Adversarial Behavior Research Articles

False Data Injection Attacks on Reinforcement Learning-Based Charging Coordination in Smart Grids and a Countermeasure

Reinforcement learning (RL) is proven effective in optimizing home battery charging coordination within smart grids. However, its vulnerability to adversarial behavior poses a significant challenge to the security and fairness of the charging process. In this study, we, first, craft five stealthy false data injection (FDI) attacks that under-report the state-of-charge (SoC) values to deceive the RL agent into prioritizing their charging requests, and then, we investigate the impact of these attacks on the charging coordination system. Our evaluations demonstrate that attackers can increase their chances of charging compared to honest consumers. As a result, honest consumers experience reduced charging levels for their batteries, leading to a degradation in the system’s performance in terms of fairness, consumer satisfaction, and overall reward. These negative effects become more severe as the amount of power allocated for charging decreases and as the number of attackers in the system increases. Since the total available power for charging is limited, some honest consumers with genuinely low SoC values are not selected, creating a significant disparity in battery charging levels between honest and malicious consumers. To counter this serious threat, we develop a deep learning-based FDI attack detector and evaluated it using a real-world dataset. Our experiments show that our detector can identify malicious consumers with high accuracy and low false alarm rates, effectively protecting the RL-based charging coordination system from FDI attacks and mitigating the negative impacts of these attacks.

A resilient consensus algorithm with inputs for the distributed monitoringof cyber-physical systems

Recent advancements in multi-agent systems (MASs) have led to the development of numerous algorithms for achieving specific objectives, such as consensus. However, security remains a major challenge in MAS consensus, particularly addressing the adversarial behavior of malicious agents. This paper explores the extension of Mean-Subsequence-Reduced (MSR) algorithm-type mechanisms for resilient dynamic consensus in the presence of input reference signals. We provide necessary and sufficient conditions for resilient dynamic consensus without relying on the presence of trusted agents. Additionally, we experimentally validate the proposed algorithm and related conditions over a small cyber–physical system used for temperature monitoring. Furthermore, we propose and experimentally validate a fault-detection and recovery algorithm to achieve a resilient dynamic average consensus of regular agents.

A blind flow fingerprinting and correlation method against disturbed anonymous traffic based on pattern reconstruction

Tor is the most widely used anonymous communication system at present which can anonymize users’ network behavior. At the same time, many illegal network activities also appear more frequently with the help of Tor, posing serious challenges for cyberspace security. Therefore, flow fingerprinting and flow correlation analysis methods are put forward to de-anonymize the malicious anonymous behaviors, which utilize external traffic features as the side-channel information. However, the adversary often reduces the ability of above two methods by adding the disturbance to the anonymous traffic. As a countermeasure against the interference, disturbance-resistant analysis methods can effectively identify those adversarial behaviors while knowing how the traffic is modified. However, in real scenarios, it is unrealistic to distinguish between disturbed and non-disturbed anonymous traffic, let alone to have a clear grasp of the disturbing strategy. In this paper, we propose a blind anonymous traffic analysis method called Blind Analyzer based on pattern reconstruction skills in a “masking-generation” manner. Specifically, Blind Analyzer extracts the pattern knowledge from non-disturbed traffic samples by masking and reconstructing them. During the method application, disturbed anonymous traces are processed following the same way, aiming at removing the incremental noise at the masking stage and restoring the original shape at the reconstruction stage. Besides, a conditional discriminator is designed to determine whether the generated sample has obvious class characteristics. Benefited from the proposed method, we can improve the effectiveness of the anonymous network behavior analysis since the disturbed traffic can be restored as normal ones accurately enough. Experiment results on three datasets show that reconstructed traffic samples output by Blind Analyzer are more useful for base analysis models, which improve the corresponding metric values by 11.23% and 6.61% in max for flow fingerprinting and correlation tasks, respectively.

Intelligent Threat Detection—AI-Driven Analysis of Honeypot Data to Counter Cyber Threats

Security adversaries are rampant on the Internet, constantly seeking vulnerabilities to exploit. The sheer proliferation of these sophisticated threats necessitates innovative and swift defensive measures to protect the vulnerable infrastructure. Tools such as honeypots effectively determine adversary behavior and safeguard critical organizational systems. However, it takes a significant amount of time to analyze these attacks on the honeypots, and by the time actionable intelligence is gathered from the attacker’s tactics, techniques, and procedures (TTPs), it is often too late to prevent potential damage to the organization’s critical systems. This paper contributes to the advancement of cybersecurity practices by presenting a cutting-edge methodology, capitalizing on the synergy between artificial intelligence and threat analysis to combat evolving cyber threats. The current research articulates a novel strategy, outlining a method to analyze large volumes of attacker data from honeypots utilizing large language models (LLMs) to assimilate TTPs and apply this knowledge to identify real-time anomalies in regular user activity. The effectiveness of this model is tested in real-world scenarios, demonstrating a notable reduction in response time for detecting malicious activities in critical infrastructure. Moreover, we delve into the proposed framework’s practical implementation considerations and scalability, underscoring its adaptability in diverse organizational contexts.

Adversarial Socialbots Modeling Based on Structural Information Principles

The importance of effective detection is underscored by the fact that socialbots imitate human behavior to propagate misinformation, leading to an ongoing competition between socialbots and detectors. Despite the rapid advancement of reactive detectors, the exploration of adversarial socialbot modeling remains incomplete, significantly hindering the development of proactive detectors. To address this issue, we propose a mathematical Structural Information principles-based Adversarial Socialbots Modeling framework, namely SIASM, to enable more accurate and effective modeling of adversarial behaviors. First, a heterogeneous graph is presented to integrate various users and rich activities in the original social network and measure its dynamic uncertainty as structural entropy. By minimizing the high-dimensional structural entropy, a hierarchical community structure of the social network is generated and referred to as the optimal encoding tree. Secondly, a novel method is designed to quantify influence by utilizing the assigned structural entropy, which helps reduce the computational cost of SIASM by filtering out uninfluential users. Besides, a new conditional structural entropy is defined between the socialbot and other users to guide the follower selection for network influence maximization. Extensive and comparative experiments on both homogeneous and heterogeneous social networks demonstrate that, compared with state-of-the-art baselines, the proposed SIASM framework yields substantial performance improvements in terms of network influence (up to 16.32%) and sustainable stealthiness (up to 16.29%) when evaluated against a robust detector with 90% accuracy.

Detection and isolation of wormhole nodes in wireless ad hoc networks based on post-wormhole actions

The wormhole attack is one of the most treacherous attacks projected at the routing layer that can bypass cryptographic measures and derail the entire communication network. It is too difficult to prevent a priori; all the possible countermeasures are either too expensive or ineffective. Indeed, literature solutions either require expensive hardware (typically UWB or secure GPS transceivers) or pose specific constraints to the adversarial behavior (doing or not doing a suspicious action). The proposed solution belongs to the second category because the adversary is assumed to have done one or more known suspicious actions. In this solution, we adopt a heuristic approach to detect wormholes in ad hoc networks based on the detection of their illicit behaviors. Wormhole and post wormhole attacks are often confused in literature; that’s why we clearly state that our methodology does not provide a defence against wormholes, but rather against the actions that an adversary does after the wormhole, such as packet dropping, tampering with TTL, replaying and looping, etc. In terms of contributions, the proposed solution addresses the knock-out capability of attackers that is less targeted by the researcher’s community. In addition, it neither requires any additional hardware nor a change in it; instead, it is compatible with the existing network stack. The idea is simulated in ns2.30, and the average detection rate of the proposed solution is found to be 98-99%. The theoretical time to detect a wormhole node lies between 0.07-0.71 seconds. But, from the simulation, the average detection and isolation time is 0.67 seconds. In term of packet loss, the proposed solution has a relatively overhead of ≈\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\approx$$\\end{document} 22%. It works well in static and mobile scenarios, but the frame losses are higher in mobile scenarios as compared to static ones. The computational complexity of the solution is O(n). Simulation results advocate that the solution is effective in terms of memory, processing, bandwidth, and energy cost. The solution is validated using statistical parameters such as Accuracy, Precision, F1-Score and Matthews correlation coefficient (Mcc\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$M_{cc}$$\\end{document}).

Differential Game-Based Deep Reinforcement Learning in Underwater Target Hunting Task.

To meet requirements for real-time trajectory scheduling and distributed coordination, underwater target hunting task is challenging in terms of turbulent ocean environments and dynamic adversarial environment. Despite the existing research in game-based target hunting area, few approaches have considered dynamic environmental factors, such as sea currents, winds, and communication delay. In this article, we focus on a target hunting system consisted of multiple unmanned underwater vehicles (UUVs) and a target with high maneuverability. Besides, differential game theory is leveraged to analyze adversarial behaviors between hunters and the escapee. However, it is intractable that UUVs have to deploy an adaptive scheme to guarantee the consistency and avoid the escape of the target without collision. Therefore, we conceive the Hamiltonian function with Leibniz's formula to obtain feedback control policies. In addition, it proves that the target hunting system is asymptotically stable in the mean, and the system can satisfy Nash equilibrium relying on the proposed control policies. Furthermore, we design a modified multiagent reinforcement learning (MARL) to facilitate the underwater target hunting task under the constraints of energetic flows and acoustic propagation delay. Simulation results show that the proposed scheme is superior to the typical MARL algorithm in terms of reward and success rate.

‘A guide for measuring resiliency and resistance’

ABSTRACT This essay addresses the critical need to apply a more advanced human-centric model in assessing current levels of governmental and societal resilience and resistance to subversion and coercion, as well as internal and/or external aggression. It proposes a method of analysis and assessment of the will, potential, and sustainability for national and/or sub-national resilience, as well as the potential for resistance to malign indigenous governance or external aggression. Finally, it examines, from a prospective external supporter’s perspective, the likely success of support to a partner’s resiliency or the potential to enable resistance to inspire change in adversary behaviors.

Algorithmic Complexity Attacks on Dynamic Learned Indexes

Learned Index Structures (LIS) view a sorted index as a model that learns the data distribution, takes a data element key as input, and outputs the predicted position of the key. The original LIS can only handle lookup operations with no support for updates, rendering it impractical to use for typical workloads. To address this limitation, recent studies have focused on designing efficient dynamic learned indexes. ALEX, as the first and one of the representative dynamic learned index structures, enables dynamism by incorporating a series of design choices, including adaptive key space partitioning, dynamic model retraining, and sophisticated engineering and policies that prioritize read/write performance. While these design choices offer improved average-case performance, the emphasis on flexibility and performance increases the attack surface by allowing adversarial behaviors that maximize ALEX's memory space and time complexity in worst-case scenarios. In this work, we present the first systematic investigation of algorithmic complexity attacks (ACAs) targeting the worst-case scenarios of ALEX. We introduce new ACAs that fall into two categories, space ACAs and time ACAs, which target the memory space and time complexity, respectively. First, our space ACA on data nodes exploits ALEX's gapped array layout and uses Multiple-Choice Knapsack (MCK) to generate an optimal adversarial insertion plan for maximizing the memory consumption at the data node level. Second, our space ACA on internal nodes exploits ALEX's catastrophic cost mitigation mechanism, causing an out-of-memory (OOM) error with only a few hundred adversarial insertions. Third, our time ACA generates pathological insertions to increase the disparity between the actual key distribution and the linear models of data nodes, deteriorating the runtime performance by up to 1, 641× compared to ALEX operating under legitimate workloads.

Backdoor attack and defense in federated generative adversarial network-based medical image synthesis.

Deep Learning-based image synthesis techniques have been applied in healthcare research for generating medical images to support open research and augment medical datasets. Training generative adversarial neural networks (GANs) usually require large amounts of training data. Federated learning (FL) provides a way of training a central model using distributed data while keeping raw data locally. However, given that the FL server cannot access the raw data, it is vulnerable to backdoor attacks, an adversarial by poisoning training data. Most backdoor attack strategies focus on classification models and centralized domains. It is still an open question if the existing backdoor attacks can affect GAN training and, if so, how to defend against the attack in the FL setting. In this work, we investigate the overlooked issue of backdoor attacks in federated GANs (FedGANs). The success of this attack is subsequently determined to be the result of some local discriminators overfitting the poisoned data and corrupting the local GAN equilibrium, which then further contaminates other clients when averaging the generator's parameters and yields high generator loss. Therefore, we proposed FedDetect, an efficient and effective way of defending against the backdoor attack in the FL setting, which allows the server to detect the client's adversarial behavior based on their losses and block the malicious clients. Our extensive experiments on two medical datasets with different modalities demonstrate the backdoor attack on FedGANs can result in synthetic images with low fidelity. After detecting and suppressing the detected malicious clients using the proposed defense strategy, we show that FedGANs can synthesize high-quality medical datasets (with labels) for data augmentation to improve classification models' performance.

Securing blockchain-based timed data release against adversarial attacks1

Timed data release refers to protecting sensitive data that can be accessed only after a pre-determined amount of time has passed. While blockchain-based solutions for timed data release provide a promising approach for decentralizing the process, designing an attack-resilient timed-release service that is resilient to malicious adversaries in a blockchain network is inherently challenging. A timed-release service on a blockchain network is inevitably exposed to the risk of post-facto attacks where adversaries may launch attacks after the data is released in the blockchain network. Existing incentive-based solutions for timed data release in Ethereum blockchains guarantee protection under the assumption of a fully rational adversarial environment in which every peer acts rationally. However, these schemes fail invariably when even a single participating peer node in the protocol starts acting maliciously and deviates from the rational behavior. In this paper, we propose a systematic solution for attack-resilient and practical blockchain-based timed data release in a mixed adversarial environment, where both malicious adversaries and rational adversaries exist. We first propose an effective uncertainty-aware reputation measure to capture the behaviors of the peer involved in timed data release activities in the network. In light of such a measure, we present the design of a basic protocol that consists of two critical ingredients, namely reputation-aware peer recruitment and verifiable enforcement protocols. The former, prior to the start of the enforcement protocols, performs peer recruitment based on the reputation measure to make the design probabilistically attack-resilient to the post-facto attacks. The latter is responsible for contractually guarding the recruited peers at runtime by transparently reporting observed adversarial behaviors. However, the basic recruitment design is only aware of the reputation of the peers and it does not consider the working time schedule of the participating peers and as a result, it results in lower attack-resilience. To enhance the attack resilience further without impacting the verifiable enforcement protocols, we propose a temporal graph-based reputation-aware peer recruitment algorithm that carefully determines the peer recruitment plan to make the service more attack-resilient. In our proposed approach, we formally capture the timed data release service as a temporal graph and we develop a novel maximal attack-resilient path-finding algorithm on the temporal graph for the participating peers. We implement a prototype of the proposed approach using Smart Contracts and deploy it on the Ethereum official test network, Rinkeby. For extensively evaluating the proposed techniques, we perform simulation experiments to validate the effectiveness of the reputation-aware timed data release protocols as well as our proposed temporal-graph-based improvements. The results demonstrate the effectiveness and strong attack resilience of the proposed mechanisms and our approach incurs only a modest gas cost.

Magnets to Adversaries—An Analysis of the Attacks on Public Cloud Servers

Security adversaries are always constantly looking for targets to exploit. The mechanism of exploitation used by security adversaries varies significantly. Many focus on easy compromises as mere pivots to extend their attacks from these exploited systems to continue accomplishing their original goals. The cloud environment is a highly susceptible target for adversaries and provides a solid mechanism for observing adversary behavior. The sheer volume of attacks on the cloud provides insights into the attacker’s objectives and attack patterns, which can be leveraged for protecting infrastructure. This work deep dives into the practices used by adversaries on the commonly exposed protocols in the Amazon Web Services (AWS), Microsoft Azure (Azure), Google Cloud Platform (GCP), and Oracle Cloud Infrastructure (OCI) platforms. A robust honeypot model is documented that compares attacker behavior across various ports and protocols running in multiple cloud environments. This work illustrates that adversary activity is highly versatile in the public cloud environment, with an average of 700 new and unique IP addresses found attacking honeypot infrastructure daily. Further, this article illustrates the security safeguards a typical organization can leverage to mitigate the threats from these adversaries constantly probing insecure targets on the cloud platform.

Fake news detection using machine learning: an adversarial collaboration approach

PurposePurveyors of fake news perpetuate information that can harm society, including businesses. Social media's reach quickly amplifies distortions of fake news. Research has not yet fully explored the mechanisms of such adversarial behavior or the adversarial techniques of machine learning that might be deployed to detect fake news. Debiasing techniques are also explored to combat against the generation of fake news using adversarial data. The purpose of this paper is to present the challenges and opportunities in fake news detection.Design/methodology/approachFirst, this paper provides an overview of adversarial behaviors and current machine learning techniques. Next, it describes the use of long short-term memory (LSTM) to identify fake news in a corpus of articles. Finally, it presents the novel adversarial behavior approach to protect targeted business datasets from attacks.FindingsThis research highlights the need for a corpus of fake news that can be used to evaluate classification methods. Adversarial debiasing using IBM's Artificial Intelligence Fairness 360 (AIF360) toolkit can improve the disparate impact of unfavorable characteristics of a dataset. Debiasing also demonstrates significant potential to reduce fake news generation based on the inherent bias in the data. These findings provide avenues for further research on adversarial collaboration and robust information systems.Originality/valueAdversarial debiasing of datasets demonstrates that by reducing bias related to protected attributes, such as sex, race and age, businesses can reduce the potential of exploitation to generate fake news through adversarial data.

A Security Resilience Metric Framework Based on the Evolution of Attack and Defense Scenarios

The frequent attacks show that no information system is absolutely safe and the security capabilities are relative. Security resilience becomes a complementary priority for improving information systems’ continuous service and security capabilities in the face of attacks such as unknown vulnerabilities and backdoors. Endogenous security defense technology has become an important research aspect to improve the security resilience of information systems. However, there are some limitations in the research of the information system security resilience evaluation model, such as lacking indexes to characterize the system security resilience under an attack environment. In this paper, a security resilience enhancement strategy based on dynamic defense is constructed to improve the security performance of the system through IP port hopping and attack surface conversion. For the adversarial behaviors of attackers and defenders, we propose a security resilience metric framework based on the evolution of attack and defense scenarios, which is evaluated using a resilient security evaluation model based on the fuzzy Choquet integral. In the model, the weights of evaluation indicators are calculated based on the DEMATEL method. The 2-addable fuzzy measures of each indicator are calculated secondarily. Then the security performance of the system is calculated using the fuzzy Choquet integral. Absorptive capacity, adaptive capacity, and resilience factor are proposed to better supervise the metric framework’s validity. Finally, four groups of control cases were created by building the Web service system after the endogenous security transformation as the experimental simulation scenario. Experimental simulation results show the superiority of the proposed metric model.

SpearSim-V2: Synthetic Task Environment for Evaluating Attacker Behaviors

Despite extensive research on phishing, a severe lack of work centered on attackers has resulted in a limited understanding of the adversarial behaviors conducive to attack success and failures. This work describes a novel method for conducting controlled laboratory studies of cognitive vulnerabilities that attackers experience during the design and execution phases of spear-phishing attacks. Based on the SpearSim platform, the new simulation environment integrates cognitive agents that model and predict end-user responses to spear-phishing attacks. This advancement to SpearSim allows the generation of real-time, automated, “human-like” responses to simulated spear-phishing attacks. This enables the execution of experiments focused on attackers and attacker behaviors. We describe the proposed simulation framework, provide details about the implemented simulation environment, and present results to evaluate the performance of the simulation environment. Compared to the earlier version of SpearSim involving human end-users, the new approach generates responses at a much faster rate (3 times faster than human end-users) and importantly with less variance in the time to respond. The cognitive agents used in the simulation predicted human responses to phishing and spear-phishing attackers with moderate accuracy (about 60%). Our proposed method intends to provide an effective and robust way to conduct laboratory experiments on spear-phishing attacks and further understand attackers' decision-making processes that could be exploited to thwart future attacks.

Enemy at the Gates: A Strategic Cultural Analysis of Russian Approaches to Conflict in the Information Domain

When studying the strategic behavior of a foreign adversary, the act of mirror imaging one’s own conceptual frames often risks producing inaccurate assessments. To avoid such outcomes, some scholars promote the study of strategic culture as a framework for generating more empathetic analyses of foreign state decision-making. This article maintains that strategic cultural approaches are particularly useful for conceptualizing contemporary Russian understandings of confrontation in the information domain. To this end, it is argued that while contemporary Russian thinkers view information as a crucial asset in their country’s ongoing “struggle” with the West, Moscow’s use of informational nonmilitary means remains ultimately a critical, albeit subordinate element of a broader multidomain coercive strategy.

Enhancing Microsoft 365 Security: Integrating Digital Forensics Analysis to Detect and Mitigate Adversarial Behavior Patterns

This research article investigates the effectiveness of digital forensics analysis (DFA) techniques in identifying patterns and trends in malicious failed login attempts linked to public data breaches or compromised email addresses in Microsoft 365 (M365) environments. Pattern recognition techniques are employed to analyze security logs, revealing insights into negative behavior patterns. The findings contribute to the literature on digital forensics, opposing behavior patterns, and cloud-based cybersecurity. Practical implications include the development of targeted defense strategies and the prioritization of prevalent threats. Future research should expand the scope to other cloud services and platforms, capture evolving trends through more prolonged and extended analysis periods, and assess the effectiveness of specific mitigation strategies for identified tactics, techniques, and procedures (TTPs).

A threat‐intelligence driven methodology to incorporate uncertainty in cyber risk analysis and enhance decision‐making

AbstractThe challenge of decision‐making under uncertainty in information security has become increasingly important, given the unpredictable probabilities and effects of events in the ever‐changing cyber threat landscape. Cyber threat intelligence provides decision‐makers with the necessary information and context to understand and anticipate potential threats, reducing uncertainty, and improving the accuracy of risk analysis. The latter is a principal element of evidence‐based decision‐making, and it is essential to recognize that addressing uncertainty requires a new, threat‐intelligence (TI) driven methodology, and risk analysis approach. We propose a solution to this challenge by introducing a TI‐based security assessment methodology and a decision‐making strategy that considers both known unknowns and unknown unknowns. The proposed methodology aims to enhance the quality of decision‐making by utilizing causal graphs, which offer an alternative to conventional methodologies that rely on attack trees, resulting in a reduction of uncertainty. Furthermore, we consider tactics, techniques, and procedures that are possible, probable, and plausible, improving the predictability of adversary behavior. Our proposed solution provides practical guidance for information security leaders to make informed decisions in uncertain situations. This paper offers a new perspective on addressing the challenge of decision‐making under uncertainty in information security by introducing a methodology that can help decision‐makers navigate the intricacies of the dynamic and continuously evolving landscape of cyber threats.

Know Your Enemy: Identifying Adversarial Behaviours in Deep Reinforcement Learning Agents (Student Abstract)

It has been shown that an agent can be trained with an adversarial policy which achieves high degrees of success against a state-of-the-art DRL victim despite taking unintuitive actions. This prompts the question: is this adversarial behaviour detectable through the observations of the victim alone? We find that widely used classification methods such as random forests are only able to achieve a maximum of ≈71% test set accuracy when classifying an agent for a single timestep. However, when the classifier inputs are treated as time-series data, test set classification accuracy is increased significantly to ≈98%. This is true for both classification of episodes as a whole, and for “live” classification at each timestep in an episode. These classifications can then be used to “react” to incoming attacks and increase the overall win rate against Adversarial opponents by approximately 17%. Classification of the victim’s own internal activations in response to the adversary is shown to achieve similarly impressive accuracy while also offering advantages like increased transferability to other domains.

Students’ Application of the MITRE ATT&CK® Framework via a real-time Cybersecurity Exercise

The MITRE ATT&CK framework enables practitioners to understand and track cyber adversary behaviors. Concepts such as social engineering (SE) are not directly captured in current version of ATT&CK as an individual technique, though the application of SE is relevant to many technical behaviors. Utilizing the ATT&CK framework in an educational setting, specifically within a competition focused on SE, allows students to explore adversarial behavior through experiential learning and understand how SE is relevant within cybersecurity. The structure of the framework allows students to see and describe each behavior from the perspective of the adversary, motivating them to compile and question “why” and “how” each individual action contributes to the operational objectives. This paper shares students’ mappings of the ATT&CK framework to playbooks they developed during a real-time SE penetration testing competition. Students were given numerous flags to pursue during the competition and this paper will share their playbooks and mappings to the ATT&CK framework. This paper demonstrates that while someone with more knowledge and experience using the framework may map a SE case study differently than multidisciplinary students who are experiencing it for the first time, there is not a single correct way to map onto the matrix. Having students experience this mapping process allows them to understand the breakdown of an adversary’s behavior and interpret key tactics and techniques in a way that fits their mapping needs. This paper also demonstrates how a SE case study can be mapped onto the ATT&CK framework despite SE not being the focus of the framework, and that SE uses tactics and techniques that are also relevant to technical cyberattacks. The authors hope to encourage more interdisciplinary cybersecurity education by sharing this experiential learning event.