Cybersecurity Community Research Articles

Intelligent Incident Response Systems Using Machine Learning

Machine learning (ML) is revolutionising cybersecurity by enhancing the ability to predict, detect, and respond to cyber threats. By leveraging advanced algorithms, ML systems can analyse vast datasets in real-time, identify patterns, and automate responses, addressing the challenges of increasingly sophisticated cyberattacks. This paper explores the transformative impact of machine learning in cybersecurity, highlighting key tasks such as classification, anomaly detection, and natural language processing. It also discusses future research directions, including explainable AI, adversarial machine learning, federated learning, and privacy-preserving techniques. The cybersecurity community can develop more robust and adaptive defences by focusing on these innovative areas, ensuring a safer digital environment. Integrating machine learning into cybersecurity practices is crucial for navigating the evolving threat landscape and maintaining trust in digital systems.

On Collaboration and Automation in the Context of Threat Detection and Response with Privacy-Preserving Features

Organizations and their security operation centers often struggle to detect and respond effectively to an extensive quantity of ever-evolving cyberattacks. While collaboration, such as threat intelligence sharing between security teams, and response automation are often discussed in the cybersecurity community, issues like data sensitivity and confidence in detection may hinder their adoption. This work investigates the potentials and challenges of collaboration and automation to enhance incident response processes. We propose a reference architecture for data sharing in threat detection and response, aiming to boost collaborative and automated efforts across organizations while also considering privacy-preserving features. To address these challenges and potentials, we discuss how such a framework could enhance current response processes within and between organizations, validated with results in local attack detection, incident response, and data sharing.

A saddlepoint approximation for the smoothed periodogram

Poor variance properties of the periodogram often limit its practical applicability to a wide range of modern spectral estimation and detection applications. The smoothed periodogram, a refined periodogram-based method, is one such nonparametric approach to reducing variance. Neighboring spectral samples are averaged across a spectral window, as opposed to the more common temporal or lag window. Tapered spectral windows and other modifications needed to address the time-bandwidth product and resolution-variance trade-offs complicate the statistical analysis, making it difficult to quantify statistical performance. In addition, approximate distributions for the smoothed periodogram require a priori normalization along with simplifying assumptions to yield computationally tractable results. Here, under mild asymptotic conditions, the distribution derived prior to normalization is shown to be computationally intractable in most cases. First-order statistical approximations are computationally stable but result in sizeable inaccuracies, particularly in the tails. We use a saddlepoint approximation, a second-order asymptotic method, that allows for accurate statistical characterization but is also numerically stable. Monte Carlo simulations are used to validate the results and to illustrate the robustness of the approach. Finally, its utility is demonstrated on a real-world dataset relevant to the side-channel and hardware cybersecurity communities.

A Practical Approach to Formal Methods: An Eclipse Integrated Development Environment (IDE) for Security Protocols

In order to develop trustworthy distributed systems, verification techniques and formal methods, including lightweight and practical approaches, have been employed to certify the design or implementation of security protocols. Lightweight formal methods offer a more accessible alternative to traditional fully formalised techniques by focusing on simplified models and tool support, making them more applicable in practical settings. The technical advantages of formal verification over manual testing are increasingly recognised in the cybersecurity community. However, applying formal methods, even in their more practical forms, outside highly specialised research settings remains challenging. For practitioners, formal modelling and verification are often too complex and unfamiliar to be used routinely. In this paper, we present an Eclipse Integrated Development Environment for the design, verification, and implementation of security protocols and evaluate its effectiveness, including feedback from users in educational settings. It offers user-friendly assistance in the formalisation process as part of a Model-Driven Development approach. This IDE centres around the Alice & Bob (AnB) notation, the AnBx Compiler and Code Generator, the OFMC model checker, and the ProVerif cryptographic protocol verifier. For the evaluation, we identify the six most prominent limiting factors for formal method adoption, based on relevant literature in this field, and we consider the IDE’s effectiveness against those criteria. Additionally, we conducted a structured survey to collect feedback from university students who have used the toolkit for their projects. The findings demonstrate that this contribution is valuable as a workflow aid and helps users grasp essential cybersecurity concepts, even for those with limited knowledge of formal methods or cryptography. Crucially, users reported that the IDE has been an important component to complete their projects and that they would use again in the future, given the opportunity.

Enhancing privacy policy comprehension through Privacify: A user-centric approach using advanced language models

As the digital age advances, the collection, usage, and dissemination of personal data have become critical concerns for users, regulators, and the cybersecurity community. Questions surrounding the extent of identifiable data collection, its usage, sharing, selling, and the mechanisms of consent are increasingly central to discussions on user data privacy. These issues highlight the need for effective management and comprehension of privacy policies. To this end, this paper introduces Privacify— a production-ready web application designed to enhance the accessibility and understandability of privacy policies, thus empowering users to make more informed decisions about their data. At its backend, Privacify leverages a combination of text segmentation, summarization using Large Language Model (LLM), and map-reduce technologies to facilitate BASE analysis for single-document insights and WRT and REV for comprehensive cross-document analysis. Designed with a user-centric approach, Privacify features an intuitive interface that presents all relevant user privacy information in easy-to-understand language, complete with a detailed explainability component. This design not only simplifies privacy policies but also aids users in effortlessly navigating complex privacy terms, significantly boosting their ability to protect and manage their personal information. Our evaluation employs robust methodologies, including reliability and accuracy assessments, alongside rigorous functionality verification through ROUGE metrics and human analysis, validating the system’s efficacy and performance. Privacify’s architecture promotes scalability, replicability, and seamless deployment, advancing the domain of user data protection through improved privacy comprehension.

A COMPARATIVE ANALYSIS OF CYBER SECURITY BEHAVIOURS OF UNIVERSITY STUDENTS

Concern over cyber security is on the rise because of our growing reliance on technology. Examining students’ awareness of cyber security is crucial because they frequently use technology. The paper compares student awareness of cyber security at Erzurum Technical University and Kyrgyz-Turkish Manas University. The review investigated both the effectiveness of these universities’ cyber security education initiatives as well as the students’ understanding of cyber security issues. Throughout the online education process, the research was carried out in Türkiye and Kyrgyzstan. The findings revealed that students at Erzurum Technical University were more knowledgeable of cyber security issues than those at Kyrgyz-Turkish Manas University. The article made a number of recommendations based on the findings for raising student awareness of cyber security, including education and training, regular assessments, fostering a culture of cyber security, incorporating cyber security into the curriculum, and creating a cyber-security community. According to the article’s conclusion, colleges are crucial in ensuring that students are well-informed and have the skills and information they need to defend themselves online.

Unveiling the Depths of Phishing: Understanding Tactics, Impacts, and Countermeasures

Phishing attacks have emerged as a pervasive threat in the cybersecurity landscape, exploiting human vulnerabilities to compromise sensitive information and perpetrate cybercrime. This paper provides a comprehensive examination of phishing attacks, encompassing their methods, prevalence, and impact on individuals and organizations. Through an in-depth literature review, we delve into the various types of phishing attacks, including email phishing, spear phishing, and pharming, elucidating their distinct characteristics and methodologies. We highlight the significant financial and reputational costs incurred by victims of phishing attacks across different sectors. Despite advancements in cybersecurity technologies and awareness programs, phishing attacks persist as a prominent attack vector due to their adaptability and sophistication. Current mitigation strategies, such as email filtering, user education, and multi-factor authentication, offer some defense against phishing attacks but are not without limitations. Building upon this foundation, we discuss emerging trends in phishing attack vectors and explore the potential of advanced technologies, such as machine learning, artificial intelligence, and blockchain, to enhance phishing detection and prevention capabilities. Furthermore, we underscore the importance of collaboration between industry stakeholders, government agencies, and cybersecurity researchers in combating phishing attacks and fortifying cyber resilience. By fostering greater awareness and cooperation within the cybersecurity community, we can develop more effective defenses against phishing attacks and mitigate the impact of future cyber threats.

Automated Mapping of Common Vulnerabilities and Exposures to MITRE ATT&CK Tactics

Effectively understanding and categorizing vulnerabilities is vital in the ever-evolving cybersecurity landscape, since only one exposure can have a devastating effect on the entire system. Given the increasingly massive number of threats and the size of modern infrastructures, the need for structured, uniform cybersecurity knowledge systems arose. To tackle this challenge, the MITRE Corporation set up two powerful sources of cyber threat and vulnerability information, namely the Common Vulnerabilities and Exposures (CVEs) list focused on identifying and fixing software vulnerabilities, and the MITRE ATT&CK Enterprise Matrix, which is a framework for defining and categorizing adversary actions and ways to defend against them. At the moment, the two are not directly linked, even if such a link would have a significant positive impact on the cybersecurity community. This study aims to automatically map CVEs to the corresponding 14 MITRE ATT&CK tactics using state-of-the-art transformer-based models. Various architectures, from encoders to generative large-scale models, are employed to tackle this multilabel classification problem. Our results are promising, with a SecRoBERTa model performing best with an F1 score of 77.81%, which is closely followed by SecBERT (78.77%), CyBERT (78.54%), and TARS (78.01%), while GPT-4 showed a weak performance in zero-shot settings (22.04%). In addition, we perform an in-depth error analysis to better understand the models’ performance and limitations. We release the code used for all experiments as open source.

SoK: Sensor wars: Attacks and defenses on acoustic sensors

In this talk, we will examine attacks that can be performed against sensors that have become prevalent in smart devices, Internet of Things, and Cyber-Physical Systems. These devices have become part of our everyday life, integrated, for example, in health monitoring solutions, autonomous vehicles, and home automation. A classification of current threat models on sensors is presented. Of particular interest are attacks that make use of interference to trick devices into performing unintended actions. This talk serves as a summary of knowledge on the state of the art in utilizing sensor data for improving the security of smart devices and systems with the goal of inspiring new interdisciplinary research between the acoustics and cybersecurity communities.

Cyber Guardian : Intelligent Threat Surveillance

Advanced persistent threats (APTs) are cyberattacking that use covert strategies to target specific groups. As a result of the rapid growth of computing technology and the widespread connectivity of devices, there has been a boom in data transfer across networks. Because APTs' attack tactics are always changing, it can be difficult to detect them. This has led cybersecurity experts to develop creative solutions. We found gaps in the research on APT detection by doing a systematic literature review (SLR) covering the years 2012 to 2022 and finding 75 studies related to computer, mobile, and Internet of Things technologies. The most sophisticated cyberattack, known as an advanced persistent threat, involves malevolent individuals breaking into a network without authorization and staying hidden for an extended period. Advancement persistent threat attacks and organizational threats are becoming more frequent. Machine learning is one technique used to detect attacks by sophisticated persistent threats. The need for improved detection methods is highlighted by our findings, and we offer suggestions to guide the creation of early APT detection models and progress in cybersecurity. We propose a conceptual model known as Cyber Guardian that uses Random Forest classifier and attention techniques to create a self-translation machine through an encoder-decoder framework. These advanced attention algorithms are intended to improve the machine's capacity to examine and decipher intricate patterns found in HTTP requests, enhancing APT detection capabilities, and providing cybersecurity experts with cutting-edge instruments to proactively detect and neutralize new threats in real-time. This all-encompassing strategy is a major advancement in the ongoing fight against Advanced Persistent Threats (APTs) and emphasizes how crucial it is for the cybersecurity community to continuously innovate and collaborate in order to remain ahead of changing cyberthreats.

AI security and cyber risk in IoT systems.

Internet-of-Things (IoT) refers to low-memory connected devices used in various new technologies, including drones, autonomous machines, and robotics. The article aims to understand better cyber risks in low-memory devices and the challenges in IoT risk management. The article includes a critical reflection on current risk methods and their level of appropriateness for IoT. We present a dependency model tailored in context toward current challenges in data strategies and make recommendations for the cybersecurity community. The model can be used for cyber risk estimation and assessment and generic risk impact assessment. The model is developed for cyber risk insurance for new technologies (e.g., drones, robots). Still, practitioners can apply it to estimate and assess cyber risks in organizations and enterprises. Furthermore, this paper critically discusses why risk assessment and management are crucial in this domain and what open questions on IoT risk assessment and risk management remain areas for further research. The paper then presents a more holistic understanding of cyber risks in the IoT. We explain how the industry can use new risk assessment, and management approaches to deal with the challenges posed by emerging IoT cyber risks. We explain how these approaches influence policy on cyber risk and data strategy. We also present a new approach for cyber risk assessment that incorporates IoT risks through dependency modeling. The paper describes why this approach is well suited to estimate IoT risks.

COMPOSITE BEHAVIORAL MODELING FOR IDENTITY THEFT DETECTION MIXTURE OF CLINICAL CONCEPTS

In this work, we aim at building a bridge from coarse behavioral data to an effective, quick-response, and robust behavioral model for online identity theft detection. We concentrate on this issue in online social networks (OSNs) where users usually have composite behavioral records, consisting of multidimensional low-quality data, e.g., offline check-ins and online user-generated content (UGC). As an insightful result, we validate that there is a complementary effect among different dimensions of records for modeling users’ behavioral patterns. To deeply exploit such a complementary effect, we propose a joint (instead of fused) model to capture both online and offline features of a user’s composite behavior. We evaluate the proposed joint model by comparing it with typical models and their fused model on two real-world datasets: Foursquare and Yelp. The experimental results show that our model outperforms the existing ones, with the area under the receiver operating characteristic curve (AUC) values 0.956 in Foursquare and 0.947 in Yelp, respectively. Particularly, the recall (true positive rate) can reach up to 65.3% in Foursquare and 72.2% in Yelp with the corresponding disturbance rate (false-positive rate) below 1%. It is worth mentioning that these performances can be achieved by examining only one composite behavior, which guarantees the low response latency of our method. This study would give the cybersecurity community new insights into whether and how real-time online identity authentication can be improved via modeling users’ composite behavioral patterns.

PhishTransformer: A Novel Approach to Detect Phishing Attacks Using URL Collection and Transformer

Phishing attacks are a major threat to online security, resulting in millions of dollars in losses. These attacks constantly evolve, forcing the cyber security community to improve detection systems. One major problem with current detection systems is that they cannot detect new phishing attacks, such as Browser in the Browser (BiTB) and malvertising attacks. These attacks hide behind legitimate Uniform Resource Locators (URLs) and can evade detection systems that only analyze a web page URL without exploring the page content. To address this problem, we propose PhishTransformer, a deep-learning model that can detect phishing attacks by analyzing URLs and page content. We propose only using URLs embedded within a webpage, such as hyperlinks and JFrames, to train PhishTransformer. This helps reduce the number of features that need to be extracted from the page content, which makes training the model more efficient. PhishTransformer combines convolutional neural networks and transformer encoders to extract features from website URLs and page content. These features are then used to train a classifier that can distinguish between phishing attacks and legitimate websites. We tested PhishTransformer on a dataset of 10,000 URLs. Our results show that PhishTransformer can achieve an F1-score of 99%, precision of 99%, and recall of 99%. This result suggests that PhishTransformer is a promising new approach to phishing detection.

Eclipsing Security: An In-Depth Analysis of Advanced Persistent Threats

Abstract—Advanced Persistent Threats (APTs) pose a significant challenge in today's cybersecurity landscape due to their persistent, targeted, and secretive nature. In today's highly connected digital world, it's crucial to understand and tackle the risks linked to Advanced Persistent Threats (APTs). In this research paper, titled "Eclipsing Security: An In-Depth Analysis of Advanced Persistent Threats," we comprehensively explore the lifecycle, attack methodology, and practical aspects of APTs. Our focus extends to understanding how these threats gain access, the key tactics employed, and the technological aspects involved. Additionally, we also delve into how APTs differ from conventional attacks, emphasizing their unique characteristics that distinguish them from other cyber threats. Our goal is to provide valuable insights to the cybersecurity community, offering practical strategies to strengthen defenses against these elusive and enduring threats. Keywords—Advanced Persistent Threats (APTs), Cybersecurity, Lifecycle Analysis, Attack Methodology, Practical Implementation, Legal and Regulatory Frameworks, Case Studies, Mitigation and Defense Strengthening.

FlowTransformer: A transformer framework for flow-based network intrusion detection systems

This paper presents the FlowTransformer framework, a novel approach for implementing transformer-based Network Intrusion Detection Systems (NIDSs). FlowTransformer leverages the strengths of transformer models in identifying the long-term behaviour and characteristics of networks, which are often overlooked by most existing NIDSs. By capturing these complex patterns in network traffic, FlowTransformer offers a flexible and efficient tool for researchers and practitioners in the cybersecurity community who are seeking to implement NIDSs using transformer-based models. FlowTransformer allows the direct substitution of various transformer components, including the input encoding, transformer, classification head, and the evaluation of these across any flow-based network dataset. To demonstrate the effectiveness and efficiency of the FlowTransformer framework, we utilise it to provide an extensive evaluation of various common transformer architectures, such as GPT 2.0 and BERT, on three commonly used public NIDS benchmark datasets. We provide results for accuracy, model size and speed. A key finding of our evaluation is that the choice of classification head has the most significant impact on the model performance. Surprisingly, Global Average Pooling, which is commonly used in text classification, performs very poorly in the context of NIDS. In addition, we show that model size can be reduced by over 50%, and inference and training times improved, with no loss of accuracy, by making specific choices of input encoding and classification head instead of other commonly used alternatives.

FLAD: Adaptive Federated Learning for DDoS attack detection

Federated Learning (FL) has been recently receiving increasing consideration from the cybersecurity community as a way to collaboratively train deep learning models with distributed profiles of cyber threats, with no disclosure of training data. Nevertheless, the adoption of FL in cybersecurity is still in its infancy, and a range of practical aspects have not been properly addressed yet. Indeed, the Federated Averaging algorithm at the core of the FL concept requires the availability of test data to control the FL process. Although this might be feasible in some domains, test network traffic of newly discovered attacks cannot be always shared without disclosing sensitive information. In this paper, we address the convergence of the FL process in dynamic cybersecurity scenarios, where the trained model must be frequently updated with new recent attack profiles to empower all members of the federation with the latest detection features. To this aim, we propose FLAD (adaptive Federated Learning Approach to DDoS attack detection), an FL solution for cybersecurity applications based on an adaptive mechanism that orchestrates the FL process by dynamically assigning more computation to those members whose attacks profiles are harder to learn, without the need of sharing any test data to monitor the performance of the trained model. Using a recent dataset of DDoS attacks, we demonstrate that FLAD outperforms state-of-the-art FL algorithms in terms of convergence time and accuracy across a range of unbalanced datasets of heterogeneous DDoS attacks. We also show the robustness of our approach in a realistic scenario, where we retrain the deep learning model multiple times to introduce the profiles of new attacks on a pre-trained model.

Router forensics: Navigating the digital crossroads

As the digital landscape continues to evolve, routers have become central gatekeepers, governing the flow of information in networks. This study delves deep into the realm of router forensics, focusing on the methodologies and techniques employed to extract and analyze forensic data from these pivotal devices. Drawing upon both traditional and contemporary approaches, our research underscores the significance of router logs, volatile data, and the challenges that arise in their forensic analysis. We highlight the pressing need for standardized forensic protocols, especially in the face of diverse router architectures and rapidly emerging cyber threats. Our study also emphasizes the potential of leveraging advanced technologies, such as machine learning, in enhancing forensic capabilities. By providing a comprehensive overview of the current state of router forensics and shedding light on potential future trajectories, this research aims to fortify the cybersecurity community's arsenal against escalating cyber threats, ensuring a more secure and resilient digital ecosystem.

Understanding How National CSIRTs Evaluate Cyber Incident Response Tools and Data: Findings from Focus Group Discussions

National Computer Security Incident Response Teams (CSIRTs) have been established worldwide to coordinate responses to computer security incidents at the national level. While it is known that national CSIRTs routinely use different types of tools and data from various sources in their cyber incident investigations, limited studies are available about how national CSIRTs evaluate and choose which tools and data to use for incident response. Such an evaluation is important to ensure that these tools and data are of good quality and, consequently, help to increase the effectiveness of the incident response process and the quality of incident response investigations. Seven online focus group discussions with 20 participants (all staff members) from 15 national CSIRTs across Africa, Asia Pacific, Europe, and North and South America were carried out to address this gap. Results from the focus groups led to four significant findings: (1) there is a confirmed need for a systematic evaluation of tools and data used in national CSIRTs, (2) there is a lack of a generally accepted standard procedure for evaluating tools and data in national CSIRTs, (3) there is a general agreement among all focus group participants regarding the challenges that impinge a systematic evaluation of tools and data by national CSIRTs, and (4) we identified a list of candidate criteria that can help inform the design of a standard procedure for evaluating tools and data by national CSIRTs. Based on our findings, we call on the cyber security community and national CSIRTs to develop standard procedures and criteria for evaluating tools and data that CSIRTs, in general, can use.

Are crowd-sourced CTI datasets ready for supporting anti-cybercrime intelligence?

Cyber crimes rapidly increased over the past years, with attackers performing large-scale activities, using sophisticated and complex tactics and techniques, that have targeted governments, companies, and even strategic infrastructures. To tackle these attacks, the cyber-security community usually shares Cyber Threat Intelligence (CTI) that includes the collected Indicators of Compromise (IoC) using several open or private sharing platforms. In this paper, we study the informativeness and relevance of the IoCs related to cyber crimes following a major real-world event such as the war in Ukraine, which started in February 2022. To this end, we analyze different kinds of attacks available in a crowd-sourced dataset of Cyber Threat Intelligence (CTI) reports. Our analysis shows that while this data is able to capture major trends such as the ones following major events, the degree of miscellaneous information inside the reports makes it difficult to discern the association of a specific trace unequivocally.

How to safely communicate with a phishing attacker by email?

The published study is a part of the long-term research of emails with phishing attacks against the article's author. In the previous three years, 3 experiments were carried out to analyze phishing emails. The result is their detailed classification. The subsequent experiment was focused on defense against phishing attacks using the rules of the MS Outlook email client. The last experiment, which is the article's content, is devoted to analyzing communications with phishing attackers. A fake identity was created for the experiment and security rules were set up. A total of 100 phishing emails were answered, with a preference for those whose content was not aimed at fulfilling any request; that was clarified during the communications. The conducted literature search confirmed the assumption that no one is engaged in similar research, so the results of the research may be more interesting for the cybersecurity community. The articles of the literary research are focused on the issue of social engineering from an interdisciplinary perspective. A great deal of attention has also been oriented on the influence of social networks on people information perception or on their exploitation in cyber-attacks. The result of the study is a statistical analysis of communications and a detailed analysis of its content. Out of 100 replies to the phishing email, 32 (32%) were answered by the phisher. The longest communications had 6 cycles. If the phisher insisted aggressively on personal information, the communications was terminated. From the content of the communications, the attacker's procedures and his argumentation to obtain the required information were primarily examined. A detailed analysis of the texts from the communications aimed to answer the question of whether the phisher is a robot or a person. Further considerations are being made within the team on how to continue researching phishing attacks.