Adversarial Behavior Research Articles

Reconnaissance Techniques and Industrial Control System Tactics Knowledge Graph

In the initial stages of industrial control system (ICS) penetration testing, pentesters conduct reconnaissance by using various tools including Nmap, Shodan, Maltego, Google, Google Hacking Database (GHDB), Recon-ng and more. Testers use various reconnaissance techniques (RTs) within the tools to directly access ICS devices. Many novice ICS-pentesters stop their reconnaissance work upon successfully accessing an ICS device. However, continuing to conduct reconnaissance after initial access can lead to pentesters finding even more information to find more ICS devices, ICS networks, and ways to make ICS exploitation more effective. Our research motivation stems from finding ways to explicitly model the continuation of using RTs once an ICS device is accessed. Knowledge graphs offer an approach for linking RTs together and creating chains of RTs.
 
 MITRE ATT&CK ICS provides a matrix of ICS adversarial behaviours. The matrix consists of main exploit tactics and techniques used to accomplish these tactics. Example techniques include ICS alarm suppression, blocking command messages, starting a device, and stopping services. ATT&CK ICS also provides ICS data sources that defenders use to detect the adversarial techniques. Application logs, files, logon sessions, network traffic, and operational databases represent some of the ICS data sources. We reasoned that if adversaries could find the ICS data sources and discover the ability to modify the data sources, then adversaries could cover their tracks to successfully carry out ICS tactics. For example, ICS attackers could modify log entries to hide the attacker’s steps or ICS attackers could delete alarm notifications that showed that ICS attackers changed ICS settings.
 
 In this work in progress research, we used knowledge-graph modelling techniques to link together RTs with ICS data sources, the ability to modify the data sources, the ability to then cover tracks of ICS techniques, and the impact of techniques on accomplishing ICS tactics. We named the graph RT-ICS Graph. With knowledge graph queries and shortest-path algorithms run over the RT-ICS graph, we showed how RTs can explicitly lead to impacts on adversaries carrying out ICS tactics. The accomplishment of ICS tactics can cause severe damage or harm.

Decision-making under uncertainty: beyond probabilities

AbstractThis position paper reflects on the state-of-the-art in decision-making under uncertainty. A classical assumption is that probabilities can sufficiently capture all uncertainty in a system. In this paper, the focus is on the uncertainty that goes beyond this classical interpretation, particularly by employing a clear distinction between aleatoric and epistemic uncertainty. The paper features an overview of Markov decision processes (MDPs) and extensions to account for partial observability and adversarial behavior. These models sufficiently capture aleatoric uncertainty, but fail to account for epistemic uncertainty robustly. Consequently, we present a thorough overview of so-called uncertainty models that exhibit uncertainty in a more robust interpretation. We show several solution techniques for both discrete and continuous models, ranging from formal verification, over control-based abstractions, to reinforcement learning. As an integral part of this paper, we list and discuss several key challenges that arise when dealing with rich types of uncertainty in a model-based fashion.

Datafying diplomacy: How to enable the computational analysis and support of international negotiations

Computational diplomacy, the application of digital and computational methods to the study and practice of international negotiations, presents unique challenges compared to most other fields in the computational humanities and social sciences. Among them are the necessity of responsiveness when handling crises, the need to anticipate and respond to adversarial behavior, or the need for secrecy in dealing with sensitive information. In this paper, we propose an agenda to address these challenges, and evaluate the feasibility of the various tasks that could be assigned to computational diplomacy. While most analysis tools seem almost ready to use, the availability and reliability of diplomacy-related data remains a major concern.

Relationship between Secure Decision Points and Arbitrary Polygon Positions in Malicious Models

The problem of determining the position relationship between points and polygons is very extensive in practical applications. However, the existing solutions are only applicable to the case of convex polygons, and no solutions are given for arbitrary polygons. In addition, most of the existing schemes are carried out under the semi-honest model, and cannot resist the active attack of malicious adversaries. In order to solve these problems, this paper uses Paillier's encryption scheme, the idea of zero-knowledge proof to design a decision protocol to protect the position relationship between points and arbitrary polygons, which can not only prevent the deceptive behavior of malicious adversaries, but also extend the application from convex polygons to arbitrary polygons. A simulation example is used to prove that this paper is safe and efficient under the malicious model.

Grasping Living Objects With Adversarial Behaviors Using Inverse Reinforcement Learning

Living objects are difficult to grasp since they can actively elude capture by adopting adversarial behaviors that are extremely hard to model or predict. In this case, an inappropriately strong contact force may hurt the struggling living objects and a grasping algorithm that can minimize the contact force whenever possible is required. To solve this challenging task, in this article, we present a reinforcement-learning (RL)-based algorithm with two stages: the pregrasp stage and the in-hand stage. In the pregrasp stage, the robot focuses on the living object's adversarial behavior and approaches it in a reliable manner. In particular, we use inverse RL to encode the living object's adversarial behavior into a reward function. The negative value of the learned reward function is then used to train a high-quality grasping policy that can compete with the living object's adversarial behavior with the RL framework. In the in-hand stage, we use RL to train a grasp policy such that the dexterous hand can grab the living object with the minimal force. A set of dense rewards are also specifically designed to encourage the robot to grasp and hold the living object persistently. To further improve the grasp performance, we explicitly take into account the structure of the dexterous robot hand by treating the hand as a graph and adopting graph convolutional network to formulate the grasping policy. We conduct a set of experiments to demonstrate the performance of our proposed method, in which the robot can grasp living objects with the success rate of 90% and 95% in the pregrasp and in-hand stages, respectively. The contact force applied by the robotic hand to the living object is dramatically reduced in comparison with the baseline grasping policy.

TRUSTS Technology Integration Inventory: Assessing the Impact of a New Technology on Work System Resilience

We present the Transform with Resilience during Upgrades to Socio-Technical Systems (TRUSTS) Framework, which specifies sources of work system resilience. A work system is defined as elements, including technology, people, policies, protocols, and procedures, that cooperatively function to achieve shared goals. By describing sources of work system resilience, the framework can help a work system’s stakeholders preserve its resilience. This is especially important for high-consequence work systems; these are work systems involved in healthcare, military operations, and national airspace management, as examples. In these work systems, responsivity and adaptivity, i.e., resilience, are requisites to achieving missions and goals in the face of outages and other unexpected events, high demands, and nonroutine conditions. In event-driven environments, system resilience is also required to respond to routine variety produced by uncontrollable aspects of the work, such as treatment responses, weather, and adversary behaviors. The TRUSTS framework is derived from foundational literature in complex systems science and resilience engineering. We build upon prior research in resilience engineering. In that body of work, work system resilience has been defined by Erik Hollnagel and colleagues as based on four cornerstones: anticipating, monitoring, responding, and learning. Its fundamental principles have been described in David Woods’ Theory Graceful Extensibility and writings on complex systems’ adaptive capacity. These cornerstones and principles have typically been described as high-level system capabilities that are illustrated by examples. With TRUSTS, we identify detailed system characteristics and capabilities that afford those high-level cornerstones. The framework is organized into five inter-related factors (a.k.a. the “Big Five” factors) that allow a high-consequence work system and its operations to be responsive and adaptive in the face of challenges. Each of the “Big Five” consists of three to four sub-factors, and each sub-factor consists of two or more resilience requirements. The framework and our associated efforts to operationalize work system resilience are heavily informed by targeted analysis of case studies of new technologies introduced into high-consequence work operations, including healthcare work operations, and interviews with military planning and command and control experts. Currently, we are endeavoring to integrate the TRUSTS Framework into the development of new technologies for health care and other high-consequence work systems. Increasingly, technologies are designed to participate in core work system activities, such as assessment, decision making, planning, and resource brokering and allocation. In these roles, they become integral to the work of other system elements—both technological and human—and the work system as a whole; i.e., they are a part of that work system. When technologies have core roles such as these, they have greater potential to inadvertently interfere with one or more of the means used by the work system to be adaptive and resilient to changing demands and conditions. They also have greater potential to positively contribute to the work system’s resilience. Our goal is to help developers attend to the ways their new technology will impact the work system’s ability to be adaptive and resilient. We present ongoing work to integrate TRUSTS Framework resilience sources into technology development, including newly developed methods and tools that together enable a TRUSTS Resilience-Aware Development (RAD) approach to technology development. The goal of RAD is to help ensure new technologies are designed to contribute to and not unintentionally compromise work system resilience. It ensures technology development benefits both work system efficiency and resilience in the balanced way that is necessary for long-term work system and mission success. Together, the TRUSTS framework and RAD approach and tools can be used to ensure that, as our healthcare work systems become more complex and technology-driven, they maintain the ability to provide responsive patient care and safety that is adaptive to conditions.

Fraud-Agents Detection in Online Microfinance: A Large-Scale Empirical Study

Online Microlending, a new financial service, focuses on small loans without any sort of collateral. It provides more flexible and quicker funding for borrowers, as well as higher interest rates of return. For platforms that provide such services, an essential task is to adequately evaluate each loan’s risk so as to minimize the possible financial loss. However, there exists a special group of borrowers, namely <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">fraud-agents</i> , who gain illegal profits from inciting other borrowers to cheat, i.e., they help the high-risk borrowers evade the risk evaluation by crafting fake personal information. The existence of fraud-agents poses a severe threat to the risk management systems and results in a huge financial loss for lending platforms. In this article, we present the first machine learning-based solution to detect fraud-agents in online microlending. The key challenge of this decade-long problem is that it is unclear how to construct effective features from multiple behavior logs such as phone call history, address book, loan history and activity logs of borrowers. To address this problem, we first conduct an empirical study on over 600K borrowers to gain some insights on the adversarial behaviors of fraud-agents comparing to normal borrowers and benign-agents. Based on the study, we are able to design a total of 26 features, falling into four groups, for fraud agent detection. Then, we propose a two-stage detection model to address the challenge of limited number of labeled fraud agent examples. The evaluation results show that our method can achieve a precision of 94.30%. We deploy our method on a real large online microlending platform with 11,953,273 borrowers, and we identify 29,727 fraud-agents from them. The domain experts from the platform confirm that 95.59% of them are real fraud-agents, and have added them to the platform’s internal blacklist. We further conduct a measurement study on those fraud-agents to share deeper insights on their adversarial behaviors.

Development and Analysis of a Reconnaissance-Technique Knowledge Graph

Penetration testing involves the use of many tools and techniques. The first stage of penetration testing involves conducting reconnaissance on a target organization. In the reconnaissance phase, adversaries use tools to find network data, people data, company/organization data, and attack data to generate a risk assessment about a target to determine where initial weaknesses may be. Although a small number of tools can be used to conduct many of reconnaissance tasks, including Shodan, Nmap, Recon-ng, Maltego, Metasploit, Google and more, each tool holds an abundance of specific techniques that can be used. Furthermore, each technique uses unique syntax. For example, Nmap holds over 600 scripts that make up its Nmap Scripting Engine. Depending on the type of device targeted, Nmap scripts can scan for ports, operating systems, IP addresses, hostnames and more. As another example, Maltego operates over 150 transforms or modules that collect data on organizations, files and people. Understanding which reconnaissance tool, techniques within those tools, and the syntax for each technique represents a highly complex task. MITRE ATT&amp;CK, a widely accepted framework, models tactics and techniques within the tactics to help users make sense of adversarial behaviours. The tactic of reconnaissance is modelled in ATT&amp;CK as well as its techniques. However, the explicit links between reconnaissance techniques are not modelled. Our research focused on the development of an ontology called Recontology to model the domain of reconnaissance. Recontology was then used to form Reconnaissance-Technique Graph (RT-Graph) to model 102 reconnaissance techniques and the directional links between the techniques. We used exploratory data analysis (EDA) methods including a graph spatial-layout algorithm and several graph-statistical algorithms to examine RT-Graph. We also used EDA to find critical techniques within the graph. Patterns across the results are discussed as well as implications for real-world uses of RT-Graph.

Inferring adversarial behaviour in cyber‐physical power systems using a Bayesian attack graph approach

AbstractHighly connected smart power systems are subject to increasing vulnerabilities and adversarial threats. Defenders need to proactively identify and defend new high‐risk access paths of cyber intruders that target grid resilience. However, cyber‐physical risk analysis and defense in power systems often requires making assumptions on adversary behaviour, and these assumptions can be wrong. Thus, this work examines the problem of inferring adversary behaviour in power systems to improve risk‐based defense and detection. To achieve this, a Bayesian approach for inference of the Cyber‐Adversarial Power System (Bayes‐CAPS) is proposed that uses Bayesian networks (BNs) to define and solve the inference problem of adversarial movement in the grid infrastructure towards targets of physical impact. Specifically, BNs are used to compute conditional probabilities to queries, such as the probability of observing an event given a set of alerts. Bayes‐CAPS builds initial Bayesian attack graphs for realistic power system cyber‐physical models. These models are adaptable using collected data from the system under study. Then, Bayes‐CAPS computes the posterior probabilities of the occurrence of a security breach event in power systems. Experiments are conducted that evaluate algorithms based on time complexity, accuracy and impact of evidence for different scales and densities of network. The performance is evaluated and compared for five realistic cyber‐physical power system models of increasing size and complexities ranging from 8 to 300 substations based on computation and accuracy impacts.

Communication-efficient and Byzantine-robust distributed learning with statistical guarantee

Communication efficiency and robustness are two major issues in modern distributed learning frameworks. This is due to the practical situations where some computing nodes may have limited communication power or may behave adversarial behaviors. To address the two issues simultaneously, this paper develops two communication-efficient and robust distributed learning algorithms for convex problems. Our motivation is based on surrogate likelihood framework and the median and trimmed mean operations. Particularly, the proposed algorithms are provably robust against Byzantine failures, and also achieve optimal statistical rates for strong convex losses and convex (non-smooth) penalties. For typical statistical models such as generalized linear models, our results show that statistical errors dominate optimization errors in finite iterations. Simulated and real data experiments are conducted to demonstrate the numerical performance of our algorithms.

Introducing UWF-ZeekData22: A Comprehensive Network Traffic Dataset Based on the MITRE ATT&amp;CK Framework

With the rapid rate at which networking technologies are changing, there is a need to regularly update network activity datasets to accurately reflect the current state of network infrastructure/traffic. The uniqueness of this work was that this was the first network dataset collected using Zeek and labelled using the MITRE ATT&amp;CK framework. In addition to identifying attack traffic, the MITRE ATT&amp;CK framework allows for the detection of adversary behavior leading to an attack. It can also be used to develop user profiles of groups intending to perform attacks. This paper also outlined how both the cyber range and hadoop’s big data platform were used for creating this network traffic data repository. The data was collected using Security Onion in two formats: Zeek and PCAPs. Mission logs, which contained the MITRE ATT&amp;CK data, were used to label the network attack data. The data was transferred daily from the Security Onion virtual machine running on a cyber range to the big-data platform, Hadoop’s distributed file system. This dataset, UWF-ZeekData22, is publicly available at datasets.uwf.edu.

ACTing Like a Lawyer: An Affect Control Theory Explanation of Gender Gaps in Law

Despite increased parity, large gaps remain between men and women in law. The author proposes that the cultural meanings and everyday interactions in which lawyers engage may create a gendered institution that reifies the gender hierarchy. Using three universal dimensions of meaning, the author investigates differences in the meanings of lawyer-related identities by gender. The results show that across all of these identities, female-modified identities carry cultural meanings that are less powerful than nonmodified identities. Using affect control theory, the author develops hypotheses about the expectations for men and women lawyers when enacting behaviors coded as either adversarial or caring. The data suggest that women are perceived as gender deviant when engaging in adversarial behaviors, while men are perceived as gender deviant when engaging in communal behaviors. These empirical hypotheses suggest ways that cultural meanings shape how lawyers experience their daily work lives and have broad implications for the gender hierarchy in high-powered workplaces.

Can Sanctions End Wars?

Russia’s invasion of Ukraine has led to extensive economic, financial, trade, and other types of sanctions directed at individual Russians and the Russian economy. Most European and North American countries as well as Australia, New Zealand, Japan, and Korea have enacted sanctions and many of them are also supporting Ukraine with military and economic assistance. Many other countries including China, India, and Brazil do not support the sanctions although 141 countries belonging to the United Nations (out of a total membership of 193) voted to condemn the war. Although the use of economic sanctions to influence the behavior of foreign adversaries has a long history, they have become a more prominent foreign policy tool since the end of the Cold War. Their effectiveness at changing the undesirable behavior of political leaders in countries such as Russia, Iran, or North Korea, however, has generally been unimpressive. While economic sanctions did eventually result in an agreement with Iran to control its development of nuclear arms, an agreement with which the Iranian government was complying, the Trump Administration withdrew from that compact, and it has proved difficult to re-instate it. Meanwhile, Iran may be resuming its efforts to acquire nuclear weapons. Past experience with sanctions suggest that the current measures taken against Russia are unlikely to lead to an early termination of the war in Ukraine.

A Survey of MulVAL Extensions and Their Attack Scenarios Coverage

Organizations employ various adversary models to assess the risk and potential impact of attacks on their networks. A popular method of visually representing cyber risks is the attack graph. Attack graphs represent vulnerabilities and actions an attacker can take to identify and compromise an organization’s assets. Attack graphs facilitate the visual presentation and algorithmic analysis of attack scenarios in the form of attack paths. MulVAL is a generic open-source framework for constructing logical attack graphs, which has been widely used by researchers and practitioners and extended by them with additional attack scenarios. This paper surveys all of the existing MulVAL extensions and maps all MulVAL interaction rules to MITRE ATT&CK Techniques to estimate their attack scenarios coverage. This survey aligns current MulVAL extensions along unified ontological concepts and highlights the existing gaps. It paves the way for the systematic improvement of MulVAL and the comprehensive modeling of the entire landscape of adversarial behaviors captured in MITRE ATT&CK.

Adversarial agent-learning for cybersecurity: a comparison of algorithms

Abstract We investigate artificial intelligence and machine learning methods for optimizing the adversarial behavior of agents in cybersecurity simulations. Our cybersecurity simulations integrate the modeling of agents launching Advanced Persistent Threats (APTs) with the modeling of agents using detection and mitigation mechanisms against APTs. This simulates the phenomenon of how attacks and defenses coevolve. The simulations and machine learning are used to search for optimal agent behaviors. The central question is: under what circumstances, is one training method more advantageous than another? We adapt and compare a variety of deep reinforcement learning (DRL), evolutionary strategies (ES) and Monte Carlo Tree Search methods within Connect 4, a baseline game environment, and on both a simulation supporting a simple APT threat model, SNAPT, as well as CyberBattleSim, an open-source cybersecurity simulation. Our results show that when attackers are trained by DRL and ES algorithms, as well as when they are trained with both algorithms being used in alternation, they are able to effectively choose complex exploits that thwart a defense. The algorithm that combines DRL and ES achieves the best comparative performance when attackers and defenders are simultaneously trained, rather than when each is trained against its non-learning counterpart.

Cryptography &amp; Network Security

Abstract: Cryptography is the practice and study of techniques to secure communication in the presence of adversarial behavior. On the other hand, Network security is the set of rules and configurations designed to protect the integrity, confidentiality, and accessibility of computer networks and data using both software and hardware technologies. Cryptography and network security are used to protect network and data communication take place over wireless networks and data which is stored in our systems. Cryptography is a network security tactic that is used to protect enterprise information and communication from cyber threats through the use of codes(encryption) using techniques such as merging words with images, and other ways to hide information in storage or transit. In this paper, we discussed about cryptography process, security mechanism, security services, attacks, types of cryptography, Steganography.

Analyzing Malicious Activities and Detecting Adversarial Behavior in Cryptocurrency based Permissionless Blockchains: An Ethereum Usecase

Different malicious activities occur in cryptocurrency-based permissionless blockchains such as Ethereum and Bitcoin. Some activities are due to the exploitation of vulnerabilities which are present in the blockchain infrastructure, some activities target its users through social engineering techniques, while some activities use it to facilitate different malicious activities. Since cryptocurrency-based permissionless blockchains provide pseudonymity to its users, bad actors prefer to carry out transactions related to malicious activities on them. Towards this, we aim at automatically flagging blockchain accounts as suspects that indulge in malicious activities, thus reducing the unintended support that cryptocurrency-based permissionless blockchains provide to malicious actors. We first use the cosine similarity (CS) metrics to study the similarities between the feature vector of accounts associated with different malicious activities and find that most of the malicious activities associated with the Ethereum blockchain behave similarly. We then use the K-Means clustering algorithm to check if accounts associated with similar malicious activities cluster together. We also study the effect of bias on the performance of a machine learning (ML) algorithm, due to the number of accounts associated with malicious activity. We then compare the different state-of-the-art models and identify that Neural Networks (NNs) are resistant to bias associated with a malicious activity and are also robust against adversarial attacks. The previously used ML algorithms for identifying malicious accounts also show bias towards an over-represented malicious activity.

Threat modeling framework for mobile communication systems

This paper presents a domain-specific threat-modeling framework for the cellular mobile networks. We survey known attacks against mobile communication and organize them into attack phases, tactical objectives, and techniques. The Bhadra framework aims to provide a structured way to analyze and communicate threats on a level that abstracts away the technical details but still provides meaningful insights into the adversarial behavior. Our goals are similar to existing threat modeling frameworks for enterprise information systems, but with a focus on mobile operator networks. The framework fills a gap that has existed in tools and methodology for sharing of threat intelligence within and between organizations in the telecommunications industry. The paper includes concrete case studies of applying the framework. It can also be read as a survey of attacks against mobile networks.CCS CONCEPTSSecurity and privacy→ Security requirements; Mobile and wireless security; Networks→ Networks Mobile networks

AntiConcealer: Reliable Detection of Adversary Concealed Behaviors in EdgeAI-Assisted IoT

Internet of Things (IoT) is one of the rapidly developing technologies today that attract huge real-world applications. However, the reality is that IoT is easily vulnerable to numerous types of cyberattacks and anomalies. Detecting them is becoming increasingly challenging day by day due to limitations with IoT devices and threat intelligence. Particularly, one of the most challenging problems is to detect the existence of malicious adversaries that continuously adapt or conceal their behaviors in IoT to hide their actions and to make the IoT security protocol ineffective. In this article, we study this problem at the IoT device level that can be a great idea to avoid potential attacks. We present <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">AntiConcealer</monospace> , an edge-aided IoT framework, and propose an edge artificial intelligence-enabled approach (EdgeAI) for detecting adversary concealed behaviors in the IoT. We first develop an adversary behavior model and use this to identify mid-attack temporal patterns by learning the multivariate Hawkes process (MHP), a kind of point process as a random and finite series of events (e.g., behaviors) controlled by a probabilistic model. Naturally, learning MHP processed on EdgeAI reveals the influence of the concealed behaviors of adversaries in the IoT. These concealed behaviors are then grouped using a nonnegative weighted influence matrix. To observe the performance of the <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">AntiConcealer</monospace> framework through evaluation, we employ honeypots integrated with edge servers and verify the usability and reliability of adversary behavioral identification.

Inter-Organizational System Integration

Manufacturing firms have increasingly relied on inter-organizational systems (IOS) to facilitate inter-firm transactions and integration with suppliers. However, they frequently face various impediments, such as adversarial behaviours and misalignments, when trying to integrate with IOS (i.e., IOS integration or IT/IS integration). Based on the perspectives of mutual adaptation of technology and organization and socio-technical systems, this study develops two compromise constructs critical for IOS integration: inter-firm process compromise and technology compromise. These two compromise constructs, treated as neutral alignment, are proposed to affect the achievement of higher IOS integration. Based on 146 matched-pair samples, the findings demonstrate the importance of technology and inter-firm process compromises in achieving greater IOS integration, which, in turn, enables higher inter-firm dependence and operational performance. This research provides theoretical and practical implications that contribute to our understanding of the role of compromise in facilitating IOS integration. The implications should serve as an important basis for future research in examining IOS integration.