Cybersecurity Experts Research Articles

An Explainable Machine Learning Framework for Intrusion Detection Systems

In recent years, machine learning-based intrusion detection systems (IDSs) have proven to be effective; especially, deep neural networks improve the detection rates of intrusion detection models. However, as models become more and more complex, people can hardly get the explanations behind their decisions. At the same time, most of the works about model interpretation focuses on other fields like computer vision, natural language processing, and biology. This leads to the fact that in practical use, cybersecurity experts can hardly optimize their decisions according to the judgments of the model. To solve these issues, a framework is proposed in this paper to give an explanation for IDSs. This framework uses SHapley Additive exPlanations (SHAP), and combines local and global explanations to improve the interpretation of IDSs. The local explanations give the reasons why the model makes certain decisions on the specific input. The global explanations give the important features extracted from IDSs, present the relationships between the feature values and different types of attacks. At the same time, the interpretations between two different classifiers, one-vs-all classifier and multiclass classifier, are compared. NSL-KDD dataset is used to test the feasibility of the framework. The framework proposed in this paper leads to improve the transparency of any IDS, and helps the cybersecurity staff have a better understanding of IDSs' judgments. Furthermore, the different interpretations between different kinds of classifiers can also help security experts better design the structures of the IDSs. More importantly, this work is unique in the intrusion detection field, presenting the first use of the SHAP method to give explanations for IDSs.

Malware Persistence Mechanisms

Abstract In the public imagination Cybersecurity is very much about malware, even though malware constitutes only part of all the threats faced by Cybersecurity experts. However, malware is still one of the best methods to gain persistent access and control of a target system. Malware is often combined with a well socially-engineered phishing attack that deceives a user to gain a foothold on a system. Once the attakcer gains a beachhead in the victim’s network, it may be used to download additional payloads and exploit vulnerabilities, to gain more control and access within a network. Using malware as their foothold, attackers are able to to conduct reconnaissance, gather intelligence (e.g., exfiltration of intellectual property) or simply inflict damage or extortion (e.g., ransomware). All of this has to be done in a way that allows an attacker to retain access for as long as possible; the ability to do so is called persistence, and this paper examines the different techniques used by malware to accomplish persistence in an ever evolving landscape.

The effect of intrapreneurial competencies on innovative work behaviour: a case of cyber security experts in Malaysia

The effect of intrapreneurial competencies on innovative work behaviour: a case of cyber security experts in Malaysia

The Elections Clause Obligates Congress to Enact a Federal Plan to Secure U.S. Elections Against Foreign Cyberattacks

While foreign adversaries continue to launch cyber-attacks aimed at disrupting elections in the United States, Congress has been reluctant to take action. After Russia interfered in the 2016 election, cyber-security experts articulated clear measures that must be taken to secure U.S. election systems against foreign interference. Yet the federal government has failed to act. Congress’s reticence is based on a misguided notion that greater federal involvement in the conduct of elections unconstitutionally infringes on states’ rights. Both state election officials and certain congressional leaders operate under the assumption that federalism principles grant states primacy in conducting federal elections. This Comment dispels the myth that Congress must defer to states to regulate federal elections. The text of the Elections Clause in Article I, Section 4 of the U.S. Constitution confers to Congress final authority in determining the “Times, Places and Manner” of federal elections. Therefore, the system of administering U.S. elections is based on decentralization rather than federalism. The risk of foreign interference in U.S. elections was a precise reason the founders bestowed on Congress ultimate control over federal elections. States and municipalities lack the capacity to effectively combat foreign cyber invasion. This Comment makes the case that Congress has a responsibility to exercise its power under the Elections Clause to create a federal plan to secure voter registration databases and voting mechanisms against cyber-attacks in order to protect the integrity of our democracy.

Harnessing Artificial Intelligence Capabilities to Improve Cybersecurity

Cybersecurity is a fast-evolving discipline that is always in the news over the last decade, as the number of threats rises and cybercriminals constantly endeavor to stay a step ahead of law enforcement. Over the years, although the original motives for carrying out cyberattacks largely remain unchanged, cybercriminals have become increasingly sophisticated with their techniques. Traditional cybersecurity solutions are becoming inadequate at detecting and mitigating emerging cyberattacks. Advances in cryptographic and Artificial Intelligence (AI) techniques (in particular, machine learning and deep learning) show promise in enabling cybersecurity experts to counter the ever-evolving threat posed by adversaries. Here, we explore AI’s potential in improving cybersecurity solutions, by identifying both its strengths and weaknesses. We also discuss future research opportunities associated with the development of AI techniques in the cybersecurity field across a range of application domains.

A Collaborative Response to Provocative Comments in a Medical School

This article was migrated. The article was marked as recommended. In 2018, anonymous online provocative comments were submitted to student leaders of a Syrian Refugee Initiative (SRI) at the Penn State College of Medicine. This triggered a series of actions with students and medical school leaders aimed at identifying the person who submitted the comments, trying to understand mutual perspectives, and managing the impact of the event on the student body.We describe the history of our college's commitment to humanism and how the SRI was a direct outgrowth of that culture. Voices of the student leaders who were directly impacted by the provocative comments and educational leaders who worked to resolve the crisis are presented. We also describe a collaborative process that involved engaging cybersecurity experts to identify the perpetrator, and share how the students and educational leaders were able to develop trust despite initial skepticism by students over the leadership's avowed commitment to taking the hate speech seriously.While the perpetrator was never identified and opportunities for improvement were identified along the way, by including student leaders in the process, students and administrators were able to develop trust and reach reasonable closure on this disturbing event. Take home messages are presented to guide other institutions in navigating instances of provocative comments or speech.

Assembling cybersecurity: The politics and materiality of technical malware reports and the case of Stuxnet

ABSTRACTThis is an article about how cybersecurity gets “made,” with a focus on the role of commercial computer security firms in generating knowledge in matters of international cybersecurity. The argument is two-fold. Firstly, malware may be an intangible artefact in some ways, but its success and its interpretation as malware is deeply interwoven in social, technical, and material alliances. Secondly, a materialist-minded examination of Symantec’s Stuxnet reports will demonstrate the politically situated nature of how cybersecurity expertise emerges. The article finds that Symantec’s work was not a-political or neutrally-technical: Their experts made profoundly political choices in their analyses. By showing the processes that go into making cybersecurity, the article contributes to a widening and deepening of debates about what is at stake in cybersecurity knowledge and practices.

CYBERSECURITY STRATEGY FOR SMART CITY IMPLEMENTATION

Abstract. The development of information and communication technology has spread throughout the world. Many benefits can be obtained, but the risks cannot be avoided. Communication grows massively in cyberspace and thus poses a security threat to smart city services. This threat can be overcome through national spectrum by implementing cyberspace security strategies in developing smart cities. This paper describes cybersecurity strategies performed in supporting the development of smart cities. Security strategies are developed based on factors related to the perspective of three pillars of smart city implementation models, namely technology, people, and institutions. Factors related to cybersecurity from these three pillars are explored from the experience of policy makers, actors, and users of smart city services, and evaluated using the opinions of cybersecurity experts and smart cities. This strategy will be a standard document that will be used as a reference in carrying out all processes related to information security in supporting the development of smart cities.

Cyber hygiene: The concept, its measure, and its initial tests

While policy makers to cyber security experts call for improving cyber hygiene, no one really knows what it means. In fact, there exists no scholarly research explicating the concept or its measurement. This research makes an important contribution by conceptualizing cyber hygiene, operationalizing it, empirically identifying its sub-dimensions, and developing an inventory for it. The research achieves this with a mixed-methods approach, where using a combination of experts and a convenience sample of Internet users, it develops the initial items reflecting the construct, empirically refines the items, confirms its dimensions, and validates its fit. The outcome is an 18-item Cyber Hygiene Inventory (CHI) that measures five distinct dimensions of user cyber hygiene. Finally, the research demonstrates why cyber hygiene matters. Using the CHI it shows how cyber hygiene significantly predicts aspects of human cyber interaction that are pivotal to cyber safety including user self-beliefs about technology, how they cognitively process information online, and their online banking behavior.

A systematic review on the status and progress of homomorphic encryption technologies

With the emergence of big data and the continued growth in cloud computing applications, serious security and privacy concerns emerged. Consequently, several researchers and cybersecurity experts have embarked on a quest to extend data encryption to big data systems and cloud computing applications. As most cloud users turn to using public cloud services, confidentiality becomes and even more complicated issue. Cloud clients storing their data on a public cloud always seek solutions to confidentiality problem. Homomorphic encryption emerged as a possible solution where client’s data is encrypted on the cloud in a way that allows some search and manipulation operations without proper decryption. In this paper, we present a systematic review of research paper published in the field of homomorphic encryption. This paper uses PRISMA checklist alongside some items of Cochrane’s Quality Assessment to review studies retrieved from various resources. It was highly noticeable in the reviewed papers that security in big data and cloud computing has received most attention. Most papers suggested the use of homomorphic encryption although the thematic analysis has identified other potential concerns. Regarding the quality of the articles, 38% of the articles failed to meet three checklist items, including explicit statement of research objectives, procedure recognition and sources of funding used in the study. The review also presented compendium textual analysis of different homomorphic encryption algorithms, application areas, and areas of future developments. Results of the evaluation through PRISMA and the Cochrane tool showed that a majority of research articles discussed the potential use and application of Homomorphic Encryption as a solution to the growing demands of big data and absence of security and privacy mechanisms therein. This was evident from 26 of the total 59 articles that met the inclusion criteria. The term Homomorphic Encryption appeared 1802 times in the word cloud derived from the selected articles, which speaks of its potential to ensure security and privacy, while also preserving the CIA triad in the context of big data and cloud computing.

Cyberphysical risks of hacked internet-connected vehicles.

The integration of automotive technology with internet connectivity promises to both dramatically improve transportation while simultaneously introducing the potential for new unknown risks. Internet-connected vehicles are like digital data because they can be targeted for malicious hacking. Unlike digital data, however, internet-connected vehicles are cyberphysical systems that physically interact with each other and their environment. As such, the extension of cybersecurity concerns into the cyberphysical domain introduces new possibilities for self-organized phenomena in traffic flow. Here we study a scenario envisioned by cybersecurity experts leading to a large number of internet-connected vehicles being suddenly and simultaneously disabled. We investigate posthack traffic using agent-based simulations and discover the critical relevance of percolation for probabilistically predicting the outcomes on a multilane road in the immediate aftermath of a vehicle-targeted cyberattack. We develop an analytic percolation-based model to rapidly assess road conditions given the density of disabled vehicles and apply it to study the street network of Manhattan (New York City, New York, USA) revealing the city's vulnerability to this particular cyberphysical attack. While a comprehensive investigation of city-scale traffic around hacked vehicles is an extremely complicated problem, we find that the statistical physics of percolation can provide an estimate of the number of vehicles that critically disrupts citywide traffic flow. Our upper-bound estimate represents a quantification of citywide traffic disruptions when multiple vehicles are hacked.

An ISO 27001 compliance project for a cyber security service team

The ISO 270011 standard from the ISO/IEC 27000 family is a well-known reference framework for information security management. It defines and details controls and processes required for compliance with security practices. It provides companies with guidance and tools to adequately protect their technological environment and their information against security breaches, thereby simultaneously increasing the trust of their customers. Being ISO 27001 compliant provides a real competitive advantage and is even a requirement for some RFP tenders. Being ISO 27001 compliant or other equivalent governance frameworks, such as COBIT,2 is not a luxury for certain companies, especially those offering cyber security services. This framework has become a must to work with certain companies who have specific regulatory and legal constraints, such as PCI and SOX for banking environments, SOC I & II or NERC for companies operating in operational technology (OT) (SCADA/ICS) environments in North America. This paper puts forth a practical use case inspired by a real project initiated to reinforce the security governance framework of a major IT company offering cyber security (Bell Multi Services [Bell MS]) to financial firms and OT (SCADA/ICS) companies. To avoid advertising or unintentionally revealing confidential information, some information which is too specific and not relevant to this paper has been removed. The security and compliance programme executed for this company will be identified by a fictive name: SecurePhoenix programme. The objective of this programme was clearly to enhance the level of security services (risk management, logging and monitoring management, incident management, vulnerability management, identity and access management, etc.) offered by Bell Canada3 Multi Services security team for multi clients (here referred to by the fictive name Bell Security Operational Center [Bell SOC]). A year after SecurePhoenix launched all projects, the triad parameters (budget, time, quality) were all in the red. Bell Canada — or, more specifically, Bell MS — therefore hired the current author’s company, project management, audit and cyber security expertise to bring it the programme back on track.

Health Information Held Hostage

Electronic medical records are increasingly vulnerable to hackers exploiting the consistent lack of cybersecurity expertise in hospitals. Since education in digital hygiene will likely never truly conquer the absent-minded nature of humankind, it could be worthwhile to implement the distributed system of InterPlanetary File System, reducing the incidence of patient records being held hostage by hackers, but possibly increasing the incidence of data breaches for informational gain only. 
 (Included as first paragraph of main article)

Educating Future Multidisciplinary Cybersecurity Teams

We present a vision and the curricular foundations needed for the multidisciplinary cybersecurity teams of the future, which are made up of diverse cybersecurity experts, each contributing unique abilities and perspectives that emerged from their own discipline-centric methodological approaches. Examples demonstrating the effectiveness of current and emerging multidisciplinary cybersecurity teams are included.

CyberMaster: An Expert System to Guide the Development of Cybersecurity Curricula

The growing number of reported cyber-attacks pose a difficult challenge to individuals, governments and organizations. Adequate protection of information systems urgently requires a cybersecurity-educated workforce trained using a curriculum that covers the essential skills required for different cybersecurity work roles. The goal of the CyberMaster expert system is to assist inexperienced instructors with cybersecurity course design. It is an intelligent system that uses visual feedback to guide the user through the design process. Initial test executions show the promise of such a system in addressing the enormous shortage of cybersecurity experts currently available for designing courses and training programs.

Inspiring Girls to Explore Cyber Security

The head of a Gloucestershire school, in partnership with GCHQ, is determined to inspire the next generation of female cyber security experts. Claire Penketh, Senior PR Officer at BCS, met him.

Detecting Anomalies in Computer Networks Recurrent Neural Networks

Due to the widespread use of computer networks as well as the numerous attacks that such networks face, a fast and accurate means of detecting attacks represents an ever growing need. In this paper, a system that uses a recurrent neural network (RNN) is explored as a potential method for detecting intrusions. The investigated system is applied to an unlabeled cyber-security data set in order to determine its effectiveness. The goal is to train the system on every individual user included in the data set so as to learn their behavior and then to allow for the identification of any deviations in their behavior. It should be stressed here that deviations in behavior (or anomalies) cannot be labeled as “intrusions” without the involvement of domain experts. Nevertheless, they can be used to identify potential attacks, and they can also be presented to cyber-security experts for further evaluation. Several architectures for the system are explored with the aim of identifying the optimal one. A system is developed to be both fast and good at identifying anomalous behavior, while at the same time it must be able to adapt to any changes the attackers might implement to avoid detection, thus the results shown in this work using an unlabeled data set to train the network does not allow for the accuracy of the system for identifying the attackers. This means that identifying the optimal architecture is a difficult task. Yet, the system used in this paper is able to identify likely anomalies, which leads to the conclusion that RNNs do represent an effective means of flagging anomalous behavior.

Fundamentals methodology of formation cyber competences at security sector experts and Ukraine defense

The analysis of the existing systems of training military specialists in cybersecurity issues for the national security and defense spheres in a number of leading countries of the world (USA, UK, Canada, Germany, Poland) was conducted. An analysis of the cybersecurity education system of the US population was also conducted. Data is provided about main educational institutions in these countries where military cybersecurity experts are successfully trained, as well as the training programs offered by the US Department of Homeland Security to train children in the system of pre-school and school education, their parents, teachers and other. The data shows system and programs for the preparation of cybersecurity bachelors in higher educational institutions of the United States. Analyzed the prerequisites, stages of formation and the current state of the training system in Ukraine of cybersecurity specialists. It was determined that the standards for training military specialists in higher education institutions of the security and defense sector of Ukraine did not sufficiently take into account their competence in the cybersecurity basics. The analysis of the basic concepts in the professional-competence approach to the training of cybersecurity specialists has been carried out. The main provisions of the methodology for the development of an integrated system of improving cyber-education of the population and training of specialists in cybersecurity issues for the security and defense sector of Ukraine are proposed. It has been shown that raising the level of population education in cybersecurity issues in Ukraine should begin with pre-school education, as well as introduce a permanent school cyber-education system, which will make it possible to better prepare a child for adulthood in a modern high-tech society. Clarified requirements for cybersecurity education in higher education. In accordance with the best foreign experience, it was suggested that the main efforts in training cybersecurity experts for the security and defense sector should be focused on integrating the scientific, pedagogical and material-technical potentials on a single basis, by forming higher military schools (higher education institutions with specific learning conditions) a new type in the form of an integrated teaching and research and experimental test complex.

Mitigating Risks of Hybrid War: Search for an Effective Energy Strategyin The Baltic States

Abstract Meanwhile, energy security is threatened in new domains – maritime and cyber. In the maritime domain, military operations target construction works of the new objects as well as operating interconnectors, cables, LNG terminals, and other strategic assets. Regular situational awareness in the Baltic Sea region is lacking, as is sufficient naval and civilian maritime cooperation. In the cyber realm attacks become more frequent and more complex, critical infrastructure being the main target. As cyber security expertise and exercise are lacking and integration into European natural gas and electricity systems is not completed, blackout scenario in the Baltic States remains possible.

Predicting future AI failures from historic examples

PurposeThe purpose of this paper is to explain to readers how intelligent systems can fail and how artificial intelligence (AI) safety is different from cybersecurity. The goal of cybersecurity is to reduce the number of successful attacks on the system; the goal of AI Safety is to make sure zero attacks succeed in bypassing the safety mechanisms. Unfortunately, such a level of performance is unachievable. Every security system will eventually fail; there is no such thing as a 100 per cent secure system.Design/methodology/approachAI Safety can be improved based on ideas developed by cybersecurity experts. For narrow AI Safety, failures are at the same, moderate level of criticality as in cybersecurity; however, for general AI, failures have a fundamentally different impact. A single failure of a superintelligent system may cause a catastrophic event without a chance for recovery.FindingsIn this paper, the authors present and analyze reported failures of artificially intelligent systems and extrapolate our analysis to future AIs. The authors suggest that both the frequency and the seriousness of future AI failures will steadily increase.Originality/valueThis is a first attempt to assemble a public data set of AI failures and is extremely valuable to AI Safety researchers.