Cyber Domain Research Articles

Resilient and robust control strategy against deception attacks in the platoon of vehicles

AbstractA platoon must ensure the security of conducting missions due to the susceptibility of the vehicles to cyber‐attacks. The deception attack is a common type of cyber‐attack that might be introduced during data exchange through communication channels. Therefore, it can divert each vehicle by injecting uncertainty into the communication link between the agents in the cyber domain. This paper employs a leader–follower consensus system as a reference model to control the platoon vehicles. Accordingly, each agent in the reference model sends its information as a reference trajectory to its corresponding vehicle within the platoon. The vehicles are equipped with a robust local controller, enabling them to follow their desired trajectory in the presence of external disturbances. Furthermore, each vehicle employs an unknown input observer to detect a deception attack while decoupling it from external disturbances. Moreover, by introducing a switching strategy based on mode‐dependent average dwell time to the leader–follower consensus system, a novel resilient control strategy against the deception attack is implemented in the cyber domain. The resultant resilient leader–follower consensus system in the platoon retrieves and restores the attacked vehicle in the platoon to its associated states. The applicability of the proposed method is shown via simulation.

A Comprehensive Survey on Cyber-Physical System Security in the Internet of Things (IoT): Addressing and Solutions

Background: Cyber-Physical Systems (CPSs) integrate computing, control, and communication technologies, bridging cyberspace and the physical world to enhance critical infrastructure and safety-critical systems. Existing surveys often address CPS security from a single perspective, necessitating a more comprehensive approach. Methods: This paper presents a thorough review of CPS security from three perspectives: the physical domain, the cyber domain, and the cyber-physical domain. We examine attacks on physical components like sensors, cyber-attacks targeting CPSs, and integrated cyber-physical attacks. For each domain, we analyse corresponding detection and defence mechanisms. Results: Our review reveals that CPSs face significant security threats across all domains. In the physical domain, attacks on sensors can disrupt system operations, but various defences are available. In the cyber domain, CPSs are vulnerable to malware, hacking, and denial-of-service attacks, with several detection and defence strategies in place. The cyber-physical domain highlights complex threats where cyber-attacks cause physical damage, requiring comprehensive security approaches. Conclusion: By examining CPS security from multiple perspectives, this review provides a holistic understanding of current threats and defence mechanisms. It identifies future research directions to enhance CPS security, aiming to better protect critical infrastructure against evolving cyber threats.

The Copenhagen School’s widening security theory in relation to cybersecurity. Applicability and Implications

This paper critically examines the relationship between cybersecurity and Copenhagen School’s widening security theory, with the aim of assessing the possibility of applying this theoretical framework to the cyber realm. As cybersecurity is a relatively recent addition to the security discourse, this research explores whether the Copenhagen School’s traditional framework, which was primarily focused on securitisation processes in the five main sectors (military, political, economic, environmental, and societal), adequately encompasses the unique aspects and dynamics of cyber domain. The research question is: Why the cybersecurity field can’t become a separate constructivist sector? The study begins with a detailed overview of both cybersecurity landscape and Copenhagen School’s fundamental principles to provide the context for a comparative analysis of the Copenhagen theory and contemporary cybersecurity literature. In doing so, the research delves into the features of cybersecurity, with a focus on the evolving nature of cyber threats and vulnerabilities. By performing a qualitative analysis of the existing literature, the paper assesses the limitations of integrating these two concepts, ultimately concluding that cybersecurity lacks the distinct characteristics required to be considered a separate sector under the Copenhagen School’s framework. The findings contribute to the ongoing discussions regarding the adaptation of traditional security theories to address contemporary security challenges in the digital age.

The Role of Internet of Battlefield Things in Modern Warfare: A Cybersecurity Perspective

The Internet of Battlefield Things (IoBT) is revolutionizing military operations by integrating interconnected devices and autonomous systems into combat environments, significantly enhancing decision-making, communication, and battlefield efficiency. However, this reliance on IoBT introduces substantial cybersecurity risks, exposing military networks to sophisticated cyber threats such as hacking, malware, and Distributed Denial of Service (DDoS) attacks. This paper explores the interplay between IoBT and the cyber domain, identifying the key challenges, vulnerabilities, and solutions necessary to secure these interconnected systems in the context of modern warfare. The study reviews the architectural components of IoBT, including sensors, drones, and communication networks, and examines their potential weaknesses in the face of cyberattacks. Additionally, it discusses common attack vectors such as Man-in-the-Middle (MitM) and zero-day exploits, which pose significant risks to military systems. To counter these threats, the paper evaluates various cybersecurity strategies, including the application of artificial intelligence (AI), machine learning (ML), blockchain technology, and robust encryption protocols designed to enhance the resilience and security of IoBT networks. Case studies of real-world IoBT deployments and cyber breaches further illustrate the practical implications of these challenges and defense mechanisms.

Assessing the Effectiveness of Cyber Domain Controls When Conducting Cybersecurity Audits: Insights from Higher Education Institutions in Canada

This study validates a comprehensive cybersecurity audit model through empirical analysis in three higher education institutions in Canada. The research aims to enhance cybersecurity resilience by assessing the effectiveness of cybersecurity controls across diverse educational environments. Given the increasing frequency and sophistication of cyberattacks targeting educational institutions, this research is essential to ensure the protection of sensitive academic and personal data. Data were collected through detailed audits involving system vulnerabilities, compliance with security policies, and incident response management at each institution. The findings underscore the importance of tailored cybersecurity strategies and continuous auditing to mitigate cyber risks in the Canadian higher education sector. This study contributes to the field by validating a versatile audit tool that can be adapted to various institutional contexts, promoting enhanced cybersecurity practices and evaluating the effectiveness of cybersecurity safeguards across the higher education sector in Canada. The results of the audit model validations provide the cybersecurity maturity rating of each institution. Further research is recommended to refine the model and explore its application in other industries and sectors.

Assessing Attribution and Credible Deterrence in Cyberspace

This study examines the issues that states face in discerning actors within the realm of cyberspace, characterizing these challenges as akin to navigating the unregulated landscape. Lack of an effective attribution mechanism and a credible deterrence framework have significantly contributed to the volatility in cyber domain in contemporary times. This paper argues that states often accuse their adversaries of orchestrating cyber-attacks against them, yet they frequently fail to provide substantial evidence because actors behind attacks in cyberspace leverage the inherent anonymity of cyberspace to evade accountability, complicating the process of attribution even further. In addition, this study also underscores the importance of establishing an effective mechanism of deterrence in cyberspace to dissuade the attacking actors from engaging in malicious cyber activities. In line with this, this paper looks at the cyber space activities through novel perspective of no biasness, without subjectivity and tends to offer the answers of why attribution is problem, is there any possible solution to it in practice. Therefore, this study aims to highlight the ways to attribute the cyber-attacks and highlight the challenges to attribution, especially in the current scenario of states sponsoring indirectly cyber-attacks against many other states by outsourcing their aggressive designs in cyberspace to non-state actors.

A hybrid cyber–physical risk identification method for grid-connected photovoltaic systems

Identifying risks in modern electric power systems is essential, and one of the main difficulties concerns covering the wide range of technologies that permeate its cyber and physical domains. Different risk identification methods have been proposed, but applying them individually does not guarantee coverage of both domains. On the other hand, the simple non-articulated application of a set of existing risk identification methods can lead to an exhaustive and inefficient process. This paper proposes a new Cyber–Physical Risks Identification Method (CPRIM) to comprehensively and efficiently identify risks in electrical power systems. To systematically cover risks ranging from the cyber domain to the physical domain, CPRIM combines in a complimentary and articulated way the National Institute of Standards and Technology (NIST) Cybersecurity Framework, a Risk Factor model, and the HAZOP, establishing a novel hybrid risk identification approach. This work also proposes a method based on Jaccard and overlap indexes to quantitatively assess the complementarity and superposition that may exist when applying different risk identification methods to electrical power systems. The results obtained in a real computer-managed photovoltaic plant indicate that CPRIM can efficiently identify cyber–physical risks, showing a reasonable trade-off between system coverage and redundancy in identified risks.

Assessing Power and Hierarchy in Cyberspace: An Approach of Power Transition Theory

This study explores the application of Power Transition Theory (PTT) to cyberspace, aiming to establish a comprehensive framework for understanding and measuring cyber power. Utilizing PTT’s national power model, the research treats states as rational and unitary actors, integrating the rational actor model to assess state behavior in cyberspace. The objectives include defining cyber power, developing a novel metric for its evaluation, and categorizing states within a hierarchical structure of cyber power. By analyzing key components such as data resources, digital economic strength, and cyber political capacity, the study provides a nuanced understanding of cyber power dynamics. The results demonstrate that the traditional IR theories retain relevance in the cyber domain, offering a valuable lens for comprehending global cyber governance and geopolitical competition. This foundational work sets the stage for future analyses of power transitions within cyberspace, highlighting the critical interplay between traditional power metrics and emerging digital landscapes.

Rising sun in the cyber domain: Japan’s strategic shift toward active cyber defense

This paper provides an in-depth analysis of Japan’s evolving cyber defense capabilities and explores its future challenges. National security has transformed in the twenty first century, with cyberspace becoming a key conflict domain. Japan, like other nations, has adapted to these changes. In 2022, the Japanese government introduced its active cyber defense concept. The National Security Strategy of 2022 stated the government’s posture for active cyber defense, which pre-emptively neutralizes adversary computers. This marked a turning point in Japan’s security and defense. This strategic shift, which occurred notably between 2000 and 2022, exemplifies Japan’s transition in the cyber domain. The scope of protecting cyberspace has evolved from primarily safeguarding civilian infrastructure to adopting proactive measures. This evolution is analyzed in the paper, which contrasts Japan’s approach with Western nations’ military-driven cyber policies. Additionally, the multifaceted challenges and opportunities arising from this paradigm shift in cyber capability development are explored. The analysis encompasses key aspects, including the policy formation, international cooperation, budgetary allocations, and the progress of organizational structures regarding the cyber domain. Furthermore, the study explores Japan’s future trajectory in cyber defense, with a particular focus on its role within the ‘Multi-Domain Defense Force’ and the dynamics of the Japan-US alliance.

The Offense-Defense Balance in Cyberspace

The study of cyber strategy and its implications for international security has become increasingly crucial, necessitating an examination of the unique challenges posed by the dynamic and stealthy nature of the cyber domain. This paper addresses whether offensive or defensive strategies prevail in cyberspace, especially in light of evolving technological landscapes and debates over cyber threats. By applying offense-defense theory from international relations, the research explores the nuanced relationship between offensive and defensive operations in cyberspace. Despite prevalent views favoring offense dominance, recent skepticism questions the severity of cyber threats and suggests a possible overemphasis on offensive operations. This paper systematically examines the core concepts, findings, and operational variables of offense-defense theory, providing clarity to the conceptual debates surrounding cyber conflict. Recognizing the unique characteristics of the cyber domain, it urges a careful consideration of biases that may distort judgments about offense dominance. The evolving nature of cyberspace and its potential for redesign introduces caution and underscores the need for a nuanced understanding of the offense-defense balance. The preliminary assessment concludes that the question of whether offense or defense "dominates" in cyberspace is overly simplistic. Given the intricate interactions of cyber capabilities, other coercive means available to states, and the dynamic evolution of cyber technology, this question can only be answered within specific contextual and chronological boundaries. Within such conditions, the state of the offense-defense balance is crucial to tactical and operational decision-making. At the strategic policymaking level, the more coherent question is how cyber technologies are shifting the balance of advantages between offense and defense in the overall military posture of states. In essence, this paper provides valuable insights into the ongoing discourse on cyber strategy, theoretical frameworks, and nuanced analyses to inform policy and strategic decision-making in the face of evolving cyber threats.

A Theory of Offensive Cyberspace Operations and Its Policy and Strategy Implications

The significance of Offensive Cyberspace Operations (OCO) in cyber warfare and national security is increasingly recognised, yet academic literature lacks a dedicated theoretical framework to fully articulate its unique aspects and strategic dimensions. Traditionally enveloped within the broader context of information warfare, OCO's distinct characteristics have often been overlooked. Addressing this gap, our paper aims to delineate the specificities of OCO and establish a structured conceptual model that enhances understanding and operational clarity. To achieve this, the study adopts an interpretive approach, drawing from existing literature on information warfare and cyberspace, alongside official U.S. government and military publications on cyberspace operations. Employing the theory-building method, we focus primarily on conceptualization. This involves creating a coherent conceptual framework through abstraction, synthesis, and diagramming, informed by seminal works in the field. Among the paper's key contributions are detailed conceptual models that shed light on OCO's integration within the broader cyber domain, the influence of U.S. policy and strategy on OCO, and the critical triad for successful operations: access, vulnerabilities, and payloads. Furthermore, we elucidate the primary and secondary components of OCO, specifically cyberspace attack and exploitation, offering new insights into their roles and implications. Thus, the framework includes conceptual maps highlighting OCO's key elements, relationships, and challenges, aiming to advance academic discourse, practical strategies, and policy in cyberspace operations. This effort marks a significant step forward in both theoretical engagement and practical application within the field.

Consciência situacional como ferramenta estratégica da defesa cibernética

The technological growth of the last decades has changed the way many sectors of society and the state carry out their respective activities. The defense sector is part of this framework due to its essentially technological nature. With these changes, discussions began about phenomena known as ‘cyberspace’, ‘cyber power’, and ‘cyber domain’. Because cyberspace permeates and can even influence the other operational domains (sea, land, air, and space), having the right knowledge of cyberspace – both one’s own and that of one’s adversaries – has become a competitive advantage in interstate conflicts. This knowledge is called situational awareness, a concept conceived in the 1980's by Mica Endsley, then Chief Scientist of the United States Air Force, and which can be defined as the ability to perceive and understand activities in a given time and space and to predict the future evolution of the situation. This concept can be unfolded in the cyber domain, giving rise to the socalled cyber situational awareness, which generally means the full knowledge of the actions occurring in the cyber space of interest. Thus, this article aims to elucidate the strategic role of cyber situational awareness, identifying the theories and models of its emerging concept and, subsequently, its developments in military strategy.

Principle of Distinction in Cyber Warfare

Abstract Principle of distinction, one of the fundamental principles of international humanitarian law dictates, that participants in hostilities at all times distinguish between civilian objects and military objectives, as well as between civilians and combatants. This article addresses the adequacy of the protection offered by the principle in the cyber domain. Great reliance of militaries on civilian cyberinfrastructure expands the range of military objectives to the systems which key civilian activities depend on. There are many unknowns in fulfilling even the simple conditions for the combatant status, as well as in regulation of civilian direct participation in hostilities.

Development of a Phishing Detection System Using Support Vector Machine

Phishing represents a significant and escalating threat within the cyber domain, inflicting substantial financial losses on internet users annually. This illicit practice leverages both social engineering tactics and technological means to unlawfully obtain sensitive information from individuals online. Despite numerous studies and publications exploring various methodologies to combat phishing, the number of victims continues to surge due to the inefficiencies of current security measures. The inherently anonymous and unregulated nature of the internet further compounds its susceptibility to phishing attacks. While it's commonly believed that successful phishing endeavours involve the creation of replica messages or websites to deceive users, this notion has not undergone systematic examination to identify potential vulnerabilities. This paper endeavours to fill this gap by conducting a comprehensive evaluation of phishing, synthesizing diverse research perspectives and methodologies. It introduces an innovative classification method utilizing Support Vector Machine (SVM), achieving an impressive accuracy rate of 96.4% in detecting phishing attempts. By implementing this model to distinguish between phishing and legitimate URLs, the proposed solution offers a valuable tool for individuals and organizations to promptly identify and mitigate phishing threats. The findings of this study hold significant implications for bolstering internet security measures and enhancing user awareness in navigating potentially malicious online content.

Latent profiles of cyber violence among South Korean adolescents: Applicability of routine activity theory

AbstractThere is a growing concern towards the risk of cyber violence among young digital natives. This study tested the applicability of routine activity theory in the cyber domain using a national sample of 2228 South Korean adolescents. Latent profile analysis was used to identify the conditions of the motivated offender, suitable target, and capable guardian within the online context. Low‐risk, detached norm, and comprehensive‐risk profiles emerged. Binary logistic regression indicated that adolescents in the comprehensive‐risk profile were most likely to experience cyber violence, compared to other profiles. The risk of perpetration was greater for the low‐risk profile than the detached norm profile. This study identified the contexts of youth that heighten the risk of cyber violence and suggested important points of intervention.

Impact of space systems capabilities and their role as critical infrastructure

The cyber domain has led to growth in current satellite capabilities, which have become essential due to the increased use of both civil and military critical infrastructure (CI) management systems. In recent decades, outer space has proven to be an increasingly critical sector for the international management of commercial CI, with private operators acting on both multi- and transnational levels. However, the space domain is characterised by not only opportunities but also risks and threats. As the security implications of space were not sufficiently considered at the beginning of the space era, some of the predominant risks currently extend into the commercial sphere. These risks must be considered to ensure the resilience of connected CIs in outer space. Security is a vital issue in the cyber and space domains and should be considered in every phase of a space system's life cycle, from the development and manufacturing of space assets to their deployment and end of life. This involves CI in several sectors, each of which exhibits different but interrelated risks. For example, telecommunications and location systems increasingly require the use of CI, which creates a fragile interdependence that is extremely vulnerable to threats. This paper underlines the importance of recognising space systems as CI and emphasises the need for a better integration of these assets in a system-of-systems analysis. The consequences of global satellite disruption on terrestrial CI are used to support this view. In such a disruptive scenario, mitigation measures based on in-orbit servicing or responsive space capabilities, for example, would allow CI to be restored to first ensure national security followed by commercial activities. Moreover, this paper provides an overview of the legal and policy aspects of using space systems’ capabilities in CI to better understand their implications and encourage the development of recommendations.

Cyber Strategy in Practice

National cyber security strategies had already undergone a period of evolution before Russia’s 2022 invasion of Ukraine, ostensibly in preparation for just such a catalyser of major cyber conflagration. But the cyber war never came. Tom Johansmeyer, Gareth Mott and Jason R C Nurse analyse the national cyber security strategies (NCSS) of the US, Ukraine and Russia – as significant cyber domain stakeholders in the conflict – and how aligned these strategies were for the cyber component of the Ukrainian war. In addition, they consider areas of reflection for the future evolution of NCSS documents, particularly in light of the current state of play with cyber operations. ■

Reintegration of cyber veterans: challenges and strategies for post-war transition.

Battles in the cyber domain often lack visibility compared to the physical domain, which can lead to insufficient appreciation of its actors' achievements by the general public and society. Nonetheless, it has become a crucial area of modern warfare in which cyber professionals defend the nation's critical infrastructure, support other military operations and achieve military objectives that could not be attained in other domains. Although cyber combatants might not have as high a risk of injury or death as those on the front lines, they still can face traumatic events and suffer from the same types of issues after the war as any other veteran. Earlier studies on war veterans have shown they have elevated risks of mental health issues, substance use, social problems and financial difficulties which might push some individuals towards a path of crime. The cyber domain is also not limited by time or place, which has given rise to cyber volunteerism in which skilled individuals around the globe decide to assist their own country or friendly nations. This publication aims to identify the challenges cyber veterans might face when transitioning back to civilian life and develop appropriate strategies to facilitate their reintegration. It also raises the awareness of the hundreds of thousands of volunteers who can develop similar problems after the war. Without proper awareness, support and dialogue, some of these individuals can also drift towards harmful social implications such as cybercrime.

The Legal Status and Targeting of Hacker Groups in the Russia-Ukraine Cyber Conflict

Abstract The armed conflict between Russia and Ukraine has been characterized by a considerable number of cyber operations by States and non-State actors in support to either party to the conflict. One year since the Russian invasion of Ukraine, the ‘Russia-Ukraine cyber conflict’ offers valuable insights for estimating the effectiveness of International Humanitarian Law in regulating the status and the conduct of individuals engaging in cyberspace operations during wartime. By discussing the status of hackers groups and individuals who have conducted cyber operations in support of Ukraine, this Article claims that the relevance of the concept of combatancy is diminished in the cyber domain, and that the notion of direct participation in hostilities must be adapted to the specific features of cyberspace. Furthermore, the article focuses on the issues relating to the targeting of individual who directly participate in hostilities by conducting cyber operations in support of Ukraine. By doing so, the Article argues that cyber direct participants place themselves at an increased risk of being attacked, even though the Russian armed forces are limited in their targeting decisions by the principles of proportionality and precaution.

Human-Centered AI in Military Cyber Operations

Military Cyber Operations are an integral part of modern warfare and national security strategies as they crossed the science fiction realm, represent a real operational battlefield, and developed into an option in military toolboxes. Seeing ongoing technological advancements that allow the creation and use of complex mechanisms and technologies, the increasing digitalization of critical infrastructure, the growing abundance of data collected, generated, and exchanged between multiple parties, and the rise of stakeholders engaging in building and/or executing military Cyber Operations together with the increased number of such operations being conducted all over the globe reflects important lessons that need to be learned: the core element of such operations are humans: they build, acquire, execute, and assess them while also being impacted entities by them, e.g., through (psychological or physical) injury or death, or damage or destructions of human infrastructure. Moreover, the key process governing all the life cycle phases of military Cyber Operations is human decision-making or humanly assisted/augmented decision-making relying on advanced intelligent methods built with AI. Nevertheless, building and conducting military Cyber Operations should be done in a legal, responsible, and effective way implying a deep understanding of the context and adversary, proper target and cyber weapon selection, development, and use, and a clear overview of potential effects produced. These represent important aspects that should be properly defined and tackled in this domain. Hence, this research aims to introduce the Human-Centred AI concept and approach in the military cyber domain to illustrate ways to prioritize human involvement and interaction, human understanding, effective decision-making, and ethical considerations when building and conducting military Cyber Operations. To this end, an extensive literature review is conducted in the military, cyber, and AI domains together with instantiation on military Cyber Operations.