Cybersecurity Systems Research Articles

Detection of Cyber Attacks and Network Attacks Using Machine Learning Algorithms

Now a days cyber crime growing and has a big effect everywhere globally. ethical hackers are normally involved in identifying flaws and recommending mitigation measures. the cyber safety international, there's a pressing need for the improvement of powerful techniques. Because of the effectiveness of machine learning in cyber security issues, machine learning for cyber security has recently become a hot topic. In cyber security, machine learning approaches have been utilized to handle important concerns such as intrusion detection, malware classification and detection, spam detection, and phishing detection. Although ML cannot fully automate a cyber-security system, it can identify cyber-security threats more efficiently than other software-oriented approaches, relieving security analysts of their burden. As a result, effective adaptive methods, such as machine learning techniques, can yield higher detection rates, lower false alarm rates, and cheaper computing and transmission costs. Our key goal is that the challenge of detecting attacks is fundamentally different from those of these other applications, making it substantially more difficult for the intrusion detection community to apply machine learning effectively. In this study, the CPS is modeled as a network of agents that move in unison with one another, with one agent acting as a leader and commanding the other agents. The proposed strategy in this study is to employ the structure of deep neural networks for the detection phase, which should tell the system of the attack's existence in the early stages of the attack. The use of robust control algorithms in the network to isolate the misbehaving agent in the leader-follower mechanism has been researched. Following the attack detection phase with a deep neural network, the control system uses the reputation algorithm to isolate the misbehaving agent in the presented control method. Experiment results show that deep learning algorithms can detect attacks more effectively than traditional methods, making cyber security simpler, more proactive, and less expensive and more expensive.

The inverse problem of Q-analysis of complex systems structure in cyber security


 
 
 It is considered the inverse problem of Q-analysis. In the course of the research, an algorithm for the recovery of simplicial complexes from elementary simplex using local maps and a structural tree was developed. This algorithm will reduce the amount of data stored and improve the management process if the simplicial complex describes a real big complex system wich it can imagine cyber security system.
 
 

Review of Cybersecurity Analysis in Smart Distribution Systems and Future Directions for Using Unsupervised Learning Methods for Cyber Detection

In a physical microgrid system, equipment failures, manual misbehavior of equipment, and power quality can be affected by intentional cyberattacks, made more dangerous by the widespread use of established communication networks via sensors. This paper comprehensively reviews smart grid challenges on cyber-physical and cyber security systems, standard protocols, communication, and sensor technology. Existing supervised learning-based Machine Learning (ML) methods for identifying cyberattacks in smart grids mostly rely on instances of both normal and attack events for training. Additionally, for supervised learning to be effective, the training dataset must contain representative examples of various attack situations having different patterns, which is challenging. Therefore, we reviewed a novel Data Mining (DM) approach based on unsupervised rules for identifying False Data Injection Cyber Attacks (FDIA) in smart grids using Phasor Measurement Unit (PMU) data. The unsupervised algorithm is excellent for discovering unidentified assault events since it only uses examples of typical events to train the detection models. The datasets used in our study, which looked at some well-known unsupervised detection methods, helped us assess the performances of different methods. The performance comparison with popular unsupervised algorithms is better at finding attack events if compared with supervised and Deep Learning (DL) algorithms.

AMGmal: Adaptive mask-guided adversarial attack against malware detection with minimal perturbation

Modern cyber security systems increasingly rely on deep neural networks (DNNs) to tackle the surge in security threats. However, it is well-known that DNNs are vulnerable to adversarial examples. The state-of-the-art adversarial malware attacks focus on fooling the detector without losing functionality, but ignore the magnitude of perturbation, which can lead to attack failure in real-world scenarios. This paper proposes a novel technique of generating adversarial malware examples, AMGmal, i.e., Adaptive Mask-Guided adversarial attack against malware detection with minimal perturbation. By prioritizing the modification of critical bytes at slack areas by saliency detection and mask guidance technique, we find an optimal balance between the evasion rate, perturbation magnitude and running time through three strategies, namely Dilation, Erosion and Heuristic. The proposed strategies can be extended to other attack methods as a generic post-processing step to minimize the perturbation. We evaluate the performance of AMGmal on the Malimg and SOREL-20M datasets and five DNN-based malware detectors. Experimental results show that the perturbation magnitude is reduced to one-third of base attack, from 3.34% to 0.90% and 2.32% to 0.73%. Compared to existing methods, AMGmal has the highest success rate of 68.09% and 64.75% when the amount of perturbation is similar, and vice versa. Furthermore, AMGmal is still effective even with defenses in place.

Model-Based Systems Engineering Cybersecurity for Space Systems

As industries in various sectors increasingly adopt model-based systems engineering (MBSE) for system lifecycle design and development, engineers can manage and describe systems of higher complexity than ever before. This is especially true for the field of space systems; while past missions have developed using document-based planning, it is only in the last several years that NASA and other organizations in the space industry have begun using MBSE. One crucial factor of space systems development that is often overlooked is cybersecurity. As space systems become more complex and cyberphysical in nature, cybersecurity requirements become more difficult to capture, especially through document-based methods; a need for a means by which to continuously verify and validate systems cybersecurity for cyberphysical space missions arises. By expanding upon a National Institute of Standards and Technology (NIST) framework for cyber resiliency, this work proposes a methodology that uses MBSE traceability functionality to demonstrate adequate cybersecurity for cyberphysical space systems using SysML requirements modeling capabilities. Key goals, objectives, and strategic principles leading to achieving cybersecurity at all levels of the system’s architectural hierarchy are presented. Recommendations for the future of space cybersecurity include the addition of the space sector to the Department of Homeland Security Cybersecurity & Infrastructure Security Agency’s list of critical infrastructure sectors to improve standardization and control of space cyberinfrastructure.

Kajian Ilmu Pertahanan dalam Strategi Pertahanan Negara Guna Menghadapi Ancaman Teknologi Digital di Indonesia

This article explains the use of people's personal data to state security data that is currently interconnected and circulating on the internet network. Regulation of the Minister of Defense No. 16 years 2010 which mandated the establishment of a digital technology defense concept in Indonesia. Data surveillance is carried out physically and logically with integrity and upholding confidentiality be able to find illegal processes. Continued with this capacity and capability improvement as a must to be able to continue to innovate and develop because over time the types of threats and challenges will change and develop. As a support, qualified digital or cyber technology system is built first. Thus, it is hoped that the cyber defense strategy in Indonesia can guarantee sovereignty and security for the nation and state. With the aim of developing human resources to meet the needs of personnel in national cybersecurity activities. The Indonesian government has realized that this development requires policy as a measurable and clear legal basis which is then followed by the establishment of a strategic cybersecurity system. Thus, it is hoped that the security of citizens in conducting activities in the digital world can be well guaranteed their rights and obligations.

Report on the 3rd International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS - 2022)

Critical Infrastructures (CIs) are vital for modern societies, covering different sectors like banking, emergency services, energy, healthcare, oil and gas, transportation, and water distribution. Over the years, CIs rely on technology for their seamless operations. Their reliable and secure operation is of supreme importance to societal welfare and a nation's economy. This paper reports on the presentation and discussions held during the 3rd International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS - 2022). The main aim of this EnCyCriS workshop is to gather contributions from researchers and practitioners working on challenges and solutions for engineering and cybersecurity of critical systems in the Fourth Industrial Revolution (4IR). This year´s edition has accepted and presented seven papers in addition to a keynote speech from a Principal Analyst in Information Security for Equinor ASA, Norway. This workshop was co-located with the 44th International Conference on Software Engineering (ICSE - 2022), which took place on 16th May 2022.

Factors Influencing User’s Intention to Adopt AI-Based Cybersecurity Systems in the UAE

Aim/Purpose: The UAE and other Middle Eastern countries suffer from various cybersecurity vulnerabilities that are widespread and go undetected. Still, many UAE government organizations rely on human-centric approaches to combat the growing cybersecurity threats. These approaches are ineffective due to the rapid increase in the amount of data in cyberspace, hence necessitating the employment of intelligent technologies such as AI cybersecurity systems. In this regard, this study investigates factors influencing users’ intention to adopt AI-based cybersecurity systems in the UAE. Background: Even though UAE is ranked among the top countries in embracing emerging technologies such as digital identity, robotic process automation (RPA), intelligent automation, and blockchain technologies, among others, it has experienced sluggish adoption of AI cybersecurity systems. This selectiveness in adopting technology begs the question of what factors could make the UAE embrace or accept new technologies, including AI-based cybersecurity systems. One of the probable reasons for the slow adoption and use of AI in cybersecurity systems in UAE organizations is the employee’s perception and attitudes towards such intelligent technologies. Methodology: The study utilized a quantitative approach whereby web-based questionnaires were used to collect data from 370 participants working in UAE government organizations considering or intending to adopt AI-based cybersecurity systems. The data was analyzed using the PLS-SEM approach. Contribution: The study is based on the Protection Motivation Theory (PMT) framework, widely used in information security research. However, it extends this model by including two more variables, job insecurity and resistance to change, to enhance its predictive/exploratory power. Thus, this research improves PMT and contributes to the body of knowledge on technology acceptance, especially in intelligent cybersecurity technology. Findings: This paper’s findings provide the basis from which further studies can be conducted while at the same time offering critical insights into the measures that can boost the acceptability and use of cybersecurity systems in the UAE. All the hypotheses were accepted. The relationship between the six constructs (perceived vulnerability (PV), perceived severity (PS), perceived response efficacy (PRE), perceived self-efficacy (PSE), job insecurity (JI), and resistance to change (RC)) and the intention to adopt AI cybersecurity systems in the UAE was found to be statistically significant. This paper’s findings provide the basis from which further studies can be conducted while at the same time offering critical insights into the measures that can boost the acceptability and use of cybersecurity systems in the UAE. Recommendations for Practitioners: All practitioners must be able to take steps and strategies that focus on factors that have a significant impact on increasing usage intentions. PSE and PRE were found to be positively related to the intention to adopt AI-based cybersecurity systems, suggesting the need for practitioners to focus on them. The government can enact legislation that emphasizes the simplicity and awareness of the benefits of cybersecurity systems in organizations. Recommendation for Researchers: Further research is needed to include other variables such as facilitating conditions, AI knowledge, social influence, and effort efficacy as well as other frameworks such as UTAUT, to better explain individuals’ behavioral intentions to use cybersecurity systems in the UAE. Impact on Society: This study can help all stakeholders understand what factors can increase users’ interest in investing in the applications that are embedded with security. As a result, they have an impact on economic recovery following the COVID-19 pandemic. Future Research: Future research is expected to investigate additional factors that can influence individuals’ behavioral intention to use cybersecurity systems such as facilitating conditions, AI knowledge, social influence, effort efficacy, as well other variables from UTAUT. International research across nations is also required to build a larger sample size to examine the behavior of users.

GAME THEORETICAL APPROACH TO THE MODELING OF CONFLICTS IN INFORMATION SECURITY SYSTEMS

The increase in the number and complexity of cyber threats forces us to study not only the technical aspects of cyber security, but also the social and interaction between participants in the digital space. The game-theoretic approach opens up opportunities for a deeper understanding of emerging conflicts and the development of effective management strategies to ensure cyber security. In this context, it is important to investigate how game theory can be applied to the analysis of conflicts in cyberspace and what practical conclusions can be drawn for the improvement of cyber security systems as a whole, which determined the relevance and importance of this work. Based on the scientific literature, a review of various approaches to the application of game theory in information and cyber security systems was carried out. The main concepts of the concept of game theory are highlighted, such as player, strategy, winning and losing, which allows to structure and understand interactions in security systems. The most common types of games from the point of view of information security management are characterized: maximin equilibrium, Nash equilibrium, Pareto-optimal situations, Stackelberg equilibrium. A formal description of the game model in conflict conditions and a mechanism for applying game theory to modeling decisions in conflict situations in security systems have been developed. The subject area of the game of the conflict situation is presented for each of the “subject-subject” levels: the level of the individual (criminal — user); business level (internal and/or external violator — company manager); state level (violators/hackers — state institutions, state officials); the level of international relations (states, a group of subjects/hackers — institutions and/or political leaders of another state). Specific scenarios for managing conflict situations in security systems using a game-theoretic approach are proposed. The results of the research can be used in the practice of solving conflict situations in organizations, serve for the development of software on this problem, and also as educational material for students of the specialty 125 Cybersecurity and information protection.

МОДЕЛЬ ИНТЕЛЛЕКТУАЛЬНОЙ ИНФОРМАЦИОННООБРАЗОВАТЕЛЬНОЙ СИСТЕМЫ ВОЕННОГО ВУЗА В УСЛОВИЯХ ЦИФРОВОЙ ТРАНСФОРМАЦИИ ОБРАЗОВАНИЯ

The article reveals the purpose, functions and components of the model of the intellectual information and educational system of the military university. Peculiarities of the components of the intellectual information and educational system providing its functioning are described: digital educational platform; training management and monitoring system; analytical system of training support; intellectual system, providing personalized training; cyber security system. Opportunities of intellectualization of training in the implementation of the model in the electronic environment of the university are presented.

MATHEMATICAL METHODS IN CYBERSECURITY: CATASTROPHE THEORY

The improvement of protection systems is based on the introduction and use of a mathematical apparatus. Ensuring the confidentiality, integrity and availability of information is an urgent and important problem in the modern world. Crisis processes are characteristic phenomena in security systems, so stochastic models cannot always describe their functioning and give a solution. An effective tool for solving this problem can be the use of dynamic models based on the provisions of catastrophe theory. This study is devoted to the analysis of modern approaches to the use of the basic provisions of catastrophe theory in cybersecurity systems. The work presents a brief historical view of the development of this theory and highlights the main definitions: bifurcations, attractors, catastrophes. Elementary catastrophes, their forms and features are characterized. A review of the literary sources of the use of catastrophe theory in information and cyber security was carried out. The analysis made it possible to single out that this theory has not yet been widely implemented, but there are point scientific developments in the process of detecting network anomalies in the cloud environment. The considered approaches to the application of catastrophe theory in information and cyber security can be used to train specialists in the specialty 125 Cybersecurity in the process of research

Digital empathy and supply chain cybersecurity challenges: concept, framework and solutions for small-medium enterprises

Despite contributing significantly to the world's economy and being the most targeted by cybercriminals for being the weakest link in the supply chain, small-medium enterprises (SMEs) lag behind cybersecurity implementation. The budget and expertise constraint hinders them from catching up with cybersecurity initiatives. This study explores the management concept of digital empathy and proposes a solution framework for SMEs to overcome cybersecurity challenges. We found that three drivers can be the solution to overcome the cybersecurity barrier within firms' internal context, such as adequate funding, management support, and attitude towards cybersecurity risk. Our theoretical framework has also included the digital empathy approach incorporating subscription-based solutions, modular solutions, and zero-trust architecture. In addition, we suggest that the supply chain's cybersecurity systems be regularly monitored and maintained to balance cybersecurity and affordability. Furthermore, to enable future scalability, SMEs must implement the zero-trust architecture, which acts as a foundation for self-healing and self-correcting supply chain networks.

Cyberattacks on healthcare systems

Cyberattacks on healthcare information systems have become more frequent in the last few years. The consequences are not only the collapse of a system and a financial damage, but also a direct threat to the patients' health and lives. The basic methods and techniques of stealing health data from end users of the internet and the use of stolen data to commit criminal acts are presented in this paper. Numerous cyberattacks on healthcare systems worldwide are reviewed and analyzed, with a focus on the COVID19 pandemic. In recent years, the international community has intensified its work on legal regulations and conventions and raising awareness concerning the cyber security of healthcare systems. Cyberattacks on healthcare systems are a global problem, and the solutions should be global, as well.

НЕЧІТКІ МНОЖИНИ ТИПУ-2 В ЗАДАЧАХ МОДЕЛЮВАННЯ ТА ОЦІНЮВАННЯ СТАНІВ КРИТИЧНИХ СИСТЕМ З НЕДОВИЗНАЧЕНИМИ ВХІДНИМИ ДАНИМИ ТА ВИКОРИСТАННЯМ ЕКСПЕРТІВ

A method of type-2 fuzzy sets implementation for critical systems’ modeling and state assessment tasks with uncertain input data is proposed. It is shown that the basis for solving the modeling task is designing of a fuzzy logic system with interval membership functions of type-2. The paper presents the task of further developing the process of estimating the interval output of a fuzzy system with experts involvement. An approach based on fuzzy sets is proposed for solving the task of critical systems’ modeling and states assessment. Using the example of energy grid systems, where a high degree of uncertainty is present, it is shown that the main factors that influence the appearance of uncertainty in the initial data set of such systems are caused by the lack of sufficient information in the open print and the high variability of threats under the influence of the growing pace of digitalization of business processes. An analysis of expert evaluations of the interval output of fuzzy systems based on examples of modeling complex objects in various fields of application is given. The first example demonstrates the results of modeling in the field of natural sciences with uncertain initial data for assessing the prospects of an artesian well, where the final assessment is made by an expert. The second example demonstrates the implementation of the interval fuzzy model in the task of social orientation, where the problem of recruiting personnel in social groups from the point of view of professional suitability is modeled. The third task refers to modeling in the field of medical diagnosis of diseases of the endocrine system. Evaluation by experts of the results of interval fuzzy modeling in this field makes it possible to determine the state of a person's disease for endocrine pathology and prescribe timely treatment. The given examples of evaluating the interval output of a fuzzy system, taking into account the opinion of experts, confirm the possibilities for making decisions that are adequate for the subject area in the conditions of uncertain input data. Prospects for the application of the proposed models for the problems of cyber security of critical systems are given.

PRE-PROJECT SOLUTIONS FOR BUILDING AN AUTHORIZATION SYSTEM BASED ON THE ZERO TRUST CONCEPT

This article describes the task of building effective solutions to increase the level of cyber security of state-level information systems in the conditions of weapons of aggression and powerful cyber attacks on critical infrastructure. A descriptive supplement to the security threat model has been developed, taking into account the concept of Zero Trust, and the threat model has been visualized, which allows you to determine the potential vulnerabilities of existing solutions regarding the construction of identification and access control subsystems. Requirements for contactless authentication hardware are defined. A functional diagram of the interaction of radio frequency identification components with passive electrical oscillating circuits has been built. A block diagram has been created algorithm of the identification system to the hardware authentication device. Defined functional and engineering solutions for the construction of contactless hardware authentication of clients during access to system devices. Grounded sketch decisions regarding the construction of a steganographic data exchange protocol in identification and access management procedures.

Resilient Load Frequency Control of Multi-Area Power Systems Under DoS Attacks

Cyber security of modern power systems has become increasingly significant due to their open communication architecture and expanding network connectivity exposed to malicious cyber attacks. Resilient control represents an effective means to preserve the survivability of the power system under cyber attacks. In this paper, we address the resilient load frequency control (LFC) design for multi-area power systems under a new class of time-constrained denial-of-service (DoS) attacks. First, different from the widely-explored duration- and frequency-constrained DoS attack models, we consider a general time-constrained DoS attack model where only the attack durations are confined into some bounds, which represents less a priori knowledge of an attacker’s actions. Second, instead of using a traditional yet conservative time-invariant Lyapunov function (TILF), we develop an attack-parameter-dependent time-varying Lyapunov function (TVLF) approach to enable a resilient LFC design without jeopardizing the desired closed-loop system stability and performance. Furthermore, we provide a formal stability and performance analysis condition as well as a design criterion for the desired DoS-resilient output feedback LFC controller. We also show that the minimum allowable sleeping period and the maximum allowable active period of the attacked LFC system can be explicitly disclosed. Finally, we present two simulation case studies on a two-area LFC system and a three-area LFC system to demonstrate the effectiveness of the obtained results.

Secure keys data distribution based user-storage-transit server authentication process model using mathematical post-quantum cryptography methodology

<abstract> <p>The central remote servers are essential for storing and processing data for cloud computing evaluation. However, traditional systems need to improve their ability to provide technical data security solutions. Many data security challenges and complexities await technical solutions in today's fast-growing technology. These complexities will not be resolved by combining all secure encryption techniques. Quantum computing efficiently evolves composite algorithms, allowing for natural advances in cyber security, forensics, artificial intelligence, and machine learning-based complex systems. It also demonstrates solutions to many challenging problems in cloud computing security. This study proposes a user-storage-transit-server authentication process model based on secure keys data distribution and mathematical post-quantum cryptography methodology. The post-quantum cryptography mathematical algorithm is used in this study to involve the quantum computing-based distribution of security keys. It provides security scenarios and technical options for securing data in transit, storage, user, and server modes. Post-quantum cryptography has defined and included the mathematical algorithm in generating the distributed security key and the data in transit, on-storage, and on-editing. It has involved reversible computations on many different numbers by super positioning the qubits to provide quantum services and other product-based cloud-online access used to process the end-user's artificial intelligence-based hardware service components. This study will help researchers and industry experts prepare specific scenarios for synchronizing data with medicine, finance, engineering, and banking cloud servers. The proposed methodology is implemented with single-tenant, multi-tenant, and cloud-tenant-level servers and a database server. This model is designed for four enterprises with 245 users, and it employs integration parity rules that are implemented using salting techniques. The experimental scenario considers the plain text size ranging from 24 to 8248 for analyzing secure key data distribution, key generation, encryption, and decryption time variations. The key generation and encryption time variations are 2.3233 ms to 8.7277 ms at quantum-level 1 and 0.0355 ms to 1.8491 ms at quantum-level 2. The key generation and decryption time variations are 2.1533 ms to 19.4799 ms at quantum-level 1 and 0.0525 ms to 3.3513 ms at quantum-level 2.</p> </abstract>

DETECTION OF NETWORK ANOMALIES WITH NEURAL NETWORKS ALGORITHMS

The rapid digitalization of the world has led to various attacks on computer systems and networks, so network security is an extremely important and relevant component of information security today. Creating effective cybersecurity tools and mechanisms is becoming increasingly difficult as the number of different devices and services grows. Identification of malicious traffic using deep learning methods has become a key component of intrusion detection systems (IDS). This article compares two deep learning models (recurrent neural network and convolutional neural network) for detecting anomalies in networks. Both neural networks were found to be useful in a wide range of applications. It has been shown that convolutional neural networks are best at detecting network anomalies in synergy with layers of long short-term memory. The development of deep learning technologies, including the considered neural network algorithms, is a promising direction in promoting the development of cybersecurity of information systems. These technologies are unique because they are at the initial stage of creation. The aforementioned technologies are currently not widespread in intrusion detection and network anomaly detection systems due to their novelty, so they require more thorough research. Conventional machine learning algorithms will eventually become insufficient, as they do not have such a good learning capability as deep learning neural networks do. The article provides a detailed analysis of the capabilities of recurrent and convolutional neural networks along with long short-term memory layers, which may be useful for use in further research.

An Online Approach to Covert Attack Detection and Identification in Power Systems

The development of information technology and digital control systems has posed an inevitable trend of interconnectivity and wirelessness of data communications in power systems. As a result, the cybersecurity of power systems has been raising concerns over the past decades. Yet the complexity of power systems and their conventional designs with local and wide area network communications has posed increasing vulnerability to cyberattacks. Among the types of cyberattacks, data integrity attacks can be more harmful to power systems, especially power transmission systems, through malicious manipulation of measurement and control data to cause damage to the physical system. As the sophistication of cyberattacks increases, certain cyberattacks can successfully bypass traditional intrusion detection systems, which calls for better design of detection schemes. On the other hand, in a large-scale network, attack identification for a power system is as important as attack detection. In this paper, we develop an online approach based on the Sparse Group Lasso to detect and identify the location of a typical type of data integrity attack named <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">covert attacks</i> on power transmission systems. We provide the theoretical foundation of the proposed method with a simplified linear system model and extend the method to nonlinear systems. We validate the performance of our method on both linear and nonlinear system settings with a comprehensive numerical study.

Artificial Intelligence in Smart Logistics Cyber-Physical Systems: State-of-The-Arts and Potential Applications

Logistics creates tremendous economic value through supporting the trading of goods between firms and customers, thereby improving the welfare of the society. In order to continuously improve the quality of logistics service, a great variety of cyber-physical techniques have been utilized in the modern logistics systems, which help tackle the grand challenges in multiple aspects including time efficiency, economic cost, safety risk and cyber-security. The fast development of artificial intelligence (AI) has gained significant popularity and success in various domains, and hence, it has been adopted to construct high-quality solutions that can facilitate the monitoring, operation and decision in logistics systems. Furthermore, the deployment of advanced sensoring and computing components forms a cyber-physical system (CPS) infrastructure, which promotes the capability and scalability on data acquisition, transmission, storage and processing, thereby enabling the further penetration of AI technologies. Based on the existing advances, this paper is devoted to conducting a comprehensive survey of the AI applications in the modern logistics CPSs. In specific, we focus on the AI-based research and industrial solutions that can improve the time/economic efficiency, safety and cyber-security of logistics systems. The potential applications of AI to tackle the remaining challenges are also discussed to investigate the way to continuously improving the quality of logistics service.