Cyber Defense Research Articles

Preferential Cyber Defense for Power Grids

Preferential Cyber Defense for Power Grids

Threat-Based Simulation of Data Exfiltration Toward Mitigating Multiple Ransomware Extortions

Network-based attacks and their mitigation are of increasing importance in our ever-connected world. Often network-based attacks address valuable data, which the attacker either encrypts to extort ransom or steals to make money reselling, or both. After the infamous WannaCry and NotPetya ransomware attacks in 2017, companies stepped up their cyber defenses. More emphasis was placed on backup and recovery processes so that even when files were destroyed, organizations had copies for quick recovery. However, cyber criminals have also adapted their methods. Instead of simply encrypting files, double extortion ransomware now exfiltrates the data first, before encrypting it. As a consequence, the early detection and prevention of data exfiltration is one of today’s major challenges of institutions connected to the Internet. If attempts to illegal data exfiltration are successfully detected, the attacked institution should address a probable subsequent encryption attack step as well. In particular, valuable business assets must be checked for unauthorized access and need to be protected. However, due to the bulk of network traffic and persistent data, automation is a key requirement to successfully defend contemporary threats. The main goal of this article is to present a concept and its initial evaluation to achieve automation of data exfiltration mitigation in a targeted manner. Our concept consists of two main steps. Based on recognized international approaches used in cyber threat intelligence, an automatic procedure on the base of the MITRE Adversarial Tactics, Techniques Common Knowledge (ATT&CK) framework for deriving current threats with respect to data exfiltration is presented in the first place. In the spirit of the Digital Threats: Research and Practice (DTRAP) forum, a practical approach is chosen in addition to the theory in this manner. Our evaluation reveals that we are able to automatically identify the most relevant recent risks of unauthorized data exfiltration. In our second step, we present the design of a simulation gear based on the attacks extracted from the MITRE ATT&CK framework. The aim is to simulate the greatest threats before they actually occur in the operational environment. The strict focus on the threats of data exfiltration characterizes our solution and makes our approach an ideal addition to existing solutions. We provide an evaluation of this initial simulation concept and its underlying technology for the implementation to show that we are on the right track.

Cybersecurity and Cyber Defense Insights: The Complementary Conceptual model of Cyber resilience

Cybersecurity planning within a complex system and applying its principles aims to achieve system resilience in cyberspace. The purpose of a complex system is to carry out a mission as a set of abilities and preferences concerning the internal and external circumstances of the system. Achieving cyber resistance requires organizational, human, material, and financial resources to implement measures, activities, and procedures to reduce residual (remaining) security risk. This part of the security risk must be accepted within the system since it is impossible to achieve its further reduction. The research in this paper analyzes ways and means to achieve cyber resistance in the conditions of today's growing security risks. This research aims to create a new model of cyber resistance, which includes cyber and information security. This also considers that the methods of separating previously unseen threats and attacks of the past day are unknown today in a large number of business cases. To confront the challenges, there is a need to create "knowledge about ignorance" and the development of cyber capabilities based on the principles of cyber security and defense.

Malware Attack Detection in Large Scale Networks using the Ensemble Deep Restricted Boltzmann Machine

Today, cyber attackers use Artificial Intelligence (AI) to boost the sophistication and scope of their attacks. On the defense side, AI is used to improve defense plans, robustness, flexibility, and efficiency of defense systems by adapting to environmental changes. With the developments in information and communication technologies, various exploits that are changing rapidly constitute a danger sign for cyber security. Cybercriminals use new and sophisticated tactics to boost their attack speed and size. Consequently, there is a need for more flexible, adaptable, and strong cyber defense systems that can identify a wide range of threats in real time. In recent years, the adoption of AI approaches has increased and maintained a vital role in the detection and prevention of cyber threats. This paper presents an Ensemble Deep Restricted Boltzmann Machine (EDRBM) to classify cybersecurity threats in large-scale network environments. EDRBM acts as a classification model that enables the classification of malicious flowsets in a large-scale network. Simulations were carried out to evaluate the efficacy of the proposed EDRBM model under various malware attacks. The results showed that the proposed method achieved a promising malware classification rate in malicious flowsets.

Technical performance metrics of a security operations center

This research introduces a novel framework for creating metrics intended for security operations centers (SOCs). The framework is developed using the design science research methodology and has been validated by generating four novel metrics to assess the technical performance of a SOC. Additionally, the study examines the existing landscape of metrics for SOCs and concludes that a majority of the metrics discussed in the literature primarily focus on operational aspects rather than technical performance. The absence of adequate technical performance metrics makes it challenging to accurately evaluate the tangible impact of a SOC on overall cyber defense capabilities. The research also highlights the insufficiency of current methods in constructing metrics and frameworks tailored for measuring SOCs' technical performance. The resulting framework offers SOCs means to create high-quality metrics for performance evaluation. Furthermore, the metrics the framework was validated with offer SOCs an opportunity to enhance their ability to quantify their threat detection capabilities.

Analysis of presidential regulations concerning cyber security to bolster defense policy management

As a developing country, Indonesia must effectively manage its national defense by implementing defense policies which can be interpreted as management activities that transform into defense policy management entities. The objective is to protect against various dangerous threats resulting from the dynamics of the current strategic environment, which continues to undergo rapid and significant changes. Cyber threats pose a potentially dangerous threat that has a multidimensional impact. Therefore, this article analyzes one of the Indonesian government's efforts to deal with cyber threats, which is in the form of Presidential Regulation No. 47 of 2023. The research employs a qualitative descriptive approach in the field of literacy studies, drawing on reputable sources such as journals, books, and internet materials. It investigates the management measures and strategies implemented by Indonesia to combat cyber threats in accordance with presidential regulations for cybersecurity. These findings elaborate on the implementation of presidential regulations that concentrate on cyber crisis management and national cyber security strategy as a suitable and praiseworthy response to the constantly evolving cyber threats. Nonetheless, addressing several challenges requires strategic competencies in leadership to formulate cyber defense policies and strategies and carry them out optimally.

A hybrid cyber defense framework for reconnaissance attack in industrial control systems

The convergence of information technology (IT) and operation technology (OT) has made Industrial Control Systems (ICS) a popular target for cyberattacks in recent years. Unlike traditional networks, enhancing availability is the ICS network's top priority rather than confidentiality in the CIA scheme. We propose a bio-inspired adaptive defense framework based on dissimilar redundancy, diversity, and adaptive defense strategies to achieve this aim. The proposed mechanism mixed optimal network shuffling and cyber deception techniques to maximise the time attackers spend on the decoys. Besides, to provide an extra layer of protection for system availability, we introduce dual heterogeneous subnets in the proposed framework that could be regenerated once compromised. We evaluate the performance of the proposed defense framework in a typical industrial manufacturing network using an SDN-based platform and test the defense framework in various scenarios. Compared with previous research, the simulation shows a considerable improvement in defense performance in the adaptive defense mode.

Exploring topic models to discern cyber threats on Twitter: A case study on Log4Shell

Gathering information about cyber threats from various sources can help organisations improve proactive cyber defense and mitigate potential cyber attacks. Recently, Twitter has shown to be beneficial in providing timely Cyber Threat Intelligence (CTI) concerning cyber threats, software vulnerabilities and exploits. However, manually identifying and investigating useful insights, patterns, and trends from abundant unstructured tweets is difficult. This work proposes an end-to-end data-driven framework to collect, analyze, and monitor tweets using unsupervised topic modeling techniques. A novel visualization technique is also proposed to monitor the dynamic topic trends over time, offering an interpretable way to gain insights into a topic's lifecycle. A case study is conducted on the Log4shell vulnerability incident to demonstrate the applicability of the proposed framework. Experiments are carried out on a real-world Twitter dataset collected from 47 users within the CTI community. Results indicate that the proposed framework can discover emerging topics relevant to real-world cybersecurity incidents, with Log4Shell-related topics identified before the common public disclosure date by the National Vulnerability Database (NVD). This framework can expedite the data processing workflow and visualization for cyber threat analysis, enabling organizations to identify trends and patterns that can potentially indicate a security breach or attack.

The dangerous trends of using malware by the aggressor country to the damage of state interests under the legal regime of martial law

The trends in the use of malware by the russian hackers and cybercriminals commissioned by the special services of the Russian Federation have been determined. The scope and consequences of the spread of malware on a global scale are outlined. The threats and risks associated with cyber-attacks and the spread of malicious software are detailed. The attention is focused on the use of the TOR network by cybercriminals in modern conditions. The tasks of the special services of the Russian Federation in the conditions of cyber warfare, the forms and methods of conducting attacks using malicious software are summarized. The methodology of spreading malicious software through such mechanisms as financial fraud and phishing has been updated. The peculiarities of the distribution of malicious software of Russian origin have been revealed. The achievements related to Ukraine's acquisition of membership in the NATO structure on cooperation in the field of cyber defense are highlighted. The further directions of improving the current legislation in the matter of combating malware, in particular phishing have been determined.

Direction of Japan’s New Cybersecurity Policy

The direction of Japan’s cybersecurity policy is shaped by the escalating threat of state-sponsored cyberattacks in peacetime. This surge, notably from Russia, China, and North Korea, involves diverse tactics such as information manipulation, functional disruption, and financially motivated attacks, posing economic and national security risks. In response, nations are increasingly adopting Active Cyber Defense (ACD) strategies. ACD combines real-time attack detection with proactive countermeasures, aiming to impose costs on malicious cyber actors and mitigate potential damage. The United States and the United Kingdom lead in ACD implementation, using technical and policy responses, including hackbacks, to deter and attribute cyber threats. Japan is aligning its security policy with ACD principles, recognizing the need for proactive cyber measures beyond passive cyber defenses. This shift involves enhancing cyber capabilities, increasing cyber-related units, and fostering collaboration with the private sector. However, legal and regulatory challenges hinder ACD implementation in Japan, with existing laws restricting activities such as attack monitoring and attribution. Bridging these gaps is crucial for developing a comprehensive cybersecurity framework and ensuring the nation’s resilience against evolving cyber threats.

Frustration, Confusion, Surprise, Confidence, And Self-Doubt: Cyber Operators’ Affects During A Realistic Experiment

In this paper we examine data from a complex two-day experiment with professional cyber red teamers to determine what creates, or contributes, to affective states that may further disrupt attackers. Participants rated their frustration, surprise, confidence, self-doubt, and confusion at the end of each day, and these responses were scored on a Likert scale and using Thematic analysis. We found several elements strongly contributed to the frequency and severity of these affective states, supporting our initial hypothesis, and further that (1) experiencing a Lack of Progress impacted four of the five states with moderate severity, and (2) interacting with elements in the environment that Deviated from what was expected was associated strongly with surprise. Implications for cyber defense and limitations of the method are discussed.

A Comprehensive Analysis of the Worst Cybersecurity Vulnerabilities in Latin America

Vulnerabilities in cyber defense in the countries of the Latin American region have favored the activities of cybercriminals from different parts of the world who have carried out a growing number of cyberattacks that affect public and private services and compromise the integrity of users and organizations. This article describes the most representative vulnerabilities related to cyberattacks that have affected different sectors of countries in the Latin American region. A systematic review of repositories and the scientific literature was conducted, considering journal articles, conference proceedings, and reports from official bodies and leading brands of cybersecurity systems. The cybersecurity vulnerabilities identified in the countries of the Latin American region are low cybersecurity awareness, lack of standards and regulations, use of outdated software, security gaps in critical infrastructure, and lack of training and professional specialization.

국제 다자회의 발전을 통한 국방 사이버안보 향상 방안 연구

국제 다자회의 발전을 통한 국방 사이버안보 향상 방안 연구

Cybersecurity Strategies for Safeguarding Customer’s Data and Preventing Financial Fraud in the United States Financial Sectors

As the financial sectors in the United States deal with expanding cyberthreats and a rising danger of financial crime, cybersecurity has become a top priority. This paper examines the crucial cybersecurity techniques used by financial institutions to protect client information and counter the growing risk of financial fraud. It proves that understanding common fraud tactics used to defraud financial institutions and customers, putting fraud detection and prevention techniques like anomaly detection and machine learning into practice, and using transaction monitoring and anti-money laundering tactics to spot and stop fraudulent activity are all necessary for preventing financial fraud. The paper begins by reviewing the common cyber dangers affecting the financial industry and the strategies used by cybercriminals to circumvent security precautions and take advantage of weaknesses. After looking at potential risks, the paper highlights the importance of proactive cybersecurity measures and risk mitigation techniques. It highlights crucial components of cybersecurity frameworks, including strong data encryption, multifactor authentication, intrusion detection systems, and ongoing security monitoring. This paper also emphasizes the value of educating and training financial institution staff members to increase cybersecurity resilience. It underlines the significance of building a strong security culture, educating personnel about potential dangers, and encouraging responsible management of client data. The study also explores the advantages of financial organizations working together and exchanging threat knowledge. It examines industry alliances, information-sharing platforms, and public-private partnerships as crucial methods for group protection against cyber threats. This paper highlighted the significance of artificial intelligence and machine learning in cybersecurity domain. It demonstrates how these technologies improve cybersecurity systems' capabilities by spotting irregularities and potential attacks. It emphasizes the significance of taking a proactive and dynamic strategy to securing client information and maintaining faith in the United States’ financial sectors. Overall, this paper provides a thorough overview of cybersecurity tactics crucial for protecting consumer data and avoiding financial fraud in the financial sectors across the United States. By taking a vigilant, team-based, and technology-driven strategy, financial institutions may strengthen their cyber defenses, protect the data of their clients, and defend the integrity of the financial system.

The importance of cybersecurity frameworks to regulate emergent AI technologies for space applications

Over the past decades, industries and governments have progressively been relying upon space data-centric and data-dependant systems. This led to the emergence of malicious activities, also known as cyber-threats, targeting such systems. To counter these threats, new technologies such as Artificial Intelligence (AI) have been implemented and deployed. Today, AI is highly capable of delivering fast, precise, and reliable command-and-control decision-making, as well as providing reliable vulnerability analysis using well-proven cutting-edge techniques, at least when applied to terrestrial applications. In fact, this might not yet be the case when used for space applications. AI can also play a transformative and important role in the future of space cybersecurity, and it poses questions on what to expect in the near-term future.Challenges and opportunities deriving from the adoption of AI-based solutions to achieve cybersecurity and later cyber defence objectives in both civil and military operations require rethinking of a new framework and new ethical requirements. In fact, most of these technologies are not designed to be used or to overcome challenges in space. Because of the highly contested and congested environment, as well as the highly interdisciplinary nature of threats to AI and Machine Learning (ML) technologies, including cybersecurity issues, a solid and open understanding of the technology itself is required, as well as an understanding of its multidimensional uses and approaches. This includes the definition of legal and technical frameworks, ethical dimensions and other concerns such as mission safety, national security, and technology development for future uses.The continuous endeavours to create a framework and regulate interdependent uses of combined technologies such as AI and cybersecurity to counter “new” threats require the investigation and development of “living concepts” to determine in advance the vulnerabilities of networks and AI.This paper defines a cybersecurity risk and vulnerability taxonomy to enable the future application of AI in the space security field. Moreover, it assesses to what extent a network digital twins’ simulation can still protect networks against relentless cyber-attacks in space against users and ground segments. Both concepts are applied to the case study of Earth Observation (EO) operations, which allows for conclusions to be drawn based on the business impact (reputational, environmental, and social) of a cyber malicious activity. Since AI technologies are developing on a daily basis, a regulatory framework is proposed using ethical and technical approaches for this technology and its use in space.

Enabling Protection Against Data Exfiltration by Implementing ISO 27001:2022 Update

The risk of data theft has increased significantly over the past years. As a consequence, overwhelming damage is caused to institutions and private persons, respectively. Even the widespread ISO standard 27001 was updated recently in October 2022 to integrate data exfiltration aspects. Corresponding new security controls have been introduced. In this paper we review the ISO 27001:2022 with respect to data exfiltration and come up with recommendations on how recently integrated ISO 27001:2022 controls can be used in an operational environment. Based on that, we introduce and demonstrate the effectiveness of a proactive and dynamic concept by integrating a simulation cycle into the Information Security Management System (ISMS) and using cyber threat intelligence to provide us with information about current threats. We provide a prototype for the threat simulation cycle based on a smart combination of established and widely accepted cyber defence tools. Within our evaluation we show the feasibility of our targeted and dynamically configurable simulation of data exfiltration threats and thus support to thwart the actual cyber-attacks in advance. In all we contribute to prevent (or at least make it significantly more difficult) the threat of data exfiltration. Dynamic, threat aware and preventive cyber-defence is our objective, and we provide an updated concept which integrates conclusively into an ISO 27001:2022 compliant ISMS.

COOPERATION BETWEEN UKRAINE AND NATO IN COUNTERING DESTRUCTIVE IINFORMATIONAL INFLUENCES OF THE RUSSIAN FEDERATION (2022–2023)

The research analyses NATO's experience in countering information threats, since the current level of development requires a collective fight against the spread of information, using it as a form of warfare. The spread of information is becoming increasingly complex due to the development of technology and the evolution of communication channels. It is show that NATO has recognized the need to adapt its strategies and capabilities to effectively counter the challenges posed by disinformation, propaganda and cyber operations and to expand its tools to counter hybrid threats. The article analyses the potential of the NATO-Ukraine partnership in the fight against Russian propaganda, their cooperation in the field of information security: common interests and trends. It also describes the main challenges and threats to NATO-Ukraine cooperation and defines the framework for NATO-Ukraine cooperation in cyber defense. The flow of Russian disinformation has increased significantly since the start of Russia's full-scale war in Ukraine. However, Ukraine began strengthening its information and media environment as early as 2014, and began working on mechanisms to combat information threats. Russia's disinformation campaigns are aimed at causing divisions within Ukraine and between other governments. It is important to note that the North Atlantic Alliance is also subject to Russian propaganda. For example, the Russian mass media spread the following information: 1) the purpose of the Maidan is to create NATO bases in Crimea; 2) NATO placed a biological weapons laboratory in Ukraine; 3) NATO special services worked on the hijacking of Russian planes by Ukraine; 4) NATO considers Ukraine a disposable tool for war with Russia and others. That is, it should be noted that information and its dissemination play an important role for states and international organizations to spread their own interests and achieve goals. The authors provide key recommendations for strengthening the counteraction to disinformation that can be used by any actor in international relations. As a result, it is argued that states should work to create a new autonomous institution that can conduct the data analysis necessary to ensure the independent control required by the new policy framework; media literacy should be developed; and technology companies such as Meta, YouTube and Twitter should adhere to their policies on prohibiting disinformation funded by advertising.

The Weakest Link: Employee Cyber-Defense Behaviors While Working from Home

ABSTRACT With the increase in the number of employees working remotely from home following the COVID-19 pandemic, cyberattacks have grown in quantity and strength. While companies invest tremendous resources in technical defense practices and protection tools, the main weak link is still the human factor. The current study aims to provide theoretical and empirical evidence of the antecedents that contribute to active cyber defense as well as cyber risk behaviors. Based on a sample of 338 employees who worked from home or on-site during and after COVID-19, we examined the effects of organizational training on employee defense behaviors. The results of the current study suggest that the workplace and the amount of confidence in the defense measures play an important role in contributing to cyber risk behavior. Therefore, it is crucial that managers raise employee awareness of the hazards and educate them on the different defense methods that they can apply.

Deep Reinforcement Learning for Cyber Security.

The scale of Internet-connected systems has increased considerably, and these systems are being exposed to cyberattacks more than ever. The complexity and dynamics of cyberattacks require protecting mechanisms to be responsive, adaptive, and scalable. Machine learning, or more specifically deep reinforcement learning (DRL), methods have been proposed widely to address these issues. By incorporating deep learning into traditional RL, DRL is highly capable of solving complex, dynamic, and especially high-dimensional cyber defense problems. This article presents a survey of DRL approaches developed for cyber security. We touch on different vital aspects, including DRL-based security methods for cyber-physical systems, autonomous intrusion detection techniques, and multiagent DRL-based game theory simulations for defense strategies against cyberattacks. Extensive discussions and future research directions on DRL-based cyber security are also given. We expect that this comprehensive review provides the foundations for and facilitates future studies on exploring the potential of emerging DRL to cope with increasingly complex cyber security problems.

Emerging Trends and Future Prospects of Cybersecurity Technologies: Addressing Challenges and Opportunities

Cybersecurity is an ever-evolving domain, continuously challenged by sophisticated threats and rapidly advancing technologies. To safeguard digital assets and privacy in the face of emerging risks, it is imperative to explore and embrace the latest trends and innovations in cybersecurity technologies. This research paper investigates the most promising emerging trends in cybersecurity and their potential implications for the future landscape of cyber defense. By addressing the challenges and opportunities presented by these technologies, this paper aims to shed light on how organizations and policymakers can proactively strengthen their cybersecurity posture.