Cyber Defense System Research Articles

THE METHODS OF ARTIFICIAL INTELLIGENCE FOR MALICIOUS APPLICATIONS DETECTION IN ANDROID OS

This paper presents and discusses a method for Android’s applications classification with the purpose of malware detection. Based on the application of an Artificial Immune System and Artificial Neural Networks we propose the “antivirus” system especially for Android system that can detect and block undesirable and malicious applications. This system can be characterized by self-adaption and self-evolution and can detect even unknown and previously unseen malicious applications. The proposed system is the part of our team’s big project named “Intelligent Cyber Defense System” that includes malware detection and classification module, intrusions detection and classification module, cloud security module and personal cryptography module. This paper contains the extended research that was presented during the IEEE 8th International Conference on Intelligent Data Acquisition and Advanced Computing Systems: Technology and Applications (IDAACS’2015) [1].

The Human Factors of Cyber Network Defense

Technology’s role in the fight against malicious cyber-attacks is critical to the increasingly networked world of today. Yet, technology does not exist in isolation: the human factor is an aspect of cyber-defense operations with increasingly recognized importance. Thus, the human factors community has a unique responsibility to help create and validate cyber defense systems according to basic principles and design philosophy. Concurrently, the collective science must advance. These goals are not mutually exclusive pursuits: therefore, toward both these ends, this research provides cyber-cognitive links between cyber defense challenges and major human factors and ergonomics (HFE) research areas that offer solutions and instructive paths forward. In each area, there exist cyber research opportunities and realms of core HFE science for exploration. We raise the cyber defense domain up to the HFE community at-large as a sprawling area for scientific discovery and contribution.

Data Fusion-based resilient control system under DoS attacks: A game theoretic approach

In this paper, the resilient control under the Denial-of-Service (DoS) attack is rebuilt within the framework of Joint Directors of Laboratories (JDL) data fusion model. The JDL data fusion process is characterized by the so-called Game-in-Game approach, where decisions are made at different layers. The interactions between different JDL levels are considered which take the form of Packet Delivery Rate of the communication channel. Some criterions to judge whether the cyber defense system is able to protect the underlying control system is provided. Finally, a numerical example is proposed to verify the validity of the proposed method.

Insights from nature for cybersecurity.

The alarming rise in the quantity of malware in the past few years poses a serious challenge to the security community and requires urgent response. However, current countermeasures seem no longer to be effective. Thus, it is our belief that it is now time for researchers and security experts to turn to nature in the search for novel inspiration for defense systems. Nature has provided species with a whole range of offensive and defensive techniques, which have been developing and improving over the course of billions of years of evolution. Extremely diverse living conditions have promoted a large variation in the devised biosecurity solutions. In this article we introduce a novel Protection framework in which common denominators of the encountered offensive and defensive means are proposed and presented. The bio-inspired solutions are discussed in the context of cybersecurity, where some principles have already been adopted. The deployment of the whole nature-based framework should aid in the design and improvement of modern cyberdefense systems.

Intrusion Detection Forecasting Using Time Series for Improving Cyber Defence

The strength of time series modeling is generally not used in almost all current intrusion detection and prevention systems. By having time series models, system administrators will be able to better plan resource allocation and system readiness to defend against malicious activities. In this paper, we address the knowledge gap by investigating the possible inclusion of a statistical based time series modeling that can be seamlessly integrated into existing cyber defense system. Cyber-attack processes exhibit long range dependence and in order to investigate such properties a new class of Generalized Autoregressive Moving Average (GARMA) can be used. In this paper, GARMA (1, 1; 1, ±) model is fitted to cyber-attack data sets. Two different estimation methods are used. Point forecasts to predict the attack rate possibly hours ahead of time also has been done and the performance of the models and estimation methods are discussed. The investigation of the case-study will confirm that by exploiting the statistical properties, it is possible to predict cyber-attacks (at least in terms of attack rate) with good accuracy. This kind of forecasting capability would provide sufficient early-warning time for defenders to adjust their defense configurations or resource allocations.

DEFIDNET: A framework for optimal allocation of cyberdefenses in Intrusion Detection Networks

Intrusion Detection Networks (IDN) are distributed cyberdefense systems composed of different nodes performing local detection and filtering functions, as well as sharing information with other nodes in the IDN. The security and resilience of such cyberdefense systems are paramount, since an attacker will try to evade them or render them unusable before attacking the end systems. In this paper, we introduce a system model for IDN nodes in terms of their logical components, functions, and communication channels. This allows us to model different IDN node roles (e.g., detectors, filters, aggregators, correlators, etc.) and architectures (e.g., hierarchical, centralized, fully distributed, etc.). We then introduce a threat model that considers adversarial actions executed against particular IDN nodes, and also the propagation of such actions throughout connected nodes. Based on such models, we finally introduce a countermeasure allocation model based on a multi-objective optimization algorithm to obtain optimal allocation strategies that minimize both risk and cost. Our experimental results obtained through simulation with different IDN architectures illustrate the benefit of our framework to design and reconfigure cyberdefense systems optimally.

Applications of Artificial Intelligence Techniques to Combating Cyber Crimes: A Review

With the advances in information technology (IT) criminals are using cyberspace to commit numerous cyber crimes. Cyber infrastructures are highly vulnerable to intrusions and other threats. Physical devices and human intervention are not sufficient for monitoring and protection of these infrastructures; hence, there is a need for more sophisticated cyber defense systems that need to be flexible, adaptable and robust, and able to detect a wide variety of threats and make intelligent real-time decisions. Numerous bio-inspired computing methods of Artificial Intelligence have been increasingly playing an important role in cyber crime detection and prevention. The purpose of this study is to present advances made so far in the field of applying AI techniques for combating cyber crimes, to demonstrate how these techniques can be an effective tool for detection and prevention of cyber attacks, as well as to give the scope for future work.

Soft Computing Techniques in Cyber Defense

intelligence is a technology to make the machines human compatible. Various techniques like- heuristic search (Generate and test, Hill climbing, BFS, DFS, Problem reduction, constraint satisfaction, means-ends analysis etc.), game playing, understanding, planning, NLP, Learning, commonsense, predictions and actions, and expert systems are there to make the system intelligent. This paper primarily focuses on the problem of malicious objects in the cyber space and discusses the usage of different AI techniques to overcome the mentioned problem. Every day the information stored in the computer and the information in transit faces threats due to malicious objects which further leads to a big loss. This paper discusses the possibilities to incorporate the AI techniques to analyze the data and finding and restricting the malicious objects. To make a proactive cyber defense system how the system log can be explored to find the malicious object and how the AI techniques like heuristic search can help in this process is discussed. This paper also discusses about the uncertainty of attacks and gives some views to implement AI techniques such as probability and Bayes theorem, certainty factors and rule based system, Bayesian networks, fuzzy logic etc.

Collaboration as proactive measure against cyber warfare in South Africa

The international scope of the Internet and wide reach of technological usage requires cyber defence systems to intersect largely with the application and implementation of international legislation. One of the problems associated with the technological revolution is that cyber space comprises complex and dynamic technological innovations to which no current legal system is well suited. A further complication is the lack of comprehensive treaties facilitating international cooperation with regard to cyber defence. The result is that many countries will not be properly prepared or adequately protected by legislation in the event of a cyber attack on a national level. The article investigates this problem by touching on the influence that cyber defence has on the international position of the government. The article addresses the principles of cyber security and cyber warfare acts, and briefly touches on cyber security collaboration efforts for South Africa. The authors are of the opinion that Africa does not follow a coordinated approach in dealing with cyber security, and that the various structures that have been established to deal with cyber security are inadequate to deal with issues holistically. To work towards such a co ordinated approach, it is suggested that specific interventions be developed to address cyber crime. This approach should create and maintain a partnership or collaboration between business, government and civil society. The authors are of the opinion that unless these spheres of society work together, Africa's efforts to ensure a secure cyber space may be compromised.

Principles for Better Information Security through More Accurate, Transparent Risk Scoring

This paper explores approaches for scoring information security risk that could lead to investment drivers and drive appropriate levels of security. Our approach is grounded on two important factors that determine cyber risk: (1) the information security resources (e.g., technologies, skills, and policies) that reduce the likelihood and consequences of successful information exploits; and (2) the security processes and capabilities that drive a continuous improvement of the security resources in use. The quality of a cyber defense system is the result of the integration of these two factors. This manuscript proposes such a two-factor hierarchical system of scoring, details candidate measures, and explores economic conditions for selecting appropriate measures. We review several scoring systems available that contain elements from this proposed system and discuss conditions for market adoption of information security scoring.

Immuno-inspired autonomic system for cyber defense

The biological immune system is an autonomic system for self-protection, which has evolved over millions of years probably through extensive redesigning, testing, tuning and optimization process. The powerful information processing capabilities of the immune system, such as feature extraction, pattern recognition, learning, memory, and its distributive nature provide rich metaphors for its artificial counterpart. Our study focuses on building an autonomic defense system, using some immunological metaphors for information gathering, analyzing, decision making and launching threat and attack responses. This on-going research effort is not to mimic the nature but to explore and learn valuable lessons useful for self-adaptive cyber defense systems.