Cyber Battlefield Research Articles

Under Attack in the Cyber Battlefield: A Scoping Review of Journalists’ Experiences of Cyberharassment

ABSTRACT This scoping review synthesises evidence on journalists’ experiences of online harassment. This review aims to (i) understand the prevalence and impact of cyberharassment among journalists, (ii) explore coping strategies adopted by this population, and (iii) map out differences influenced by sociodemographic characteristics. The search was performed until 31st August 2023 in 4 database hosts, accessing a total of 13 databases. A total of 19 records were deemed eligible for inclusion in this review. This review demonstrates that online harassment of journalists is pervasive on a global scale and that it is not confined to a particular geographical region, culture, or sociopolitical context. Apart from a myriad of emotional and psychological sequalae on an individual and collective level, cyberharassment of journalists threatens press freedom and deters the journalistic “watchdog” role through the promotion of self-censorship. There is significant knowledge about female journalists’ lived experiences of cyberharassment, partly due to the amplified frequency and severity of the abuse that is received. Yet little is known about the impact of cyberharassment on male journalists, and journalists with marginalised identities. Recommendations for the mitigation of the effects of cyberharassment among journalists are imparted on an individual, collective, organisational and societal level.

A Small State’s Cyber Posture: Deterrence by Punishment and Beyond

This study explores a small-state’s offensive cyber capabilities as a deterrent against great-power cyber hostilities. More specifically, it poses the question: Could Norway successfully deter hostile cyber operations of greater powers, notably China and Russia, by signaling a resolve to retaliate within the same domain? The study reviews literature on the small state’s prospects of acquiring relevant offensive cyber capabilities; successfully signaling a deterrence-by-punishment posture; and, more generally, on the intricacies of retaliating against a greater power. The study concludes that most small states would enter the cyber battlefield with non-strategic and surreptitious capabilities, be inclined to signal their resolve with considerable ambiguity, and be compelled to respond with deniable means. It finds that such obscure features – the hallmarks of murky clandestine operations rather than a strategic posture – do not provide efficacious deterrence. Hence, to Norway and similar small states, deterrence by punishment may be an elusive, if not altogether vain, cyber posture.

Research on Cyber ISR Visualization Method Based on BGP Archive Data through Hacking Case Analysis of North Korean Cyber-Attack Groups

North Korean cyber-attack groups such as Kimsuky, Lazarus, Andariel, and Venus 121 continue to attempt spear-phishing APT attacks that exploit social issues, including COVID-19. Thus, along with the worldwide pandemic of COVID-19, related threats also persist in cyberspace. In January 2022, a hacking attack, presumed to be Kimsuky, a North Korean cyber-attack group, intending to steal research data related to COVID-19. The problem is that the activities of cyber-attack groups are continuously increasing, and it is difficult to accurately identify cyber-attack groups and attack origins only with limited analysis information. To solve this problem, it is necessary to expand the scope of data analysis by using BGP archive data. It is necessary to combine infrastructure and network information to draw correlations and to be able to classify infrastructure by attack group very accurately. Network-based infrastructure analysis is required in the fragmentary host area, such as malware or system logs. This paper studied cyber ISR and BGP and a case study of cyber ISR visualization for situational awareness, hacking trends of North Korean cyber-attack groups, and cyber-attack tracking. Through related research, we estimated the origin of the attack by analyzing hacking cases through cyber intelligence-based profiling techniques and correlation analysis using BGP archive data. Based on the analysis results, we propose an implementation of the cyber ISR visualization method based on BGP archive data. Future research will include a connection with research on a cyber command-and-control system, a study on the cyber battlefield area, cyber ISR, and a traceback visualization model for the origin of the attack. The final R&D goal is to develop an AI-based cyber-attack group automatic identification and attack-origin tracking platform by analyzing cyber-attack behavior and infrastructure lifecycle.

Research on Cyber IPB Visualization Method based on BGP Archive Data for Cyber Situation Awareness

Cyber powers around the world are conducting cyber information-gathering activities in cyberspace, a global domain within the Internet-based information environment. Accordingly, it is imperative to obtain the latest information through the cyber intelligence preparation of the battlefield (IPB) process to prepare for future cyber operations. Research utilizing the cyber battlefield visualization method for effective cyber IPB and situation awareness aims to minimize uncertainty in the cyber battlefield and enable command control and determination by commanders. This paper designed architecture by classifying cyberspace into a physical, logical network layer and cyber persona layer to visualize the cyber battlefield using BGP archive data, which is comprised of BGP connection information data of routers around the world. To implement the architecture, BGP archive data was analyzed and pre-processed, and cyberspace was implemented in the form of a Di-Graph. Information products that can be obtained through visualization were classified for each layer of the cyberspace, and a visualization method was proposed for performing cyber IPB. Through this, we analyzed actual North Korea’s BGP and OSINT data to implement North Korea’s cyber battlefield centered on the Internet network in the form of a prototype. In the future, we will implement a prototype architecture based on Elastic Stack.

New method for assets sensitivity calculation and technical risks assessment in the information systems

One of the most important components constructing the information security management system is the risk assessment process. Information technology system risks have a direct impact on the mission of organisations. Risk assessment allows organisations to identify weaknesses and security threats, and adopt appropriate solutions to deal with risks. The risk identification and assessment is the most important and complex part of the risk management process. In this study, a method has been presented to asset technical risks with regard to the sensitivity of each of the assets. In this research, the cyber battlefield framework has been presented to analyse the assets' sensitivity and then to determine the risk of each. The cyber battlefield contains exact information about cyber environment, including a vulnerability of knowledge repository, tangible and intangible components of cyber environment, and the relationships between them. Cyber-attacks are performed using vulnerabilities in the cyber environment components, so the present study focuses on the provision of a method to determine the risk due to the vulnerabilities. Considering the cost of risks treatment, the risks have been prioritised.

A Framework to Create a Virtual Cyber Battlefield for Cyber Maneuvers and Impact Assessment

One of the best ways to recognize cyber threats is to perform cyber maneuvers. Performing cyber maneuvers in the operating environment has many challenges. The proposed approach is to perform cyber maneuvers and security analyses on a virtual environment that is quite similar to the physical environment. This challenge has been solved by modeling and simulating cyber battlefield. In this model, by gathering detailed data of cyberspace elements including knowledge repository of vulnerability, tangible and intangible elements of cyberspace and the relationships between them, cyber maneuvers, penetration testing, cyber-attacks injection, attack tracking, visualization, cyber-attacks impact assessment and risk assessment can be provided and executed. This research provides a model and tool for identifying the risks in the network and helping to prioritize actions to eliminate threats. For evaluation, the results were compared with the output of the security tools of the Iran fuel smart card project system and the results were reviewed in the focus group.

Presenting a method to perform cyber maneuvers

Performing cyber maneuvers in an operational environment is not easy. We need a cyber-situational awareness framework to perform its maneuvers to protect the cyberspace and to cope with its attacks. The battlefield provided has essential information for detecting cybercrime events. The present study resolved the challenges of implementing these maneuvers through dynamic simulation of the cyber battlefield. The cyber battlefield contains detailed information on cyberspace elements, including the vulnerability knowledge repository, the tangible and intangible components of the cyberspace allowing maneuvering, penetration testing, injection attacks, tracking attacks, visualization, evaluation of the impact of cyberattacks, and risk evaluation. By injecting attacks and using the proposed algorithms, an impact assessment of each attack step on each of the elements of the environment has been done to identify potential threats. Using the proposed algorithms, an impact assessment has been performed on each of the environmental elements in order to identify potential threats. A dynamic updating simulator engine has been designed to update the vulnerability knowledge base automatically and change the topology and features of elements, accesses, services, hosts, and users. Modeling and simulation were evaluated using a qualitative research method and creating a focus group.

A framework to achieve dynamic model of cyber battlefield

With fast growth of cyber space and related network infrastructures, it is important to detect the intrusion and respond to it in a timely manner. Cyber-attacks are in progress and are becoming more complex, as a result, more sensitive and more difficult to defend cyberspace. To determine the best response to cyber-attacks and cyber protection are cyber situation awareness. To achieve this goal, we require a framework to provide the possibility of cyber maneuvers. In this research running cyber maneuvers by simulating the dynamic cyber battlefield. Cyber battlefield contains the information necessary to detect cyber incidents. This paper aims to present a novel method for integrated model of cyber battlefield. It is necessary to execution cyber maneuvers to achieve cyber situation awareness. In this cyber defense model, situation awareness presents useful information (in a real time) to the analyst cyber space. The present study presents a framework of cyber situation awareness for accurate inspection of the current situation of cyber battlefield and cyber maneuvers. This method would be successful in exposing cyber threats for timely response.

Cyberwarfare

Perpetrators and victims usually act as if it never happened, while the evidence is designed to erase itself. Cyberwarfare is a potent weapon in political conflicts, espionage, and propaganda. Difficult to detect a priori, it is often recognized only after significant damage has been done. Gaining offensive capability on the cyber battlefield figures prominently in the national strategies of many countries and is explicitly stated in the doctrines of several, including China, Russia, and the U.S. It is generally understood they are laying the groundwork for potential cyber conflicts by hacking the networks of adversaries and allies alike.