Cybersecurity Scenarios Research Articles

Zero-Day Malware Detection and Effective Malware Analysis Using Shapley Ensemble Boosting and Bagging Approach.

Software products from all vendors have vulnerabilities that can cause a security concern. Malware is used as a prime exploitation tool to exploit these vulnerabilities. Machine learning (ML) methods are efficient in detecting malware and are state-of-art. The effectiveness of ML models can be augmented by reducing false negatives and false positives. In this paper, the performance of bagging and boosting machine learning models is enhanced by reducing misclassification. Shapley values of features are a true representation of the amount of contribution of features and help detect top features for any prediction by the ML model. Shapley values are transformed to probability scale to correlate with a prediction value of ML model and to detect top features for any prediction by a trained ML model. The trend of top features derived from false negative and false positive predictions by a trained ML model can be used for making inductive rules. In this work, the best performing ML model in bagging and boosting is determined by the accuracy and confusion matrix on three malware datasets from three different periods. The best performing ML model is used to make effective inductive rules using waterfall plots based on the probability scale of features. This work helps improve cyber security scenarios by effective detection of false-negative zero-day malware.

Problem- Based Cybersecurity Lab with Knowledge Graph as Guidance

Lecture-based teaching paired with laboratory-based exercises is most commonly used in cybersecurity instruction. However, it focuses more on theories and models but fails to provide learners with practical problem-solving skills and opportunities to explore real-world cybersecurity challenges. Problem-based Learning (PBL) has been identified as an efficient pedagogy for many disciplines, especially engineering education. It provides learners with real-world complex problem scenarios, which encourages learners to collaborate with classmates, ask questions and develop a deeper understanding of the concepts while solving real-world cybersecurity problems. This paper describes the application of the PBL methodology to enhance professional training-based cybersecurity education. The authors developed an online laboratory environment to apply PBL with Knowledge-Graph (KG) based guidance for hands-on labs in cybersecurity training.Learners are provided access to a virtual lab environment with knowledge graph guidance to simulated real-life cybersecurity scenarios. Thus, they are forced to think independently and apply their knowledge to create cyber-attacks and defend approaches to solve problems provided to them in each lab. Our experimental study shows that learners tend to gain more enhanced learning outcomes by leveraging PBL with knowledge graph guidance, become more aware of cybersecurity and relevant concepts, and also express interest in keep learning of cybersecurity using our system.

Modeling Realistic Adversarial Attacks against Network Intrusion Detection Systems

The incremental diffusion of machine learning algorithms in supporting cybersecurity is creating novel defensive opportunities but also new types of risks. Multiple researches have shown that machine learning methods are vulnerable to adversarial attacks that create tiny perturbations aimed at decreasing the effectiveness of detecting threats. We observe that existing literature assumes threat models that are inappropriate for realistic cybersecurity scenarios, because they consider opponents with complete knowledge about the cyber detector or that can freely interact with the target systems. By focusing on Network Intrusion Detection Systems based on machine learning, we identify and model the real capabilities and circumstances required by attackers to carry out feasible and successful adversarial attacks. We then apply our model to several adversarial attacks proposed in literature and highlight the limits and merits that can result in actual adversarial attacks. The contributions of this article can help hardening defensive systems by letting cyber defenders address the most critical and real issues and can benefit researchers by allowing them to devise novel forms of adversarial attacks based on realistic threat models.

Novel Network Testbed of Adaptive Cyber Defense System Design for Web Data security

In recent generations, the cyber security scenario has transposed significantly from conventional response based security mechanisms to forward security strategies. And this transformation is still continuing which is shifting it from visionary security strategies to cyber immunity which eliminates the cyber risks by introducing uncompromising and adaptive security measures. In the process of developing new security algorithms/ procedures, accurate modeling and effective simulation play a vital part for the robustness and effectiveness of proposed system. It's also necessary to break down the deportment of proposed system against multiple types of known cyber attacks. This paper focuses on the being network testbeds for an effective analysis and monitoring while proposing a new network testbed for examining new security generalities like cyber impunity. The proposed network testbed is designed to incorporate the techniques and procedures of Nature inspired Cyber Security to accommodate the adaptive responses against the sophisticated and ever advancing cyber attacks. The proposed testbed provides customizable analytical tool to design, test and examine the new security algorithms through a rich set of attack scripts. It also allows inventors to design, execute, and evaluate their defensive techniques with library support.

Ontology-Based Emotional Decision-Making in Self-Evolving Defensive Agents

Responding instantaneously in an unprecedented situation is inevitable to mitigate zero day attacks in the cyber world. This situation has strong resemblance with the fight for survival in biological world. Both being complex systems, the biological world and the cyber world have structural similarities. Emotions are the key factor used by biological beings to take intuitive decisions, which are key to survival in the natural world. Inspired from the idea of emotional decision making in natural world and the structural similarity shown by biological and cyber worlds, this paper proposes an ontological mechanism to implement artificial emotion-based decision making for autonomous agents in cyber security scenario. Emotions are modelled as manifestation of the goals of agents. Stimuli and response are connected through emotions using the ontological structure. The mechanism is proven useful in eliciting appropriate response for the stimuli using ontological reasoning through SPARQL queries.

AI-assisted Computer Network Operations testbed for Nature-Inspired Cyber Security based adaptive defense simulation and analysis

In the current ever-changing cybersecurity scenario, active cyber defense strategies are imperative. In this work, we present a standard testbed to measure the efficacy and efficiency of customized networks while analyzing various parameters during the active attack. The presented testbed can be used for analyzing the network behavior in presence of various types of attacks and can help in fine-tuning the proposed algorithm under observation. The proposed testbed will allow users to design, implement, and evaluate the active cyber defense mechanisms with good library support of nature-inspired and AI-based techniques. Network loads, number of clusters, types of home networks, and number of nodes in each cluster and network can be customized. While using the presented testbed and incorporating active-defense strategies on existing network architectures, users can also design and propose new network architectures for effective and safe operation. In this paper, we propose a unified and standard testbed for cyber defense strategy simulation and bench-marking, which would allow the users to investigate current approaches and compare them with others, while ultimately aiding in the selection of the best approach for a given network security situation. We have compared the network performance in difference scenarios namely, normal, under attack and under attack in presence of NICS-based adaptive defense mechanism and achieved stable experimental results. The experimental results clearly show that the proposed testbed is able to simulate the network conditions effectively with minimum efforts in network configuration. The simulation results of defense mechanisms verified on the proposed testbed got the improvement on almost 80 percent while increasing the turnaround time to 1–2 percent. The applicability of proposed testbed in modern technologies like Fog Computing and Edge Computing is also discussed in this paper.

Building next generation Cyber Ranges with CRACK

Cyber Ranges are complex infrastructures hosting high quality exercises that simulate cybersecurity scenarios of real-world complexity. Building the computing infrastructure is only the first step towards the successful execution of the cyber exercises. The design, verification and deployment of scenarios are costly and error-prone activities. As a matter of fact, a misconfiguration in the scenario can compromise the exercise and the training goals. This makes the design, development, and deployment of live-fire cyber exercises of real-world complexity so expensive that can be afforded only by a limited number of organizations. In this paper we present CRACK, a framework for the (i) design, (ii) model verification, (iii) generation, and (iv) automated testing of cyber scenarios. We introduce the CRACK SDL, a Scenario Definition Language based on TOSCA, an OASIS standard for the specification and orchestration of virtual infrastructures. CRACK SDL allows for the declarative specification of the scenario elements and their interplay, e.g., a vulnerability affecting a system. Through a formal encoding of the properties of an SDL specification, CRACK also supports the automatic verification of a scenario against its training objectives. After a successful verification, the scenario is automatically deployed in the Cyber Range and automatically tested to check the correspondence between the behavior of the deployed system and its specification. The key functionalities offered by CRACK are presented through a simple, yet representative case study. Experimental results confirm the effectiveness of the proposed approach.

Cognitive security: A comprehensive study of cognitive science in cybersecurity

Nowadays, IoT, cloud computing, mobile and social networks are generating a transformation in social processes. Nevertheless, this technological change rise to new threats and security attacks that produce new and complex cybersecurity scenarios with large volumes of data and different attack vectors that can exceeded the cognitive skills of security analysts. In this context, cognitive sciences can enhance the cognitive processes, which can help to security analysts to establish actions in less time and more efficiently within cybersecurity operations. This works presents a cognitive security model that integrates technological solutions such as Big Data, Machine Learning, and Support Decision Systems with the cognitive processes of security analysts used to generate knowledge, understanding and execution of security response actions. The model considers alternatives to establish the automation process in the execution of cognitive tasks defined in the cyber operations processes and includes the analyst as the central axis in the processes of validation and decision making through the use of MAPE-K, OODA and Human in the Loop.

A Cloud-based platform for the emulation of complex cybersecurity scenarios

In the last few years, cybersecurity has become a hot topic because of the ever-increasing availability of Internet accessible services driven by the diffusion of connected devices. The consequent exposition to cyber threats demands for suitable methodologies, techniques and tools allowing to adequately handle issues arising in such a complex domain. This paper describes the architecture of SmallWorld, a scalable software platform designed to reproduce realistic scenarios achieved by the immersion of real systems into a software defined virtual environment. SmallWorld enables the assessment, teaching and learning of cybersecurity related aspects in different areas and for various purposes. It exploits innovative and state-of-the-art virtualization and simulation techniques for reproducing in a realistic setting a dynamic environment where large distributed computer systems can be deployed and from where they can interact with real life entities. One of the main features of SmallWorld is the support for designing and building complex scenarios which are dynamic and reactive and where a number of autonomous software agents can be deployed. Agents are able to reproduce the behaviors of human users and/or malicious applications into a SmallWorld scenario making it a more realistic testing environment. The practical use of SmallWorld is shown by means of two realistic case studies.

Static versus Dynamic Data Information Fusion analysis using DDDAS for Cyber Security Trust

Abstract Information fusion includes signals, features, and decision -level analysis over various types of data including imagery, te xt, and cyber security detection. With the maturity of data processing, the e xplosion of big data, and the need fo r user acceptance; the Dynamic Data-Driven Application System (DDDAS) philosophy fosters insights into the usability of information systems solutions. In this paper, we e xp lore a notion of an adaptive adjustment of secure communication trust analysis that seeks a balance between standard static solutions versus dynamic -data driven updates. A use case is provided in determin ing trust for a cyber security scenario exp loring comparisons of Bayesian versus evidential reasoning for dynamic security detection updates. Using the evidential reasoning proportional conflict redistribution (PCR) method, we demonstrate improved trust for dynamically changing detections of denial of service attacks.

CHEAT: An updated approach for incorporating human factors in cyber-security assessments

The human element has been identified as a contributing factor in over 95% of cyber-security incidents. Current technical risk assessment methodologies, such as the IS1-2 Supplement, go some way to quantifying the characteristics of non-malicious insider attacks. However, the approaches are based on historical understanding of the user group, organisational security culture and past security breaches, and do not fully consider the psychological motivations that give rise to human error in cyber-security scenarios. Applied knowledge of human limitations and cognitive biases was used to derive a structured approach to capture typical human errors as part of cyber-security assessments. By recognising the psychological root causes behind human errors in cyber-security scenarios, one can identify appropriate risk management and mitigating strategies, in the same way that human reliability analysis tools, such as the Human Error Assessment and Reduction Technique (HEART), mitigate human error as part of safety case evidence. This article presents the cyber human error assessment tool, a structured approach to address human factor considerations in cyber-security assessments.

Static Versus Dynamic Data Information Fusion Analysis Using DDDAS for Cyber Security Trust

Information fusion includes signals, features, and decision -level analysis over various types of data including imagery, te xt, and cyber security detection. With the maturity of data processing, the e xplosion of big data, and the need fo r user acceptance; the Dynamic Data-Driven Application System (DDDAS) philosophy fosters insights into the usability of information systems solutions. In this paper, we e xp lore a notion of an adaptive adjustment of secure communication trust analysis that seeks a balance between standard static solutions versus dynamic -data driven updates. A use case is provided in determin ing trust for a cyber security scenario exp loring comparisons of Bayesian versus evidential reasoning for dynamic security detection updates. Using the evidential reasoning proportional conflict redistribution (PCR) method, we demonstrate improved trust for dynamically changing detections of denial of service attacks.

A Framework for Linking Cybersecurity Metrics to the Modeling of Macroeconomic Interdependencies

Hierarchical decision making is a multidimensional process involving management of multiple objectives (with associated metrics and tradeoffs in terms of costs, benefits, and risks), which span various levels of a large-scale system. The nation is a hierarchical system as it consists multiple classes of decisionmakers and stakeholders ranging from national policymakers to operators of specific critical infrastructure subsystems. Critical infrastructures (e.g., transportation, telecommunications, power, banking, etc.) are highly complex and interconnected. These interconnections take the form of flows of information, shared security, and physical flows of commodities, among others. In recent years, economic and infrastructure sectors have become increasingly dependent on networked information systems for efficient operations and timely delivery of products and services. In order to ensure the stability, sustainability, and operability of our critical economic and infrastructure sectors, it is imperative to understand their inherent physical and economic linkages, in addition to their cyber interdependencies. An interdependency model based on a transformation of the Leontief input-output (I-O) model can be used for modeling: (1) the steady-state economic effects triggered by a consumption shift in a given sector (or set of sectors); and (2) the resulting ripple effects to other sectors. The inoperability metric is calculated for each sector; this is achieved by converting the economic impact (typically in monetary units) into a percentage value relative to the size of the sector. Disruptive events such as terrorist attacks, natural disasters, and large-scale accidents have historically shown cascading effects on both consumption and production. Hence, a dynamic model extension is necessary to demonstrate the interplay between combined demand and supply effects. The result is a foundational framework for modeling cybersecurity scenarios for the oil and gas sector. A hypothetical case study examines a cyber attack that causes a 5-week shortfall in the crude oil supply in the Gulf Coast area.