Cyber Activities Research Articles

머신러닝을 이용한 검색량 기반 악성 URL 탐지기법 연구

As internet technology develops and there are increases in cyber activities such as e-mail, SNS and e-commerce, cyber security is being emphasized as one of the most important social issues. In particular, spam mail, SMS phishing and other malicious URLs to breach personal data are inflicting financial and physical damage. This paper proposes a malicious URL detection method based on search volume from internet search engines to resolve such problem. The search volume-based malicious URL detection method uses portal search engines to automatically search URLs linked to emails, text messages and SNS to determine whether or not they can be categorized as malicious URLs according to the volume of the search result. This method allows normal URLs, but will protect to abnormal behaviors.

Rivalry Type and Cyber Operations: “Hot” Rivalries, “Cold” Rivalries, and Cyber Incidents, 1990–2009

Abstract Cyber operations targeting government computers and network infrastructure are becoming increasingly common and have the potential to be extremely damaging. Interstate rivalry has been shown to shape a wide range of global patterns. This paper examines the intersection between these two important phenomena. It builds upon previous scholarship by developing a broader and more nuanced theory of the rivalry-cyber operation relationship and testing it empirically with newly developed data on cyber operations from 1990 to 2009. Our results go beyond existing studies to demonstrate that certain types of “cold” rivalries experience elevated numbers of cyber operations, while other “hot” rivalries experience fewer incidents. This finding sheds new light on our general understanding of the volume and location of cyber operations in the international system. It also underscores important distinctions among rivalries that help to explain significant cyber activities and may help to improve our grasp of other emerging threats.

Understanding Cyber Security

This study provides an understanding of cyber security and further analyses the Cyber Security and Data Protection Bill of Zimbabwe. The internet and other technological developments have provided a variety of platforms for increased and sometimes unrestricted exercise of freedom of expression, association, online transactions, and access to information rights. Zimbabwe has faced increased threats from cyber activities. This has necessitated the country to enact the Cyber Security and Data Protection Bill. The purpose of the Cyber Security and Data Protection Bill is to increase cyber security in order to build confidence and trust in the secure use of information and communication technologies by data controllers, their representatives, and data subjects. This study relied on data gathered through key informant interviews and documentary search. The key informants were drawn from various institutions that deal with cybercrime. Zimbabwe does not have adequate and effective legislative instruments to combat cybercrime.

Comparison between Saudi Arabia and USA: Prevention and Dealing with Cyber Security

Cyber security practices mainly involve the prevention of external threats to software, hardware, server data, and other assets which are connected to the internet. Organizations follow a lot of cyber security practices to protect their systems and databases from malicious cyber actors. Cybercriminals use different techniques like spear-phishing, phishing, password attack, denial of service, ransomware, etc. to cause harm to people, organizations, and governments and steal important information from them. We analyzed the use of deep learning algorithms to deal with cyber-attacks. Deep neural networks or deep learning consist of machine learning procedures to support the network to fix complex issues and learn from unmanaged data. In addition, we also analyzed some of the cyber security laws and practices implemented in the US and Saudi Arabia to work collaboratively against cyber threats. It is observed that both countries are doing well against cyberthreats, but they need to work even more to provide training and support to professionals in the public sector who handle sensitive data about cyber security.

Analysis of Data Encryption Algorithms for Telecommunication Network‐Computer Network Communication Security

Nowadays, the development of information technology can be described as extremely rapid, especially with the widespread use of the Internet; the security of communications in the network has become an important issue we are facing. The purpose of this article is to solve the problems in today’s network security data encryption algorithms. Starting from the computer network communication security data encryption algorithm, we discuss the effects of several different encryption methods on improving network security. The research results show that it is known that the application of link encryption algorithm in network communication security encryption algorithm can increase the security index by 25%, the node encryption algorithm can increase the security index by 35%, and the end‐to‐end encryption algorithm can make the cyber activity safety index to increase by 40%. Among them, RSA algorithm and DES algorithm are two very representative algorithms; they represent different encryption systems. From the perspective of network data link, there are three methods of encryption algorithm, namely, link encryption algorithm, node encryption algorithm, and end‐to‐end encryption algorithm.

CYBER WARFARE AND INTERNATIONAL CYBER LAW: WHITHER?

This paper analyses historical, sociological and normative aspects of the cyber violence in international relations and international law, aiming to assess the adequacy of the extant international norms for its regulation. It results with the knowledge on the lack of international cooperation and a universal approach, the instrumentalisation of the internet as a means of warfare, lacunae in the relevant legal framework, and the peril of compromisation of the international law. Since the social jeopardy of activities in the cyberspace is hardly measurable and subjected to highly arbitrary interpretations, the problem of the uncertain peacetime or belligerent legal qualification of cyber activities is exposed. The other serios problem is a high risk from potentially disproportional responses of states to the cyber violence. Especially due to the lack of universal international institutions in the field of cyber, it must be concluded that the international lege lata applicable to the cyber violence is not adequate and sustainable. The progressive development of international cyber law is thus suggested, through the pacification of the internet and the international criminalisation of cyber violence.

When Cyber Activities Are Space Activities

Proceedings of the International Institute of Space Law is een online tijdschriftenplatform van Boom uitgevers Den Haag (Boom juridisch, Boom criminologie, Boom bestuurskunde en Eleven International publishing)

Terrestrial Cyber Activity of Non- Governmental Actors and State Responsibility under the Outer Space Treaty

Proceedings of the International Institute of Space Law is een online tijdschriftenplatform van Boom uitgevers Den Haag (Boom juridisch, Boom criminologie, Boom bestuurskunde en Eleven International publishing)

Mathematical Study of Advanced Persistent Threat (APT) Hunting Techniques

The paper documents, based mainly on [3]-[6] published papers where a consistent mathematical description of cyberspace and various types of Cyber-Attacks and protection measures are presented, a holistic mathematical approach to a rigorous description of Advanced Persistent Threat (APT) actors’ modus operandi through various scenarios and Cyber Kill Chain stages [2]. After referring [6] to the various elements of Cyber-Attacks we propose some techniques (via 5 scenarios) of tracking the modus operandi of the most sophisticated and non-linear cyber actors, the Advanced Persistent Threat actors that are usually nation-state or nation-state backed and usually stay undetected for an extended time in later stages of Cyber Kill Chain in defenders’ networks. Keywords: Valuation of cyber assets, vulnerability of cyber assets, node supervision, sophistication of an attack germ of cyber-attack, cyber defense, proactive cyber protection, Advanced Persistent Threat (APT) actors, Indication of Compromise (IOC), Tactics, Techniques and Procedures (TTPs).

The vital role of international law in the framework for responsible state behaviour in cyberspace

ABSTRACT This article explores the importance of international law in debates about responsible behaviour in cyberspace – in providing a rules-based framework, in legitimising states’ actions in response to unlawful activity in cyberspace by other states, and in lending normative force to statements calling out malicious cyber activity. At the same time, the article seeks to highlight the challenges involved in applying international law, and uses the application of two peacetime precepts of international law – the principle of sovereignty and the principle of non-intervention in other states’ internal affairs – to illustrate some of the doctrinal issues with which states are grappling. While acknowledging these challenges, the article concludes that even if the UN parallel processes in the form of the Open Ended Working Group and Group of Government Experts do not result in substantial agreement between states on issues of international law, the debates in themselves are valuable in encouraging states to deliberate on these issues and to make their views public. By publicising their views, states add momentum to the journey towards cyber-specific understandings of international law.

The Effect of Bad Password Habits on Personal Data Breach

Users tend to utilize bad or weak passwords with memorable characteristics such as simple words from the dictionary and easy to remember sequence of numbers from birthdays. Poor or bad password habits lead to compromise of personal data privacy and allow hackers to gain unauthorized access to these passwords and use them for criminal and fraudulent cyber activities. The purpose of this research is to examine the impact of password habits among Malaysians on their personal data breaches. This study provides insights into the behavior of users concerning their passwords use. This study used a positivism paradigm and applied a quantitative approach and used a convenience sampling technique to collect data from 297 respondents from Malaysian nationals. IBM SPSS AMOS 24 is used to conduct the analysis. The result from the study shows that “lacking the use of second-factor authentication’ have a significant and a positive impact on the personal data breaches. Based on this finding, it can be concluded that the lack of second-factor authentication is an essential factor that significantly impacts personal data breach. This finding provides a different perspective from the usual connection of bad password habits of weak password length and combination, easy to guess the password and common password reuse to be the main contributing factor of the personal data breaches by the previous literature. The contribution of this research is the provision of empirical evidence that emphasize the need to continually beef up own security by correctly using second-factor authentication across individual accounts. Doing so is crucial to curb personal data breaches.

Countering Malicious Cyber Activity: Targeted Financial Sanctions

Since 2012 policymakers in the United States and Europe have imposed targeted financial sanctions against malicious cyber operators with the stated goal of deterring such activity. This draft paper provides an overview of the legal frameworks for sanctioning malicious cyber actors and the set of relevant sanctions imposed to date. Despite an emphasis on the goal of deterrence, both policymakers and academics have difficulty determining whether sanctions deter malicious cyber activity. Considering the continued use of cyber sanctions, this draft paper highlights key considerations for policymakers to evaluate whether sanctions can deter wrongful behavior in cyberspace.

Social media dissidence and activist resistance in Zimbabwe

Dissidents exist in every nation, always have, and perhaps always will – existing in that risky space between being patriots and being enemies of the state. Social media, on the other hand, is a fairly recent tool of communication defined by its heightened ductility in the hands of users. The admixture of social media and political dissidence has thrown many governments in a ceaseless panic, reflected in the raft of legislation enacted to control and constrain cyber activities. This paper studied the ‘social media dissidence’ phenomenon in Zimbabwe in the period 2016 within the context of digital media and the publics in Africa. The periodization understudy is noticeable because it bore witness to a variety of unsettling acts by individuals that provoked panicked responses from the state. Using qualitative data drawn from Facebook and Twitter and deploying Mamdani’s citizen and subject, the study examines the nature of the born-digital dissidence in a sample of two cases, #ThisFlag and #Tajamuka. The paper establishes the possibilities and limitations of deploying social media as a tool for expressing protest and dissidence. The study found that social media dissidence is marked by constant fluidity, transmogrification, crests, and troughs.

To What Extent We Repeat Ourselves? Discovering Daily Activity Patterns Across Mobile App Usage

With the prevalence of smartphones, people have left abundant behavior records in cyberspace. Discovering and understanding individuals’ cyber activities can provide useful implications for policymakers, service providers, and app developers. In this paper, we propose a framework to discover daily cyber activity patterns across people's mobile app usage. The framework first segments app usage traces into short time windows and then applies a probabilistic topic model to infer users’ cyber activities in each window. By constructing and exploring the coherence of users’ activity sequences, the framework can identify individuals’ daily patterns. Next, the framework uses a hierarchical clustering algorithm to recognize the common patterns across diverse groups of individuals. We apply the framework on a large-scale and real-world dataset, consisting of 653,092 users with 971,818,946 usage records of 2,000 popular mobile apps. Our analysis shows that people usually follow yesterday's activity patterns, but the patterns tend to deviate as the time-lapse increases. We also discover five common daily cyber activity patterns, including afternoon reading, nightly entertainment, pervasive socializing, commuting, and nightly socializing. Our findings have profound implications on identifying the demographics of users and their lifestyles, habits, service requirements, and further detecting other disrupting trends such as working overtime and addiction to the game and social media.

Educational modules and research surveys on critical cybersecurity topics

Cybersecurity comprised all the technologies and practices that protect data as well as computer and network systems. In this article, we develop four course modules on critical cybersecurity topics that can be adopted in college-level cybersecurity courses in which these topics are covered. Our goal for developing these course modules with the hands-on labs is to increase students’ understanding and hands-on experiences on these critical topics that support cyber skills development for college students. The hands-on labs are designed to enhance students’ engagement and provide them hands-on experiences with real-world cyber activities to augment their cyber education of both foundational and advanced skills. We also conduct research surveys on the most-recent significant research in these critical cybersecurity fields. These cybersecurity course modules with the labs are also designed to help college/university professors enhance and update their cybersecurity course content, activities, hands-on lab exercises, and pedagogical methods, as well as emphasize the cyber skills to meet today’s pressing cybersecurity education needs for college students. Our proposed cybersecurity modules with hands-on labs will also help building the nation’s cybersecurity workforce.

Private-Sector Attribution of Cyber Incidents: Benefits and Risks to the U.S. Government

In a blog post in June 2016, the threat intelligence company CrowdStrike attributed the breach of the Democratic National Committee’s (DNC’s) networks to two groups of cyber actors closely linked t...

Cyber Attribution: Technical and Legal Approaches and Challenges

Abstract Considering the role of attribution in the law of state responsibility, this article examines the technical and international law methodologies and determinants used when attributing malicious cyber activities falling below the use-of-force threshold to a state, and identifies the challenges that arise which lead to responsibility gaps. The article goes on to discuss a number of proposals that aim to improve the effectiveness of the attribution process and also close some of the existing responsibility gaps. They include institutional proposals envisaging the creation of an international attribution agency; normative proposals advocating the revision of the legal determinants of attribution; and proposals concerning the standard of proof. The aim of the article is to reconstruct the theory and practice of cyber attribution in order to enhance the regulatory potential of international law in this area.

Joint Modelling of Cyber Activities and Physical Context to Improve Prediction of Visitor Behaviors

This article investigates the cyber-physical behavior of users in a large indoor shopping mall by leveraging anonymized (opt in) Wi-Fi association and browsing logs recorded by the mall operators. Our analysis shows that many users exhibit a high correlation between their cyber activities and their physical context. To find this correlation,propose a mechanism to semantically label a physical space with rich categorical information from DBPedia concepts and compute a contextual similarity that represents a user’s activities with the mall context. We demonstrate the application of cyber-physical contextual similarity in two situations: user visit intent classification and future location prediction. The experimental results demonstrate that exploitation of contextual similarity significantly improves the accuracy of such applications.

Cybercrime vs. Cyberwar: Paradigms for Addressing Malicious Cyber Activity

This contribution seeks to identify and assess the frameworks used to describe and deter malicious cyber activity (MCA), and to highlight legal and operational challenges in tackling problems that arise where these frameworks overlap or intersect. To that end, we examine two different models, an “armed conflict model” and a “law enforcement model,” that have been used to address the threat posed by such activity. The terms cyber-war and cyber-crime, respectively, encapsulate each of these models — yet the line separating these categories is not well defined, and both terms have been used by laypersons and experts alike to describe conduct ranging from network intrusions to data ex-filtration to denials-of-service. Our analysis of these ambiguities and their implications proceeds in four parts. Part I describes. Part II explores the assumptions underlying the predominant armed conflict model. Part III discusses the implications of characterizing MCA as cyber-war as opposed to cyber-crime. Part IV concludes by suggesting that these characterizations should be viewed along a continuum, and that the law enforcement model should not be given short shrift by policy-makers or — perhaps most importantly — appropriators.

Operation “Olympic Games.” Cyber-sabotage as a tool of American intelligence aimed at counteracting the development of Iran’s nuclear programme

The purpose of the article is to analyse Operation “Olympic Games” including, in particular, to indicate the political background to the activities aimed at preventing the development of Iran’s nuclear programme, and to examine the preparation and conduct of the operation, the involvement of the US and Israeli intelligence services, and the use of intelligence methods and sources. An equally important objective is to indicate the real consequences of the cyberattack with the Stuxnet virus. In the research process, a critical analysis of literature in the field of Intelligence Studies and source materials (including legal acts, strategies, reports, and other official studies of the entities forming the US Intelligence Community) was carried out. The example of Operation Olympics Games shows that complex cyber-sabotage operations resulting in the destruction of critical infrastructure on a large scale require the involvement of numerous state resources and advanced cyber activities, and the use of many different methods and intelligence sources. Thus, strong states with well-developed intelligence capabilities are much more capable of effectively using cyber-sabotage on a large scale.