Cybersecurity Systems Research Articles

An Advanced Fitness Function Optimization Algorithm for Anomaly Intrusion Detection Using Feature Selection

Cyber-security systems collect information from multiple security sensors to detect network intrusions and their models. As attacks become more complex and security systems diversify, the data used by intrusion-detection systems becomes more dimensional and large-scale. Intrusion detection based on intelligent anomaly detection detects attacks based on machine-learning classification models, soft computing, and rule sets. Feature-selection methods are used for efficient intrusion detection and solving high-dimensional problems. Optimized feature selection can maximize the detection model performance; thus, a fitness function design is required. We proposed an optimization algorithm-based feature-selection algorithm to improve anomaly-detection performance. We used a genetic algorithm and proposed an advanced fitness function that finds the most relevant feature set, increasing the detection rate, reducing the error rate, and enhancing analysis speed. An improved fitness function for the selection of optimized features is proposed; this function can address overfitting by solving the problem of anomaly-detection performance from imbalanced security datasets. The proposed algorithm outperformed other feature-selection algorithms. It outperformed the PCA and wrapper-DR methods, with 0.99564 at 10%, 0.996455 at 15%, and 0.996679 at 20%. It performed higher than wrapper-DR by 0.95% and PCA by 3.76%, showing higher differences in performance than in detection rates.

Training Needs of Information Specialists at Saudi Universities Libraries to Achieve Cybersecurity Requirements

This study aimed to determine the cybersecurity degree of awareness among information specialists in Saudi university libraries, their required competencies, the vital training needs, and statistically significant differences in cybersecurity awareness among information specialists according to gender, years of experience, and the number of training courses. The researcher used the descriptive analytical method on a sample of male and female university librarians in Saudi libraries. The sample consisted of 200 information specialists from Saudi universities. The questionnaire included six axes: awareness of cybersecurity among information specialists, cybersecurity systems and methods for information professionals in Saudi university libraries, the necessary cybersecurity competencies for information specialists in Saudi universities, the requirements for achieving cybersecurity, and the training needs for information specialists to achieve cybersecurity. A high degree of relative cybersecurity awareness among information specialists at Saudi universities’ libraries was found. Statistically, there were significant differences in gender, years of experience, and training courses.

The Role of Nato in Enhancing Ukraine's Cybersecurity during Times of Conflict

This study aims to analyze the impact of NATO support on Ukraine which is in a conflict situation with Russia. Ukraine has taken a step forward to strengthen its ties with NATO by signing an agreement to formalize its participation in the security alliance's Joint Center for Advanced Technologies in Cyber Defense (CCDCOE). This study will discover how this action will affect the tensions in the Cyber Security System between Ukraine and Russia. In order to find the answer, it is necessary to identify the motives by using qualitative research design through secondary sources in the form of official state documents and secondary sources in the form of journals, dissertations and related research. The result of this study conluded NATO’s involvement in the cyber war between UkraineRussia is quite substantial and greatly influenced the course of the war, this is what motivated the researcher to conduct further studies and see what influences were given., regardless of the difficult to collect the information. This study might help us understand the situation of Cyber Conflict between Ukraine-Russia and predicts the potential consequences from this action, and hopefully give us more informations to analyze and evaluate to find the best solution of this existing conflict.

Holistic Approach to Ensuring Safety and Cybersecurity in the Use of Intelligent Technologies in Air Transport

The article is devoted to the study and analysis of the problems associated with the use of intelligent technologies in air transport security and cybersecurity issues. Possible dangers that may arise when using autonomous systems, including autonomous aircraft, are considered. The technical measures that can be taken to prevent these dangers, including the development of new methods of cybersecurity and protection against hacker attacks, are analyzed. The problem of ensuring security in air transport associated with the introduction of new technologies and automated systems is investigated. The risks associated with this process are described, such as possible aircraft accidents, data storage problems, and passenger safety issues. Technical measures that can be taken to ensure safety in air transport, including the development of new technologies and diagnostic methods that can detect possible problems before they become serious, are considered. Practical solutions to these problems are proposed, including the development of new security and cybersecurity systems that can be used in air transport. The technical measures that can be taken to ensure the safety and efficiency of the use of intelligent technologies in air transport are described. It is established that the developed simulation model can serve as an effective tool for managing the processes of aircraft ground handling at the airport, as well as allow predicting the results of such processes and developing algorithms for the rational allocation of resources, considering the functioning of the system in different modes. To ensure the efficient functioning of the aircraft ground handling system, it is proposed to implement technical measures to improve cybersecurity and ensure the system's resilience to possible cyberattacks.

Cyber Security System Based on Machine Learning Using Logistic Decision Support Vector

Nowadays, we are moving towards cybersecurity against digital attacks to protect systems, networks, and data in developing areas. A collection of technologies and processes is at the core of cybersecurity. A network security system is a feature of network and computer (host) security. Cybercrime leads to billion-dollar losses. Given these crimes, the security of computer systems has become essential to reduce and avoid the impact of cybercrime. We propose the Logistics Decision Support Vector (LDSV) algorithm dealing with this problem. Initially, we collected the KDD Cup 99 dataset to create a network intrusion detection, such as penetrations or attacks, a prognosis model that varies between the "Non Malicious" and "Malicious" standard links. These method finds the cyber-attack category based on the behavior features. In the second step, data preprocessing should be cleaned from errors, and raw data should be converted into a prepared dataset. The third step is Feature Selection (FS) techniques often improve the feature selection process in an Intrusion Detection System (IDS) that is more convenient for using the mean of the Chi-square test (MAC) method. Finally, a classification is done to classify and detect the network intrusion detection based on LDSV for Cyber security. The proposed LDSV simulation is based on the Precision F-Measure, Recall, and Accuracy for the best result.

Cyber-physical Shooting Gallery

While much has been written on the dire need for workers who understand both the IT and OT core concepts necessary to protect the cyber-physical systems of critical infrastructure, practical and specific recommendations for how to meet this need through education and workforce training are lacking. Many of the available programs for teaching cybersecurity of physical systems rely on virtual simulations and students may not encounter relevant physical equipment until they are in the workplace. RADICL’s Cyber-physical Shooting Gallery is a critical missing piece toward a comprehensive system to develop the competent workforce the nation needs. Through a series of cyber-physical capture-the-flag challenges that integrate the Purdue ICS Model with the MITRE ATT&CK framework, the Cyber-physical Shooting Gallery provides an accessible educational model for cyber-physical security education and training.

RADICL CTF

To address the nationwide workforce shortage of skilled and educated cyber-informed engineers, we must develop low-cost and highly effective resources for industrial control systems education and training. College curricula in technology management, cybersecurity, and computer science aim to build students’ computational and adversarial thinking abilities but are often done only through theory and abstracted concepts [1]. To better a student’s understanding of industrial control system applications, post-secondary institutions can use gamification to increase student interest through an interactive, user-friendly, hands-on experience. RADICL CTF can provide post-secondary institutions with new opportunities for low-cost, guided exercises for industrial control system (ICS) education to help students master adversarial thinking. Based on an extension to picoCTF, RADICL CTF is a platform for students to design, implement and evaluate exercises that test their understanding of core concepts in industrial control systems cybersecurity, answering the need for more interactive education methods. The main contributions of this paper are the improvement of the cyber-security curriculum through extending the picoCTF platform to promote the gamification of industrial control system concepts with consideration to the Purdue Reference Architecture.

An efficient cyber security system based on flow-based anomaly detection using Artificial neural network

Cyber security is developing factor for protecting internet resources by handing various monitoring feature based support to improve the security. Increasing internet cries in the defined facts for need of advance met in cyber security. Most internet attacker’s theft the information through malicious activities, false data injection, hacking and make soon creating procedures. In most cases cyber sercuity failed to detect the malicious activities because the monitoring feature analyses improper to predict the result in previous machine learning algorithms. TO resolve this problem to propose an advance cyber security based on flow-based anomaly detection using Min max game theory optimized artificial neural network (MMGT-ANN). The reprocessing was carried out with KDD crime dataset. Then Data driven network model is applied to monitor the feature margins and defect scaling rate. Based on the feature scaling rate Transmission Flow defect rate is estimated and applied with Min max Game theory to select the feature limits. Then features are trained with optimized ANN to detect the crime rate. By the attention of the proposed system achieves higher performance in precision rate to attain higher detection accuracy with lower time complexity compared to the other system.

Controller Cyber-Attack Detection and Isolation

This article deals with the cyber security of industrial control systems. Methods for detecting and isolating process faults and cyber-attacks, consisting of elementary actions named "cybernetic faults" that penetrate the control system and destructively affect its operation, are analysed. FDI fault detection and isolation methods and the assessment of control loop performance methods developed in the automation community are used to diagnose these anomalies. An integration of both approaches is proposed, which consists of checking the correct functioning of the control algorithm based on its model and tracking changes in the values of selected control loop performance indicators to supervise the control circuit. A binary diagnostic matrix was used to isolate anomalies. The presented approach requires only standard operating data (process variable (PV), setpoint (SP), and control signal (CV). The proposed concept was tested using the example of a control system for superheaters in a steam line of a power unit boiler. Cyber-attacks targeting other parts of the process were also included in the study to test the proposed approach's applicability, effectiveness, and limitations and identify further research directions.

International Perspective on Securing Cyberspace Against Terrorist Acts

This research reviews the legal framework for protecting the security of cyberspace from terrorist acts, using the following approaches: the legal approach, the descriptive approach, and the analytical approach. This is achieved by gathering knowledge and data on the protection of cybersecurity and analyzing the different tools and methods that terrorist organizations use to implement their cybercrimes. The goal is to find ways to overcome the various challenges that terrorists pose to regional (Arab-wide) and international cybersecurity systems to find mechanisms and solutions to deal with this phenomenon effectively and to reduce its increasing risks to people and the security, stability, and economies of nations. The most significant conclusion that was reached is the need to continue international efforts to strengthen the fight against cyberterrorism and to establish a binding legal treaty in this regard so as to prevent further harm to the safety of the international community.

A Robust Stackelberg Game for Cyber-Security Investment in Networked Control Systems

We present a resource-planning game for cyber-security of networked control systems (NCSs). The NCS is assumed to be operating in closed loop using a linear state feedback <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\mathcal {H}_{2}$ </tex-math></inline-formula> -controller. A zero-sum, two-player Stackelberg game (SG) is developed between an attacker and a defender for this NCS. The attacker aims to disable communication of selected nodes and thereby render the feedback gain matrix to be sparse, leading to degradation of closed-loop performance, while the defender aims to prevent this loss by investing in the protection of targeted nodes. Both the players trade their <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\mathcal {H}_{2}$ </tex-math></inline-formula> -performance objectives for the costs of their actions. The standard backward induction (BI) method is modified to determine a cost-based Stackelberg equilibrium (CBSE) that saves the players’ costs without degrading the control performance. We analyze the dependence of a CBSE on the relative budgets of the players and on the node “importance” order. Moreover, a robust defense (RD) method is developed for the realistic case when the defender is not informed about the attacker’s resources. The proposed algorithms are validated using examples from wide-area control of electric power systems. It is demonstrated that reliable and RD is feasible unless the defender’s resources are severely limited relative to the attacker’s resources. We also show that the proposed methods are robust to time-varying model uncertainties and thus are suitable for long-term security investment in realistic NCSs. Finally, we use computationally efficient genetic algorithms (GAs) to compute the optimal strategies of the attacker and the defender in realistic large power systems.

Detection of Cyber Attacks in Network Using ML

Cybercrime is on the rise everywhere and takes advantage of different flaws in the computing environment. Paying ethical hackers boosted their focus on finding flaws and suggesting solutions. Due to machine learning's success in solving problems related to cyber security, it has recently become a topic of significant relevance. Major concerns in cyber security, such as intrusion detection, malware categorization, and detection, have been addressed using machine learning approaches. Although though it cannot fully automate a cyber security system, machine learning may be able to identify cyber security threats more effectively than other software-oriented approaches, which lessens the stress on security analysts. In this research, we suggest using a machine learning model to identify the network attack. To obtain reliable predictions, some machine learning approaches, such as Random Forest, SVM, Gradient Boosting have been applied. The dataset CSE-CIC-IDS2018 was used to train the model. As a result, efficient adaptive techniques, including different machine learning algorithms, can increase detection rates. The basic objective is to ascertain whether the network is being attacked. Random Forest gave highest accuracy of 99.99%.

PLC Cybersecurity Test Platform Establishment and Cyberattack Practice

Programming logic controllers (PLCs) are vital components for conveyors in production lines, and the sensors and actuators controlled underneath the PLCs represent critical points in the manufacturing process. Attacks targeting the exploitation of PLC vulnerabilities have been on the rise recently. In this study, a PLC test platform aims to analyze the vulnerabilities of a typical industrial setup and perform cyberattack exercises to review the system cybersecurity challenges. The PLC test platform is a sorting machine consisting of an automatic conveyor belt, two Mitsubishi FX5U-32M PLCs, and accessories for material sorting, and Modbus is the selected protocol for data communication. The O.S. on the attacker is Kali ver. 2022.3, runs Nmap and Metasploit to exploit the target Modbus registers. On the other hand, the target host runs the O.S., Ubuntu 22.04 in the cyberattack exercises. The selected attack method for this study is packet reply which can halt operations sending custom data packets to the PLC. In summary, this study provides a basic step-by-step offensive strategy targeting register modification, and the testbed represents a typical industrial environment and its vulnerabilities against cyberattacks with common open-source tools.

An Intelligent Multi-Stage Model for Countering the Impact of Disinformation on the Cybersecurity System

An Intelligent Multi-Stage Model for Countering the Impact of Disinformation on the Cybersecurity System

An Automated Post-Exploitation Model for Cyber Red Teaming

Red teaming is a well-established methodology for ensuring and augmenting cyber system security; however, the training, expertise, and knowledge of appropriate tools and techniques required to perform effective red teaming come with a significant cost in time and resources. Large organizations such as the Department of Defense (DOD) use vulnerability assessment to identify software patches and other remediations for cyber systems to mitigate cyberspace exploitation. If a patch cannot be applied in a timely manner, for instance to minimize network downtime, measuring and identifying the impact of such unpatched vulnerabilities is left to scarce red teaming services. These services typically concentrate on initial access exploitation, which stops short of exploring the larger security impacts of cyber threats performing post-exploitation actions. This gap in post-exploitation red team analysis results in increased susceptibility to adversary offensive cyberspace operations (OCO) against DOD systems. This research extends the Cyber Automated Red Team Tool (CARTT), developed at the Naval Postgraduate School, by implementing automated red team post-exploitation analysis. The intent of this extended capability is to reduce the workload on limited DOD red teams and penetration testers by providing system administrators with the ability to perform deeper system analysis for the impacts of exploited vulnerabilities.

A Review and Testing of Fault Tolerance Levels of Anti-Poaching Cybersecurity System

The development of anti-poaching networks and systems has created a new environment for animals in game reserves all over the world. Advanced technologies such as heat sensors, drones, and trip wires help prevent poachers from entering the property and therefore, creating a safer environment for animals to roam freely. Radio frequency identification (RFID) systems are used to track the location of animals. These networks are, however, susceptible to being hacked if not properly protected with cybersecurity tools, resulting in cyber-criminals gaining access into the network. Many attacks or threats can be executed on the RFID network due to some exposed vulnerabilities of elements within the anti-poaching network. The purpose of this paper is to explore the empirical methods of common attacks, used by cyber-criminals, to attack the anti-poaching network, and whether these methods used are effective in identifying weaknesses within the network. This will be executed by creating an experimental structure of the anti-poaching system with a specialised focus on the RFID elements, using quantitative research methods to produce findings. GNS3, an open-source software application that has specifically been chosen to conduct this research, is used to build the network simulation in order to analyse the weaknesses of the network. Cybersecurity protocols are implemented to protect the network and aim to protect the animals. The attacks performed, such as Flood and Scapy attacks, have shown that the anti-poaching network is vulnerable to penetration from cyber-criminals. A hypothesis test was conducted to determine whether the attacks had a significant effect on the network, by using the average ping time from specific nodes to Google. It was found that the average ping time increased by 2.0020 units, therefore stating that the elements of the network were successfully attacked. The fault tolerance test shows that the availability of the anti-poaching network is roughly 90 percent which concludes that the network is configured to deliver quality performance and handle failures, should there be any intervention. This will allow game reserves to implement and have information on a better and safer RFID system for the animals.

The Polish Financial Supervision Authority in the national cybersecurity system

The Polish Financial Supervision Authority in the national cybersecurity system

Detection of Cyber Attacks and Network Attacks Using Machine Learning Algorithms

Now a days cyber crime growing and has a big effect everywhere globally. ethical hackers are normally involved in identifying flaws and recommending mitigation measures. the cyber safety international, there's a pressing need for the improvement of powerful techniques. Because of the effectiveness of machine learning in cyber security issues, machine learning for cyber security has recently become a hot topic. In cyber security, machine learning approaches have been utilized to handle important concerns such as intrusion detection, malware classification and detection, spam detection, and phishing detection. Although ML cannot fully automate a cyber-security system, it can identify cyber-security threats more efficiently than other software-oriented approaches, relieving security analysts of their burden. As a result, effective adaptive methods, such as machine learning techniques, can yield higher detection rates, lower false alarm rates, and cheaper computing and transmission costs. Our key goal is that the challenge of detecting attacks is fundamentally different from those of these other applications, making it substantially more difficult for the intrusion detection community to apply machine learning effectively. In this study, the CPS is modeled as a network of agents that move in unison with one another, with one agent acting as a leader and commanding the other agents. The proposed strategy in this study is to employ the structure of deep neural networks for the detection phase, which should tell the system of the attack's existence in the early stages of the attack. The use of robust control algorithms in the network to isolate the misbehaving agent in the leader-follower mechanism has been researched. Following the attack detection phase with a deep neural network, the control system uses the reputation algorithm to isolate the misbehaving agent in the presented control method. Experiment results show that deep learning algorithms can detect attacks more effectively than traditional methods, making cyber security simpler, more proactive, and less expensive and more expensive.

The inverse problem of Q-analysis of complex systems structure in cyber security

&#x0D; &#x0D; &#x0D; It is considered the inverse problem of Q-analysis. In the course of the research, an algorithm for the recovery of simplicial complexes from elementary simplex using local maps and a structural tree was developed. This algorithm will reduce the amount of data stored and improve the management process if the simplicial complex describes a real big complex system wich it can imagine cyber security system.&#x0D; &#x0D; &#x0D;

Review of Cybersecurity Analysis in Smart Distribution Systems and Future Directions for Using Unsupervised Learning Methods for Cyber Detection

In a physical microgrid system, equipment failures, manual misbehavior of equipment, and power quality can be affected by intentional cyberattacks, made more dangerous by the widespread use of established communication networks via sensors. This paper comprehensively reviews smart grid challenges on cyber-physical and cyber security systems, standard protocols, communication, and sensor technology. Existing supervised learning-based Machine Learning (ML) methods for identifying cyberattacks in smart grids mostly rely on instances of both normal and attack events for training. Additionally, for supervised learning to be effective, the training dataset must contain representative examples of various attack situations having different patterns, which is challenging. Therefore, we reviewed a novel Data Mining (DM) approach based on unsupervised rules for identifying False Data Injection Cyber Attacks (FDIA) in smart grids using Phasor Measurement Unit (PMU) data. The unsupervised algorithm is excellent for discovering unidentified assault events since it only uses examples of typical events to train the detection models. The datasets used in our study, which looked at some well-known unsupervised detection methods, helped us assess the performances of different methods. The performance comparison with popular unsupervised algorithms is better at finding attack events if compared with supervised and Deep Learning (DL) algorithms.