Cyber Defense System Research Articles

Formation of the TNI Cyber Force: A Strategic and Policy Analysis

The increasing cyber threats in Indonesia require strengthening the country's defense strategy. This study focuses on the formation of the Indonesian National Army (TNI) Cyber Force as part of efforts to strengthen the country's cyber security in facing increasingly complex threats. The purpose of this study is to analyze the policy and strategy for the formation of the TNI Cyber Force and evaluate the synergy between institutions, especially with the National Cyber ​​and Crypto Agency (BSSN). This study uses a qualitative method with a secondary data analysis approach, including reports from Fortinet, AwanPintar.id, and national policy documents related to cybersecurity. The research findings show that the TNI Cyber Force has a crucial role in protecting Indonesia's critical infrastructure from the threat of botnets, ransomware, and other cyber-attacks. The synergy between the TNI and BSSN is key to building an effective cyber defense system. Although there has been an increase in cyber readiness, this study found that challenges still exist, including in terms of human resources and the technology used. In conclusion, the formation of the TNI Cyber Force is an important step in dealing with cyber threats, but there needs to be further strengthening in cross-sector coordination and adoption of the latest technology.

Modelling of Cyber Attack Detection and Response System for 5G Network Using Machine Learning Technique

The rapid increase in the adoption of 5G networks has revolutionized communication technologies, enabling high-speed data transmission and connectivity across various domains. However, the advent of 5G technology comes with an increased risk of cyber-attacks and security breaches, necessitating the development of robust defence mechanisms to safeguard network infrastructure and mitigate potential threats. The work presents a novel approach for modelling a cyber-attack response system tailored specifically for 5G networks, leveraging machine learning techniques to enhance threat detection and response capabilities. The study introduced innovative methodologies, including the integration of standard backpropagation and dropout regularization technique. Furthermore, an intelligent cyber threat classification model that proactively detects and mitigates malware threats in 5G networks was developed. Additionally, a comprehensive cyber-attack response model designed to isolate threats from the network infrastructure and mitigate potential security risks was formulated. The result of testing the response algorithm with simulation, and considering quality of service such as throughput, latency and packet loss, showed 80.05%, 24.9ms and 4.09% respectively. During system integration of the model on 5G network with stimulated malware, the throughput reported 71.81%. Also, packet loss reported loss rate of 23.18%, while latency reported 178.98ms. Our findings contribute to the advancement of cybersecurity in 5G environments and lay the foundation for the development of robust cyber defence systems to safeguard critical network infrastructure against emerging threats.

A cyber defense system against phishing attacks with deep learning game theory and LSTM-CNN with African vulture optimization algorithm (AVOA)

Phishing attacks pose a significant threat to online security, utilizing fake websites to steal sensitive user information. Deep learning techniques, particularly convolutional neural networks (CNNs), have emerged as promising tools for detecting phishing attacks. However, traditional CNN-based image classification methods face limitations in effectively identifying fake pages. To address this challenge, we propose an image-based coding approach for detecting phishing attacks using a CNN-LSTM hybrid model. This approach combines SMOTE, an enhanced GAN based on the Autoencoder network, and swarm intelligence algorithms to balance the dataset, select informative features, and generate grayscale images. Experiments on three benchmark datasets demonstrate that the proposed method achieves superior accuracy, precision, and sensitivity compared to other techniques, effectively identifying phishing attacks and enhancing online security.

Features of liability for cyber-attacks in EU countries

The article is devoted to the peculiarities of responsibility for cyber-attacks in the countries of the European Union. It is noted that cyber-attacks on state bodies can be a component of cyber war or hybrid war and at the same time pose a threat to national and global security, as they can lead to the leakage of important information, disrupt the operation of state systems and lead to various negative consequences. So, for example, in Europe, the main goals of hackers from 2022, in addition to Ukraine, became Poland, the Baltic countries, Northern Europe and Germany. The share of cyberattacks on European Union (EU) countries increased from about 10% in the first quarter of 2022 to almost 50% in 2023. In total, 162 cyber-attacks were carried out on Ukraine in 2022; to Poland – 114; Estonia, Lithuania and Latvia – 157; Sweden, Norway, Denmark and Finland – 95, Germany – 57.
 An increase in the activity of cyber-attacks on the networks of the energy sector, the diplomatic corps, law enforcement agencies, the defense complex, state enterprises and media companies has been established. The main goal of these attacks is to damage the country’s critical infrastructure. Globally, there has been a steady trend towards an increase in the number of targeted cyber-attacks on critical infrastructure facilities in recent years. And therefore, in connection with the possible negative consequences in the case of the implementation of cyber-attacks, it is important to note that ensuring the effective functioning of the country’s cyber defense system remains a high-priority task. Each year underscores the urgency of this challenge as threats in cyberspace continue to grow and become more highly specialized.
 It was concluded that their public attribution will be important for determining possible responsibility in the countries of the European Union for a cyber-attack, which will include the identification and public announcement of who is behind a specific cyber-attack that affects state, commercial or other objects.

Zero-Trust Marine Cyberdefense for IoT-Based Communications: An Explainable Approach

Integrating Explainable Artificial Intelligence (XAI) into marine cyberdefense systems can address the lack of trustworthiness and low interpretability inherent in complex black-box Network Intrusion Detection Systems (NIDS) models. XAI has emerged as a pivotal focus in achieving a zero-trust cybersecurity strategy within marine communication networks. This article presents the development of a zero-trust NIDS framework designed to detect contemporary marine cyberattacks, utilizing two modern datasets (2023 Edge-IIoTset and 2023 CICIoT). The zero-trust NIDS model achieves an optimal Matthews Correlation Coefficient (MCC) score of 97.33% and an F1-score of 99% in a multi-class experiment. The XAI approach leverages visual and quantitative XAI methods, specifically SHapley Additive exPlanations (SHAP) and the Local Interpretable Model-agnostic Explanations (LIME) algorithms, to enhance explainability and interpretability. The research results indicate that current black-box NIDS models deployed for marine cyberdefense can be made more reliable and interpretable, thereby improving the overall cybersecurity posture of marine organizations.

AI-based model for fraud detection in bank systems

Due to the very high direct or indirect costs of fraud, banks and financial institutions seek to accelerate the recognition of the activities of fraudsters. The reason for this is its direct effect on serving the customers of these institutions, reducing operating costs and remaining as a reliable and valid financial service provider. On the other hand, in recent years, with the development of information and communication technology, electronic banking has become very popular. In the meantime, it is inevitable to use fraud detection techniques to prevent fraudulent actions in banking systems, especially electronic banking systems. In this paper, a method has been developed that leads to the improvement of fraud detection in information security and cyber defense systems. The main purpose of fraud detection systems is to predict and detect false financial transactions and improve the intrusion detection system using information classification. In this regard, the genetic algorithm, which is known as one of the stochastic optimization methods, is used. At the end, the results of the genetic algorithm have been compared with the results of the decision tree classification and the regression tree. The simulation results show the effectiveness and superiority of the proposed method.

Analysis of adversarial attacks on the machine learning models of cyberprotection systems.

Modern trends in the development of cyber protection systems are associated with the widespread use of machine learning technologies to detect and prevent cyber threats. At the same time, attackers are looking for ways to evade detection by such systems, using both traditional attack methods and new ones aimed exclusively at countering artificial intelligence - adversarial attacks. Therefore, finding ways to counteract adversarial attacks is an urgent scientific and technical task. Adversarial Machine Learning (AML) is used to study them, which consists in simulating such attacks. The purpose of research is to determine ways to increase the resilience of cyber defense systems operating with the use of machine learning technologies to the impact of attacks based on AML models. The article provides examples of the application of machine learning methods in cyber protection systems. The models of adversarial attacks are described, namely: models of evasion, poisoning, functional extraction, inversion, and models of membership inference attack. Possible scenarios of their implementation are considered. Examples of adversarial attacks on machine learning models for recognizing images and text messages, detecting domain name generation algorithms, HTTP traffic malware, malicious content in e-mails, bypassing antivirus software are analyzed. Studies have shown that even without access to the algorithms of machine learning models, it is possible to bypass the cyber protection system. Therefore, to ensure the security of networks and services by means of cyber protection with artificial intelligence, it is necessary to take into account the need to counter adversarial attacks. For this purpose, it is proposed to: collect and aggregate training data for each machine learning model individually, instead of obtaining them from publicly available sources; optimize the content of event logs, taking into account the possibility of using the information contained in them to create adversarial attacks; to ensure the protection of training data and algorithms of the functioning of models; in the case of deploying cyber protection systems on critical infrastructure objects, use specially developed machine learning models that are not publicly available, which will complicate the possibility of creating a functional extraction attack.

A Graphical and Qualitative Review of Literature on AI-based Cyber-Threat Intelligence (CTI) in Banking Sector

Cyber threats have become a threat to the banking industry, and resulting in the business attempting to implement artificial intelligence strategies while build resilient cyber-defense systems. This is done to ensure that unauthorized access, which leads to cyber-attacks, is severely limited. The credit trade is undergoing significant technical change. Because of this, crucial to comprehend implications a cyber threat, as well as how technologies implementation that is artificial intelligence will revolutionize entire sector. Paper aims at examining how AI affects cyber threat intelligence in the commerce subdivision. A graphical and qualitative analysis of available publications, primarily conference papers, was carried out. Despite being widely used in India and the United States, there are still few studies in the AI field. Furthermore, no study found that African banks used AI for cyber threat intelligence.

Malware Attack Detection in Large Scale Networks using the Ensemble Deep Restricted Boltzmann Machine

Today, cyber attackers use Artificial Intelligence (AI) to boost the sophistication and scope of their attacks. On the defense side, AI is used to improve defense plans, robustness, flexibility, and efficiency of defense systems by adapting to environmental changes. With the developments in information and communication technologies, various exploits that are changing rapidly constitute a danger sign for cyber security. Cybercriminals use new and sophisticated tactics to boost their attack speed and size. Consequently, there is a need for more flexible, adaptable, and strong cyber defense systems that can identify a wide range of threats in real time. In recent years, the adoption of AI approaches has increased and maintained a vital role in the detection and prevention of cyber threats. This paper presents an Ensemble Deep Restricted Boltzmann Machine (EDRBM) to classify cybersecurity threats in large-scale network environments. EDRBM acts as a classification model that enables the classification of malicious flowsets in a large-scale network. Simulations were carried out to evaluate the efficacy of the proposed EDRBM model under various malware attacks. The results showed that the proposed method achieved a promising malware classification rate in malicious flowsets.

Deep Learning-Based Symptomizing Cyber Threats Using Adaptive 5G Shared Slice Security Approaches

In fifth Generation (5G) networks, protection from internal attacks, external breaches, violation of confidentiality, and misuse of network vulnerabilities is a challenging task. Various approaches, especially deep-learning (DL) prototypes, have been adopted in order to counter such challenges. For 5G network defense, DL module are recommended here in order to symptomize suspicious NetFlow data. This module behaves as a virtual network function (VNF) and is placed along a 5G network. The DL module as a cyber threat-symptomizing (CTS) unit acts as a virtual security scanner along the 5G network data analytic function (NWDAF) to monitor the network data. When the data were found to be suspicious, causing network bottlenecks and let-downs of end-user services, they were labeled as “Anomalous”. For the best proactive and adaptive cyber defense system (PACDS), a logically organized modular approach has been followed to design the DL security module. In the application context, improvements have been made to input features dimension and computational complexity reduction with better response times and accuracy in outlier detection. Moreover, key performance indicators (KPIs) have been proposed for security module placement to secure interslice and intraslice communication channels from any internal or external attacks, also suggesting an adaptive defense mechanism and indicating its placement on a 5G network. Among the chosen DL models, the CNN model behaves as a stable model during behavior analysis in the results. The model classifies botnet-labeled data with 99.74% accuracy and higher precision.

DESIGNING A FRAMEWORK FOR CYBER PROTECTION BASED ON UNIQUE IDENTIFICATION TO IMPROVE THE SECURITY OF ETHIOPIAN SOCIAL MEDIA USERS OVER FACEBOOK

The social media like Facebook is one of the prominent having 2.6 billion monthly active users. However, Facebook users pose different security threats by impersonation and spreading untrue information. Nowadays, there are numerous threats to social media such as Facebook in Ethiopia. Due to this problem, it is significant to design remedial solutions for such problems. This research study aims to establish a Unique-ID-based Cyber Defense Framework to enhance the security of Facebook users and inhibit the creation of fake profiles and impersonation by spammers. The researcher followed an exploratory with a constructive research design using surveys, and in-depth interview-based primary data analytics. The study concluded with a Unique-ID-based Cyber Defense Framework consisting of application and security layers with various critical components. In the proposed system, the Digital Residential ID issued for Addis Ababa residents is used to cross-check the user-provided data with the resident DB to check the authenticity of the user based on the country code. After that, a framework and its prototype are developed. The result of user acceptance test shows an optimistic answer i.e., 87% of respondents accepted the research outcomes as a positive contribution. On the other hand, 13% still have a dilemma to accept a new and innovative contribution for an enhanced Unique-ID-based Cyber defense system to improve the security of Facebook users. The study concluded by noticing every time a user attempts to create a Facebook account, the user will be asked to confirm his/her uniqueness. Also, they could be prohibited from establishing fake or multiple accounts. Keywords: Country code, Cyber defense Facebook, Fake profile, Impersonation, Security Threat, Unique Id

Applying Access Control Enabled Blockchain (ACE-BC) Framework to Manage Data Security in the CIS System.

Cybersecurity information sharing (CIS) is important in different business processes to secure data transmission, because it comprises Internet of Things (IoT) connectivity, workflow automation, collaboration, and communication. The shared information is influenced by intermediate users and alters the originality of the information. Although risk factors such as confidentiality and privacy of the data are reduced when using a cyber defense system, existing techniques rely on a centralized system that may be damaged during an accident. In addition, private information sharing faces rights issues when accessing sensitive information. The research issues influence trust, privacy, and security in a third-party environment. Therefore, this work uses the Access Control Enabled Blockchain (ACE-BC) framework to enhance overall data security in CIS. The ACE-BC framework uses attribute encryption techniques to manage data security, while the access control mechanism limits unauthorized user access. The effective utilization of blockchain techniques ensures overall data privacy and security. The efficiency of the introduced framework was evaluated using experimental results, and the experimental outcome indicated that the recommended ACE-BC framework enhanced the data confidentiality ratio (98.9%), the throughput ratio (98.2%), the efficiency ratio (97.4%), and the latency rate (10.9%) when compared to other popular models.

Fingerprinting Network Sessions for the Discovery of Cyber Threats

A
 rtificial intelligence (AI) assisted cyber-attacks, within the network cybersecurity domain, have evolved to be more successful at every phase of the cyber threat lifecycle. This involves, amongst other tasks, reconnaissance, weaponisation, delivery, exploitation, installation, command & control, and actions. The result has been AI-enhanced attacks, such as DeepLocker, self-learning malware and MalGan, which are highly targeted and undetectable, and automatically exploit vulnerabilities in existing cyber defence systems
 . Countermeasures would require significant improvements in the efficacy of existing cyber defence systems to enable the discovery and detection of AI-enhanced attacks in networks in general. The challenge is that rule-and-anomaly-based intrusion detection approaches would need to be evolved into a dynamic self-learning approach before being able to discover “undetectable” network threats. The problem is that, when considering current state-of-the-art network cybersecurity countermeasures, this has not yet been achieved. One of the key challenges in achieving this is the inability to extract meaningful information from network packets. The novel solution proposed in this paper is to fingerprint network sessions. Each fingerprint is represented by a two-dimensional matrix that can be visualised, comprising a unique session key, the protocol discourse and the transmitted data. This is achieved by extracting information, summarising network session key events, encoding the received data, and merging it with existing fingerprints. The unique key and transmitted data are encoded using a Hilbert curve, while the protocol discourse is encoded into a tornado diagram. The resulting visualised network session fingerprints reveal hidden patterns that are ideal for subsequent pattern recognition, reinforcement learning (RL) or support vector machines (SVM) training to discover AI-enhanced cyber threats as they evolve.

Adaptive Cyber Defense Technique Based on Multiagent Reinforcement Learning Strategies

The static nature of cyber defense systems gives attackers a sufficient amount of time to explore and further exploit the vulnerabilities of information technology systems. In this paper, we investigate a problem where multiagent systems sensing and acting in an environment contribute to adaptive cyber defense. We present a learning strategy that enables multiple agents to learn optimal policies using multiagent reinforcement learning (MARL). Our proposed approach is inspired by the multiarmed bandits (MAB) learning technique for multiple agents to cooperate in decision making or to work independently. We study a MAB approach in which defenders visit a system multiple times in an alternating fashion to maximize their rewards and protect their system. We find that this game can be modeled from an individual player’s perspective as a restless MAB problem. We discover further results when the MAB takes the form of a pure birth process, such as a myopic optimal policy, as well as providing environments that offer the necessary incentives required for cooperation in multiplayer projects.

Utilizing Deep Learning to Identify Potentially Dangerous Routing Attacks in the IoT

Due to the rapid increase of cyber-security difficulties brought about by sophisticated assaults such as data injection attacks, replay attacks, etc., the design of cyber-attack detection and control systems has emerged as an essential subfield within cyber-physical systems (CPSs) during the past few years. The outcome of these attacks could be a system failure, malfunctioning, or other undesirable effects. Consequently, it may be necessary to implement the cyber defense system in preparation for impending CPSs to have an improved security system. The various cyber-attack detection schemes based on deep learning algorithms have been intended to detect and mitigate the cyber-attacks that can be launched against CPSs, smart grids, power systems, and other similar infrastructure. This article comprehensively reviews several different deep learning algorithms suggested for use in CPSs to accomplish cyber defense. In the beginning, several methods devised by earlier academics are analyzed in great detail. After that, a comparison study is performed to determine the shortcomings of each algorithm and offer a recommendation for how further improvements to CPSs might be made more effectively.

Decision-making in a state cybersecurity

Nowadays, the issue of cyber security as a component of information security of the state is extremely relevant for Ukraine and the World community. Even so, it should be taken into account that the use of cyberspace expands people's communication capabilities, promotes the development of information technologies, research and novelty, and stimulates the development of industry and the economy. Nevertheless, the advantages of modern cyberspace can lead to new threats to people, society, national and international security. Along with initiatives of natural (unintentional) origin, the number and power of cyberattacks is increasing. These cyberattacks are inspired by the interests of individuals, groups, states, and associations of states. Increasing the effectiveness of mathematical modeling of state cyber security information systems can be ensured by modeling both the complex system and the subsystems that are the essential part of it. It stimulates the progress of models and algorithms that allow solving complex problems of system management and processing of the information flow. Furthermore, it is necessary to limit the tolerance interval of the solution for each task of the complex system of cyber security information systems. The following steps should be taken into account: – assignment of directive terms for solving problems; – information related tasks of information processing and transmission. The analysis of the research shows the weakness of a conventional approach to the complex solution of the problem of the synthesis of mathematical models and algorithms for determining the time of decision-making in the system of both security and information cyber security; methods of countering threats, mathematical methods of modeling, creating and evaluating models of both cyberattacks and cybersecurity and solving the problem of synthesis of mathematical models and algorithms for determining the time of decision-making in the system of both security and cyber security information systems. The defined issue is an unperformed part of the general problem of ensuring information security in complex systems of technical protection and information cyber security. The tasks belong to the class of problems of nonlinear mathematical programming. Performing them, methods of the theory of nonlinear programming can be used. The main priority of the tasks is its large dimension, which has a number of tasks that are performed in the network and are introduced in the information correlation. One of the current approaches to perform non-linear programming problems of large dimensions is the use of approximation methods of the theory of non-linear programming, the essence is that the solution of the finite-dimensional nonlinear complementarity problem is carried out as a result of solving a sequence of problems of a simpler type, which require significantly optimization operating costs than the original problem. Linear approximation is not always effective as it allows to obtain only a necessarily approximate value. Lately, the new research has introduced an approach to eliminate this fault with the help of auxiliary quadratic equation. The minimization method takes a special place among these methods. Unlike other methods of this class, it converges to any initial approximation and does not require assumptions about the convexity of functions, does not require firm positive certainty of the matrix of second derivatives of Lagrange functions, and has a fairly simple structure of the auxiliary quadratic problem. Hence, the linearization method has a linear rate of ascent. However, there is a modification of the method that means that at a considerable distance from the extremum point, the speed of convergence is linear, and with sufficient proximity to it, it is quadratic. Solving quadratic problems is not exact and only those restrictions with the maxima acceptable limits can be taken into account. This feature minimizes the dimension of auxiliary problems and thereby minimizes the computer complexity of the original nonlinear problem. The described algorithm is implemented in the form of applied programs for evaluating the effectiveness of algorithms for determining the time of decision-making by cyber security information systems. Thus, the given results can be used in the development of effective decision-making time determination algorithms based on mathematical models for decision-making support systems of the cyber security information system, as well as for modeling complex technical systems and assessing the effective use of several computing information systems. Key words: cyber security, cyber defense, cyber attacks, cyber defense system, information protection, state protection, cyber space, communication channels.

A CRITICAL EXAMINATION OF SHIELDING THE CYBERSPACE: A REVIEW ON THE ROLE OF AI IN CYBER SECURITY

This review focuses on the critical analysis of AI’s role in cybersecurity to investigate the issues in the cybersecurity space. By utilizing synchronous and scattered sources on the topic in question, the opinion paper focuses capacity on AI-embedded technologies to enhance cybersecurity and discourage cyber-attacks making critical infrastructure impenetrable by malicious persons [1]. The paper is concerned with applying AI solutions paired with research documenting theoretical outcomes obtained from academic sources, field reports, and practical case examples. Suggestions, pros, and cons of those solutions, as well as the implications, are presented. More importantly, the paper does not only touch on the ethical and policy aspects of AI application in cyber security, but there is also a need for a detailed approach to cyber security, an approach that unites technological innovation to privacy, transparency, and accountability [1]. In contrast, the article brings attention to future developments and innovations in AI-based cybersecurity, which is a crucial need of the hour. AI evolution is seen in different aspects, such as designing complex Machine Learning algorithms till the inclusion of AI in Security Operations Centers (SOCs) and Threat Intelligence Platforms, which have prepared reliable weapons for cyber defense systems.

Artificial Intelligence and Cyber Defense System for Banking Industry: A Qualitative Study of AI Applications and Challenges

Cyberattacks are becoming more and more intense in the banking industry (Ryzhkova et al. 2020). Banking industry is trying to adopt artificial intelligence to create cyber defence system so that the unauthorized access and cyber attacks would be minimized. Banks in Qatar acknowledge the threat of cybercrimes and the role of cybersecurity in sustainable growth. Meanwhile, the banking industry is experiencing a major technological disruption. It becomes important to understand the implications of such technologies as artificial intelligence (AI) on the cybersecurity of banks. The present paper aims to explore the impacts of AI on the cybersecurity of banks in Qatar. A thematic analysis of interviews of 9 experts in the banking industry of Qatar was conducted. A qualitative thematic analysis was conducted using NVIVO 12 tool. Four key themes were identified: (1) AI is a major tool for enhancing the cybersecurity of banks in Qatar; (2) banks face challenges in using AI for improving cybersecurity; (3) AI can be used destructively and thus poses a threat to cybersecurity in banks of Qatar; (4) employed AI-based tools have vulnerabilities that can be exploited. Overall, Qatar banks can be expected to face new challenges in the future, due to changes in regulatory frameworks and increasing availability of AI-powered malware.

Raspberry Pi-based Intelligent Cyber Defense Systems for SMEs and Smart-homes: An Exploratory Study

Ongoing ransomware attacks have forced business to think about security of their resources. Recently, small- to-medium enterprises (SMEs) and Smart-homes have become easy targets for attackers since they don’t have cyber defense mechanism in place other than simple firewall systems which are quite vulnerable. Cyber defense systems are costly and often not within the budget of SMEs or families which inspired to think about low cost yet highly efficient cyber defense solutions. Regular individuals and families who use internet for day to day use often end-up becoming a possible resource for using them as Trojan or bitcoin nodes. This research explores the prospects of implementing a Raspberry Pi (Raspberry Pi)-based intelligent cyber- defense system (iCDS) for SME networks and Smart-homes to filter malicious contents from incoming traffic and detect malware using artificial intelligence.
 Primarily, the work presented in this paper tries to evaluate the hardware capability of network interfaces (both internal, and attached) of Raspberry Pi for handle high volumes of incoming traffic. For this, we measure the network performance of the Raspberry Pi using the speed test software and try to explore the possibility of a light weight machine learning (ML) based malware detection. The results show that the built in Ethernet interface outperforms the built in WiFi and external attached USB to Ethernet Adapter in terms of latency, download and upload throughput. Also, a new DNA based ML approach was successfully able to produce over 19.5% better accuracy rates of over classifier trained with hash-sequence. The experiment results further emphasise on the importance of generating complex malware signatures with variety to face existing threats which has taken a new form due to increase in malware based attacks, particularly for ransomware. The complexity of the generated malware is based on generic yet strong encryption principles which produced good results which is quite encouraging at this stage.

Zero-Bias Deep-Learning-Enabled Quickest Abnormal Event Detection in IoT

Abnormal event detection with the lowest latency is an indispensable function for safety-critical systems, such as cyber defense systems. However, as systems become increasingly complicated, conventional sequential event detection methods become less effective, especially when we need to define indicator metrics from complicated data manually. Although deep neural networks (DNNs) have been used to handle heterogeneous data, the theoretic assurability and explainability are still insufficient. This article provides a holistic framework for the quickest and sequential detection of abnormalities and time-dependent abnormal events. We explore the latent space characteristics of zero-bias neural networks considering the classification boundaries and abnormalities. We then provide a novel method to convert zero-bias DNN classifiers into performance-assured binary abnormality detectors. Finally, we provide a sequential quickest detection (QD) scheme that provides the theoretically assured lowest abnormal event detection delay under false alarm constraints using the converted abnormality detector. We verify the effectiveness of the framework using real massive signal records in aviation communication systems and simulation. Codes and data are available at <uri xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">https://github.com/pcwhy/AbnormalityDetectionInZbDNN</uri> .