Cyber Defense Research Articles

A Survey on Moving Target Defense: Intelligently Affordable, Optimized and Self-Adaptive

Represented by reactive security defense mechanisms, cyber defense possesses a static, reactive, and deterministic nature, with overwhelmingly high costs to defend against ever-changing attackers. To change this situation, researchers have proposed moving target defense (MTD), which introduces the concept of an attack surface to define cyber defense in a brand-new manner, aiming to provide a dynamic, continuous, and proactive defense mechanism. With the increasing use of machine learning in networking, researchers have discovered that MTD techniques based on machine learning can provide omni-bearing defense capabilities and reduce defense costs at multiple levels. However, research in this area remains incomplete and fragmented, and significant progress is yet to be made in constructing a defense mechanism that is both robust and available. Therefore, we conducted a comprehensive survey on MTD research, summarizing the background, design mechanisms, and shortcomings of MTD, as well as relevant features of intelligent MTD that are designed to overcome these limitations. We aim to provide researchers seeking the future development of MTD with insight into building an intelligently affordable, optimized, and self-adaptive defense mechanism.

Cyber expert feedback: Experiences, expectations, and opinions about cyber deception

Human behavior is a critical, yet under-studied topic in cybersecurity. Among the techniques used for cyber defense, for cyber deception, a better understanding of human perception and behavior is crucial. To this point, the current study used a custom Deception Questionnaire to assess perceptions of cyber deception among experts. In this paper, we use a qualitative thematic analysis over the questionnaire responses, which provides a rich insight into the decision-making process of cyber attackers. Results reveal that experts were unlikely to expect deception, and upon encountering potential deception, a subset of attackers would increase and others decrease their attack activity in response. This work augments prior qualitative analyses indicating that cyber deception creates a psychological impact and behavioral change in cyber attackers. Results support the psychological impact and efficacy of deception to deter malicious actors and provide insights about how defenders might utilize deceptive strategies.

Hybrid cyber defense strategies using Honey-X: A survey

The development and adoption of network technologies reshape our daily life; however, network-connected devices have become popular targets of cybercrimes. Honey-X-based cyber defense technologies, like honeypots, honeynets, and honeytokens, can provide cyber threat intelligence and protect network users against various cyberattacks by leveraging deception techniques. The hybrid defense strategies of defensive cyber deception (DCD) and moving target defense (MTD) approaches while combining the advances of Machine Learning (ML) or Game Theory (GT), which have the potential to offer cyber security enhancement against malicious adversaries. This survey paper aims to comprehensively understand the defensive approaches based on honey-X for cyber defense. It analyses and categorizes the honey-X-based defense strategies, presents the security quantification of cyber defense, and outlines challenges and future directions for honey-X-based cyber defense strategies.

The Role of Nato in Enhancing Ukraine's Cybersecurity during Times of Conflict

This study aims to analyze the impact of NATO support on Ukraine which is in a conflict situation with Russia. Ukraine has taken a step forward to strengthen its ties with NATO by signing an agreement to formalize its participation in the security alliance's Joint Center for Advanced Technologies in Cyber Defense (CCDCOE). This study will discover how this action will affect the tensions in the Cyber Security System between Ukraine and Russia. In order to find the answer, it is necessary to identify the motives by using qualitative research design through secondary sources in the form of official state documents and secondary sources in the form of journals, dissertations and related research. The result of this study conluded NATO’s involvement in the cyber war between UkraineRussia is quite substantial and greatly influenced the course of the war, this is what motivated the researcher to conduct further studies and see what influences were given., regardless of the difficult to collect the information. This study might help us understand the situation of Cyber Conflict between Ukraine-Russia and predicts the potential consequences from this action, and hopefully give us more informations to analyze and evaluate to find the best solution of this existing conflict.

Управління кібербезпекою в системі забезпечення національно укоріненої стійкості економічного розвитку

In the course of the study, it has been found that the increase in volumes and the expansion of the spheres of the use of digital technologies objectively cause the emergence of cyber threats and expose all participants of digital ecosystems to cyber risks, which restrains economic development. It has been proven that the presence of a wide range of factors that shape cyber security and cyber resilience requires the implementation of a comprehensive approach to the formulation of protective strategies of companies and institutions. The article argues that the process of organizing cyber resilience management should be based on the development of comprehensive cyber protection systems based on clear policies, rules and strategies for early detection, prevention and minimization of consequences of the implementation of cyber threats using a wide range of technical, technological, organizational, managerial and regulatory measures. The author justifies the need to develop national strategy and program for the authorities in the spheres of legislation, regulation, supervision and control over the state of cyber security. He proves that the national cyber defense strategy should provide for effective measures to protect critical infrastructure objects, state authorities and the population, as well as a system of regulatory and supervisory measures. The author establishes that the primary task for the organization and operation of cyber protection systems should be the protection of digital assets and of the companies’ resources and their customers. In order to strengthen the institutional capacity of authorities to effectively support the national cyber security ecosystem, a structural and logical scheme of interaction between companies and the State Cyber Protection Center of Ukraine in the process of exchanging information about cyber incidents has been developed, and practical recommendations have been provided for the interaction between critical infrastructure objects and state regulatory bodies, which can be used to ensure nationally rooted stability and security of Ukraine’s economic development in a hybrid "peace-war" system.

A Blockchained AutoML Network Traffic Analyzer to Industrial Cyber Defense and Protection

Network traffic analysis can raise privacy concerns due to its ability to reveal sensitive information about individuals and organizations. This paper proposes a privacy-preserving Block-chained AutoML Network Traffic Analyzer (BANTA). The system securely stores network traffic logs in a decentralized manner, providing transparency and security. Differential privacy algorithms protect sensitive information in the network flow logs while allowing administrators to analyze network traffic without the risk of leakages. The BANTA uses blockchain technology, where smart contracts automate the process of network traffic analysis, and a multi-signature system ensures the system’s security, safety, and reliability. The proposed approach was evaluated using a real-world network traffic dataset. The results demonstrate the system’s high accuracy and real-time anomaly detection capabilities, which makes it well-suited for scalable cybersecurity operations. The system’s privacy protection, decentralized storage, automation, multi-signature system, and real-world effectiveness ensure that the organization’s data is private, secure, and effectively protected from cyber threats, which are the most vexing issue of modern cyber-physical systems.

Development of Six Ware Cyber Defense Framework (SWCDF) Design as a Standardization of Computer Network Protection State Defense Information System

Development of Six Ware Cyber Defense Framework (SWCDF) Design as a Standardization of Computer Network Protection State Defense Information System

Efforts to Strengthen Cyber Defense and Cyber Security of the Indonesian Government in Maintaining National Security

The development of science and technology makes the threat to national defense also widen. From threats in the form of physical and non-physical. Increasingly sophisticated technology introduces people to the internet. Internet has become one of the primary needs today. Almost all activities are centralized from the Internet. Socio-economic, political, culture has been affected by the existence of the internet. Relations between communities have become very easy with the internet connected by social media. Out of a total of 270 million Indonesians, more than 170 million are active on social media. Not only that, economic activities, education to health have been facilitated by an online system with the existence of E-commerce and similar applications. This research discusses efforts to strengthen the Indonesian government's cyber defense and cyber security in maintaining national security. Using a descriptive qualitative research method, the author will discuss further the Indonesian government's efforts to strengthen cyber defense and security. One of these efforts has been carried out by issuing Government Regulation Number 71 of 2019 concerning the Implementation of Electronic Systems and Transactions, the existence of this PP strengthens the protection of personal data and information. Therefore it becomes interesting to be discussed further.

Applying Access Control Enabled Blockchain (ACE-BC) Framework to Manage Data Security in the CIS System.

Cybersecurity information sharing (CIS) is important in different business processes to secure data transmission, because it comprises Internet of Things (IoT) connectivity, workflow automation, collaboration, and communication. The shared information is influenced by intermediate users and alters the originality of the information. Although risk factors such as confidentiality and privacy of the data are reduced when using a cyber defense system, existing techniques rely on a centralized system that may be damaged during an accident. In addition, private information sharing faces rights issues when accessing sensitive information. The research issues influence trust, privacy, and security in a third-party environment. Therefore, this work uses the Access Control Enabled Blockchain (ACE-BC) framework to enhance overall data security in CIS. The ACE-BC framework uses attribute encryption techniques to manage data security, while the access control mechanism limits unauthorized user access. The effective utilization of blockchain techniques ensures overall data privacy and security. The efficiency of the introduced framework was evaluated using experimental results, and the experimental outcome indicated that the recommended ACE-BC framework enhanced the data confidentiality ratio (98.9%), the throughput ratio (98.2%), the efficiency ratio (97.4%), and the latency rate (10.9%) when compared to other popular models.

Teaching Offensive and Defensive Cyber Security in Schools using a Raspberry Pi Cyber Range

Computer Science as a subject is now appearing in more school curricula for GCSE and A level, with a growing demand for cyber security to be embedded within this teaching. Yet, teachers face challenges with limited time and resource for preparing practical materials to effectively convey the subject matter. We hosted a series of workshops designed to understand the challenges that teachers face in delivering cyber security education. We then worked with teachers to co-create practical learning resources that could be further developed as tailored lesson plans, as required for their students. In this paper, we report on the challenges highlighted by teachers, and we present a portable and isolated infrastructure for teaching the basics of offensive and defensive cyber security, as a co-created activity based on the teacher workshops. Whilst we present an example case study for red and blue team student engagement, we also reflect on the wide scope of topics and tools that students would be exposed to through this activity, and how this platform could then be generalised for further cyber security teaching.

General-purpose Unsupervised Cyber Anomaly Detection via Non-negative Tensor Factorization

Distinguishing malicious anomalous activities from unusual but benign activities is a fundamental challenge for cyber defenders. Prior studies have shown that statistical user behavior analysis yields accurate detections by learning behavior profiles from observed user activity. These unsupervised models are able to generalize to unseen types of attacks by detecting deviations from normal behavior without knowledge of specific attack signatures. However, approaches proposed to date based on probabilistic matrix factorization are limited by the information conveyed in a two-dimensional space. Non-negative tensor factorization, however, is a powerful unsupervised machine learning method that naturally models multi-dimensional data, capturing complex and multi-faceted details of behavior profiles. Our new unsupervised statistical anomaly detection methodology matches or surpasses state-of-the-art supervised learning baselines across several challenging and diverse cyber application areas, including detection of compromised user credentials, botnets, spam e-mails, and fraudulent credit card transactions.

Cyber Security and Cyber Defense: Challenges and Building of Cyber Resilience Conceptual Model

Cyber security encompasses a broad range of practices, tools and concepts related closely to those of information and operational technology security. Cyber security is distinctive in its inclusion of the offensive use of information technology to attack adversaries. Use of the term cyber security as a key challenge and a synonym for information security or IT security misleads customers and security practitioners and obscures critical differences between these disciplines. Recommendation for security leaders is that they should use the term cyber security to designate only security practices related to the defensive actions involving or relying upon information technology and/or operational technology environments and systems. Cyber defense is a computer network defense mechanism which includes response to actions and critical infrastructure protection and information assurance for organizations, government entities and other possible networks [3]. In this paper, we investigate how cyber security and cyber defense may lead to cyber resilience with the novel model of cyber resilience designed and presented. Furthermore, within the same model authors investigate actions for cyber security and cyber defense in conditions of increasing challenge of cyber-attacks and the limited capabilities to respond to this threat describing the process of creation, performance and future of EU Cyber Rapid Response Teams (abbr. CRRT) and Mutual Assistance in Cyber Security, introducing novel approach to cyber security and cyber defense at the EU level.

NATO's involvement in cyber defence

Cyberspace is an operational domain for the North Atlantic Alliance, and cyber defence is part of NATO's fundamental mission called collective defence. NATO is an intergovernmental organization that is aware of the negative impact that cyber attacks launched against the critical infrastructures of member states can have. NATO's most important responsibility is the collective defence of allies against security threats from all sectors, including cyberspace.

Lore a Red Team Emulation Tool

This article presents the red team emulation tool Lore, which uses boolean logic and trained models to automatically select and execute red team actions. Lore improves the current state of red team automation, and is the first such tool shown to provide a more fun and educational experience than a manual red team during a cyber defence exercise. In addition to the cyber defence exercise, empirical tests are performed to examine the accuracy of Lore's trained models. The results show that application of these models lead to two times more compromised machines than when applying expert-defined models, and five times more compromised machines than when randomly selecting actions.

Managing Large-Scale Heterogeneous Deployments for Cybersecurity

In cyber defense, we must contend with the massive amounts of data being generated in a variety of different formats and speeds. Unfortunately, traditional tools and methods are not meeting the requirements for scale and speed and rely too heavily on heuristics. Advancements in mobile technologies and the Internet of Things (IoTs) will continue to contribute to the additional growth in data volumes anticipated for the foreseeable future. As data continues to grow in complexity and scale, cyber professionals must rely upon models that are more elaborate and sophisticated to predict future behavior. More complex models can give additional inference capabilities; however, they are also difficult to scale and deploy in real-time environments. Managing large-scale, heterogeneous deployments for cybersecurity is challenging. Hardware capabilities and software tools both motivate and limit computational and inferential objectives. Hence, the interplay between data science (especially machine learning) and computation become more significant than ever to explore to gain more insight into heterogeneous deployments and how they can be more effectively managed. In this study, we identify ways in which data science tools and techniques can be used in improving the management of large-scale heterogeneous deployments for cybersecurity.

Fingerprinting Network Sessions for the Discovery of Cyber Threats

A
 rtificial intelligence (AI) assisted cyber-attacks, within the network cybersecurity domain, have evolved to be more successful at every phase of the cyber threat lifecycle. This involves, amongst other tasks, reconnaissance, weaponisation, delivery, exploitation, installation, command & control, and actions. The result has been AI-enhanced attacks, such as DeepLocker, self-learning malware and MalGan, which are highly targeted and undetectable, and automatically exploit vulnerabilities in existing cyber defence systems
 . Countermeasures would require significant improvements in the efficacy of existing cyber defence systems to enable the discovery and detection of AI-enhanced attacks in networks in general. The challenge is that rule-and-anomaly-based intrusion detection approaches would need to be evolved into a dynamic self-learning approach before being able to discover “undetectable” network threats. The problem is that, when considering current state-of-the-art network cybersecurity countermeasures, this has not yet been achieved. One of the key challenges in achieving this is the inability to extract meaningful information from network packets. The novel solution proposed in this paper is to fingerprint network sessions. Each fingerprint is represented by a two-dimensional matrix that can be visualised, comprising a unique session key, the protocol discourse and the transmitted data. This is achieved by extracting information, summarising network session key events, encoding the received data, and merging it with existing fingerprints. The unique key and transmitted data are encoded using a Hilbert curve, while the protocol discourse is encoded into a tornado diagram. The resulting visualised network session fingerprints reveal hidden patterns that are ideal for subsequent pattern recognition, reinforcement learning (RL) or support vector machines (SVM) training to discover AI-enhanced cyber threats as they evolve.

Offensive Cyberspace Operations for Cyber Security

This work-in-progress research product covers Offensive Cyberspace Operations for Cyber Security or “Offensive Defense” for Cyber Security. Offensive cyberspace operations are shrouded in secrecy. From an intelligence perspective, this makes sense because of their development since Operation Desert Storm in 1991. The phenomenon, dubbed “Information Warfare,” and to the professionals’ surprise, they could remotely turn off an Iraqi power substation. However, the implication of remotely turning off the power substation was not only to cut off the power source to an Iraqi military headquarters, but it also meant cutting off the power to a nearby hospital, risking the lives of injured Iraqi soldiers protected by the Geneva Conventions. Since the 2000s and onwards, and with the US military recognizing cyberspace as a war-fighting domain, establishing United States Cyber Command (USCYBERCOM) may be a milestone. Thus, researchers have put much thought into cyberspace operations (offensive, defensive), such as doctrine, organizations, training, materials, leadership and education, personnel, facilities, and policy. One phenomenon, dubbed “defending forward,” was coined in the 2018 US Department of Defense Cyber Strategy. The idea is simple: take the fight to the adversary. Other terms include “hunt-forward operations” and “offensive defense.” Therefore, what is “Offensive Defense” for cyber security, and why now?

Cyber Threat Intelligence Discovery using Machine Learning from the Dark Web

Cyber threat intelligence (CTI) is an actionable information or insight an organization uses to understand potential vulnerabilities it does have and threats it is facing. One important CTI for proactive cyber defense is exploit type with possible values system, web, network, website or Mobile. This study compares the performance of machine learning algorithms in predicating exploit types using form posts in the dark web, which is a semi- structured dataset collected from dark web. The study uses the CRISP data science approach. The results of the study show that machine learning algorithms which are function-based including support vector machine and deep-learning using artificial neural network are more accurate than those algorithms which are based on tree including Random Forest and Decision-Tree for CTI discovery from semi-structured dataset. Future research will include the use of high-performance computing and advanced deep-learning algorithms.

(Re-)Configuring Federal Cybersecurity Regulation: From Critical Infrastructures to the Whole-of-the-Nation

Cyberattacks are one of the greatest threats to the United States’ national security. Facing an increase in cyberattacks, the current patchwork of federal cybersecurity regulations does not maximize the country’s ex ante defense that should protect the entire nation. This Article examines federal agencies’ involvement in promulgating cybersecurity regulations and Executive Branch cybersecurity actions, identifying three shortcomings in the current framework: (1) the nation lacks a general cybersecurity agency with regulatory and enforcement authority, (2) cybersecurity programs often rely on business participation and leadership without incorporating non-profit organizations and individuals, and (3) cybersecurity approaches often overemphasize the importance of attributing attacks to the corresponding culprits. To rectify these weaknesses and maximize cyber defense, this Article argues that Congress shouldexpand the Cybersecurity and Infrastructure Security Agency’s rulemaking and enforcement authority to monitor and mitigate cyber threats across varying sectors, including government, businesses, insurers, non-profit organizations, and individuals.

An Intelligent Privacy Preservation Scheme for EV Charging Infrastructure

The electric vehicle (EV) charging ecosystem, being a distinguishable paradigm of IIoT infrastructure, consists of distributed and complex hybrid systems that demand adaptive data-driven cyber-defense mechanisms to tackle the ever-growing attack vectors of cyber-physical systems. We propose an adaptive differential privacy-based federated learning framework for building a collaborative network intrusion detection system model for EV charging stations (EVCS). We use utility optimized local differential privacy to provide data privacy to the local network traffic data of each EVCS. Moreover, we propose a reinforcement learning-based intelligent privacy allocation mechanism at the EVCS level. The main significance of the proposed mechanism is that it can make privacy provisioning adaptive to the extent of privacy breaching rate, and dynamically optimize the privacy budget and the utility to avoid human intervention such as domain knowledge experts. The experimental results confirm the efficacy of our proposed mechanism and achieves appropriate privacy provisioning accuracy to approximately 95%.