Cybersecurity Analysts Research Articles

Hybrid dung beetle optimization based dimensionality reduction with deep learning based cybersecurity solution on IoT environment

The Internet of Things (IoT) interconnects various devices and objects through the Internet to interact with corresponding devices or machines. Now, consumers can purchase many internet-connected products, from automobiles to refrigerators. Extending network capacities to every aspect of life can save money and time, increase efficiency, and enable greater access to digital experiences. Cybersecurity analysts often refer to this as increasing the attack surface from which hackers can benefit. Implementing the proper security measures is crucial since IoT devices can be vulnerable to cyberattacks and are often built with limited security features. Securing IoT devices involves implementing security measures and best practices to secure them from potential vulnerabilities and threats. Deep learning (DL) models have recently analyzed the network pattern for detecting and responding to possible intrusions, improving cybersecurity with advanced threat detection abilities. Therefore, this study presents a new Hybrid Dung Beetle Optimization-based Dimensionality Reduction with a Deep Learning-based Cybersecurity Solution (HDBODR-DLCS) method on the IoT network. The primary goal of the HDBODR-DLCS technique is to perform dimensionality reduction with a hyperparameter tuning process for enhanced detection results. In the primary stage, the HDBODR-DLCS technique involves Z-score normalization to measure the input dataset. The HDBO model is used for dimensionality reduction, which mainly selects the relevant features and discards the irrelevant features. Besides, intrusions are detected using the attention bidirectional recurrent neural network (ABiRNN) model. Finally, an artificial rabbits optimization (ARO) based hyperparameter tuning process is performed, enhancing the overall classification performance. The empirical analysis of the HDBODR-DLCS method is tested under the benchmark IDS dataset. The simulation outcomes indicated the HDBODR-DLCS method's improved abilities over existing approaches.

Analysis of methods for bypassing modern EDR endpoint protection systems

The purpose of the article is to review and analyze the methods of bypassing complex solutions for endpoint protection (EDR). The article highlights and describes the salient features of each of the EDR bypass methods and provides recommendations for countering them. EDR (Endpoint Detection and Response) is a type of cross-platform software currently most commonly used for event monitoring, security incident generation and formalization, and incident response. For each method and tool, example of it’s useand advantages and disadvantages are described. The article will be useful for cybersecurity analysts who want to deepen their knowledge of EDR and strengthen endpoint security. It will provide readers with an insight into EDR bypass techniques and help them apply recommendations to reduce the risks of EDR bypass during cyber ttacks.

Generative AI and Cognitive Computing-Driven Intrusion Detection System in Industrial CPS

Industrial Cyber-Physical Systems (ICPSs) are becoming more and more networked and essential to modern infrastructure. This has led to an increase in the complexity of their dynamics and the challenges of protecting them from advanced cyber threats have escalated. Conventional intrusion detection systems (IDS) often struggle to interpret high-dimensional, sequential data efficiently and extract meaningful features. They are characterized by low accuracy and a high rate of false positives. In this article, we adopt the computational design science approach to design an IDS for ICPS, driven by Generative AI and cognitive computing. Initially, we designed a Long Short-Term Memory-based Sparse Variational Autoencoder (LSTM-SVAE) technique to extract relevant features from complex data patterns efficiently. Following this, a Bidirectional Recurrent Neural Network with Hierarchical Attention (BiRNN-HAID) is constructed. This stage focuses on proficiently identifying potential intrusions by processing data with enhanced focus and memory capabilities. Next, a Cognitive Enhancement for Contextual Intrusion Awareness (CE-CIA) is designed to refine the initial predictions by applying cognitive principles. This enhances the system’s reliability by effectively balancing sensitivity and specificity, thereby reducing false positives. The final stage, Interpretive Assurance through Activation Insights in Detection Models (IAA-IDM), involves the visualizations of mean activations of LSTM and GRU layers for providing in-depth insights into the decision-making process for cybersecurity analysts. Our framework undergoes rigorous testing on two publicly accessible industrial datasets, ToN-IoT and Edge-IIoTset, demonstrating its superiority over both baseline methods and recent state-of-the-art approaches.

Blockchain and explainable AI for enhanced decision making in cyber threat detection

SummaryArtificial Intelligence (AI) based cyber threat detection tools are widely used to process and analyze a large amount of data for improved intrusion detection performance. However, these models are often considered as black box by the cybersecurity experts due to their inability to comprehend or interpret the reasoning behind the decisions. Moreover, AI‐based threat hunting is data‐driven and is usually modeled using the data provided by multiple cloud vendors. This is another critical challenge, as a malicious cloud can provide false information (i.e., insider attacks) and can degrade the threat‐hunting capability. In this paper, we present a blockchain‐enabled eXplainable AI (XAI) for enhancing the decision‐making capability of cyber threat detection in the context of Smart Healthcare Systems. Specifically, first, we use blockchain to validate and store data between multiple cloud vendors by implementing a Clique Proof‐of‐Authority (C‐PoA) consensus. Second, a novel deep learning‐based threat‐hunting model is built by combining Parallel Stacked Long Short Term Memory (PSLSTM) networks with a multi‐head attention mechanism for improved attack detection. The extensive experiment confirms its potential to be used as an enhanced decision support system by cybersecurity analysts.

Extensible Machine Learning for Encrypted Network Traffic Application Labeling via Uncertainty Quantification

With the increasing prevalence of encrypted network traffic, cyber security analysts have been turning to machine learning (ML) techniques to elucidate the traffic on their networks. However, ML models can become stale as new traffic emerges that is outside of the distribution of the training set. In order to reliably adapt in this dynamic environment, ML models must additionally provide contextualized uncertainty quantification to their predictions, which has received little attention in the cyber security domain. Uncertainty quantification is necessary both to signal when the model is uncertain about which class to choose in its label assignment and when the traffic is not likely to belong to any pre-trained classes. We present a new, public dataset of network traffic that includes labeled, Virtual Private Network (VPN)-encrypted network traffic generated by 10 applications and corresponding to 5 application categories. We also present an ML framework that is designed to rapidly train with modest data requirements and provide both calibrated, predictive probabilities as well as an interpretable "out-of-distribution" (OOD) score to flag novel traffic samples. We describe calibrating OOD scores using p-values of the relative Mahalanobis distance. We demonstrate that our framework achieves an F1 score of 0.98 on our dataset and that it can extend to an enterprise network by testing the model: (1) on data from similar applications, (2) on dissimilar application traffic from an existing category, and (3) on application traffic from a new category. The model correctly flags uncertain traffic and, upon retraining, accurately incorporates the new data.

Analisis dan Penanganan Insiden Siber SQL Injection Menggunakan Kerangka NIST SP 800-61R2 dan Algoritma Klusterisasi K-Means

Based on the OWASP Top Ten document in 2021, attacks or vulnerabilities in an application in the form of injection still rank in the top 3. SQL Injection attacks are still classified as injection vulnerabilities so they need special attention from Information & Communication Technology Managers. Badan Siber dan Sandi Negara (BSSN) has published a document related to preventing SQL Injection attacks. However, the document has not included a cyber attack analysis process that uses the K-Means clustering approach. So in this research, a collaborative method of handling cyber attacks in the form of SQL Injection is proposed using the NIST SP 800-61R2 framework as a fundamental for handling cyber attacks and K-Means clustering. Before analyzing cyber attacks, it is better to use a framework or standardization that applies globally. Based on the research conducted, the K-Means clustering algorithm can help cybersecurity analysts in the process of analyzing cyber attacks that occur. The result of this research is that the optimal value is obtained that cyber attacks in the form of SQL Injection, namely 3 clusters. The hope of the research can facilitate cybersecurity analysts in analyzing cyber attacks that are poured into reports to parties in need

Attack Hypotheses Generation Based on Threat Intelligence Knowledge Graph

Cyber threat intelligence on past attacks may help with attack reconstruction and the prediction of the course of an ongoing attack by providing deeper understanding of the tools and attack patterns used by attackers. Therefore, cyber security analysts employ threat intelligence, alert correlations, machine learning, and advanced visualizations in order to produce sound attack hypotheses. In this paper, we present AttackDB, a multi-level threat knowledge base that combines data from multiple threat intelligence sources to associate high-level ATT&CK techniques with low-level telemetry found in behavioral malware reports. We also present the Attack Hypothesis Generator which relies on knowledge graph traversal algorithms and a variety of link prediction methods to automatically infer ATT&CK techniques from a set of observable artifacts. Results of experiments performed with 53K VirusTotal reports indicate that the proposed algorithms employed by the Attack Hypothesis Generator are able to produce accurate adversarial technique hypotheses with a mean average precision greater than 0.5 and area under the receiver operating characteristic curve of over 0.8 when it is implemented on the basis of AttackDB. The presented toolkit will help analysts to improve the accuracy of attack hypotheses and to automate the attack hypothesis generation process.

Enhancing Communication Among Remote Cybersecurity Analysts With Visual Traces

Enhancing Communication Among Remote Cybersecurity Analysts With Visual Traces

A stochastic bi-objective cybersecurity analyst scheduling problem with preferential days off and upskilling decisions

With higher shifting rates towards digitalization, companies are more prone to the rising number of cyberattacks. Despite the insufficient supply of experts needed to safeguard the Information and Communications (ICT) system, their retention, training, and skill enhancement have become an additional challenge. The scheduling of experts is one among many areas in cybersecurity defense strategies which has attracted some recent concern. This work features a solution to a more generalized bi-objective scheduling problem using epsilon constraint and NSGA-II using a mixed integer linear program (MILP). Here, the model characterizes the enhancement of the employees’ analyzing ability while simultaneously focusing on overtime preferences. Although, a single objective approach is seen in a few articles yet bi-objective formulation in expert scheduling is never attempted. Results witness the optimal schedule in a tabulated structure with four overlapping shifts and eight-time windows implicitly representing rows and columns.

Hourly Network Anomaly Detection on HTTP Using Exponential Random Graph Models and Autoregressive Moving Average

Network anomaly detection solutions can analyze a network’s data volume by protocol over time and can detect many kinds of cyberattacks such as exfiltration. We use exponential random graph models (ERGMs) in order to flatten hourly network topological characteristics into a time series, and Autoregressive Moving Average (ARMA) to analyze that time series and to detect potential attacks. In particular, we extend our previous method in not only demonstrating detection over hourly data but also through labeling of nodes and over the HTTP protocol. We demonstrate the effectiveness of our method using real-world data for creating exfiltration scenarios. We highlight how our method has the potential to provide a useful description of what is happening in the network structure and how this can assist cybersecurity analysts in making better decisions in conjunction with existing intrusion detection systems. Finally, we describe some strengths of our method, its accuracy based on the right selection of parameters, as well as its low computational requirements.

How Putin's Cyberwar Failed in Ukraine

As Russian military forces surged across the Ukrainian border in February 2022, cybersecurity analysts shared predictions about the ways in which the Russian government would use cyberattacks to thwart Ukrainian defenses. Some government agencies and private sector organizations forecast that the Russians would launch a blitz of devastating electronic attacks against Ukrainian critical infrastructure targets, such as electrical power plants and air traffic control networks, crippling the country. While Russian cyberattacks have played a role in the conflict, their effects to date have been significantly less than what some analysts anticipated. But why? This article examines how analysts’ most extreme predictions about Russia’s use of cyberattacks in Ukraine missed the mark, links these findings to the literatures on military and intelligence forecasting, and offers recommendations for additional research.

METHOD FOR DETECTION OF RANSOMWARE CYBER THREATS BASED ON HONEYPOT: STATE-OF-ART

The work presents the research of the methods for detecting cyber threats such as Ransomware based on the use of Honeypot. Today, lack of awareness allows attacks to bypass basic security mechanisms, security vulnerabilities in the IT systems of small and large corporations are increasingly being used to cause business failures. The cyberattackscontinue to expand rapidly as cybercriminals constantly bypass the security tools developed and implemented by organizations. The purpose of attacks is increasingly data that is critical to both individuals and organizations. Attackers use capabilitiesthat can help them seize control of valuable data to demand a ransom from the data owner. Ransomware is a form of malware that infects a computer or multiple computers over a network by encrypting files and folders, making them unusable. The users are then asked to make a ransom. Ransomware is not a new threat, but its use is growing rapidly and causing large financial losses in the world. This is a serious challenge for cybersecurity analysts because typical ransomware is not detected by antivirus software due to its polymorphic nature. There was a sudden surge in extremely dangerous ransomware attacks that harmed most companies and individuals. Ransomware poses a great threat and must be fought at a global level. There is a lack of comprehensive analysis to cover the security issues of individual users and corporations. Ransomware avoidance methods are the most effective and require special attention as the reduction and recovery of ransomware becomes increasingly difficult. The task arises to investigate the effectiveness of known methods in order to assess and identify their advantages and disadvantages, which will allow in the future to develop and implement new effective methods and means of combating Ransomware-type SPZ based on the use of Honeypot. The study shows that because malware is automated and targets any location arbitrarily, placing the bait anywhere to detect activity is an improvement over the lack of monitoring at all. Experimental studies indicate a high reliability of the proposed methods, in particular the reliability of the detection of cyber threats of the Ransomware type, but the insufficient adaptability of these methods in the evolution of the malware.

Cyber threat detection: Unsupervised hunting of anomalous commands (UHAC)

The cyber security industry is rapidly adopting threat hunting as a proactive tool for early and faster detection of suspected malicious actors. In this paper, we propose a machine learning-based method, Unsupervised Hunting of Anomalous Commands (UHAC), to detect text-based anomalous commands in security information and event management (SIEM) logs that are good candidates for threat hunting. A unique feature of the proposed method is that it first creates a feature set based on the augmentation of document-term and document-character matrices. Then, an autoencoder-based detector is trained on this feature set using a custom loss function. UHAC consistently outperforms other feature sets and algorithms such as one-class support vector machine, density-based spatial clustering of applications with noise, and word-embedding based models such as word2vec. The UHAC detector identifies 84–89% of anomalies in the top 10% of the data. Findings have implications for cybersecurity analysts who perform threat hunting in SIEM logs for process auditing on endpoint devices.

Learning about simulated adversaries from human defenders using interactive cyber-defense games

Abstract Given the increase in cybercrime, cybersecurity analysts (i.e. defenders) are in high demand. Defenders must monitor an organization’s network to evaluate threats and potential breaches into the network. Adversary simulation is commonly used to test defenders’ performance against known threats to organizations. However, it is unclear how effective this training process is in preparing defenders for this highly demanding job. In this paper, we demonstrate how to use adversarial algorithms to investigate defenders’ learning using interactive cyber-defense games. We created an Interactive Defense Game (IDG) that represents a cyber-defense scenario, which requires monitoring of incoming network alerts and allows a defender to analyze, remove, and restore services based on the events observed in a network. The participants in our study faced one of two types of simulated adversaries. A Beeline adversary is a fast, targeted, and informed attacker; and a Meander adversary is a slow attacker that wanders the network until it finds the right target to exploit. Our results suggest that although human defenders have more difficulty to stop the Beeline adversary initially, they were able to learn to stop this adversary by taking advantage of their attack strategy. Participants who played against the Beeline adversary learned to anticipate the adversary’s actions and took more proactive actions, while decreasing their reactive actions. These findings have implications for understanding how to help cybersecurity analysts speed up their training.

A Stochastic Bi-Objective Cybersecurity Analyst Scheduling Problem with Preferential Days Off and Upskilling Decisions

A Stochastic Bi-Objective Cybersecurity Analyst Scheduling Problem with Preferential Days Off and Upskilling Decisions

Botnet Detection Using Artificial Intelligence

In the year 2021 more than 80 million data were breached by cyber attackers. Most of these attacks were executed as a type of ransomware attack and cyber-attack. There are different methods performed by attackers to target individual user, but to breach an organization, they use Botnet forces. A botnet (robot network), is malware infected network that is controlled by a single attacker called bot-herder. Cyber - attacker attacks many users with their malware script by different mediums like emails, spams and takes command and control (CC) of the victim device. Using these devices attacker forms a network and performs large attack like distributed denial-of-service (DDoS), attack on an organization to breach data. The complex analysis for cybersecurity analyst is to find bot-herder and the infected network. The structures of the botnets are become very different now days. Botnets can be found with its peer-peer (p2p) structure, signature detection, behavioral analysis, domain names (DNS) and network traffic. To make this different feature analysis easier, the usage of artificial intelligence (AI) is introduced in cyber security. Data from previous attacks are collected, trained using a model which helps in prediction of future attacks. Detection of DNS of core CC servers using AI are widely used nowadays. This research mainly focuses on detection of botnet malware from the net flows of malware packets. The botnet attack data set are collected from resources like Czech - university (CTU-13), Information security and object technology (ISOT). The bi-directional net flow data and the calculation of the network packets are used. Using algorithms like support vector machine (SVM), decision tree and multi-layer perceptron, the data set is trained and tested. After the training and testing, the decision tree model has good accuracy and performance metrics of 92%. This model is considered as a best fit model and helps in detection the of malware packets. The research's objective is to build an alerting system which reports once a malware packet is intruded into a network.

Cyber Threat Intelligence-Based Malicious URL Detection Model Using Ensemble Learning.

Web applications have become ubiquitous for many business sectors due to their platform independence and low operation cost. Billions of users are visiting these applications to accomplish their daily tasks. However, many of these applications are either vulnerable to web defacement attacks or created and managed by hackers such as fraudulent and phishing websites. Detecting malicious websites is essential to prevent the spreading of malware and protect end-users from being victims. However, most existing solutions rely on extracting features from the website’s content which can be harmful to the detection machines themselves and subject to obfuscations. Detecting malicious Uniform Resource Locators (URLs) is safer and more efficient than content analysis. However, the detection of malicious URLs is still not well addressed due to insufficient features and inaccurate classification. This study aims at improving the detection accuracy of malicious URL detection by designing and developing a cyber threat intelligence-based malicious URL detection model using two-stage ensemble learning. The cyber threat intelligence-based features are extracted from web searches to improve detection accuracy. Cybersecurity analysts and users reports around the globe can provide important information regarding malicious websites. Therefore, cyber threat intelligence-based (CTI) features extracted from Google searches and Whois websites are used to improve detection performance. The study also proposed a two-stage ensemble learning model that combines the random forest (RF) algorithm for preclassification with multilayer perceptron (MLP) for final decision making. The trained MLP classifier has replaced the majority voting scheme of the three trained random forest classifiers for decision making. The probabilistic output of the weak classifiers of the random forest was aggregated and used as input for the MLP classifier for adequate classification. Results show that the extracted CTI-based features with the two-stage classification outperform other studies’ detection models. The proposed CTI-based detection model achieved a 7.8% accuracy improvement and 6.7% reduction in false-positive rates compared with the traditional URL-based model.

Methodological Framework to Collect, Process, Analyze and Visualize Cyber Threat Intelligence Data

Cyber attacks have increased in frequency in recent years, affecting small, medium and large companies, creating an urgent need for tools capable of helping the mitigation of such threats. Thus, with the increasing number of cyber attacks, we have a large amount of threat data from heterogeneous sources that needs to be ingested, processed and analyzed in order to obtain useful insights for their mitigation. This study proposes a methodological framework to collect, organize, filter, share and visualize cyber-threat data to mitigate attacks and fix vulnerabilities, based on an eight-step cyber threat intelligence model with timeline visualization of threats information and analytic data insights. We developed a tool to address needs in which the cyber security analyst can insert threat data, analyze them and create a timeline to obtain insights and a better contextualization of a threat. Results show the facilitation of understanding the context in which the threats are inserted, rendering the mitigation of vulnerabilities more effective.

APPLICATION OF THE THREAT INTELLIGENCE PLATFORM TO INCREASE THE SECURITY OF GOVERNMENT INFORMATION RESOURCES

With the development of information technology, the need to solve the problem of information security has increased, as it has become the most important strategic resource. At the same time, the vulnerability of the modern information society to unreliable information, untimely receipt of information, industrial espionage, computer crime, etc. is increasing. In this case, the speed of threat detection, in the context of obtaining systemic information about attackers and possible techniques and tools for cyberattacks in order to describe them and respond to them quickly is one of the urgent tasks. In particular, there is a challenge in the application of new systems for collecting information about cyberevents, responding to them, storing and exchanging this information, as well as on its basis methods and means of finding attackers using integrated systems or platforms. To solve this type of problem, the promising direction of Threat Intelligence as a new mechanism for acquiring knowledge about cyberattacks is studied. Threat Intelligence in cybersecurity tasks is defined. The analysis of cyberattack indicators and tools for obtaining them is carried out. The standards of description of compromise indicators and platforms of their processing are compared. The technique of Threat Intelligence in tasks of operative detection and blocking of cyberthreats to the state information resources is developed. This technique makes it possible to improve the productivity of cybersecurity analysts and increase the security of resources and information systems.

Machine Learning for NetFlow Anomaly Detection With Human-Readable Annotations

We propose a framework for anomaly detection in communication network logs along with automated extraction of human-readable annotations that explain the decision logic underlying each anomaly detection. For this purpose, we develop a machine learning methodology formulated in terms of a model comprised of an OR-combination of multiple Boolean logic based sentences. Each sentence is an empirically learned set of inequality conditions involving subsets of features. The feature set, which comprises the “alphabet” for human-readable annotations, is constructed using dynamic graph based spatio-temporal aggregation to extract human-understandable aggregates of network activity. These aggregates are constructed both in terms of computers (nodes in dynamic graph) and communications between computers (edges in dynamic graph). From the alphabet, the learned model identifies subsets of features that relate to each anomaly type and the combinations of conditions in terms of the feature subsets for detection of the specific anomaly type. Given a data point that the learned model detects as anomalous, the model identifies the specific features and their combinations related to the anomaly detection. These human-readable annotations provide a cyber-security analyst a transparent view into the decision logic underlying an anomaly detection.