some users, this creates a need for hidden volumes that provide plausible deniability, the ability to deny the existence of sensitive information. Previous deniable storage solutions only offer pieces of an implementable solution that do not take into account more advanced adversaries, such as intelligence agencies, and operational concerns. Specifically, they do not address an adversary that is familiar with the design characteristics of any deniable system. Methods: We evaluated existing threat models and deniable storage system designs to produce a new, stronger threat model and identified design characteristics necessary in a plausibly deniable storage system. To better explore the implications of this stronger adversary, we developed Artifice, the first tunable, operationally secure, self repairing, and fully deniable storage system. Results: With Artifice, hidden data blocks are split with an information dispersal algorithm such as Shamir Secret Sharing to produce a set of obfuscated carrier blocks that are indistinguishable from other pseudorandom blocks on the disk. The blocks are then stored in unallocated space of an existing file system. The erasure correcting capabilities of an information dispersal algorithm allow Artifice to self repair damage caused by writes to the public file system. Unlike preceding systems, Artifice addresses problems regarding flash storage devices and multiple snapshot attacks through simple block allocation schemes and operational security measures. To hide the user’s ability to run a deniable system and prevent information leakage, a user accesses Artifice through a separate OS stored on an external Linux live disk. Conclusion: In this paper, we present a stronger adversary model and show that our proposed design addresses the primary weaknesses of existing approaches to deniable storage under this stronger assumed adversary.

The Development of the Lithuanian Armed Forces and Its Response to the Russian Conventional Threats in 2015‒2020

In a period of 2015-2020, Lithuanian Armed Forces (LAF) military spending increased twice, thus it enabled to initiate and to arrange significant critical projects that eventually allowed armed forces to upgrade military equipment and tactics. New artillery units, armoured personnel vehicles, air defence systems, anti-tank weapons, radars, anti-drone systems boosted military power of LAF. Tactics switched from anti green men to conventional tactics, where fire and manoeuvre dominates again. Meanwhile, in the same period of time in Kaliningrad the Russian armed forces boosted the number of military personnel, upgraded equipment (most of it to offensive one) and increased military exercises. In order to be prepared, LAF must look for the most efficient ways of defence towards a potential foe. In a near future LAF must decentralize a central military storage thus critical assets could be secured and used by battalions at any time. Moreover, LAF capabilities could be improved by cyber conscripts and non-conventional tactics which could bring extra dividends when a small state fights against technologically advanced adversary. Eventually, with an additional military spending LAF could obtain MLRS artillery, the coastal defence systems and unmanned combat aerial vehicles that could deal with enemy from a safer distance.

To Compete or Retreat? The Global Diffusion of Precision Strike

After the publicized use of precision strike weapons in the First Gulf War, analysts predicted that they would spread rapidly around the world. In fact, it has happened much slower than predicted. To explain this puzzle, this paper draws on a novel dataset tracking country-level acquisition of eight aspects of the precision strike complex from 1989 to 2017. The results show that supply-side factors—like a state’s technological capacity and defense relationships with key exporters—significantly affect the likelihood of states developing advanced precision strike capabilities. Demand-side factors like interstate security threats also play an important role, but not in the way traditionally theorized. We find an inverted-U relationship between security threats and proliferation. When states have rivals or neighbors with moderate precision strike capabilities, they have security incentives to compete with them. However, when states face highly advanced adversaries, they have a tougher time competing, and thus have incentives to shift resources to other defense strategies.

Щодо визначення концепції побудови системи озброєння для потреб Збройних Сил України

Створення основних зразків озброєння повинно відбуватися у рамках концепції побудови системи озброєння для потреб Збройних Сил України, яка враховує економічні, воєнно-політичні та природно-географічні умови України.На сьогодні вона може бути сформульована таким чином: «Система озброєння ЗС України повинна бути орієнтована на захист території держави від економічно значно переважаючого противника». На жаль, реалізація концепції в такому формулюванні потребує відмови від завищених амбіцій, що є дуже важким не тільки для старшого, але і для великої частини середнього покоління. Однак, це дозволить перейти від створення одиничних високовартісних зразків до масового виробництва більш дешевих зразків.Основними її принципами повинні стати:1. Асиметричний підхід до визначення пріоритетів розвитку ОВТ шляхом створення не аналогів, а зразків, що здатні їм протидіяти або унеможливлювати їх функціонування.2. Максимальне застосування у зразках ОВТ цивільних комплектуючих.3. Проведення операцій технічного обслуговування та ремонту постачальниками комплектуючих та перенесення ремонтного фонду на їх базу (відмова від складування запасних частин).4. Диверсифікація постачальників комплектуючих за умови повної поблочної уніфікації.5. Принцип гарантованого забезпечення 100% штатної потреби.Розробка нових зразків озброєння у рамках запропонованої концепції дозволить вирішити, наприклад, проблему підвищення балістичного захисту легко- та важкоброньованої техніки.Показано, що проблема підвищення рівня балістичного захисту бойових броньованих машин виникає через відсутність концептуального підходу до їх бойового застосування, котрий має базуватися на розумінні асиметричності війни з існуючим противником.Зазначено, що усі елементи бойової машини повинні функціонувати як система захисту особового складу (екіпажу) і озброєння в залежності від призначення зразка. Водночас, існуючий підхід має за мету забезпечити збереження усіх елементів зразка шляхом розташування їх в заброньовому просторі, що збільшує його об’єм і не дає змоги збільшити його товщину, через значне зростання маси. Це, у свою чергу, призводить до необхідності застосування легкосплавних, керамічних броньових матеріалів та їх комбінацій незважаючи на те, що їх ціна переважає вартість сталевої броні у десятки разів.

Nation-state attacks: practical defences against advanced adversaries

Many of the biggest stories in information security over the past few years have involved suspected nation-state actors compromising individuals and organisations, large and small, to advance state agendas. Most of these entities probably had no idea they were being targeted by nation-state actors at the time of being compromised.

Enhancing Privacy of Information Brokering in Smart Districts by Adaptive Pseudonymization

District-wide real-time information sharing provides new opportunities to optimize infrastructures and, for example, the energy consumption of smart cities. However, information collection introduces new privacy threats that must be addressed. Existing anonymization solutions are not sufficient for the brokering of streaming real-time measurements. Advanced adversaries may utilize information available from different sources and correlation analyses to reveal a measurement’s actual source. We analyze security and privacy requirements and design a privacy-enhancing architecture for an information brokering platform. We propose an adaptive pseudonymization framework to make privacy attacks harder and to gain real-time awareness of the robustness of the privacy protection of platforms. Finally, we present an initial evaluation of the proposal using real-world energy consumption measurements.

A current look at geophysical detection of illicit tunnels

Clandestine tunnels continue to pose an invisible threat to secure facilities and national borders despite decades of work and resources expended by multiple governments. Tunnels are a low-tech solution to a more formidable and advanced adversary, requiring little more than time, patience, and manpower. If there is one thing that has been learned through previous work, it is that finding tunnels is a difficult and complex problem that does not have a simple solution. There is no “silver bullet” that will work in all geologic and cultural settings with a 100% success rate and a 0% false-positive rate. Despite the challenges, notable progress has been made in recent years through advancements that use near-surface seismic methods to detect tunnels.

Identifying Emerging Hybrid Adversaries

Hybrid threats represent a very real security challenge for United States military in coming decades. They combine strengths of an irregular fighting force with various capabilities of an advanced state military, and will play an increasingly prominent role in international security issues. What are attributes of a true hybrid threat, how do they function, and how can they be countered before they even emerge? Much of existing literature dealing with hybrid threats focuses on and they are, both in present day and in past. What is needed is a methodological attempt to identify where, and in what capacity, these organizations will emerge over coming decades. This article describes a methodology to more readily identify an emerging hybrid adversary. The methodology examines current understanding of hybrid threats and their capabilities, and identification of three necessary core variables of a hybrid threat organization: maturity, capability, and complex terrain. The sweet spot where these variables overlap is point of maximum tactical, operational, and strategic effectiveness for a hybrid threat. By superimposing these three variables on a possible threat, we can gauge that organization's potential to develop into a true, mature hybrid adversary. We also see exact circumstances that would enable this development, and can consider how to assist or impede that development. Understanding Hybrid Threats There is no consensus definition of hybrid threats--in open press or military lexicon. They are defined in US Army's Training Circular 7-100 as the diverse and dynamic combination of regular forces, irregular forces, and/or criminal elements all unified to achieve mutually benefitting effects. (1) Authors Frank Hoffman, Nathan Freier, John McCuen, and Helmut Habermayer proposed similar definitions for this type of organization. Their definitions of a hybrid threat include ability to engage effectively in multiple forms of war, simultaneously. (2) William Nemeth also compellingly discusses hybrid adversaries and hybrid warfare, demonstrating how armed groups from less-developed societies tend to incorporate more advanced adversaries' technologies and tactics in new ways that are more effective than originally intended. (3) The pitfall for numerous studies related to hybrid threats and hybrid warfare is that they set aperture too wide in identifying who and what a hybrid threat is. It is only natural that every armed force will use any and every means available to it. In many instances, armed force may employ a variety of capabilities while achieving little actual effect from any number of them. For example, an insurgent group may launch cyberattacks, engage in acts of terrorism, or take part in organized criminal activities. This only means they are similar to virtually every other modern insurgent group. Everyone engaged in armed conflict will attempt to conduct cyberattacks, irregular warfare, information warfare, innovative use of off-the-shelf technology, and other spectacular attacks to maximum extent possible. One needs to be cautious in simply defining a hybrid adversary as any that engages in multiple forms of warfare, because this can include just about every type of organization from criminal gangs like MS-13 to German Wehrmacht. If everybody is a hybrid, then nobody is. The true hybrid mix of advanced military capabilities and organizational maturity is normally not commonplace among armed groups around world, nor is it easily attained. Consequently, it is important to understand if we can predict how and when an armed group becomes a fully developed hybrid adversary. A fully developed hybrid adversary will be able to transition between irregular or guerilla war, and highly conventional warfare in company- or larger-sized formations at will. Specifically, as RAND researcher David Johnson writes, a true hybrid adversary will be able to engage opposing military forces effectively at a distance, and force them to fight through an extended engagement area to get into close fight. …

Potenciální rizika evropského procesu kontroly zbrojení v kontextu rusko-gruzínského konfliktu

The paper addresses the risks and consequences of the suspension of the Russian Federation's commitments stemming from the Treaty on Conventional Armed Forces in Europe (CFE) on the process of arms control and the European security environment. It deals with the security dilemma and securitisation in general as well as with the assertive posture of Russia in the post-Soviet region, reminded through the Russian - Georgian conflict in August 2008. The role of the CFE Treaty as the cornerstone of the European security is elaborated as well as its importance for NATO. The paper deals with the negative consequences of the Russian suspension on the future of the CFE regime and European security environment. There are options suggested for eliminating the malicious consequences through promoting co-operation and confidence building between NATO and Russia, currently at freezing point, the worst state since the end of the Cold War. Should the benign measures fail to deliver, with the geopolitics back, adequate military capabilities to counter advanced adversary might be considered.