Cyber Warfare Research Articles

The role of cyber intelligence in policing cybercrime in South Africa: Insights from law enforcement officers

ABSTRACT The rapid increase of technology and the sophistication in which it is used to obtain and manipulate information presents fertile ground for cybercriminals. Thus, the consequent increase of cybercrime in South Africa poses a threat to individuals, government, businesses, and security agencies; ultimately causing extensive financial losses to the economy. The huge preventive cost incurred by putting in place stringent preventative measures, affect the financial status of individuals and threatens the sustainability of many companies. This study aimed to examine the policing of cybercrime in South Africa by analysing the experiences of police officers who are involved in the policing of this crime. It focussed on the use of cyber intelligence and cybersecurity measures for monitoring, preventing, and combating cybercrime. An empirical study was conducted in five selected provinces of South Africa, and Tesch’s data analysis method was used. The findings indicate the challenges that investigators encounter in obtaining credible digital evidence such as the frequent expiry of digital forensic licences. These challenges are compounded by victims’ unwillingness to testify due to the fear of losing their clients, and the need to protect the reputation of their companies.

What we mean

In the twenty-first century, cyberspace and the ‘real world’ have become inseparable. The stability and security of cyberspace therefore affect, in increasingly profound ways, the economies, international reputations, national security, military capabilities and global influence of states. In their short history, operations in cyberspace have already been used extensively by states and their non-state supporters for many purposes. They are an inevitable aspect of contemporary international affairs while carrying significant risk. In this Adelphi book, Marcus Willett, a former deputy head of GCHQ, argues that there is no coherent or widely shared understanding of what cyber operations really are, how they are used and what they can do; or of their implications for strategic affairs and international law; or what their ‘responsible’ use really entails. The myths and misunderstandings that abound tend to dull the conceptual clarity needed by strategic policymakers and overseers, and they complicate the essential task in a liberal democracy of maintaining public consent for, and legitimisation of, the development and use of such capabilities. The book sheds light on these issues, exposing myths and clarifying misunderstandings.

The future

In the twenty-first century, cyberspace and the ‘real world’ have become inseparable. The stability and security of cyberspace therefore affect, in increasingly profound ways, the economies, international reputations, national security, military capabilities and global influence of states. In their short history, operations in cyberspace have already been used extensively by states and their non-state supporters for many purposes. They are an inevitable aspect of contemporary international affairs while carrying significant risk. In this Adelphi book, Marcus Willett, a former deputy head of GCHQ, argues that there is no coherent or widely shared understanding of what cyber operations really are, how they are used and what they can do; or of their implications for strategic affairs and international law; or what their ‘responsible’ use really entails. The myths and misunderstandings that abound tend to dull the conceptual clarity needed by strategic policymakers and overseers, and they complicate the essential task in a liberal democracy of maintaining public consent for, and legitimisation of, the development and use of such capabilities. The book sheds light on these issues, exposing myths and clarifying misunderstandings.

The strategic utility of cyber operations

In the twenty-first century, cyberspace and the ‘real world’ have become inseparable. The stability and security of cyberspace therefore affect, in increasingly profound ways, the economies, international reputations, national security, military capabilities and global influence of states. In their short history, operations in cyberspace have already been used extensively by states and their non-state supporters for many purposes. They are an inevitable aspect of contemporary international affairs while carrying significant risk. In this Adelphi book, Marcus Willett, a former deputy head of GCHQ, argues that there is no coherent or widely shared understanding of what cyber operations really are, how they are used and what they can do; or of their implications for strategic affairs and international law; or what their ‘responsible’ use really entails. The myths and misunderstandings that abound tend to dull the conceptual clarity needed by strategic policymakers and overseers, and they complicate the essential task in a liberal democracy of maintaining public consent for, and legitimisation of, the development and use of such capabilities. The book sheds light on these issues, exposing myths and clarifying misunderstandings.

The cyber dimension of the Russia–Ukraine war

In the twenty-first century, cyberspace and the ‘real world’ have become inseparable. The stability and security of cyberspace therefore affect, in increasingly profound ways, the economies, international reputations, national security, military capabilities and global influence of states. In their short history, operations in cyberspace have already been used extensively by states and their non-state supporters for many purposes. They are an inevitable aspect of contemporary international affairs while carrying significant risk. In this Adelphi book, Marcus Willett, a former deputy head of GCHQ, argues that there is no coherent or widely shared understanding of what cyber operations really are, how they are used and what they can do; or of their implications for strategic affairs and international law; or what their ‘responsible’ use really entails. The myths and misunderstandings that abound tend to dull the conceptual clarity needed by strategic policymakers and overseers, and they complicate the essential task in a liberal democracy of maintaining public consent for, and legitimisation of, the development and use of such capabilities. The book sheds light on these issues, exposing myths and clarifying misunderstandings.

Responsible cyber power

In the twenty-first century, cyberspace and the ‘real world’ have become inseparable. The stability and security of cyberspace therefore affect, in increasingly profound ways, the economies, international reputations, national security, military capabilities and global influence of states. In their short history, operations in cyberspace have already been used extensively by states and their non-state supporters for many purposes. They are an inevitable aspect of contemporary international affairs while carrying significant risk. In this Adelphi book, Marcus Willett, a former deputy head of GCHQ, argues that there is no coherent or widely shared understanding of what cyber operations really are, how they are used and what they can do; or of their implications for strategic affairs and international law; or what their ‘responsible’ use really entails. The myths and misunderstandings that abound tend to dull the conceptual clarity needed by strategic policymakers and overseers, and they complicate the essential task in a liberal democracy of maintaining public consent for, and legitimisation of, the development and use of such capabilities. The book sheds light on these issues, exposing myths and clarifying misunderstandings.

A short history of cyber operations

In the twenty-first century, cyberspace and the ‘real world’ have become inseparable. The stability and security of cyberspace therefore affect, in increasingly profound ways, the economies, international reputations, national security, military capabilities and global influence of states. In their short history, operations in cyberspace have already been used extensively by states and their non-state supporters for many purposes. They are an inevitable aspect of contemporary international affairs while carrying significant risk. In this Adelphi book, Marcus Willett, a former deputy head of GCHQ, argues that there is no coherent or widely shared understanding of what cyber operations really are, how they are used and what they can do; or of their implications for strategic affairs and international law; or what their ‘responsible’ use really entails. The myths and misunderstandings that abound tend to dull the conceptual clarity needed by strategic policymakers and overseers, and they complicate the essential task in a liberal democracy of maintaining public consent for, and legitimisation of, the development and use of such capabilities. The book sheds light on these issues, exposing myths and clarifying misunderstandings.

Strategic risks

In the twenty-first century, cyberspace and the ‘real world’ have become inseparable. The stability and security of cyberspace therefore affect, in increasingly profound ways, the economies, international reputations, national security, military capabilities and global influence of states. In their short history, operations in cyberspace have already been used extensively by states and their non-state supporters for many purposes. They are an inevitable aspect of contemporary international affairs while carrying significant risk. In this Adelphi book, Marcus Willett, a former deputy head of GCHQ, argues that there is no coherent or widely shared understanding of what cyber operations really are, how they are used and what they can do; or of their implications for strategic affairs and international law; or what their ‘responsible’ use really entails. The myths and misunderstandings that abound tend to dull the conceptual clarity needed by strategic policymakers and overseers, and they complicate the essential task in a liberal democracy of maintaining public consent for, and legitimisation of, the development and use of such capabilities. The book sheds light on these issues, exposing myths and clarifying misunderstandings.

Maintaining balance

In the twenty-first century, cyberspace and the ‘real world’ have become inseparable. The stability and security of cyberspace therefore affect, in increasingly profound ways, the economies, international reputations, national security, military capabilities and global influence of states. In their short history, operations in cyberspace have already been used extensively by states and their non-state supporters for many purposes. They are an inevitable aspect of contemporary international affairs while carrying significant risk. In this Adelphi book, Marcus Willett, a former deputy head of GCHQ, argues that there is no coherent or widely shared understanding of what cyber operations really are, how they are used and what they can do; or of their implications for strategic affairs and international law; or what their ‘responsible’ use really entails. The myths and misunderstandings that abound tend to dull the conceptual clarity needed by strategic policymakers and overseers, and they complicate the essential task in a liberal democracy of maintaining public consent for, and legitimisation of, the development and use of such capabilities. The book sheds light on these issues, exposing myths and clarifying misunderstandings.

The UK model

In the twenty-first century, cyberspace and the ‘real world’ have become inseparable. The stability and security of cyberspace therefore affect, in increasingly profound ways, the economies, international reputations, national security, military capabilities and global influence of states. In their short history, operations in cyberspace have already been used extensively by states and their non-state supporters for many purposes. They are an inevitable aspect of contemporary international affairs while carrying significant risk. In this Adelphi book, Marcus Willett, a former deputy head of GCHQ, argues that there is no coherent or widely shared understanding of what cyber operations really are, how they are used and what they can do; or of their implications for strategic affairs and international law; or what their ‘responsible’ use really entails. The myths and misunderstandings that abound tend to dull the conceptual clarity needed by strategic policymakers and overseers, and they complicate the essential task in a liberal democracy of maintaining public consent for, and legitimisation of, the development and use of such capabilities. The book sheds light on these issues, exposing myths and clarifying misunderstandings.

Attacking the issue

In the twenty-first century, cyberspace and the ‘real world’ have become inseparable. The stability and security of cyberspace therefore affect, in increasingly profound ways, the economies, international reputations, national security, military capabilities and global influence of states. In their short history, operations in cyberspace have already been used extensively by states and their non-state supporters for many purposes. They are an inevitable aspect of contemporary international affairs while carrying significant risk. In this Adelphi book, Marcus Willett, a former deputy head of GCHQ, argues that there is no coherent or widely shared understanding of what cyber operations really are, how they are used and what they can do; or of their implications for strategic affairs and international law; or what their ‘responsible’ use really entails. The myths and misunderstandings that abound tend to dull the conceptual clarity needed by strategic policymakers and overseers, and they complicate the essential task in a liberal democracy of maintaining public consent for, and legitimisation of, the development and use of such capabilities. The book sheds light on these issues, exposing myths and clarifying misunderstandings.

On Interdicting Dense Clusters in a Network

Given a vertex-weighted undirected graph with blocking costs of its vertices and edges, we seek a minimum cost subset of vertices and edges to block such that the weight of any γ-quasi-clique in the interdicted graph is at most some predefined threshold parameter. The value of [Formula: see text] specifies the edge density of cohesive vertex groups of interest in the network. The considered weighted γ-quasi-clique interdiction problem can be viewed as a natural generalization of several variations of the clique blocker problem previously studied in the literature. From the application perspective, this setting is primarily motivated by the problem of disrupting adversarial (“dark”) networks (e.g., social or communication networks), where γ-quasi-cliques represent “tightly knit” groups of adversaries that we aim to dismantle. We first address the theoretical computational complexity of the problem. We then exploit some basic characterization of its feasible solutions to derive a linear integer programming (IP) formulation. This linear IP model can be solved using a lazy-fashioned branch-and-cut scheme. We also propose a combinatorial branch-and-bound algorithm for solving this problem. The computational performance of the developed exact solution schemes is studied using a test bed of randomly generated and real-life networks. Finally, some interesting insights and observations are also provided using a well-known example of a terrorist network. History: Accepted by Russel Bent, Area Editor for Network Optimization: Algorithms & Applications. Funding: The work of S. Butenko was partially supported by the Air Force Office of Scientific Research under Award FA9550-23-1-0300. The work of O. A. Prokopyev was partially supported by the Office of Naval Research under Award ONR N00014-22-1-2678. Supplemental Material: The software that supports the findings of this study is available within the paper and its Supplemental Information ( https://pubsonline.informs.org/doi/suppl/10.1287/ijoc.2023.0027 ) as well as from the IJOC GitHub software repository ( https://github.com/INFORMSJoC/2023.0027 ). The complete IJOC Software and Data Repository is available at https://informsjoc.github.io/ . The online appendix is available at https://doi.org/10.1287/ijoc.2023.0027 .

A Multi-level Reference Model and a Dedicated Method for Cyber-Security by Design

AbstractThe increased reliance of organizations on information technology inherently increases their vulnerability to cyber-security attacks. As a response, a host of cyber-security approaches exists. While useful, these approaches exhibit shortcomings such as an inclination to be fragmented, not accounting for up-to-date organizational data, focusing on singular vulnerabilities only, and being reactive, i.e., focusing on patching up vulnerabilities in current systems. The paper presents and evaluates a modeling method aiming to address those shortcomings and to support security by design with a focus on the electricity sector. The proposed modeling method encompasses a multi-level reference model reconstructing and integrating existing initiatives and supporting top-down and bottom-up analyses. Compared to earlier work, the paper contributes (1) a process model for cyber-security by design, which proactively considers security as a first-class citizen during the design process, (2) a complete coverage of the multi-level model, in terms of three views complementing the introduced process model, (3) an elaborated evaluation, in terms of reporting on an additional design science cycle.

Cybersecurity and the Future of International Relations

This research examines the growing influence of cybersecurity on international relations, focusing on how cyber threats, digital espionage, and cyber warfare are transforming state sovereignty, diplomacy, and global security. With the rise of state-sponsored cyberattacks and the increasing involvement of non-state actors, cybersecurity has become a central issue in the global power dynamics between major nation-states and international organizations. The study analyzes high-profile cyber incidents, such as the SolarWinds and Stuxnet attacks, and investigates their geopolitical implications, including how they have reshaped cyber norms and governance strategies. Through a comparative analysis of national cybersecurity strategies in countries like the U.S., China, and the EU, this research assesses the effectiveness of current international treaties, such as the Budapest Convention on Cybercrime, and multilateral efforts to establish cybersecurity norms. Preliminary findings suggest that cybersecurity has evolved into a strategic tool in global competition, with cyberattacks being used for coercion and disruption. Moreover, the rise of cyber espionage has heightened the stakes in digital diplomacy, leading to the establishment of specialized cyber units within foreign ministries. This study advocates for the development of comprehensive international treaties focused on cyber governance, with an emphasis on conflict prevention, cyber deterrence, and collective defense mechanisms. Additionally, it calls for greater involvement of multilateral organizations, such as the United Nations and NATO, in creating transparent and accountable frameworks for state-sponsored cyber activities. The research underscores the urgent need for cohesive global governance models to address the complex challenges posed by cybersecurity in shaping the future of international relations.

Cybersecurity Transformation: Cyber-Resilient IT Project Management Framework

In response to the escalating threats of cybersecurity attacks and breaches, ensuring the development and deployment of secure IT products has become paramount for organizations in their cybersecurity transformation. This work emphasizes the critical need for a comprehensive and secure IT project management life cycle that safeguards products from their initial development stages through decommissioning. The primary objective is to seamlessly integrate security considerations into every facet of IT project management life cycles. This work embraces a cyber-resilient IT project management framework and advocates the inclusion of cybersecurity measures in IT projects and their strategic, organized, continuous, and systematic integration throughout the entire product life cycle. It introduces a pioneering framework that harmonizes the cybersecurity risk management process with the IT project management life cycle. This framework delineates a methodical sequence of steps, each encompassing a distinct set of activities. The effectiveness and practical applicability of the proposed framework were validated through a comprehensive case study focused on the Personal Health Record (PHR) system. The PHR case study served as a real-world scenario to assess the framework’s ability to address cybersecurity challenges in a specific domain. The results of the experiment demonstrated the framework’s efficacy in enhancing the security posture of IT projects, showcasing its adaptability and scalability across diverse applications.

International Legal Guiding Principles for State Activity in Cyberspace

The rapid development of information technologies and the emergence of cyberspace as a new domain of state activity raises critical questions regarding the regulation of state actions within this space under international law. It is evident that international law applies to cyberspace; any contrary approach would create a legal vacuum, implying that states lack international legal obligations related to cyberspace and undermining state sovereignty in this new realm. Given that states are the primary subjects of international law, denying their applicability to cyberspace is existentially untenable. Despite the clear applicability of international legal principles to cyberspace, international law, like law in general, is often rigid and fails to keep pace with rapid technological advancements. Consequently, a key challenge in the international legal regulation of cyberspace is the specific application of international law in these contexts. This leads to several fundamental questions: How do the fundamental principles of international law apply to cyberspace? What is the effect of sovereignty in cyberspace? How are cyber operations attributed to the state? How is cyber-armed conflict regulated? This article addresses these fundamental issues of international legal regulation in cyberspace. Based on the findings of this research, draft guiding principles for state activity in cyberspace were proposed, which could serve as the foundation for an international methodological document, offering an alternative to the unrepresentative Tallinn Manual and potentially paving the way for a future universal international treaty in this area.

Cybersecurity in Prognostics and Health Management

PHM continues to show its value by improving operational efficiencies, increasing safety, reducing downtime, and decreasing cost of operations. PHM technologies are therefore not only being deployed as retrofit solutions but are being integrated into new systems as standard practice. Deployment covers areas such as medical equipment, nuclear power plants, aeronautics applications, oil and gas, mining, and many others. As the impact of PHM increases, it is imperative to also consider the potential vulnerabilities that are being exposed. Hackers have famously used Supervisory Control and Data Acquisition (SCADA) and Programmable Logic Controller (PLC) systems to sabotage industrial facilities. As such, it is important to understand the exposure to malfeasance to ensure that PHM does not end up being the enabling mechanism for unauthorized access to the system it is meant to keep in running order. It is also important to understand the measures that need to be taken to avoid or respond to an attack. These range from extensive penetration testing to conducting extensive counter-social engineering training, setting up a PHM-specific CERT plan and team in place. This paper discusses various threats that are emerging and that may have to be considered when designing a PHM solution. Additionally, the NIST cybersecurity framework is discussed in the context of PHM. Finally, this paper looks at the diagnostic capabilities of PHM systems to detect cyber security attacks and to contain these threats.

An automated intrusion detection system in IoT system using Attention based Deep Bidirectional Sparse Auto Encoder model

Nowadays, the Internet of Things (IoT) is a smart network connected to the Internet for transmitting gathered data with verified protocols. Attackers frequently use communication protocol defects as the basis for their attacks. Better protection measures are required since attacks affect the reputations of service providers. Both machine learning (ML) and deep learning (DL) methods have been developed in a number of research works to detect network intrusions. However, the system's security is limited by the rising number of new threats. Critical problems in IoT platforms, cyber-physical systems, wireless networks, and fog computing are caused by such attacks. The development of various cyber-security attacks reinforces the need for a strong intrusion detection system (IDS) in the IoT platform. The proposed study introduced a robust deep-feature learning mechanism for automatically detecting network intruders in the IoT platform. Initially, input data are gathered from the given dataset. Pre-processing helps reduce any noise in the data and improves the data quality using cleaning, outlier removal, and min-max normalization. The proposed Attention-based Deep Bidirectional Sparse Auto Encoder (AD-BiSA) model is the most important feature retrieved using the attention-based deep Bi-LSTM model. The different IoT network threats are categorized using a sparse Autoencoder approach. The chaotic Seagull Optimization (CSGO) algorithm decreases the loss and enhances the weight in the proposed DL technique. The UNSW NB15_IDS and NSL-KDD datasets achieve accuracy rates of 99.71% and 98.97%, respectively, for the proposed technique. The proposed method achieves better performance than existing approaches.

Navigating uncharted waters: Legal challenges and the future of unmanned underwater vehicles in maritime military cyber operations

The evolving landscape of maritime security is increasingly shaped by the integration of cyber technologies into naval operations, posing complex legal challenges under international maritime law. This paper examines the 2016 Bowditch incident, in which a U.S. Navy Unmanned Underwater Vehicle was detained by the Chinese navy, as a case study for comprehending the legal implications of maritime military cyber operations. The research delves into the ambiguous legal standing of unmanned underwater vehicles and their activities, particularly within the framework of the United Nations Convention on the Law of the Sea. Through a detailed analysis of the incident, this study identifies significant gaps in existing legal frameworks and advocates for the urgent need to augment international law to adequately address the emergence of cyber technologies in maritime military operations. The findings underscore the crucial role of international consensus in defining the legal status of unmanned maritime systems and the norms governing maritime military cyber operations, essential for upholding global maritime security and stability.

Artificial intelligence driven cyberattack detection system using integration of deep belief network with convolution neural network on industrial IoT

In Industry 4.0, information and communication technology (ICT) was employed in numerous significant infrastructures, like financial networks, smart factories, and power plants, to automate and certify industrial systems. In power control systems, ICT technologies such as IIoT have improved automated monitoring, but legacy methods, originally autonomous, now connect with external networks. This progress has presented safety vulnerabilities from legacy ICT systems. Hence, various cybersecurity approaches are developed and examined to deal with cyberattacks and vulnerabilities. Utilizing new cybersecurity models in power control systems poses risks due to their uncertified safety. Ensuring their stability and efficiency is significant for maintaining reliable power delivery and incorporating these technologies into power control systems. Therefore, this study designs a Next–Generation Cybersecurity Attack Detection using an ensemble deep learning model (NGCAD-EDLM) technique in the IIoT environment. The main cause of the NGCAD-EDLM technique is the automatic recognition of cyber-attacks. In the NGCAD-EDLM approach, the primary data normalization phase utilizing min-max normalization is performed. Next, the honey-badger algorithm (HBA) approach selects the feature subsets. Furthermore, an ensemble deep learning (DL) of two methods, namely convolutional neural networks (CNNs) and deep belief networks (DBNs) methods, are employed for classification. In addition, the DL techniques' hyperparameter selection is accomplished using the lotus effect optimization algorithm (LEOA) method. A complete set of simulation validation is performed to establish the experimental analysis of the NGCAD-EDLM method. The performance validation of the NGCAD-EDLM method exhibited a superior accuracy value of 99.21 % over other existing techniques.