Cyber Defense Research Articles

Building Cyber-Resilient Smart Grids with Digital Twins and Data Spaces

The rapid expansion of digital twin technology has revolutionized management and testing across various sectors, particularly in safeguarding critical infrastructure like smart grids. Aligned with the NIS2 Directive, Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022, digital twins play a critical role in bolstering cybersecurity measures by enabling advanced simulation and real-time monitoring, key aspects emphasized in the directive for enhancing the security of networks and information systems. Concurrently, Europe’s shift towards communal data spaces amplifies the need for robust cyber defences. This paper aims to bolster cybersecurity defences in critical infrastructure, with a particular focus on the energy sector and smart grids. It proposes an innovative architecture for cybersecurity monitoring, converting a Common Information Model-compliant system into a digital twin via the FIWARE platform and incorporating an open-source Security Information and Event Management solution. Validated by a real-world case study, our approach demonstrates significant advancements in protecting smart grids against cyber threats.

The Intersectionality of Offensive Cybersecurity and Human Factors: A Position Paper

Abstract This position paper delves into the complex interplay between proactive cyber defense mechanisms and inherent human susceptibilities. The researchers posit that as cyber systems advance in technical robustness, malicious entities progressively exploit human psychological tendencies and behavioral inconsistencies to circumvent security measures. These exploitations are not merely opportunistic but are strategic, leveraging a profound comprehension of human cognitive biases to undermine security infrastructures. The researchers argue for broadening the intellectual horizon in this domain, underscoring the imperative for a multidisciplinary methodology that amalgamates the empirical acumen of psychology, sociology, and computer science. The article asserts that the fortification of cyber defenses is contingent upon the comprehensive integration of human vulnerability assessments within cybersecurity frameworks. This position paper calls for an augmentation of scholarly research at the nexus of offensive cybersecurity and human factors, formulating defense mechanisms centered around the human element and promulgating inclusive cybersecurity policies that harmonize human and technological considerations.

Reinforcement Learning in Cyber Wargaming Defense

In recent decades the necessity for cyber security has grown for both private companies as well as government agencies. This growth is the result of increasing ability for organizations to mount cyber-attacks. As a response, organizations have been developing cyber defense artificial intelligence (AI), which greatly improves cyber-security capabilities. This ne- cessitates not only the development of cyber-attack, defense, and vulnerability frameworks to simulate a realistic environment, but also methods with which to train the AI. Further, the number and variety of networks necessitates a framework with which AI can be quickly and cost-effectively trained. This paper will explore how our team has worked to develop an efficient and comprehensive framework under which a variety of AI can be trained to fulfill the need for cyber resiliency.

Generative Artificial Intelligence: Fundamentals

Generative language models have witnessed substantial traction, notably with the introduction of refined models aimed at more coherent user-AI interactions—principally conversational models. The epitome of this public attention has arguably been the refinement of the GPT-3 model into ChatGPT and its subsequent integration with auxiliary capabilities such as search features in Microsoft Bing. Despite voluminous prior research devoted to its developmental trajectory, the model’s performance, and applicability to a myriad of quotidian tasks remained nebulous and task specific. In terms of technological implementation, the advent of models such as LLMv2 and ChatGPT-4 has elevated the discourse beyond mere textual coherence to nuanced contextual understanding and real-world task completion. Concurrently, emerging architectures that focus on interpreting latent spaces have offered more granular control over text generation, thereby amplifying the model’s applicability across various verticals. Within the purview of cyber defense, especially in the Swiss operational ecosystem, these models pose both unprecedented opportunities and challenges. Their capabilities in data analytics, intrusion detection, and even misinformation combatting is laudable; yet the ethical and security implications concerning data privacy, surveillance, and potential misuse warrant judicious scrutiny.

Navigating the Deception Stack: In-Depth Analysis and Application of Comprehensive Cyber Defense Solutions

Navigating the Deception Stack: In-Depth Analysis and Application of Comprehensive Cyber Defense Solutions

Управління діяльністю фахівців з кібербезпеки в умовах повномасштабного вторгнення

In this study dedicated to the management of cybersecurity professionals in the context of full-scale intrusion, significant aspects of this pressing issue have been examined. Drawing from an analysis of the content of cybersecurity professionals' activities and their core concepts, it has been identified that this field encompasses various facets requiring diverse skills and knowledge from these experts. Specifically, cybersecurity experts must possess technical expertise, understand threats and risks, detect and thwart cyberattacks, and adhere to ethical and legal standards. Addi-tionally, the ability to communicate and collaborate within a team, while considering socio-cultural and legal peculiarities of the country they operate in, is vital. In the context of full-scale intrusion, such as russia's invasion of Ukraine in 2022, cybersecurity professionals face challenges of extraor-dinary complexity. They must respond to aggressive cyberattacks targeting various sectors, includ-ing governmental structures, critical infrastructure, media, and the information space. Simultane-ously, they must consider ethical aspects and responsibly engage with other entities and organiza-tions to ensure collective cyber defense. This research underscores the importance of adopting a comprehensive approach to manag-ing cybersecurity professionals in times of intrusion. To achieve this, it is essential to provide train-ing and continuous skill enhancement, establish effective mechanisms for detecting and responding to cyber aggression, and strengthen international cooperation in the field of cybersecurity. Through these measures, cybersecurity professionals will have the capability to effectively safeguard the in-terests of their organizations and nations amidst heightened cyber threats, ensuring the security, privacy, and rights of users. Such an approach contributes to creating a more resilient and secure in-formation environment, a critical factor in the modern world. Furthermore, the article presents a comparative analysis of soft skills and transferable skills for cybersecurity professionals, highlighting key abilities and qualities crucial in this field. This analysis helps develop more effective strategies for training and developing cybersecurity experts, enhancing their professional competence to meet contemporary security demands. This analysis also promotes the improvement of managing cybersecurity professionals in the context of large-scale in-trusion, emphasizing the importance of combining technical and interpersonal skills to ensure the reliability and effectiveness of cybersecurity.

Passive Cyber Defense as a Norm Preservation Tool: Romania’s Behaviour as a Norm Antipreneur in Cybersecurity

Passive Cyber Defense as a Norm Preservation Tool: Romania’s Behaviour as a Norm Antipreneur in Cybersecurity

Impact of computer users on cyber defense strategies

AbstractCybersecurity research often focuses primarily or exclusively on the interactions between the attacker, trying to exploit the computer system, and the defender, trying to protect it. However, including the computer users is important because the users’ requirements are the reason the computer system exists.An extension of the Petri net formalism, Petri Nets with Players, Strategies, and Costs (PNPSC) was used to model cyberattacks described in the MITRE Common Attack Pattern Enumeration and Classification database. PNPSC models include the attacker, defender, and computer user as “players” attempting to achieve competing goals. Each player can observe the current marking of a subset of the PNPSC net's places and change the stochastic firing rates of a subset of the net's transitions in order to achieve their goals. A mapping between the markings of a player's observable places and the desired firing rates of player's controllable transitions is the player's strategy.A reinforcement learning algorithm was integrated with PNPSC models of three cyberattack patterns to learn strategies for the defender in simulations both with and without a representation of the computer user. A simulation experiment showed that the defender's reward was lower and the defender's learned strategy was different when the user was represented. A second simulation experiment and statistical analysis confirmed that the differences were not due simply to randomness. With the user represented, the system defender must balance security against usability. This research provides a more complete cyberattack model and shows that user models are important in future cybersecurity simulation.

Exploratory Analysis of Decision-Making Biases of Professional Red Teamers in a Cyber-Attack Dataset

Attacker psychology is currently under-examined in cybersecurity research. A prior, large-scale study sought to understand attackers’ behavior by testing both technological and psychological deception. Professional “red team” members participated over two days in various conditions. This data was examined for further evidence that cognitive biases, a potential disruption for attackers, may be present, and may be affecting the outcome. An applied, novel methodology for measuring confirmation bias and framing effects is presented using this realistic dataset. Both confirmation bias and the framing effect occurred in this interpretation. The framing effect appears to have reduced attacker interactions with systems in the network, which may benefit cyber defenders. These results provide additional, exploratory evidence that biases in the decision-making of cyber attackers could be used as part of a defensive cyber strategy. Limitations to the approach and directions for future study of attackers are discussed.

Cyber Preparedness of the Indian Armed Forces

The Indian armed forces today face a significant threat of cyberattacks, particularly from hostile neighbouring states like China and Pakistan. Cyberattacks could potentially damage or cripple critical weapons platforms, major communications and ISR (intelligence, surveillance, and reconnaissance) systems, and vital infrastructure, undermining the military’s preparedness and war-fighting capabilities. How prepared is the Indian military to neutralise cyberattacks from adversaries such as China and Pakistan? This is the central question that this article attempts to address. The article contends that the delayed development of technical, policy, and organisational measures in the cyber domain indicates vulnerabilities in the Indian military’s current state of cyber preparedness, leaving room for enemy cyberattacks. It emphasises the need for immediate actions to address the critical gaps in India’s cybersecurity strategy. In particular, the Indian military must focus on drastically strengthening its defensive cyber capabilities to neutralise potential enemy cyberattacks on weapons platforms, communication and ISR systems, and critical infrastructure. The article concludes that without enhanced defensive cyber capabilities, India’s military modernisation may fall short of responding adequately to technology-driven warfare threats from the hostile states in the neighbourhood.

Psychological rehabilitation of combatants in Ukraine from 2014 to 2021: statistics and current status

Military action in eastern Ukraine [Anti-terrorist Operation (ATO)] has a significant impact on the psyche of combat participants and causes changes in the life activities and behaviour of the individuals concerned. The traumatic experience gained during hostilities has a negative impact on the health of military personnel. According to psychiatrists’ forecasts, in the best-case scenario, 20% of combatants in Ukraine will be diagnosed with chronic post-traumatic stress disorder, which has already been given the name “ATO syndrome”. Given this, there is now an urgent need for rehabilitation activities, and the new conditions of hybrid warfare require social service professionals to respond quickly to combatants’ requests to organise and deliver comprehensive rehabilitation. Therefore, the aim of this study is to analyse the provision and conduct of psychological rehabilitation of combatants in Ukraine from 2014 to 2021.Philosophical and general scientific methods were employed to achieve the aim. Among the general scientific methods, the theoretical (analysis, generalisation, classification, and synthesis) and empirical (description and comparison) levels should be highlighted. Also, a bibliosemantic method was used to summarise the analysis of the subject literature and our own experimental data. In addition, various programs were employed to rehabilitate the military. For example, the “Cyber Defenders” project, which was launched in 2021. This involved 30 veterans who will receive a certificate in cybersecurity upon graduation. The E-Veteran system, which allows veterans to seek psychological support, was also analyzed.As the main results, it is worth mentioning that psychological rehabilitation is a pool of psychophysiological, psychotherapeutic, organisational, and medical measures aimed at the resumption of lost mental functions and psychocorrection of the social status of military personnel who have suffered mental combat trauma. The study analysed the mental state and profile of servicemen and servicewomen, the psychological and psychiatric problems that affected them, and government programmes and projects to support and assist ATO/JFO(Joint Forces Operation) veterans. Regarding the process of psychological rehabilitation for military personnel in Ukraine itself, positive trends can be observed since 2014, such as the opening of the Ministry of Veterans’ Affairs, but in the light of current threats and challenges, these undertakings are still insufficient.The system of psychological assistance and rehabilitation of ATO participants should be considered a component of the national security of the state. The article is of practical value in a range of areas, including in political, social work, pedagogical, and educational fields, as well as having application in criminal justice and the law.

PARAMETERS AND CRITERIA OF THE SCHOOL EDUCATIONAL ENVIRONMENT EXPERTISE

This article substantiates the relevance of the research problem, which consists in the need to solve state tasks in the field of ensuring cybersecurity of social substructures of society, which is the education system. The current legal framework of the problem under study is in urgent need of improvement and development in projection on the educational environment of the school. This is due to the clearly insufficient awareness of its subjects in matters of cybersecurity, cyber defense and cyber ethics. This is confirmed not only by the empirical observations of the authors of this article, but also by the practical lack of clear pedagogical measures of cybersecurity of the school environment. The purpose of the study is to reveal the specifics of cybersecurity of the school environment. To achieve this goal, the authors of the article interpret the concept of cybersecurity in the context of the environmental approach in education, perceived as a methodology of scientific and pedagogical research. Based on these methodological positions, the authors of the article propose a detailed system of parameters and criteria for the examination of cybersecurity of the school environment. The developed system of parameters and criteria for the examination of cybersecurity of the school environment acts not only as a measuring tool, but also as a pedagogical mechanism for the formation of such an environment. Further prospects of the research are connected with the discussion in the scientific and professional audience of the modified methodology of the cybersecurity examination of the school environment proposed by us, its approbation in the real educational process and refinement taking into account the opinions of scientists and teachers. Keywords: cybersecurity, cybersafety, school educational environment, expertise, system of parameters and criteria of expertise.

Information Security Management: American Experience

The purpose of the article is a comprehensive analysis of the American concept of threats to information security and determination of priority areas of the US’s activity in creating a secure national cyberspace. The methodological basis of the study is general scientific and special methods of cognition, in particular, systemic approach, analysis, synthesis, and logical method. Methods of content analysis, comparative and analytical monitoring of Internet resources of US government bodies responsible for information security are also used. The scientific novelty of the study consists in the expansion of ideas about theoretical aspects in the field of information security and the systematic analysis of instrumental, conceptual foundations and practical aspects of information security in the United States. Conclusions. The globalisation of information systems has created a completely new situation in the security field. In cyberspace the main threat to the US national security comes from states and intermediaries acting in their interests. They have the necessary skills and technologies to carry out destructive cyberattacks for military and political purposes, and also effectively use cyberespionage methods, which not only entails economic losses, but also causes great damage to strategically important industries for the US. The American concept covers such three key levels of cyber security as the state, private business and individual users. There are such defence priorities for the United States as ensuring the protection of critical infrastructure, information networks and systems; quality control of used IT equipment; formation of effective mechanisms of interlevel communication and raising awareness at all levels. An important component of the US National Cyber Strategy is international cooperation on information security issues. In this regard, at the international level the United States seeks to implement such opportunities as to encourage countries to increase responsibility for ensuring the security of information systems and networks at the national and global level; to create the legal regime necessary to ensure cross-border access to information; to form a regime of collective cyber defence within the framework of NATO and other bilateral and multilateral agreements with strategic partners; to preserve the maximum possible freedom of action in cyberspace in order to conduct all types of information operations both during military conflicts and in peacetime. Keywords: cyberspace, information threat, information war, information security, information management, informatisation, ICT.

SymbSODA: Configurable and Verifiable Orchestration Automation for Active Malware Deception

Malware is commonly used by adversaries to compromise and infiltrate cyber systems in order to steal sensitive information or destroy critical assets. Active Cyber Deception (ACD) has emerged as an effective proactive cyber defense against malware to enable misleading adversaries by presenting fake data and engaging them to learn novel attack techniques. However, real-time malware deception is a complex and challenging task because (1) it requires a comprehensive understanding of the malware behaviors at technical and tactical levels in order to create the appropriate deception ploys and resources that can leverage this behavior and mislead malware, and (2) it requires a configurable yet provably valid deception planning to guarantee effective and safe real-time deception orchestration. This article presents symbSODA, a highly configurable and verifiable cyber deception system that analyzes real-world malware using multipath execution to discover API patterns that represent attack techniques/tactics critical for deception, enables users to create their own customized deception ploys based on the malware type and objectives, allows for constructing conflict-free Deception Playbooks , and finally automates the deception orchestration to execute the malware inside a deceptive environment. symbSODA extracts Malicious Sub-graphs (MSGs) consisting of WinAPIs from real-world malware and maps them to tactics and techniques using the ATT&CK framework to facilitate the construction of meaningful user-defined deception playbooks. We conducted a comprehensive evaluation study on symbSODA using 255 recent malware samples. We demonstrated that the accuracy of the end-to-end malware deception is 95% on average, with negligible overhead using various deception goals and strategies. Furthermore, our approach successfully extracted MSGs with a 97% recall, and our MSG-to-MITRE mapping achieved a top-1 accuracy of 88.75%. Our study suggests that symbSODA can serve as a general-purpose Malware Deception Factory to automatically produce customized deception playbooks against arbitrary malware behavior.

A Review on Big Data Analytics on Cyber Security

Big data analytics in the context of defence refers to the capacity to gather substantial amounts of digital data for analysis, visualisation, and conclusion-making that might aid in anticipating and thwarting cyberattacks. It strengthens our position in terms of cyber protection when paired with security technology. They enable companies to identify activity patterns that point to network dangers. In this research study, we'll examine how big data might improve information security. I concentrate on how Big Data might enhance information security in this essay. In order to analyse, visualise, and derive insights that might help forecast and thwart cyberattacks, big data analytics in security requires the capacity to collect enormous volumes of digital data. It improves our cyber defence stance together with security technology. They make it possible for businesses to identify patterns of behaviour that indicate network dangers.

Utilizing Artificial Intelligence for Enhancing Cyber Security: Applications and Methodologies

The rapid advancement of technology has given rise to a host of security challenges, often leaving cybersecurity experts struggling to keep up with the latest developments. Safeguarding against security breaches and cyber-attacks now requires extensive support due to the intricate interconnections between organizations, resulting in a surge of network activity, heightened vulnerability, and an increased array of potential attack points. Addressing these complexities has become a daunting task for human capabilities alone. Conventional algorithms occasionally prove inadequate when dealing with the complexities of modern systems. The creation of software with an automatic updating mechanism, designed to stay aligned with technological progress, presents a formidable challenge. Within this landscape, Artificial Intelligence (AI) emerges as a promising avenue for mitigating cybersecurity concerns to a significant extent. By examining cybersecurity computational applications and analyzing strategies for enhancing cyber defense, AI-based solutions offer a potent pathway. This study delves into the realm of countering cybersecurity threats by harnessing the capabilities of AI applications and techniques. It explores how AI can fortify cybersecurity measures, proposing innovative approaches while also examining existing methodologies.

A Security Model for the Classification of Suspicious Data Using Machine Learning Techniques

Cybercrime first emerged in 1981 and gained significant attention in the 20th century. The proliferation of technology and our increasing reliance on the internet have been major factors contributing to the growth of cybercrime. Different countries face varying types and levels of cyber-attacks, with developing countries often dealing with different types of attacks compared to developed countries. The response to cybercrime is usually based on the resources and technological capabilities available in each country. For example, sophisticated attacks involving machine learning may not be common in countries with limited technological advancements. Despite the variations in technology and resources, cybercrime remains a costly issue worldwide, projected to reach around 8 trillion by 2023. Preventing and combating cybercrime has become crucial in our society. Machine learning techniques, such as convolutional neural networks (CNN), recurrent neural networks (RNN), and more, have gained popularity in the fight against cybercrime. Researchers and authors have made significant contributions in protecting and predicting cybercrime. Nowadays, many corporations implement cyber defense strategies based on machine learning to safeguard their data. In this study, we utilized five different machine learning algorithms, including CNN, LSTM, RNN, GRU, and MLP DNN, to address cybercrime. The models were trained and tested using the InSDN public dataset. Each model provided different levels of trained and test accuracy percentages.

Perlindungan Data Pribadi Mengenai Kebocoran Data Dalam Lingkup Cyber Crime Sebagai Kejahatan Transnasional

In this era of globalization, internet technology is growing rapidly from time to time. The right to privacy data is part of the privacy rights inherent in every individual. Until now the internet can be used as a new tool to commit a crime, especially cyber crime. The network is broad and can break through the barriers of national borders, enabling the occurrence of a cyber crime that can be carried out by crossing national borders or better known as transnational crime. This cyber crime can cause great losses both material and non-material. Moreover, cyber crime that is transnational in nature makes cyber crime require special treatment to handle it. Indonesia carried out two handlings both externally and internally. Externally, Indonesia and the National Police cooperate with the Australian Federal Police. Meanwhile, internally Indonesia formed institutions such as Id-SIRTII, Trust+positive, the birth of the European Union Convention On Cybercrime Bill, Cyber Defense Competition, Development of Cyber Defense. External handling is carried out by the Indonesian government to overcome Cyber crime that is across national borders.

Machine Learning Based Resilience Testing of an Address Randomization Cyber Defense

Moving target defenses (MTDs) are widely used as an active defense strategy for thwarting cyberattacks on cyber-physical systems by increasing diversity of software and network paths. Recently, machine Learning (ML) and deep Learning (DL) models have been demonstrated to defeat some of the cyber defenses by learning attack detection patterns and defense strategies. It raises concerns about the susceptibility of MTD to ML and DL methods. In this paper, we analyze the effectiveness of ML and DL models when it comes to deciphering MTD methods and ultimately evade MTD-based protections in real-time systems. Specifically, we consider a MTD algorithm that periodically randomizes address assignments within the MIL-STD-1553 protocol—a military standard serial data bus. Two ML and DL-based tasks are performed on MIL-STD-1553 protocol to measure the effectiveness of the learning models in deciphering the MTD algorithm: 1) determining whether there is an address assignments change i.e. whether the given system employs a MTD protocol and if it does 2) predicting the future address assignments. The supervised learning models (random forest and k-nearest neighbors) effectively detected the address assignment changes and classified whether the given system is equipped with a specified MTD protocol. On the other hand, the unsupervised learning model (K-means) was significantly less effective. The DL model (long short-term memory) was able to predict the future addresses with varied effectiveness based on MTD algorithm's settings.

Reinforcement Learning as a Path to Autonomous Intelligent Cyber-Defense Agents in Vehicle Platforms

Technological advancement of vehicle platforms exposes opportunities for new attack paths and vulnerabilities. Static cyber defenses can help mitigate certain attacks, but those attacks must generally be known ahead of time, and the cyber defenses must be hand-crafted by experts. This research explores reinforcement learning (RL) as a path to achieve autonomous, intelligent cyber defense of vehicle control networks—namely, the controller area network (CAN) bus. We train an RL agent for the CAN bus using Toyota’s Portable Automotive Security Testbed with Adaptability (PASTA). We then apply the U.S. Army Combat Capabilities Development Command (DEVCOM) Army Research Laboratory’s methodology for quantitative measurement of cyber resilience to assess the agent’s effect on the vehicle testbed in a contested cyberspace environment. Despite all defenses having similar traditional performance measures, our RL agent averaged a 90% cyber resilience measurement during drive cycles executed on hardware versus 41% for a naïve static timing defense and 98% for the bespoke timing-based defense. Our results also show that an RL-based agent can detect and block injection attacks on a vehicle CAN bus in a laboratory environment with greater cyber resilience than prior learning approaches (1% for convolutional networks and 0% for recurrent networks). With further research, we believe there is potential for using RL in the autonomous intelligent cyber defense agent concept.