Cyber Warfare Research Articles

Russia vs America cyber war: space technology mastery competition

Mastery of computers and information systems in international relations is one of the elements of a country's new power. In the context of cyber warfare, Russia and the United States are trying to modernize their technology to secure their countries in the event of an attack from the opposing party. This research aims to analyze the space technology competition carried out by two major countries, namely Russia and the United States, to achieve Great Power status in the international world. This research focuses on the technological achievements of Russia and the United States in the field of space and their implementation in the form of cyber warfare. A qualitative case study is the research method chosen by the researcher. The research stages used by researchers are divided into data collection stages and data reduction, and the next stage is that researchers conduct analysis using data reduction techniques, namely summarizing, selecting, and focusing on the things needed in this study. The results of this study show that national security priorities are number one, and especially defense priorities for the United States are no longer terrorism but great power competition. NATO is an alliance or political tool that the US relies on to achieve great power.

The criminal activities and operational roles of Australian neo-jihadists: a network perspective

ABSTRACT Despite the significant global repercussions of terrorism, including loss of lives and economic resources, research on its relationship with crime has been limited to group-level analyses. This study examines the individual criminal activities of Australian Neo-Jihadists, via social network analysis from an individual perspective. Judicial documents and newspaper articles are analysed to determine the criminal activities and operational roles of network actors. Findings suggest a prominence of criminal activities, and a significant relationship between market criminal activities and facilitation of terrorist operations. The study concludes with suggestions for future research, emphasising the potential for disrupting terrorist networks by focusing on the new crime-terror nexus.

REMaQE: Reverse Engineering Math Equations from Executables

Cybersecurity attacks on embedded devices for industrial control systems and cyber-physical systems may cause catastrophic physical damage as well as economic loss. This could be achieved by infecting device binaries with malware that modifies the physical characteristics of the system operation. Mitigating such attacks benefits from reverse engineering tools that recover sufficient semantic knowledge in terms of mathematical equations of the implemented algorithm. Conventional reverse engineering tools can decompile binaries to low-level code, but offer little semantic insight. This paper proposes the REMaQE automated framework for reverse engineering of math equations from binary executables. Improving over state-of-the-art, REMaQE handles equation parameters accessed via registers, the stack, global memory, or pointers, and can reverse engineer equations from object-oriented implementations such as C++ classes. Using REMaQE, we discovered a bug in the Linux kernel thermal monitoring tool “tmon”. To evaluate REMaQE, we generate a dataset of 25,096 binaries with math equations implemented in C and Simulink. REMaQE successfully recovers a semantically matching equation for all 25,096 binaries. REMaQE executes in 0.48 seconds on average and in up to 2 seconds for complex equations. Real-time execution enables integration in an interactive math-oriented reverse engineering workflow.

Risk Assessment of UAV Cyber Range Based on Bayesian–Nash Equilibrium

In order to analyze the choice of the optimal strategy of cyber security attack and defense in the unmanned aerial vehicles’ (UAVs) cyber range, a game model-based UAV cyber range risk assessment method is constructed. Through the attack and defense tree model, the risk assessment method is calculated. The model of attack and defense game with incomplete information is established and the Bayesian–Nash equilibrium of mixed strategy is calculated. The model and method focus on the mutual influence of the actions of both sides and the dynamic change in the confrontation process. According to the calculation methods of different benefits of different strategies selected in the offensive and defensive game, the risk assessment and calculation of the UAV cyber range are carried out based on the probability distribution of the defender’s benefits and the attacker’s optimal strategy selection. An example is given to prove the feasibility and effectiveness of this method.

Ransomware Reloaded: Re-examining Its Trend, Research and Mitigation in the Era of Data Exfiltration

Ransomware has grown to be a dominant cybersecurity threat by exfiltrating, encrypting, or destroying valuable user data and causing numerous disruptions to victims. The severity of the ransomware endemic has generated research interest from both the academia and the industry. However, many studies held stereotypical assumptions about ransomware, used unverified, outdated, and limited self-collected ransomware samples, and did not consider government strategies, industry guidelines, or cyber intelligence. We observed that ransomware no longer exists simply as an executable file or limits to encrypting files (data loss); data exfiltration (data breach) is the new norm, espionage is an emerging theme, and the industry is shifting focus from technical advancements to cyber governance and resilience. We created a ransomware innovation adoption curve, critically evaluated 212 academic studies published during 2020 and 2023, and cross-verified them against various government strategies, industry reports, and cyber intelligence on ransomware. We concluded that many studies were becoming irrelevant to the contemporary ransomware reality and called for the redirection of ransomware research to align with the continuous ransomware evolution in the industry. We proposed to address data exfiltration as priority over data encryption, to consider ransomware in a business-practical manner, and recommended research collaboration with the industry.

Attention-Enhanced Defensive Distillation Network for Channel Estimation in V2X mm-Wave Secure Communication

Millimeter-wave (mm-wave) technology, crucial for future networks and vehicle-to-everything (V2X) communication in intelligent transportation, offers high data rates and bandwidth but is vulnerable to adversarial attacks, like interference and eavesdropping. It is crucial to protect V2X mm-wave communication from cybersecurity attacks, as traditional security measures often fail to counter sophisticated threats and complex attacks. To tackle these difficulties, the current study introduces an attention-enhanced defensive distillation network (AEDDN) to improve robustness and accuracy in V2X mm-wave communication under adversarial attacks. The AEDDN model combines the transformer algorithm with defensive distillation, leveraging the transformer’s attention mechanism to focus on critical channel features and adapt to complex conditions. This helps mitigate adversarial examples by filtering misleading data. Defensive distillation further strengthens the model by smoothing decision boundaries, making it less sensitive to small perturbations. To evaluate and validate the AEDDN model, this study uses a publicly available dataset called 6g-channel-estimation and a proprietary dataset named MMMC, comparing the simulation results with the convolutional neural network (CNN) model. The findings from the experiments indicate that the AEDDN, especially in the complex V2X mm-wave environment, demonstrates enhanced performance.

The Terrorist Networks and Their Posing Threats: The Case of the Horn of Africa

This study examines the evolution and impact of terrorist networks in the Horn of Africa, primarily focusing on Somalia and the surrounding region. Following the 9/11 attacks, the Horn of Africa emerged as a critical front in global counter-terrorism efforts due to the presence of groups like al-Shabaab and ISIS. This paper explores these groups’ organizational structures, strategies, and operations, highlighting their adaptability, resilience, and the sociopolitical dynamics that have enabled them to thrive. It delves into the persistent challenges faced by Somalia, including political fragmentation, economic deprivation, and the complex interplay of local and international actors, such as the United States and Türkiye. The study emphasizes the need for a multifaceted approach to counter-terrorism that integrates military, political, and diplomatic strategies, addressing the immediate security threats and the underlying causes of extremism. By analyzing current counter-terrorism efforts and their limitations, this paper offers strategic recommendations to achieve long-term stability in the region.

Collective Countermeasures in Response to Cyber Operations under International Law

Collective Countermeasures in Response to Cyber Operations under International Law

The Russia-Ukraine War: An Exploratory Study into the Potential Impact of Cyber Warfare on Asymmetric War Efforts

Purpose: The war in Ukraine brought attention to “new” tactics on the battlefield—namely cyber warfare. It is attracting increased attention from media and civilians, enabling civilians from countries outside of Ukraine to help fight for Ukraine. The impact of cyber warfare on kinetic war efforts is not well understood. Methodology: Secondary data were collected, which included verified reports of cyber interventions in support of either party to the Russian-Ukraine war. Various cyber interventions are discussed in terms of the type of intervention, modus operandi, and potential effect. All data have been published in English by credible sources. The effect of cyber interventions will be analysed to determine their potential impact on states that are party to an asymmetrical war. Findings: Cyber warfare can potentially act as a force multiplier in kinetic efforts through actionable intelligence collected. Currently, the effect of cyber warfare seems to be negligible, as neither party to the Russian-Ukraine war effort has achieved its political ideologies. In fact, the use of drones has brought about an escalation in violence. Implications: A better understanding of cyber interventions and more effective application of these in a kinetic war could potentially aid a nation-state in achieving its ideological objectives faster, thereby reducing the intensity of the negative socioeconomic impact on nation-states not party to the conflict. Current scholarly debates about cyber warfare view the impact of cyber interventions in a kinetic effort as negligible. This article will point to a linchpin that could change the current opinion of scholars.

Digital Warfare: Exploring Cyber Criminality Amidst Armed Conflict in Southwest Region of Cameroon

This research investigates the alarming rise of cyber criminality in the Southwest region of Cameroon, a trend significantly influenced by the ongoing armed conflict that has engulfed the area. Employing a doctrinal research methodology, the study conducts a rigorous content analysis of both primary sources such as case law, treaties, legislative texts, direct observations, and policy documents and secondary sources, including scholarly textbooks, journal articles, comprehensive reports, and various online materials. The analysis utilizes diverse legal reasoning methods, including deductive, inductive, and analogical reasoning. Findings reveal a troubling surge in cyber-criminal activities since the onset of the armed conflict in English-speaking Cameroon, driven by interrelated factors such as rampant unemployment, pervasive economic hardship, widespread illiteracy, and the displacement of individuals. In light of these findings, it is crucial for the Cameroonian government to devise and implement effective strategies that not only combat cyber-crime but also address the socio-economic challenges exacerbated by the conflict. Such comprehensive measures are vital for restoring stability and security in the Southwest region and for fostering a resilient society capable of overcoming the dual impacts of cybercrime and armed conflict.

Design and Implementation of Tabletop Cybersecurity Simulation for Health Informatics Graduate Students.

Experiential learning through simulation allows students to apply didactic knowledge to real-world situations. Tabletop simulation allows for the exploration of a variety of topics, including cybersecurity in health care. Due to its low frequency, yet high-risk nature, simulation is a perfect educational modality to practice responding to a cybersecurity attack. As such, the authors designed and executed a tabletop cybersecurity simulation consisting of a prebriefing, four rounds of injects detailing potential cybersecurity breaches that students must address, and structured debriefings that included input from cybersecurity content experts. This simulation was performed in 2018, 2019, 2022, and 2023, during graduate Health Informatics (HI) students' residential visits. The simulation allowed opportunities for HI students to apply knowledge of cybersecurity principles to an unfolding tabletop simulation containing injects of scenarios they may encounter in the real world. Survey data were used to assess the students' perceptions of the simulation. Topics assessed included overall satisfaction, teamwork and communication, and length of the event. Additionally, in 2022 and 2023, data were collected on psychological safety and whether to include them in future HI residential visits. Eighty-eight graduate HI students took part in the cybersecurity simulation over four annual residential visits. Most students were satisfied with the event, found it valuable, and could see it impacting their future practice as informaticists. Additionally, students indicated high levels of psychological safety. Multiple students requested that additional simulations be incorporated into the curriculum. A tabletop cybersecurity simulation was utilized to allow HI students the ability to apply knowledge related to cybersecurity breaches to real-world examples. The simulation's best practices of prebriefing, psychological safety, and structured debriefing with expert feedback were emphasized in the simulation's design and implementation. Students found the simulation valuable and worth including in the curriculum.

MANAGING INDONESIAN DATA BREACH NOTIFICATION IN THE FINANCIAL SERVICES SECTOR: A CASE FOR ONE-STOP NOTIFICATION MODEL

As a business of trust, the banking and financial services industry must protect its reputation to ensure consumer’s confidence. However, recent adoption of emerging internet communication technologies (ICT) have introduced new risks and challenges, such as safeguarding systems from cyberattacks and protecting consumer’s personal data. Cyberattacks, especially ransomware have shed new light on the importance of privacy and security throughout the banking and financial industry’s digitization efforts. Any organisation affected by cybersecurity attacks must face a twofold legal question. First, whether or not there has been a violation of the legal security requirements? Second, is to determine whether the attack triggers Data Breach Notification to the Data Protection Authority and/or Data Owners. This paper examines the complexity of maintaining security obligations under Indonesian Law (UU ITE, UU PDP, RPP PDP, and other relevant regulations) while also highlighting the common challenges in steering Data Breach Notification, with an enhanced perspective of the European General Data Protection Regulation (EU GDPR) practices. To address the challenges of patchwork data breach notification requirements in Indonesia, this paper proposes a proactive approach by Indonesia’s future Personal Data Protection Authority in creating a one-stop notification model to enable effective data breach incident management and notification.

Rising Threat of AI-Driven Cybersecurity Attacks: Implications for National Security

Rising Threat of AI-Driven Cybersecurity Attacks: Implications for National Security

LEGAL FRAMEWORKS FOR REGULATING CYBERCRIME AND CYBER TERRORISM

Cybercrime and cyber terrorism pose significant challenges to global security and stability in the digital age. This paper explores the legal frameworks established to regulate these phenomena, analyzing their effectiveness and limitations. It examines the evolving nature of cyber threats, the complexities of defining cybercrime and cyber terrorism, and the role of international cooperation in addressing these issues. Drawing on case studies and legislative examples, this paper identifies key strategies for enhancing legal frameworks to combat cyber threats in the 21st century. Keywords: Cybercrime, Cyber Terrorism, Legal Frameworks, Legislation, Cybersecurity, International Cooperation.

Cybersecurity in Healthcare: Securing Patient Health Information (PHI), HIPPA compliance framework and the responsibilities of healthcare providers.

Healthcare industry is major target for cyberattacks, making the protection of public health information (PHI) and Personal Identifiable Information (PII) a prime issue. In this digital era, with health organizations shifting to electronic health records and telemedicine, they are facing a major cybersecurity attack such as ransomware, phishing, and data breaches. These attacks compromise patient privacy, pose serious risks to patient safety, and hinder healthcare operations. The Health Insurance Portability and Accountability Act (HIPAA) provides a comprehensive compliance framework to protect PHI, wherein health providers shall undertake administrative, physical and technical safeguards. Despite these regulations, many healthcare providers struggle with achieving and maintaining HIPAA compliance due to limited resources, outdated technologies, and the rapidly evolving nature of cyber threats. This paper explores the HIPAA compliance framework, examining the specific responsibilities of healthcare providers to secure PHI. Key measures taken include periodic analysis of risks, establishment of encryption and access control systems, and comprehensive employee training to minimize risks of cyber-attacks. The study highlights that there is a growing need for healthcare providers to adopt proactive, adaptive cybersecurity strategies to deal with emerging threats. By following HIPAA regulations and updating security practices continuously, healthcare providers can protect the PHI, ensure regulatory compliance and safeguarding patient trust. The findings emphasize the role of adhering to regulation and innovation both in managing cyber risks for the healthcare sector.

Cyber intelligence and international security. Breaking the legal and diplomatic silence?

ABSTRACT In cyberspace intelligence agencies, rather than militaries, are the most prominent security actors. However, many cyber operations conducted by intelligence agencies are not ‘classic’ espionage activities, but may be best described as digital covert action (sabotage, subversion, information operations). Given the fact that international law and diplomacy traditionally do not address espionage, cyber operations conducted by intelligence agencies have developed in a legal grey zone that gets stretched by the behaviour of the intelligence agencies of the most brazen cyber powers. The digital age has significantly transformed the capabilities and the role of intelligence agencies, which raises the question if the traditional international consensus that ‘intelligence is not discussed’ is still useful in state-to-state relations. The theoretically underdefined role and activities of intelligence agencies are affected by four big changes in the digital age: increase in scale of their activities and effects, heightened ambiguity, massive expansion of the attack surface and trickle-down insecurity, which point to a need to rethink how cyber intelligence agencies should operate. Some states will continue to push the boundaries of what is possible in cyberspace, unless other states break with the legal and diplomatic silence to discuss ‘guardrails’ to cyber intelligence activities.

The Impact of Cybersecurity Attacks on Human Trust in Autonomous Vehicle Operations.

This study examines the extent to which cybersecurity attacks on autonomous vehicles (AVs) affect human trust dynamics and driver behavior. Human trust is critical for the adoption and continued use of AVs. A pressing concern in this context is the persistent threat of cyberattacks, which pose a formidable threat to the secure operations of AVs and consequently, human trust. A driving simulator experiment was conducted with 40 participants who were randomly assigned to one of two groups: (1) Experience and Feedback and (2) Experience-Only. All participants experienced three drives: Baseline, Attack, and Post-Attack Drive. The Attack Drive prevented participants from properly operating the vehicle in multiple incidences. Only the "Experience and Feedback" group received a security update in the Post-Attack drive, which was related to the mitigation of the vehicle's vulnerability. Trust and foot positions were recorded for each drive. Findings suggest that attacks on AVs significantly degrade human trust, and remains degraded even after an error-less drive. Providing an update about the mitigation of the vulnerability did not significantly affect trust repair. Trust toward AVs should be analyzed as an emergent and dynamic construct that requires autonomous systems capable of calibrating trust after malicious attacks through appropriate experience and interaction design. The results of this study can be applied when building driver and situation-adaptive AI systems within AVs.

An Evaluation of the Security of Bare Machine Computing (BMC) Systems against Cybersecurity Attacks

The Internet has become the primary vehicle for doing almost everything online, and smartphones are needed for almost everyone to live their daily lives. As a result, cybersecurity is a top priority in today’s world. As Internet usage has grown exponentially with billions of users and the proliferation of Internet of Things (IoT) devices, cybersecurity has become a cat-and-mouse game between attackers and defenders. Cyberattacks on systems are commonplace, and defense mechanisms are continually updated to prevent them. Based on a literature review of cybersecurity vulnerabilities, attacks, and preventive measures, we find that cybersecurity problems are rooted in computer system architectures, operating systems, network protocols, design options, heterogeneity, complexity, evolution, open systems, open-source software vulnerabilities, user convenience, ease of Internet access, global users, advertisements, business needs, and the global market. We investigate common cybersecurity vulnerabilities and find that the bare machine computing (BMC) paradigm is a possible solution to address and eliminate their root causes at many levels. We study 22 common cyberattacks, identify their root causes, and investigate preventive mechanisms currently used to address them. We compare conventional and bare machine characteristics and evaluate the BMC paradigm and its applications with respect to these attacks. Our study finds that BMC applications are resilient to most cyberattacks, except for a few physical attacks. We also find that BMC applications have inherent security at all computer and information system levels. Further research is needed to validate the security strengths of BMC systems and applications.

Cyber-Security Attacks on Microgrid and Its Mitigation via Adaptive Fuzzy PID Controller

Cyber-Security Attacks on Microgrid and Its Mitigation via Adaptive Fuzzy PID Controller

The Evolution of China's Cyber-Espionage Tactics: From Traditional Espionage to AI-Driven Cyber Threats against Critical Infrastructure in the West

Purpose: This article critically investigates the evolution of China’s cyber-espionage strategies, specifically illustrating the shift from traditional espionage methodologies to the incorporation of advanced technologies, particularly artificial intelligence (AI). This transition profoundly reshapes global power dynamics, delineating nuanced threats to critical infrastructure in Western nations, including power grids, financial systems, and communication networks (Wang et al., 2019). Materials and Methods: Utilizing a theoretical framework grounded in Joseph Nye's concept of soft power and contemporary security studies, this research posits a hypothesis: there exists a positive correlation between technological advancements and the escalation of espionage activities by state actors. The inquiry encompasses a comprehensive analysis of key components, such as vulnerabilities, adaptive strategies, geopolitical implications, deterrence mechanisms, and international collaboration, thereby illuminating the multifaceted risks to national security inherent in the digital age (Nye, 2004). Findings: The study critically evaluates the countermeasures undertaken by Western countries, probing strategic enhancements of cyber defences and the formation of international coalitions aimed at collective security (Huang et al., 2021). The findings reveal substantial obstacles in achieving a cohesive and effective response to the rapidly escalating and pervasive nature of contemporary cyber threats (Zhang et al., 2020). Implications to Theory, Practice and Policy: Considering the ongoing maturation of China’s cyber capabilities, characterized by an increased reliance on AI and the impending advent of quantum computing, the article advocates for a comprehensive revaluation of global security practices (Mann et al., 2020). It underscores the imperative for Western nations to not only innovate defensively but to also adopt proactive measures and foster significant international collaboration. This multifaceted approach is essential to address the complex challenges posed by state-sponsored cyber operations within an increasingly interconnected global landscape (Chen et al., 2021).