Cybersecurity Countermeasures Research Articles

Virus control

Internet technology has become an important part of our daily lives, meaning that monitoring and identifying abnormal behaviours in network traffic are both crucial for proper operation and cybersecurity countermeasures. Moreover, the proliferation of computer networks has lead to an ever-increasing demand for bandwidth of 100Gbps and more. Thus, the scaling of monitoring and measuring capabilities for collecting accurate statistics has become a challenging issue. The group explained that their work is suitable for anomaly detection for high-speed networking and security applications Professor Yu-Kuen Lai, the lead author on this paper, spoke to us about what he's been working on: “We have developed a filtering scheme to assist superspreader [i.e., a host that infects disproportionally more secondary contacts than other hosts also infected with the same virus] detection in high-speed network traffic. Specifically, we use bitmap sketch data structures to filter out most of the non-superspreader sources from the network traffic with high probability”. It is known that in most of the network devices, the space of fast memory (SRAM) is limited. Therefore, by using this scheme, the memory space required by the measurement module to track the source IP in the network traffic can be reduced while achieving acceptable accuracy. The prototype implementation can process network traffic at a throughput of 27Gbps. Owing to the high speed of internet traffic, tracking all packets and flows to enable complex analysis in real-time is difficult. This is due to limited processing time and memory space. Sketch, an alternative to packet sampling, is a compact data structure capable of shortening substantial numbers of data elements. It relies on probabilistic properties to guarantee the accurate estimation of various attributes of the network traffic. Consequently, it is widely used in high-speed network measurement and monitoring applications. In addition to the superspreader detection application presented in this paper, Sketch algorithms are commonly used for various types of applications, such as distinct flow estimation, heavy hitter identification, traffic change detection, entropy estimation, and so on. Lai also talked to us about the limitations of this method of packet sampling: ‘as discussed in this paper, the sketch-guided filtering works by using a bitmap sketch, which is updated for each incoming packet during an observation period of measurement. When the number of bits set is approaching the number of bits in the bitmap, the filter performance decreases. This scheme is dependent on a predefined threshold parameter and the observation period length. This is a common problem when using a bitmap data structure in this kind of traffic monitoring application. To avoid this problem, we can set the length of an observation period to a small number, or increase the bitmap size, which in turn, increases the memory requirement.’ Sketch-guided filtering can reduce the total memory requirement in the hardware implementation of superspreader detection systems. However, compared to those which use a large amount of memory to count all sources and exact fan-out, it comes at the cost of a slight decrease in detection accuracy and the fan-out estimation. Counting the fan-out of each source in high-speed network traffic is prohibitively expensive in term of processing time and memory space. Most of the previous works of the superspreader detection focused on the detection algorithm and the fan-out estimation accuracy without filtering the sources of low fan-out. The proposed Sketch-guided filtering scheme first eliminates the low fan-out sources, and counts only the fan-out of spreader sources. It can be used in high-speed network systems with a lower memory requirement as compared to previous approaches. Professor Lai hopes that ‘in the short term these results can lead to more ideas and research on how to remove the unnecessary sources efficiently, so that the monitoring process can identify the anomalies accurately. In the long term, we expect that the sketch-guided filtering scheme can be used in real application on network devices for assisting superspreader detection. However, before reaching that stage, more works need to be done to verify the performance of the filter. Furthermore, an intelligent threshold setting, and a method to handle the filter “saturation” problem should be developed.’ The main innovation of the proposed system is to use the sketch-guided filtering mechanism to remove sources with potentially low fanout

A polytope-based approach to measure the impact of events against critical infrastructures

This paper provides a method to calculate the impact of cyber attacks and security countermeasures in a multi-dimensional coordinate system. The method considers the simulation of services, attacks and countermeasures in at least one dimensional coordinate system, the projection of which originates geometrical instances (e.g., lines, squares, rectangles, hyper-cubes). Such instances are measured through geometrical operations (i.e., length, area, volume, hyper-volume), so that we determine the impact of complex attacks arriving on the system, as well as the impact of the implementation of single and/or multiple countermeasures selected to mitigate the effects of such detected attacks. As a result, we are able to measure the size of cyber events, which allows us to determine the mitigation level of the incidents, as well as, residual risks, and potential collateral damages. A case study of a critical infrastructure system is provided to show the applicability of the model.

User's Adoption of Free Third-Party Security Apps

Although multiple security applications (apps) are offered by third-party developers for free, only a small portion of smart device users have adopted these apps. The lack of relevant research urgently requires an in-depth investigation of influential factors of the user's adoption of the new cyber security countermeasures. In this study, we introduce a theoretical model by integrating factors from the user's awareness perspective and the user's trust perspective. We find that the user's technology awareness and trust in security apps both have significant positive effects on their adoption intention. The user's trust in security apps also has a significant moderating effect on the relationship between their threat awareness and their adoption intention. These findings do not only provide a theoretical foundation for future mobile security app adoption research, but also offer several implications for developers to push the diffusion of their software in the promising app based cyber security market.

Signal-Layer Security and Trust-Boundary Identification based on Hardware-Software Interface Definition

An important trend in the automotive domain is to adapt established functional safety processes and methods for security engineering. Although functional safety and cyber-security engineering have a considerable overlap, the trend of adapting methods from one domain to the other is often challenged by non-domain experts. Just as safety became a critical part of the development in the late 20th century, modern vehicles are now required to become resilient against cyber-attacks. As vehicle providers gear up for this challenge, they can capitalize on experiences from many other domains, but must also face several unique challenges. Such as, that cyber-security engineering will now join reliability and safety as a cornerstone for success in the automotive industry and approaches need to be integrated into the mainly safety oriented development lifecycle of the domain. The recently released SAE J3061 guidebook for cyber-physical vehicle systems focus on designing cyber-security aware systems in close relation to the automotive safety standard ISO 26262. The key contribution of this paper is to analyse a method to identify attack vectors on complex automotive systems via signal interfaces and propose a security classification scheme and protection mechanisms on signal layer. To that aim, the hardware-software interface (HSI), a central development artefact of the ISO 26262 functional safety development process, is used and extended to support the cyber-security engineering process and provide cyber-security countermeasures on signal layer.

Index

The digital transition in the process industry is characterized by a high level of automation and an increasing connection with external networks, which makes facilities vulnerable to cybers-threats. A cyber-attack, beside economic and reputational damages, can potentially trigger major events (e.g. releases of hazardous materials, fires, explosions) with severe consequences on workers, population, and the environment. In the present study, the cybersecurity-related incidents that occurred in the process industry and in similar industrial sectors (chemical, petrochemical, energy production, water/wastewater treatment) were investigated. The aim of the study is to frame a clear picture of the cyber-attacks on the automated control systems of process facilities and to issue lessons learnt from past incidents. The study is based on the development and analysis of a database of 82 cybersecurity-related incidents gathered from various sources. Time trend, geographical distribution, distribution among the industrial sectors, impacts of the incidents, and nature of the cyber-attacks (attacker, intentional/accidental type, system infected) were investigated. The analysis of a sub-set of more detailed incidents allowed the identification of the general steps of a cyber-attack on automated control systems of a process facility, the main hacking techniques used by the attackers and the more common cybersecurity countermeasures applicable to the prevention of a cyber-attack.