Critical Infrastructure Protection Research Articles

REAL-TIME GIS FOR MONITORING AND SECURITY

Applications of geographic information systems in the security domain are diverse and cover various aspects such as crisis prevention and management, public safety, national security, critical infrastructure protection and military applications. Real-time GIS is essential for effective emergency response and management because it provides accurate information on the location and dynamics of events.

Importance of Cybersecurity/The Relevance of Cybersecurity to Diabetes Devices: An Update from Diabetes Technology Society.

As medical devices become more integrated with wireless technologies, the risks of cyberattacks and data breaches increase, making stringent cybersecurity measures essential. The implementation of rigorous cybersecurity standards is essential for enhancing the cybersecurity of devices. This article examines the evolving cyber threats faced by the medical technology industry, the role of IEEE 2621 in providing comprehensive security benchmarks for medical devices, and the need for continuous risk assessments and adherence to regulatory standards to mitigate future cyber risks. Adherence to cybersecurity standards establishes ensures the effective protection of sensitive data and critical infrastructure.

Methodological Approach for the Development of Standard C-UAS Scenarios

The integration of unmanned aircraft systems (UAS), commonly referred to as drones, into various sectors including agriculture, healthcare, and military operations has transformed industries and services. While drones offer numerous benefits, they have also been exploited by terrorists and criminals for illicit activities, such as smuggling and surveillance. Incidents involving drones flying over restricted airspaces or sensitive locations have highlighted the vulnerabilities of critical infrastructure and limitations of current law enforcement capabilities. To address these challenges, there is a growing need for effective counter-UAS (C-UAS) systems including detection, tracking, and identification technologies. However, evaluating the capabilities of these systems poses a significant challenge, leading to the demand for standardized test methodologies. The COURAGEOUS project seeks to fill this gap by developing standardized scenarios covering various use cases, such as airport security, critical infrastructure protection, and border security. These scenarios are informed by a systematic approach involving a literature review, analysis of previous incidents, assessment of current C-UAS frameworks, and gathering feedback from end users. The resulting standardized test methodology aims to enhance the understanding of C-UAS system capabilities, improve preparedness against evolving threats, and facilitate the global dissemination of project results. Through validation trials and feedback from law enforcement agencies, the COURAGEOUS project strives to contribute to a broader network of counter-UAS initiatives, ultimately enhancing the lower airspace security.

An efficient convolution neural network method for copy-move video forgery detection

Unmanned systems play a pivotal role in military surveillance, critical infrastructure protection, law enforcement, search and rescue operations, and border security, showcasing their multifaceted importance across diverse applications. Video fraud detection is integral to multimedia security, where our task involves the precise identification of modified segments within video sequences. Current approaches to video fraud detection often rely on manual feature selection and models tailored to detect specific tampering types, such as copy-move or splicing. The general representation powers of deep learning models and the connection of multiple forensic characteristics are still not fully explored. This research uses a convolutional neural network (CNN) model to identify copy-move video forgeries. Copy-move forgery is a type of video tampering whereby a portion of the video is copied and pasted somewhere different in the same video to cover an essential video characteristic. The method that is being proposed involves dividing the video into individual frames, extracting features from each frame by using a CNN model that has already been trained, and then utilizing these features to train a new CNN model that would classify each frame as either legitimate or fabricated. The proposed method effectively detects copy-move video forgery with an exceptionally high accuracy rate, exceeding current methods of accuracy and computational effort. The proposed method outperformed all other approaches on the SULFA, GRIP, and VTD datasets. The model's accuracy was 85.42 %, 86.16 %, and 81.87 %, respectively, with the shortest times recorded being 9.6 sec, 11.4 sec, and 13.7 sec, respectively. Consequently, specialists can employ the suggested method as a machine-learning instrument for detecting fake videos in real-time.

Cyber Security Exploits and Management in Telecommunication Companies: The Case of Uganda

This study examined the risks faced by telecommunication companies due to cyber-attacks and threats to their critical information infrastructure. It suggests control measures to avert the vulnerabilities of such infrastructure to cyber attackers. Critical information infrastructure is important to the companies as a revenue enabler and reputation identifier. However, the infrastructure, if not well protected, can be a national security threat, affect the national economy, and disrupt societal integration and business globally. Cyber security is the protection of internet-connected systems, including hardware, software, people, and data, from cyber-attacks. Its threat exploits the increased complexity and connectivity of critical infrastructure systems. The identification of the critical information infrastructure was done through document analysis and discussion with the network technical teams. The infrastructure systems, such as devices, servers, data, database, firewall, and network, were identified in this study as vulnerable to attack. This study suggests a framework to support timely intrusion detection and for the protection of critical information infrastructure. To secure and safeguard the critical information infrastructure from inherent vulnerabilities, it is recommended that continuous monitoring of the critical infrastructure attack gates should be made part of the overall risk management of a telecommunication company, and innovations in cyber security detection and prevention should be harnessed.

Water-Enhancing Gels Exhibiting Heat-Activated Formation of Silica Aerogels for Protection of Critical Infrastructure During Catastrophic Wildfire.

A promising strategy to address the pressing challenges with wildfire, particularly in the wildland-urban interface (WUI), involves developing new approaches for preventing and controlling wildfire within wildlands. Among sprayable fire-retardant materials, water-enhancing gels have emerged as exceptionally effective for protecting civil infrastructure. They possess favorable wetting and viscoelastic properties that reduce the likelihood of ignition, maintaining strong adherence to a wide array of surfaces after application. Although current water-enhancing hydrogels effectively maintain surface wetness by creating a barricade, they rapidly desiccate and lose efficacy under high heat and wind typical of wildfire conditions. To address this limitation, unique biomimetic hydrogel materials from sustainable cellulosic polymers crosslinked by colloidal silica particles are developed that exhibit ideal viscoelastic properties and facile manufacturing. Under heat activation, the hydrogel transitions into a highly porous and thermally insulative silica aerogel coating in situ, providing a robust protective layer against ignition of substrates, even when the hydrogel fire suppressant becomes completely desiccated. By confirming the mechanical properties, substrate adherence, and enhanced substrate protection against fire, these heat-activatable biomimetic hydrogels emerge as promising candidates for next-generation water-enhancing fire suppressants. These advancements have the potential to dramatically improve the ability to protect homes and critical infrastructure during wildfire.

Machine learning algorithms in SIEM systems for enhanced detection and management of security events

As cyber threats become increasingly sophisticated, traditional Security Information and Event Management (SIEM) systems face challenges in effectively identifying and responding to these dangers. This research presents the development of a SIEM system integrated with machine learning (ML) to enhance threat detection, anomaly identification, and automated incident response. The integration of ML allows the SIEM system to go beyond conventional rule-based approaches, enabling the detection of previously unknown threats by learning from historical data. The system employs advanced algorithms to analyze large-scale log data and network traffic, providing real-time insights and reducing false positives. Key features of this SIEM include anomaly detection, predictive analytics, and adaptive thresholds, which allow it to adjust dynamically based on contextual data. By adapting to new and evolving cyber threats, the system provides a more resilient and proactive defense against potential attacks. The results indicate that integrating machine learning into SIEM systems can offer organizations a more effective, scalable, and adaptive security solution, ensuring the protection of critical infrastructure and data in a rapidly changing digital landscape.

Information protection and cyber security in the public and financial sectors

The public sector faces increasing challenges in the field of cyber security and information protection, stimulated by the rapid development of digital technologies. A significant increase in the need for reliable protection of state data and information systems requires state institutions to implement complex information protection measures. The purpose of the study is to analyze modern approaches and technologies in the field of cyber security and the use of encryption, cryptography, and the use of cloud technologies that can be used in the public sector for effective information protection. The research methodology involves consideration of strategies that allow to increase the level of security and ensure the protection of critical infrastructure. The results of the study emphasize the need to adapt to the rapidly changing digital environment and involve modern technological solutions to create a reliable information network system in the public sector. The findings of the study draw attention to the importance of global cooperation and increased investment in the field of countering digital attacks, demonstrating examples of effective international cooperation and support in this direction. The need for the integration of international standards and practices in order to create a global digital space has been revealed. A promising area of research is the analysis of the impact of the latest technologies on data storage strategies, which contributes to the identification of ways for further innovations in the industry and the creation of flexible information network systems capable of effectively responding to changing conditions and challenges of modern cyberspace.

Emerging Challenges and New Responses, Building Capabilities to Counter Threats in Cyberspace

Cyberspace phenomena are changing rapidly at international and national levels. Growing threats, new vulnerabilities and protection against them require continuous action at the level of the EU, NATO and national competent authorities and organisations. Adequate protection of critical infrastructure and cyberspace is a vital strategic, operational and technical challenge for the EU, NATO and therefore nations. Cross-border impacts, threat actors and malicious actions require coordination of international and national procedures, mechanisms and cooperation. This article presents the most important phenomena and trends experienced today, as well as EU and NATO initiatives and requirements at the strategic level, illustrating what changes can be expected in cybersecurity.

Informational and legal aspects of protection of critical infrastructure of Ukraine

This paper is committed to the problems of legal regulation of critical infrastructure protection. It has been determined that the legal provision of protection of critical infrastructure has positive aspects, but at the same time it is affected by problems in public administration. The implementation of the provisions of the legislative act at the level of by-laws is rather slow. Informational and legal aspects of critical infrastructure protection determine the presence of a problem fields. The problems of legal regulation are caused by the complex nature of the information infrastructure, which causes difficulties in legal regulation. Another important aspect is finding a balance between the protection of critical infrastructure information and the government’s “open data” policy. This also causes difficulties for the policy of transparency and accountability in public administration. The specified problems cause a negative impact on legal regulation. Finding ways to solve this problem is an important task for law-making and legal science.

IT Failures in Hospitals - Structures and Processes in Hospitals for Coping Cyber Attacks

Clinics are, by definition, part of a country's critical infrastructure. In recent years, hospitals have increasingly become the target of cyber attacks, resulting in disruptions to their functionality lasting weeks to even months. According to the "National Strategy for the Protection of Critical Infrastructures (CRITIS Strategy)", clinics are legally obligated to take preventive measures against such incidents. This involves evaluating, defining, and developing failure concepts for IT-dependent processes within a clinic to be prepared for a cyber attack. Specifically tailored emergency plans for computer system failures should be created and maintained in all IT-dependent areas of a clinic.Additionally, paper-based alternative solutions, such as request forms for diagnostic or consultation services, department-specific emergency documents, and patient documentation charts, should be kept in a readily accessible location known to staff in the respective areas. The complete restoration of a clinic's network after a cyber attack often requires extensive recovery of numerous IT systems, which may take weeks to months in some cases.If the hospital has robust plans for cyber emergency preparedness, including regular scans and real-time backups, stabilization and a quicker resumption of operations may be possible.

The Israel-Hamas Armed Conflict in the Middle East: A Sociological Lens

The State of Israel and the Palestinian Islamist militant group Hamas have been in conflict for decades. Amid the conflict, Israel is determined to maintain control of Gaza and strive to eliminate Hamas as a terrorist organisation at all costs. Hamas’s objection to Israel’s attempt to occupy Gaza and its refusal to recognise the State of Israel led to violence that resulted in many losses of life and property. This article examined the Israel-Hamas armed conflict in the Middle East, using a sociological lens. Henri Tajfel and John Turner’s Social Identity Theory was adopted as a framework to guide the paper. Using evidence from textbooks, journals, media reports, government publications, and online sources, the results showed that the conflict between Israel and Hamas stems from many factors, including territorial settlement, political and ideological differences, and the role of the international community. The consequences of the armed conflict between Israel and Hamas include loss of life and property, destruction of critical infrastructure, economic disruption, and diplomatic relations. The study recommended the urgent need for a comprehensive and sustainable solution that prioritises the protection of human life, dignity, well-being, and critical infrastructure in the Gaza Strip. The international community should stop supporting an escalation of the conflict and instead engage in a peaceful effort to reconcile Israel and Palestine. Further research is needed to determine the coping strategies of the displaced Palestinians in the Gaza Strip and nearby cities.

AI-driven cybersecurity solutions for real-time threat detection in critical infrastructure

Cyber-security as a concept relates to the protection of critical infrastructures that are significant to the security of a nation. Because many security threats have targeted computer-based critical infrastructures, nations have considered it necessary to enhance their security to detect and predict cyber threats accurately. This paper aimed to discuss the role of artificial intelligence (AI) in increasing real-time threat detection to critical infrastructures such as water facilities and transport systems. Through the implementation and application of AI, it is easier to not only detect the threat but also counter it promptly. Thus, the paper discussed the latest AI technologies, the approaches for their use and the cases, for example, the Colonial Pipeline ransomware attack, to demonstrate AI’s capabilities and limitations in this area. Other strategies such as measures and formulation of policies were also considered to ensure sound protection and improvement policies and regulations framework for cybersecurity.

Maritime Pollution in Pakistan and Its Impact on Marine Life: Challenges and Way Forward

Marine pollution is a major threat to marine biodiversity, ecosystems and socio-economic conditions of coastal communities in Pakistan. Driven by industrial, agricultural and plastic pollution, mounting levels of marine pollution are largely resulting in habitat destruction, biodiversity loss and difficulties in conduct of subsistence activities. Lack of waste management system and public awareness further compound the problem. The present study gives a comprehensive analysis of marine pollution, its sources, types and mechanism as well as the damage is does to marine environment. The study also examines existing domestic and international legislation on marine pollution eradication and puts forth recommendations in the form of both short and long terms measures for pollution mitigation in Pakistan. The study also emphasizes the need to sensitize public attention on this pressing issue and advocates awareness campaigns regarding oil spill response preparedness, investment in resilient infrastructure and plastic pollution eradication initiatives. Long term measures stem from analysis of several case studies of island countries. These measures include protection of critical infrastructure, ecosystem conservation as well as increased research and development. Effective implementation of these measures can help Pakistan transition into a sustainable and secure future.

Critical Entities Resilience Assessment (CERA) to small-scale disasters

Since 2022, there has been a significant increase in the importance of critical entities in terms of critical infrastructure protection. The adoption of the Critical Entities Resilience Directive must in EU member states ensure not only the protection of critical infrastructure, but also a sufficient resilience level of the entities themselves. This directive obliges critical entities to take measures to increase their resilience but does not provide any methodological support. A necessary starting point for fulfilling this obligation is knowledge of the current state of critical entities resilience to small-scale disasters. The results of the resilience assessment will then enable critical entities to identify vulnerabilities on the basis of which adequate technical, security and organisational measures can be defined. Therefore, this article presents an entirely new semi-quantitative method, CERA, which has been developed for the comprehensive assessment of entity and infrastructure resilience of critical entities. At the core of this method is a procedure that allows critical entities to self-assess their internal resilience through individual factors, which are defined in detail in this article. In order to facilitate the assessment process, the authors of the article have created the CERA Support Tool, which is supplementary material to this article. The Results section of the article also includes a presentation of a practical application example of the proposed procedure.

Building risk assessment methodology for explosive and non-conventional terrorist attacks

An original methodology suitable for the assessment of the risk of a terrorist attack in a given site/building is proposed and illustrated for the case of an explosive or non-conventional (Chemical, Biological, Radiological, Nuclear and explosive—CBRNe) attack. The Building Risk Assessment Methodology discussed in this paper represents the arrival point of a detailed analysis and research carried out during the past 5 years and provides the synthesis of different results obtained for the assessment of Building Threats and Building Vulnerabilities. These two assessments were discussed in detail in other already published papers. The effort presented in this work is to deploy a risk and impact assessment technique for buildings that can be adopted in any operating scenario in the presence of explosive or non-conventional threats. The main target of the methodology is to provide a sufficiently accurate estimate of the risk in a simple fashion. The methodology allows to manage the different kinds of risk related to the explosive and non-conventional threats, and it is useful for identifying a ranking of risks for different buildings in different portions of territory and for prioritizing actions and investments in preparedness, protection and resilience of critical areas and critical infrastructures. In the paper, the results of two different case studies for three different threats will be considered, analyzed and compared.

Developing intelligent cyber threat detection systems through quantum computing

In the face of increasingly sophisticated cyber threats, traditional detection systems often fall short in protecting critical supply chains. This research presents the development and evaluation of an intelligent cyber threat detection system integrating Quantum Computing (QC) and Artificial Intelligence (AI). The proposed system significantly enhances detection accuracy, reduces latency, and improves resource efficiency compared to traditional methods. Quantum algorithms, such as Quantum Support Vector Machines (QSVM) and Quantum Neural Networks (QNN), demonstrated superior performance with accuracies of 95.2% and 96.7%, respectively. The system achieved high detection rates for various cyber threats, including malware, phishing, ransomware, and advanced persistent threats (APTs), with reduced false positive rates. The integration of QC also resulted in faster threat detection and response times, with system latency halved across key components. These advancements provide substantial benefits for cyber threat response in supply chains, ensuring robust protection of financial transactions and critical infrastructure. The enhanced scalability and efficiency make the system a valuable asset for safeguarding the United States' financial sector against sophisticated cyber-attacks.

Proactive Threat Hunting in Critical Infrastructure Protection through Hybrid Machine Learning Algorithm Application.

Cyber-security challenges are growing globally and are specifically targeting critical infrastructure. Conventional countermeasure practices are insufficient to provide proactive threat hunting. In this study, random forest (RF), support vector machine (SVM), multi-layer perceptron (MLP), AdaBoost, and hybrid models were applied for proactive threat hunting. By automating detection, the hybrid machine learning-based method improves threat hunting and frees up time to concentrate on high-risk warnings. These models are implemented on approach devices, access, and principal servers. The efficacy of several models, including hybrid approaches, is assessed. The findings of these studies are that the AdaBoost model provides the highest efficiency, with a 0.98 ROC area and 95.7% accuracy, detecting 146 threats with 29 false positives. Similarly, the random forest model achieved a 0.98 area under the ROC curve and a 95% overall accuracy, accurately identifying 132 threats and reducing false positives to 31. The hybrid model exhibited promise with a 0.89 ROC area and 94.9% accuracy, though it requires further refinement to lower its false positive rate. This research emphasizes the role of machine learning in improving cyber-security, particularly for critical infrastructure. Advanced ML techniques enhance threat detection and response times, and their continuous learning ability ensures adaptability to new threats.

Legal Regulation of Cybersecurity and Privacy on the Internet as SDG's

Objective: The article focuses on the conceptual framework for the formation and development of legal regulation of cybersecurity and privacy on the Internet. Theoretical Framework: Technological development has provided humanity with many clear benefits. However, it has also created severe challenges and threats to national security, critical infrastructure, private persons and states, as well as the international community. In Ukraine, these issues have been exacerbated by the Russian-Ukrainian war. Method: The research methodology is based on a logical and systematic presentation and analysis of the material related to the process of legal support for cybersecurity and privacy. Results and Discussion: Today, states and international organizations have to pursue two different policies: one in the virtual environment and the other in the real world. The Presidential Commission on Critical Infrastructure Protection was established in 1996 in the United States. As of today, the definition of “cybersecurity” has been determined at the legislative level. It includes 10 fundamental principles related to the development of the Internet and its impact on human life. Research Implications: The previous legislative experience of international law related to cybersecurity and privacy has been summarized. Originality/Value: In Ukraine, the process of legal support for cybersecurity and privacy on the Internet is also ongoing. Ukraine has both ratified several international documents related to this issue and has its own legislative framework.

MBSE Analysis & Update of U.S. Infrastructure Data Taxonomy (IDT) Using U.S. National Critical Functions (NCFs)

AbstractIn this paper, we will demonstrate the application of Model‐Based Systems Engineering (MBSE) tools and techniques we have used to assist the U.S. Department of Homeland Security (DHS) / Cybersecurity Infrastructure Security Agency (CISA) in analysis of open‐source Infrastructure Data Taxonomy (IDT) data to analyze and contribute to the updates required for their IDT. We will show how we have used Functional Analysis, Logical Structure Taxonomies, and MBSE tools to analyze the IDT alongside the DHS National Critical Functions (NCFs) to recommend and improve these updates for their IDT. We have also proposed updates to the NCFs themselves where obvious improvements could be made. Our future recommendations are to continue this effort as a team of INCOSE Critical Infrastructure Protection and Recovery (CIPR) team members, along with other INCOSE Working Groups (WGs), and to explore other use cases based on this model data, as well as inviting other Subject Matter Experts (SMEs) to assist in the enhancements. This modeling effort demonstrated the use of these MBSE tools while working together with other organizations to enable improvements to the Critical Infrastructure (CI) space leveraging systems theory & thought leadership. We will outline further avenues for exploration using this provided MBSE capability in multiple areas that could be useful to the DHS, and will discuss a potential longer‐term engagement with DHS in an annual challenge. This challenge similar to those led by multiple other projects will include collaborations with universities and other CI / CIPR entities interested in this modeling of the CI space. Other opportunities to extend the model further include, but are not limited to security / cybersecurity, operational, and services modeling use cases, involving Industrial Control Systems (ICS) and much more. We have shown how these tools are effective and efficient for use in the water / wastewater sector, but will also yield similar benefits when applied across all identified sectors and across the international community as well (i.e., transportation, telecommunications, etc.). Interestingly we have seen in our initial analyses that the various taxonomies across sectors, subsectors, segments, subsegments, and assets vary slightly between regions and countries internationally for various reasons.