Cyber Experts Research Articles

Plans to Improve the Acquisition of Defense Cyber Experts

Plans to Improve the Acquisition of Defense Cyber Experts

Never Overlook Security Awareness on Deployment

Since preliminary evidence supports the association between security culture and information security awareness (ISA), more research is needed to determine how it interacts with organizational culture. Beyond variations in respondent nation or gender, the study's findings also demonstrate an association between stronger cyber expertise and level of cyber awareness. Additionally, awareness is linked to defense mechanisms but not the information they were willing to divulge. People play an even more important role in the collaboration between those teams and the security team when security is incorporated into DevOps practices. Furthermore, security is crucial when creating essential systems since it allows us to control objectives, risks, and evidence. Labor only starts after implementing security into the DevOps toolchain. To establish a security culture, we are additionally required to start with behavioral alterations. One of the largest Sharia banks in Indonesia anticipated cyberattacks in 2023, demonstrating to us how crucial security is in the modern world. Although no one could claim that using one of the security solutions would guarantee absolute safety, information security technology is quite dynamic. Future studies could improve on the current findings by taking into account national culture. This study has the aim of proving that we are never satisfied by current security maturity even if you or your company is implementing the best security tools, because the vulnerability can come from that deployment and wherever the environment itself.

Barriers to Mental Health Support in Cyberbullying: A Thematic Analysis of What Mental Health Professionals and Cyber Experts Think

Background: Cyberbullying can be a traumatic experience for adolescents. It can affect their psychosocial functioning, development, and mental well-being in the long term. Though mental health support is needed to help adolescents, parents, and schools, they do not seek appropriate support. Aim: This article describes the viewpoint of mental health and cyber experts on the barriers to seeking mental health support among adolescents, parents, and school administrators and identifies approaches to intervention. Methods: The qualitative research study was conducted in Bengaluru Urban, India. Ten specialists were interviewed, including mental health professionals and cyber experts who work with children and adolescents. The data were analyzed using thematic analysis. Results: Seven major themes emerged from the study as follows: (a) knowledge of cyberbullying, (b) negative impact of cyberbullying, (c) attributed factors for cyberbullying, (d) barriers for help-seeking, (e) child-centric intervention, (f) parental intervention, and (g) whole-school approach to cyberbullying. Conclusion: Several factors would affect help-seeking by adolescents, parents, and schools in the context of cyberbullying. These factors need to be considered in developing a comprehensive, school-based intervention on cyberbullying for adolescents.

A Static Approach for Malware Analysis: A Guide to Analysis Tools and Techniques

Abstract: Malicious code presents a severe risk to computer systems, making work difficult for information security and cyber experts. Malware analysis is in great demand because of its importance and function in digital forensics and cyber security. Malware, often known as malicious software, is purposefully written software that harms or damages people, computers, servers, or networks. An overview of malware analysis methods and techniques in the fields of digital forensics and cyber security is given in this article. The study examines several malware types, their characteristics, and analysts' challenges in locating and analyzing them. It also highlights the importance of continuing this field's research and development to stay ahead of evolving malware threats. Trojan horses, worms, backdoors, rootkits, and adware are examples of malware. There are several methods for analyzing malware, but one of the most well-known is static analysis. This article will look at several methods for doing malware analysis and detection on corporate systems, as well as the resources available to assist with sample inspection to reduce the impact of malware assaults on an organization's operations. The investigator must first choose which methods and instruments to use for analysis. Static analysis, which includes malware scanners and detectors, is the first line of defense against malware. As technology advances, malware creators use various techniques to conceal their source code from scanners and detectors that search for strings, pattern matching, and other similar patterns to determine hash values that may be used to identify the infection. Malware experts decompress the packed file into unpacked one to examine obfuscated malware. This study examines efforts to investigate the many techniques and instruments malware uses in the real world.

Critical infrastructure defense: perspectives from the EU and USA cyber experts

Purpose. To examine the components of cyber autonomy according to the insights of seasoned professionals from the European Union (EU) and the United States of America (USA). The value of each element will be calculated by obtaining data from structured in-depth interviews. Methodology. Through an investigation of different aspects of the research, we used the Delphi technique and research interviews include the option of the Interviewee Transcript Review (ITR). The Delphi method is processed in several rounds, usually three, with two rounds being considered as a minimum and in that respect the Delphi method helps our study explore, predict and identify the nature and fundamental elements of Cyber Autonomy. Findings. The study findings demonstrate that elements such as “Policies”, “Reputation management”, and “Infrastructure and Architecture” hold substantial importance within Cyber Autonomy. These elements are considered critical for future perspectives. The research highlights the role of Cyber Autonomy in streamlining cybersecurity approaches, mitigating the impact of cyber-attacks, and safeguarding possible reputation damage. The study also highlights the importance of well-defined implementation methods and the organizational structure in successfully deploying Cyber Autonomy. Originality. The research demonstrates the interdisciplinary nature of cybersecurity and applies a comprehensive approach covering information security, information security policy, technical and economic aspects, noting the important role of governance in the company share value recovery process. Cyber Autonomy could offer a concept of defense reputation that helps to identify potential cyber threats that are further intensified in connection with the development of various platforms for remote control of artificial intelligence, distance learning, and opportunities for autonomous operation of enterprise systems, the influence of multinational companies on financial markets, and automated decision-making systems. Practical value. Experts’ insights are analyzed that can help to provide practical solutions for the Cyber Autonomy and risk management methods for implementing cyber resilience strategy for critical infrastructure. The research provides adjustments to existing cybersecurity frameworks and directives which consider new cyber elements of information security realities. The current study can be used as a guide to confidence-building measures for possible reputation and financial loss, reinforces protection actions against disinformation or negative cyber impact.

Novel Application of Open-Source Cyber Intelligence

The prevalence of cybercrime has emerged as a critical issue in contemporary society because of its far-reaching financial, social, and psychological implications. The negative effects of cyber-attacks extend beyond financial losses and disrupt people’s lives on social and psychological levels. Conventional practice involves cyber experts sourcing data from various outlets and applying personal discernment and rational inference to manually formulate cyber intelligence specific to a country. This traditional approach introduces personal bias towards the country-level cyber reports. However, this paper reports a novel approach where country-level cyber intelligence is automatically generated with artificial intelligence (AI), employing cyber-related social media posts and open-source cyber-attack statistics. Our innovative cyber threat intelligence solution examined 37,386 tweets from 30,706 users in 54 languages using sentiment analysis, translation, term frequency–inverse document frequency (TF-IDF), latent Dirichlet allocation (LDA), N-gram, and Porter stemming. Moreover, the presented study utilized 238,220 open-intelligence cyber-attack statistics from eight different web links, to create a historical cyber-attack dataset. Subsequently, AI-based algorithms, like convolutional neural network (CNN), and exponential smoothing were used for AI-driven insights. With the confluence of the voluminous Twitter-derived data and the array of open-intelligence cyber-attack statistics, orchestrated by the AI-driven algorithms, the presented approach generated seven-dimensional cyber intelligence for Australia and China in complete automation. Finally, the topic analysis on the cyber-related social media messages revealed seven main themes for both Australia and China. This methodology possesses the inherent capability to effortlessly engender cyber intelligence for any country, employing an autonomous modality within the realm of pervasive computational platforms.

Cyber expert feedback: Experiences, expectations, and opinions about cyber deception

Human behavior is a critical, yet under-studied topic in cybersecurity. Among the techniques used for cyber defense, for cyber deception, a better understanding of human perception and behavior is crucial. To this point, the current study used a custom Deception Questionnaire to assess perceptions of cyber deception among experts. In this paper, we use a qualitative thematic analysis over the questionnaire responses, which provides a rich insight into the decision-making process of cyber attackers. Results reveal that experts were unlikely to expect deception, and upon encountering potential deception, a subset of attackers would increase and others decrease their attack activity in response. This work augments prior qualitative analyses indicating that cyber deception creates a psychological impact and behavioral change in cyber attackers. Results support the psychological impact and efficacy of deception to deter malicious actors and provide insights about how defenders might utilize deceptive strategies.

Photography and Remote Warfare: An Inquiry into the Visual Representation of Cyber in News Images

While the importance of new technologies for warfare has only grown, the images used to represent them have remained static. Online image searches of ‘cyber attacks’, ‘cyber security’ or ‘cyber warfare’ pull up image after image that all look the same: rows of 1’s and 0’s, a hooded man in front of a computer, a padlock. To date, little attention has been given to the ways emerging technology is visualized and therefore image-makers have little research to go on when they are considering making images on these topics. Similarly, journalists, campaigners and policymakers have little evidence on which to base decisions they are having to make regularly when selecting images. This paper looks at the importance of news images for shaping our political realities and how remote warfare – that centers on less visible warfare – poses new challenges to photojournalists. This shift in warfare coincided in the early 2000s with both the “visual turn” in security studies and the “postphotographic” age. Through a series of qualitative interviews with cyber experts from Europe, the US, and Russia, this paper sheds light on how current cyber images are interpreted, offering a first step to understanding what current cyber visual discourse is saying, how, and why.

Utilizing cyberplace managers to prevent and control cybercrimes: a vignette experimental study

Place management is central to Routine Activities Theory and proactive utilization of place managers is one of 25 Situational Crime Prevention techniques. Yet little is known about the effectiveness of using place managers to prevent cybercrimes. This paper uses a vignette experimental survey of 213 cybersecurity professionals to explore their perceptions of cybercrime prevention. We find that organizations that partner with and proactively utilize cybersecurity professionals as place managers are perceived as more effective in controlling cybercrimes than those organizations that do not specifically assign professionals to proactively prevent and control cybercrimes. We conclude that assigned cyberplace managers are more likely to use their cyber skills and knowledge than those who lack the time and space to utilize their cyber expertise.

An exploratory cybercrime analysis and its impact on india

In the modern era, the rapid use of the internet has led to reports of cybercrimes. The number of cybercrimes is constantly increasing. The purpose of this paper is to identify the root causes of cybercrime and find insights that can be used by the administration to take fruitful decisions to overcome cybercrime offenses. It has collected data related to the registered cybercrime cases in various Indian states on different parameters for the years 2016 to 2019. The preprocessing was applied to individual datasets, and a common data set was prepared. Data analysis using Power BI (business intelligence) and Microsoft (MS) Excel tools was performed for the Indian states, and its impact was analyzed through year-wise analysis. The outcome of this paper can be utilized by the Indian administration, cyber experts, working professionals, and users to take care of the affecting factors and limit cybercrimes.

A Cyber-Diplomacy and Cybersecurity Awareness Framework (CDAF) for Developing Countries

Cybersecurity is high on the agenda of national and international security policy discussions – mostly lead by diplomats. The practise of diplomacy has evolved since the Internet has become the backbone of society as we know it. Technological evolution has resulted in a significantly bigger and more accessible cyberspace, but the ability of governments and institutions to respond to and function in an expanding cyberspace seems to be lagging behind. The practice of diplomacy has similarly changed fundamentally and created a cyber-diplomacy environment where there is an increased utilization of inter alia social media platforms to achieve foreign policy goals. There is not enough attention given to practical processes to guide the new breed of diplomats in the evolving world of cyber-diplomacy and there is a need to improve the cybersecurity awareness of diplomats in all countries, but this article will focus primarily on developing countries. To mitigate potential cyber threats to diplomacy, diplomats need to be subjected to cyber-diplomacy orientation as well as functional cyber awareness training. Preliminary research conducted suggests that there is a gap between the existing and required cyber-diplomacy and cybersecurity awareness levels of diplomats from developing countries. The purpose of the article is to present a cyber-diplomacy and cybersecurity awareness framework (CDAF) that can be used by developing countries to equip their diplomats to play a more constructive role within the international cyber-diplomacy domain. The CDAF comprises of two distinct components, namely cyber-diplomacy and cybersecurity awareness, but this article will focus primarily on the cyber-diplomacy capacity building aspect of the CDAF. The CDAF was developed by following a design science research approach where a real-world problem was identified followed by an in-depth literature review to identify objectives and possible solutions to the problem. The subsequent outcomes were used to design and development of the CDAF. The article concludes with a critical evaluation of the proposed framework as well as how it can be incorporated into the developing cybersecurity knowledge modules of the Global Forum on Cyber Expertise (GFCE).

Jasmine: A new Active Learning approach to combat cybercrime

One of the reasons that the deployment of network intrusion detection methods falls short is the lack of realistic labeled datasets, which makes it challenging to develop and compare techniques. It is caused by the large amounts of effort that it takes for a cyber expert to classify network connections. This has raised the need for methods that learn from both labeled and unlabeled data which observations are best to present to the human expert. Hence, Active Learning (AL) methods are of interest.In this paper, we propose a new hybrid AL method called Jasmine. Firstly, it uses the uncertainty score and anomaly score to determine how suitable each observation is for querying, i.e., how likely it is to enhance classification. Secondly, Jasmine introduces dynamic updating. This allows the model to adjust the balance between querying uncertain, anomalous and randomly selected observations. To this end, Jasmine is able to learn the best query strategy during the labeling process. This is in contrast to the other AL methods in cybersecurity that all have static, predetermined query functions. We show that dynamic updating, and therefore Jasmine, is able to consistently obtain good and more robust results than querying only uncertainties, only anomalies or a fixed combination of the two.

Cyber Threat Hunting

Security and Information Event Management (SIEM) systems require significant manual input; SIEM tools with machine learning minimizes this effort but are reactive and only effective if known attack patterns are captured by the configured rules and queries. Cyber threat hunting, a proactive method of detecting cyber threats without necessarily knowing the rules or pre-defined knowledge of threats, still requires significant manual effort and is largely missing the required machine intelligence to deploy autonomous analysis. This paper proposes a novel and interactive cognitive and predictive threat-hunting prototype tool to minimize manual configuration tasks by using machine intelligence and autonomous analytical capabilities. This tool adds proactive threat-hunting capabilities by extracting unique network communication behaviors from multiple endpoints autonomously while also providing an interactive UI with minimal configuration requirements and various cognitive visualization techniques to help cyber experts quickly spot events of cyber significance from high-dimensional data.

Crowdsourcing cyber experts to determine relevant topics during cyber curriculum development efforts

ABSTRACT The cyber security environment, its threats, and its defence strategies are constantly changing. Educational programmes and their curriculum are known to be slow changing and at times out-of-date, resulting in content that may not be as relevant to their students and the industry. This research paper will 1 – present an overview of the curriculum development (CDev) process when using committees and their hindrance, 2 – describe the concept of crowdsourcing and its benefits when using domain experts, 3 – propose a Curriculum Development using Crowdsourcing Framework (CDC-F) to integrate expert crowdsourcing into parts of the CDev process (specifically the identification of industry-relevant topics and sub-topics for further curriculum content development), and 4 – present the process and results of ang experiment utilising the CDC-F.

Addressing the Skills Shortage in Cybersecurity

Security by design is an up and coming paradigm which seeks to decrease the opportunity for corruption and disruption, and to increase the inherent stability, dependability and resilience of systems. Cyber experts need to be involved in the design phase as Finagle's Law, interpreted for cybersecurity, is 'if it can be hacked, it will – at the worst possible time'. Testing is designed to counter Murphy's Law and reduce resistentialism. Defensive programming, original cybersecurity, carries an overhead, for which there is often no demonstrable return. The priority of the design stage cybersecurity expert is to plan for contingencies and think like a hacker. It is about risk management; understanding this dictates security by design requirements in the knowledge that interconnected systems' security is only as strong as its weakest link. Definition and audit of Service Level Agreements (SLA) are an essential part of cybersecurity, as is the audit of any third party suppliers of componentry of the system under design. Governance and policy definitions, exciting for some, are integral to cybersecurity. Beyond this, the cybersecurity expert must consider system failure. Recent ransomware attacks have demonstrated the necessity for business continuity plans as recovery has still taken time. The Blue Team Field Manual has an impressive list of necessary documentation and actions required in this event, but glosses over the effort required. While the above is rolling maintenance, threat hunting differs. Every vulnerability or threat must be evaluated for consequential impact. Either a passionate interest in psychology or an extremely jaundiced view of the world is a necessary attribute for cybersecurity. Reality is so different from the aspirations of potential pen testers, incident responders, and AI security engineers facing 3 – 5 post-graduation years to proficiency, it is no wonder disillusion results in a shortage of 3.5 million cybersecurity experts.

Enhancement detection distributed denial of service attacks using hybrid n-gram techniques

Distributed denial of service (DDoS) attacks have always been a concern of cyber experts. To detect DDoS attacks, several methods can be used. One of the methods used in this research is the n-gram technique. The n-gram approach analyzes the payload of data packets that enter the network to obtain attack patterns. Data is captured and analyzed, after which it is compared with clean data packets. The chi-square distance value close to 1 indicates that the two packages are very similar so that the data packet is not an attack. A deal less than one means the data packet is categorized as an attack. In this research, the threshold for determining the attack level can be lowered to obtain a very high detection accuracy. As a result, the 2-gram technique has a detection accuracy rate with the lowest false positive value of around 13%, with the highest actual positive ratio reaching 99.98%.

Detecting User Behavior in Cyber Threat Intelligence: Development of Honeypsy System

This research demonstrates a design of an experiment of a hacker infiltrating a server where it is assumed that the communication between the hacker and the target server is established, and the hacker also escalated his rights on the server. Therefore, the honeypot server setup has been designed to reveal the correlation of a hacker’s actions with that of the hacker’s experience, personality, expertise, and psychology. To the best of our knowledge, such a design of experiment has never been tested rigorously on a honeypot implementation except for self-reporting tests applied to hackers in the literature. However, no study evaluates the actual data of these hackers and these tests. This study also provides a honeypot design to understand the personality and expertise of the hacker and displays the correlation of these data with the tests. Our Honeypsy system is composed of a Big-5 personality test, a cyber expertise test, and a capture-the-flag (CTF) event to collect logs with honeypot applied in this sequence. These three steps generate data on the expertise and psychology of known cyber hackers. The logs of the known hacker activities on honeypots are obtained through the CTF event that they have participated in. The design and deployment of a honeypot, as well as the CTF event, were specifically prepared for this research. Our aim is to predict an unknown hacker's expertise and personality by analyzing these data. By examining/analyzing the data of the known hackers, it is now possible to make predictions about the expertise and personality of the unknown hackers. The same logic applies when one tries to predict the next move of the unknown hackers attacking the server. We have aimed to underline the details of the personalities and expertise of hackers and thus help the defense experts of victimized institutions to develop their cyber defense strategies in accordance with the modus operandi of the hackers.

Enhancement Detection DDoS Attacks Using Hybrid N-Gram Techniques

DDoS attacks have always been a concern of cyber experts. To detect DDoS attacks, there are several methods that can be used. One of the methods used in this research is the N-Gram technique. The n-Gram technique analyzes the payload of data packets that enter the network to obtain attack patterns, data is captured and analyzed after which it is compared with net data packets. The chi-square distance value that is close to 1 indicates that the two packages are very similar, so that the data packet is not an attack. A value less than 1 means the data packet is categorized as an attack. In this research, the threshold for determining the level of attack can be lowered to obtain a very high detection accuracy. As a result, the 2-Gram technique has a detection accuracy rate with the lowest false positive value of around 13% with the highest true positive ratio reaching a value of 99.98%.

Cyber Threat Hunting

Security and Information Event Management (SIEM) systems require significant manual input; SIEM tools with machine learning minimizes this effort but are reactive and only effective if known attack patterns are captured by the configured rules and queries. Cyber threat hunting, a proactive method of detecting cyber threats without necessarily knowing the rules or pre-defined knowledge of threats, still requires significant manual effort and is largely missing the required machine intelligence to deploy autonomous analysis. This paper proposes a novel and interactive cognitive and predictive threat-hunting prototype tool to minimize manual configuration tasks by using machine intelligence and autonomous analytical capabilities. This tool adds proactive threat-hunting capabilities by extracting unique network communication behaviors from multiple endpoints autonomously while also providing an interactive UI with minimal configuration requirements and various cognitive visualization techniques to help cyber experts quickly spot events of cyber significance from high-dimensional data.

Defining Cyber Security and Cyber Security Risk within a Multidisciplinary Context using Expert Elicitation.

It is important to have and use standardized terminology and develop a comprehensive common understanding of what is meant by cyber security and cyber security risk given the multidisciplinary nature of cyber security and the pervasiveness of cyber security concerns throughout society. Using expert elicitation methods, collaborating cyber researchers from multiple disciplines and two sectors (academia, government–military) were individually interviewed and asked to define cyber security and cyber security risk. Data‐driven thematic analysis was used to identify the most salient themes within each definition, sector, and cyber expert group as a whole with results compared to current standards definitions. Network analysis was employed to visualize the interconnection of salient themes within and across sectors and disciplines. When examined as a whole group, “context‐driven,” “resilient system functionality,” and “maintenance of CIA (confidentiality, integrity, availability)” were the most salient themes and influential network nodes for the definition of cyber security, while “impacts of CIA vulnerabilities,” “probabilities of outcomes,” and “context‐driven” were the most salient themes for cyber security risk. We used this expert elicitation process to develop comprehensive definitions of cyber security (cybersecurity) and cyber security risk that encompass the contextual frameworks of all the disciplines represented in the collaboration and explicitly incorporates human factors as significant cyber security risk factors.