Cybersecurity Data Research Articles

Different Machine Learning Algorithms used for Secure Software Advance using Software Repositories

In the present phase of the Fourth Industrial Revolution (4IR or Industry 4.0), the digital world has a wealth of data, such as Internet of Things (IoT) data, cybersecurity data, mobile data, business data, social media data, health data, etc. To intelligently analyze these data and develop the corresponding smart and automated applications, the knowledge of artificial intelligence (AI), particularly, machine learning (ML) is the key. Cyber Security attacks are significantly growing in today’s modern world of technology and advanced software development. The inclusion of cyber security defense is vital in every phase of software development. Identifying and implementing key relevant cyber security vulnerability controls during the early stages of the software development life cycle, i.e., the requirement phase is especially important. The Common Attack Pattern Enumeration & Classification (CAPEC) is a publicly available software repository from MITRE that currently lists 555 vulnerability attack patterns. As Cyber Security continues to exponentially grow in complexity, the importance of the Machine Learning role to automate the identification of vulnerabilities for various software development is paramount to aid software developers in creating protected software. This paper discusses the conducted survey on different machine learning algorithms used for secure software development using software repositories.

The Power of Cybersecurity Data Science in Protecting Digital Footprints

Cybersecurity data science has become a crucial tool in protecting digital footprints, as the increasing number of digital devices and reliance on the internet has made it a critical issue. Digital footprints, including online purchases, social media posts, and email exchanges, provide personal information that cybercriminals can use to steal sensitive information or launch phishing attacks. Data mining, machine learning and deep learning algorithms are used in cybersecurity data science to find and stop cyberattacks. These algorithms process a lot of data in real-time and find patterns and oddities that could mean a cyberattack is coming. The technology has been highly successful in improving threat detection and response, as well as tracking the spread of malware, identifying the origin of cyberattacks, and understanding the motivations and tactics of cyber criminals. The use of cybersecurity data science has resulted in improved overall cybersecurity practices and reduced the risk of data breaches and financial losses.

Exploring the global geography of cybercrime and its driving forces

Cybercrime is wreaking havoc on the global economy, national security, social stability, and individual interests. The current efforts to mitigate cybercrime threats are primarily focused on technical measures. This study considers cybercrime as a social phenomenon and constructs a theoretical framework that integrates the social, economic, political, technological, and cybersecurity factors that influence cybercrime. The FireHOL IP blocklist, a novel cybersecurity data set, is used to map worldwide subnational cybercrimes. Generalised linear models (GLMs) are used to identify the primary factors influencing cybercrime, whereas structural equation modelling (SEM) is used to estimate the direct and indirect effects of various factors on cybercrime. The GLM results suggest that the inclusion of a broad set of socioeconomic factors can significantly improve the model’s explanatory power, and cybercrime is closely associated with socioeconomic development, while their effects on cybercrime differ by income level. Additionally, results from SEM further reveals the causal relationships between cybercrime and numerous contextual factors, demonstrating that technological factors serve as a mediator between socioeconomic conditions and cybercrime.

TRUST XAI: Model-Agnostic Explanations for AI With a Case Study on IIoT Security

Despite artificial intelligence (AI)’s significant growth, its “black box” nature creates challenges in generating adequate trust. Thus, it is seldom utilized as a standalone unit in IoT high-risk applications, such as critical industrial infrastructures, medical systems, financial applications, etc. Explainable AI (XAI) has emerged to help with this problem. However, designing appropriately fast and accurate XAI is still challenging, especially in numerical applications. Here, we propose a universal XAI model, named the transparency relying upon statistical theory (TRUST), which is model-agnostic, high performing, and suitable for numerical applications. Simply put, TRUST XAI models the statistical behavior of the AI’s outputs in an AI-based system. Factor analysis is used to transform the input features into a new set of latent variables. We use mutual information (MI) to rank these variables and pick only the most influential ones on the AI’s outputs and call them “representatives” of the classes. Then, we use multimodal Gaussian (MMG) distributions to determine the likelihood of any new sample belonging to each class. We demonstrate the effectiveness of TRUST in a case study on cybersecurity of the Industrial Internet of Things (IIoT) using three different cybersecurity data sets. As IIoT is a prominent application that deals with numerical data. The results show that TRUST XAI provides explanations for new random samples with an average success rate of 98%. Compared with local interpretable model-agnostic explanations (LIME), a popular XAI model, TRUST is shown to be superior in the context of performance, speed, and the method of explainability. In the end, we also show how TRUST is explained to the user.

Tackling imbalanced data in cybersecurity with transfer learning: a case with ROP payload detection

In recent years, deep learning gained proliferating popularity in the cybersecurity application domain, since when being compared to traditional machine learning methods, it usually involves less human efforts, produces better results, and provides better generalizability. However, the imbalanced data issue is very common in cybersecurity, which can substantially deteriorate the performance of the deep learning models. This paper introduces a transfer learning based method to tackle the imbalanced data issue in cybersecurity using return-oriented programming payload detection as a case study. We achieved 0.0290 average false positive rate, 0.9705 average F1 score and 0.9521 average detection rate on 3 different target domain programs using 2 different source domain programs, with 0 benign training data sample in the target domain. The performance improvement compared to the baseline is a trade-off between false positive rate and detection rate. Using our approach, the total number of false positives is reduced by 23.16%, and as a trade-off, the number of detected malicious samples decreases by 0.68%.

Using internet of things technologies to optimize agriculture and increase productivity

The review presented in this article is devoted to the application of Internet of Things (IoT) technologies in agriculture and its impact on the productivity and sustainability of this industry. During the study, comprehensive analyses were carried out, including monitoring of climatic conditions, soil conditions, and animal activity, using IoT sensor networks. The results showed that the introduction of IoT in agriculture significantly improves resource management, which leads to increased productivity and reduced costs. However, the study also identified challenges such as data cybersecurity and the need for staff training to work with IoT systems. Despite these challenges, the use of IoT is a promising solution for agriculture, in a changing climate and growing demand for products. According to the results of the study, it can be concluded that IoT has the potential to transform agriculture, making it more sustainable, efficient and environmentally sustainable.

Big Data in healthcare: cybersecurity and legal protection of personal data

Digitalization of Russian healthcare leads to an increase of digital medical data, which eventually becomes Big Data and requires secure ways to collect, process, store and use such information. In this article, the authors analyze legal acts that govern ways to protect medical information in digital form, as well as those that establish the legal regime of personal data. The authors draw attention to the risks of re-identification of anonymized medical data and difficulties to comply with some requirements of the personal data legislation in use of Big Data technologies. In discussion on liability for offences and crimes in the sphere of computer information, the authors propose to consider healthcare information systems containing personal data as objects of critical information infrastructure of the Russian Federation. Such regime would allow to charge unlawful access to the information contained and other criminal acts under Article 274¹ of the Criminal Code of the Russian Federation. Prevalence of information and communication technologies as a method of encroachments on the digital medical data, and ultimately an intrusion into privacy, leads authors to the conclusion about expediency of addition of Article 137 of the Criminal Code of the Russian Federation with the relevant aggravating circumstance.

Особливості розвитку регіональних економічних систем на засадах цифровізації в умовах повоєнного відновлення

The study of the development of digitalization of regional economic systems in the context of military aggression and post-war recovery of territories is an urgent and important task for the State today. The European vector of digital technology development, which Ukraine has chosen and is implementing, despite the difficulties, has allowed to significantly improve the development of the digital sector in our country. A study of the state of digital transformation of the regions of Ukraine in the pre-war period was carried out using the Digital Transformation Index, which made it possible to identify the leading and outsider regions in the development of digital content and to identify the strengths and weaknesses for each region as part of the calculation of the relevant sub-indices. First of all, such innovations in digital technologies concern the public sector, which, based on the development of software products (such as Diia), has allowed society to significantly improve and speed up the processes of obtaining a certain list of public services online. Development of the software product Hromada 4.0. for local self-government bodies, has allowed the introduction of new digital technologies in them to ensure equal access of the population to the necessary public services. The main focus of this program is digital solutions to improve municipal governance, increase cybersecurity of data. The development of the «EU4Digital: Supporting the Digital Economy and Society in the Eastern Partnership» program has improved the lives of the population by stimulating economic growth, creating new jobs, supporting small and medium-sized businesses by taking advantage of the benefits of the EU Digital Single Market for Ukraine. The study of the development of digitalization of regional economic systems allowed to identify four areas of obstacles (institutional, infrastructural, ecosystem, and e-government) that hinder this development. Six directions for the development of regional economic systems on the basis of digitalization are proposed, which will increase access to public services for more segments of the population, that should simplify the procedure for obtaining such services and reduce the level of bureaucracy in our country.

Design and Evaluation of Unsupervised Machine Learning Models for Anomaly Detection in Streaming Cybersecurity Logs

Companies, institutions or governments process large amounts of data for the development of their activities. This knowledge usually comes from devices that collect data from various sources. Processing them in real time is essential to ensure the flow of information about the current state of infrastructure, as this knowledge is the basis for management and decision making in the event of an attack or anomalous situations. Therefore, this article exposes three unsupervised machine learning models based on clustering techniques and threshold definitions to detect anomalies from heterogeneous streaming cybersecurity data sources. After evaluation, this paper presents a case of heterogeneous cybersecurity devices, comparing WSSSE, Silhouette and training time metrics for all models, where K-Means was defined as the optimal algorithm for anomaly detection in streaming data processing. The anomaly detection’s accuracy achieved is also significantly high. A comparison with other research studies is also performed, against which the proposed method proved its strong points.

Leveraging the potential of synthetic text for AI in mental healthcare.

In today's world it seems fair to say that extensive digital data sharing is the price we pay for the technological advances we have seen achieved as a result of AI systems analysing large quantities of data in a relatively short time. Where such AI is used in the realm of mental health, this data sharing poses additional challenges not just due to the sensitive nature of the data itself but also the potential vulnerability of the data donors themselves should there be a cybersecurity data breach. To address the problem, the AI community proposes to use synthetic text preserving only the salient properties of the original. Such text has potential to fill gaps in the textual data availability (e.g., rare conditions or under-represented groups) while reducing exposure. Our perspective piece is aimed to demystify the process of generating synthetic text, explain its algorithmic and ethical challenges, especially for the mental health domain, as well as most promising ways of overcoming them. We aim to promote better understanding and as a result acceptability of synthetic text outside the research community.

Challenges of Big Data and Cyber Security in Health Center

Today, big data analytics are used in many fields. This section introduces the characteristics of big data, which is a visualization tool for big data, main prospects of big data use in healthcare, Benefits of Big Data Analytics in Healthcare and Progress. This document describes big data technologies in healthcare. blockchain and Data protection is becoming more important in the medical field Privacy issues and blockchain-based cyber security are also affected scrutinized closely. Healthcare is changing rapidly, and so is technology. It should be modified to suit the needs expressed by the provider. When Big data is necessary to promote personalized medicine Good luck in the field of healthcare, but there are many challenges Big data in healthcare and cyber security discussed..

Extreme minority class detection in imbalanced data for network intrusion

As the amount of traffic on the Internet increases, so does the number of new and sophisticated network attacks. Intrusion detection systems are the most important tools for accurate detection of potential threats. Due to the dynamic nature of network attacks, deep learning neural networks play a significant role in intrusion detection, as they have proven to be effective in processing large amounts of data. However, deep learning networks often have difficulties to effectively detect attack classes that are in minority, when trained with imbalanced cybersecurity data. The common way to deal with this difficulty is resampling. In contrast to resampling, in this paper we implement Deep Neural Network for intrusion detection varying its parameters, and analyze detection performances of minority classes in imbalanced multi-class data. The model is trained and tested on the CICIDS-2017 dataset, which contains almost 3 million records and 15 traffic classes, where some classes are in extreme minority, holding only a few records per class. Additionally, the model was evaluated on an also imbalanced CICIDS-2018 dataset. Two feature selection methods are performed on the preprocessed data, in order to obtain two different feature subsets. Our findings show that some coarse grained features are of such significance that attacks with only 3 instances can be completely and accurately detected. As a conclusion, we show the difference in feature characteristics for minority classes that are crucial for their detection.

Challenges Facing on IoT and Gaps that Exist in the IoT Cybersecurity of Data Transferred by MQTT & CoAP Protocols

Challenges Facing on IoT and Gaps that Exist in the IoT Cybersecurity of Data Transferred by MQTT & CoAP Protocols

Eliminating Safe Havens for Transnational Cybercrimes in the African Continental Free Trade Area

The continuous advancement in technology makes cybercrimes effortlessly transnational. Existing literature reveals that the inadequacies of cybercrime-specific legislations, procedural powers, and enforceable mutual legal assistance provisions constitute jurisdictional challenges to the prosecution of transnational cybercrimes (TNCCs). This paper appraises the adequacy of legal responses to jurisdictional challenges of TNCCs in the African region, especially the African Union Convention on Cyber Security and Personal Data Protection (the Malabo Convention). It argues that the presence of states without substantive or procedural laws on cybercrimes, or both, constitutes safe havens that challenge the effectiveness of such laws in states where they are present. It finds that the Malabo Convention has the potential to be a tool for eliminating safe havens in the African region and given the inter-connection between trade and TNCCs, it suggests that it could be made operational through its annexation as one of the protocols to the African Continental Free Trade Area (AfCFTA) Agreement. The author concludes that purely domestic legal responses to cybercrimes are inadequate and suggests a holistic approach through the operationalization of an effective regional instrument as a way to diminish safe havens for TNCCs in the African region.

Cybersecurity Threats and Their Mitigation Approaches Using Machine Learning—A Review

Machine learning is of rising importance in cybersecurity. The primary objective of applying machine learning in cybersecurity is to make the process of malware detection more actionable, scalable and effective than traditional approaches, which require human intervention. The cybersecurity domain involves machine learning challenges that require efficient methodical and theoretical handling. Several machine learning and statistical methods, such as deep learning, support vector machines and Bayesian classification, among others, have proven effective in mitigating cyber-attacks. The detection of hidden trends and insights from network data and building of a corresponding data-driven machine learning model to prevent these attacks is vital to design intelligent security systems. In this survey, the focus is on the machine learning techniques that have been implemented on cybersecurity data to make these systems secure. Existing cybersecurity threats and how machine learning techniques have been used to mitigate these threats have been discussed. The shortcomings of these state-of-the-art models and how attack patterns have evolved over the past decade have also been presented. Our goal is to assess how effective these machine learning techniques are against the ever-increasing threat of malware that plagues our online community.

A Fussy Based Neural Genetic Algorithm for Securing Data in Cyber Security

Businesses are using cyber security technologies more and more to upgrade their operations. These businesses are prone to hazards and cyber security breaches because to the very specialized characteristics of such settings, including their sensitive exchange of cyber security data and the weak design of connected devices. Our main goal is to develop a cyber security system that can take into account all potential forms of assaults while staying within the allocated budget. To achieve this, a financial strategy based on portfolio management is utilized by enabling the selection of a portfolio of security controls that maximizes security level control while minimizing direct expenses. To solve this problem we proposed Fussy Based Neural Genetic Algorithm for authenticity, reliability and confidentiality of cyber security data and it decreases the danger of cyber security data integrity. Using a complex key, the plaintext is first transformed into a complex cipher text. The key is created using logical operators and is randomly chosen from the cyber security data. By applying principles of proposed algorithm, the cipher text acquired in the first step is rendered even more unreadable in the second phase. Feature Extraction of cyber security data is done by Principle Component Analysis (PCA).The data is encrypted by using Data Encryption Standard (DES). The data is decrypted using the proposed Fussy Based Neural Genetic Algorithm with Particle Swarm Optimization (FNGA-PSO).The suggested model's metrics are examined and compared to various traditional algorithms. This model solves the lack of difference in the authenticity of cyber security information, as well as it will give real and effective information to the organizational companies.

Design and evaluation of adaptive system for big data cyber security analytics

Big Data Cyber Security Analytics (BDCA) systems leverage big data technologies to collect, store, and analyze a large volume of security event data for detecting cyber-attacks. Big data analytical frameworks (e.g, Apache Hadoop and Apache Spark) are used for building BDCA systems. These frameworks come with dozens of configurable parameters that need to be tuned for each security dataset to use the BDCA system to the maximum of its ability. Manually tuning these many parameters for each dataset is a time-consuming and resource-intensive task. Therefore, tuning techniques are proposed to automatically tune framework parameters. However, previous tuning techniques not only require users to manually initiate and execute the tuning process but are also computationally expensive. In this paper, we present ADAPTER, a parameter-driven adaptation system that automatically triggers the tuning process, tunes the framework’s configuration parameters for different security datasets, and finally executes the BDCA system with the adapted configuration. ADAPTER uses empirically designed fuzzy rules that tune each configuration parameter based on the parameter’s impact on resource utilization such as CPU and disk utilization. We have evaluated ADAPTER for fully distributed Spark-based and Hadoop-based BDCA systems using five security datasets and several adaptation scenarios. Our evaluation shows that with respect to default settings, ADAPTER (i) reduces the training time by 35.9% and 31.1% for Spark and Hadoop, respectively (ii) reduces the testing time by 15.3% and 10.1% for Spark and Hadoop, respectively (iii) improves resource utilization by 36.6% for Spark and 55% for Hadoop (iii) reduces tuning time by 499 times and 135 times for Spark and Hadoop and (iv) improves data locality by 4%.

Application of Geospatial Data in Cyber security

Geospatial data is often perceived as only being related to maps, compasses and locations. However, the application areas of geospatial data are far wider and even extend to the field of cybersecurity. Not only is there an ability to show points of interest and emerging network traffic conditions, geospatial data also has the ability to model cyber crime growth patterns and indicate affected areas as well as the emergence of certain type of cyber threats.
 Geospatial data can feed into intelligence systems, help with analysis, information sharing, and help create situational awareness. This is particularly useful in the area of cyber security. Geospatial data is very powerful and can help to prioritise cyber threats and identify critical areas of concern.
 Previously, geospatial data was primarily used by militaries, intelligence agencies, weather services or traffic control. Currently, the application of geospatial data has multiplied, and it spans many more industries and sectors. So too for cyber security, geospatial data has a wide number of uses. It may be difficult to find patterns or trends in large data sets. However, the graphic capabilities of geo mapping help present data in more digestible manner. This may help analysts identify emerging issues, threats and target areas. In this paper, the usefulness of geospatial data for cyber security is explored. The paper will cover a framework of the key application areas that geospatial data can serve in the field of cyber security. The ten application areas covered in the paper are: tracking, data analysis, visualisation, situational awareness, cyber intelligence, collaboration, improved response to cyber threats, decision-making, cyber threat prioritisation and protect cyber infrastructure It is aimed that through the paper, the application areas of geospatial data can be more widely adopted.

Training a Quantum Annealing Based Restricted Boltzmann Machine on Cybersecurity Data

We present a real-world application that uses a quantum computer. Specifically, we train a RBM using QA for cybersecurity applications. The D-Wave 2000Q has been used to implement QA. RBMs are trained on the ISCX data, which is a benchmark dataset for cybersecurity. For comparison, RBMs are also trained using CD. CD is a commonly used method for RBM training. Our analysis of the ISCX data shows that the dataset is imbalanced. We present two different schemes to balance the training dataset before feeding it to a classifier. The first scheme is based on the undersampling of benign instances. The imbalanced training dataset is divided into five sub-datasets that are trained separately. A majority voting is then performed to get the result. Our results show the majority vote increases the classification accuracy up from 90.24% to 95.68%, in the case of CD. For the case of QA, the classification accuracy increases from 74.14% to 80.04%. In the second scheme, a RBM is used to generate synthetic data to balance the training dataset. We show that both QA and CD-trained RBM can be used to generate useful synthetic data. Balanced training data is used to evaluate several classifiers. Among the classifiers investigated, K-Nearest Neighbor (KNN) and Neural Network (NN) perform better than other classifiers. They both show an accuracy of 93%. Our results show a proof-of-concept that a QA-based RBM can be trained on a 64-bit binary dataset. The illustrative example suggests the possibility to migrate many practical classification problems to QA-based techniques. Further, we show that synthetic data generated from a RBM can be used to balance the original dataset.

CURRENT INTERNATIONAL LAW FOR CYBER CRIMES: A NEED FOR NEXT STEP

Through a wide variety of restrictions and regulations, the International Law regulates the relationship between nations and other international players (such as international organisations). From weapons control to international commerce, to environment, it has been used as a framework for governing global governance. The importance of international law in cyber environment has developed as governments pay greater attention to the ‘governance of cyberspace’ (the technological infrastructure that enables the global internet to work) and ‘governance in cyberspace” (how states, industry, and individuals may utilise this technology). However, apart from few exceptions such as the Budapest Convention on Cybercrime1 and the African Union Convention on Cyber Security and Personal Data Protection (yet to be in effect), the international law does not provide specific guidelines for cyberspace regulation. Moreover, it's a cutting-edge technology that's constantly evolving. As a result, for many years, it was unclear whether or not existing international law extended to the domain of Internet. The nation states and international organisations such as the UN's First Committee on Disarmament and International Security, the G20, European Union, the ASEAN, and the Organization of American States (OAS) have all stated that existing international law applies to states' use of information and communication technologies (ICTs). Thus, International Law is no more a question of whether, but rather how it functions. While many other international......