Cybersecurity Capability Research Articles

An Overview of AI Applications in Cybersecurity for IT Management

Background: Cybersecurity serves as a defense mechanism against unauthorized access, theft, information disclosure, and service disruptions for electronic data, networks, and computer systems. Traditional cybersecurity strategies have struggled to counter increasingly sophisticated and automated cyberattacks, necessitating the exploration of advanced solutions such as artificial intelligence (AI). Aim: This research aims to highlight the role of AI technology and systems in enhancing cybersecurity measures, addressing how AI-based solutions can defend against cyber threats and identifying the associated challenges and future research directions. Methodology: A systematic literature review was conducted, focusing on recent advancements in AI applications for cybersecurity. Key databases and search engines were utilized to gather relevant articles, which were then filtered based on criteria such as language, publication quality, citation count, and accessibility. The collected literature was analyzed to extract insights on AI methods and their uses in cybersecurity. Results: The study found that AI offers several benefits in addressing cybersecurity concerns. AI systems can identify novel and complex cyber threats, handle substantial volumes of security data, and establish baselines for normal network behavior to detect deviations. Various AI techniques, including neural networks, expert systems, intelligent agents, and machine learning, were identified as effective tools in combating cyber threats. AI has demonstrated significant improvements in the detection and prevention of cyberattacks, enhancing overall cybersecurity effectiveness. Findings: While AI enhances cybersecurity capabilities, it also introduces new challenges such as the need for substantial data and resources, managing false alarms, and vulnerability to adversarial attacks. The study underscores the importance of continuous research to develop robust AI systems that can adapt to evolving cyber threats. Future research should focus on addressing the limitations of AI in cybersecurity, including adversarial threats, data integrity, and human-machine collaboration.

Automated Matching Skills to Improve the Accuracy of Job Applicant Selection Using Indonesian National Work Competency Standards

The high number of cyberattack anomalies and data leaks in Indonesia increases the need for cybersecurity in various companies. Cybersecurity capabilities and skills in Indonesia are divided into three categories based on the Indonesian National Work Competency Standards (SKKNI), namely Security Operation Center (SOC), Cybersecurity test/Penetration testing (Pentest), and Information Security Audit. Although various approaches have been applied in different companies to select job applicants, a new method with automated matching is explored in this study. This method matches the skills possessed by prospective job applicants with the profile of their job task requirements based on the SKKNI Decree of the Minister of Manpower of the Republic of Indonesia using Machine Learning (ML) models. The empirical comparison of results comes from automated matchmaking processed by Multinomial Naive Bayes (MNB) and Decision Tree algorithm models. Before modeling, the data is trained and evaluated for testing. Then to assess the most optimal algorithm between MNB and Decision Tree, a confusion matrix is proposed and used to find the best model. From the evaluation results, both models performed well and were highly accurate during training and test evaluation. The Decision Tree model performs slightly better than the MNB model, but both still provide satisfactory results in classifying data based on the Indonesian National Work Competency Standards (SKKNI) categories. This study offers a solution to minimize the number of potential applicants who are not competent in the three SKKNI cybersecurity job categories due to the mismatch of their abilities and skills.

Cybersecurity Maturity of Turkey: An Assessment with ENISA’s National Capabilities Assessment Framework (NCAF)

In this study, Turkey's cybersecurity maturity level was assessed using the European Union Agency for Cybersecurity's (ENISA) National Capabilities Assessment Framework (NCAF). The results of other global cybersecurity indices for Turkey were also given to support the NCAF assessment. Additionally, Turkey’s organizations, legal framework, public and private sector, academic landscape, incident response capabilities and military capabilities were presented through an extensive literature review. In this respect, this is the most up-to-date cybersecurity capability analysis of Turkey in English. According to the findings from NCAF assessment, Turkey has high level of cybersecurity maturity level while there are various areas that need improvement, including supply chain security, contingency strategies, education and training, security and trustworthiness of digital identity and public digital services. The methodology and findings of this study can serve as a reference for researchers to measure the cybersecurity levels of other countries.

The Role of Artificial Intelligence in Cyber Security

Without significant automation, humans are unable to manage the volume of data and the complexity of procedures required to safeguard cyberspace. Creating software and systems with typical fixed implementations (hardwired decision-making logic) that successfully prevent security threats is difficult. This problem can be solved with machine simplicity and AI learning approaches. This study assesses whether strengthening defensive mechanisms can improve cybersecurity capabilities and offers a brief summary of artificial intelligence (AI) applications of various cybersecurity using artificial technologies. We can determine that there are currently useful applications by looking at the most recent cybersecurity software that makes use of artificial intelligence. Neural networks are their primary tool for protecting the periphery and other cybersecurity domains. Nevertheless, it was evident that some cybersecurity problems would require the application of artificial intelligence technology. For instance, thorough information is needed for strategic decision-making, and logical decision support is one of the unmet cybersecurity needs.

Theory-Guided Feature Selection in Cybercrime Data Science

Cybercrime data science is being significantly hampered by the presence of 'noisy' features within vast and complex datasets. We draw from the theoretical insights of the behavioural sciences to propose a feature selection model to enrich and improve the value and interpretability of cybercrime intelligence datasets. We piloted our theory-guided feature selection approach on a subset of intelligence datafeeds provided by a global fraud and cybercrime tracking firm. The results of the proposed social influence feature selection model show significant improvement in the interpretability of the machine learning-based exploratory analysis and advanced visualization techniques in an experimental setting. The feature selection model yielded rich insights about cybercriminal psychological tactics from social engineering scam data and has potential applicability in the areas of cyberthreat response and cybersecurity awareness training. Our study shows the value of an interdisciplinary theory-guided approach to cybercrime data analytics that integrates scientific knowledge from the behavioural sciences and data science expertise. Our paper concludes by suggesting avenues for future research on theory-guided feature selection seeking to incorporate behavioural science knowledge in cybercrime data science. We intend to refine, automate, evaluate, and scale our model in future research to assess its effectiveness in producing insights about cybercriminal activities and informing decision-making in a naturalistic and real-time setting. In future research efforts, we aim to automate the encoding of features and apply a wider range of machine learning tools and evaluation metrics to extract more meaningful insights into cybercriminal psychological tactics. We also intend to refine our model on larger datasets to enhance its efficiency and responsiveness to real-time cybercrime data. We call on data scientists and cybercrime domain experts to work together to apply theory-guided feature selection to improve processes of knowledge discovery that enhance our cybersecurity capabilities.

Design and Analysis of Cyber Security Capability Maturity Model

Design and Analysis of Cyber Security Capability Maturity Model

Comprehensive evaluation of Mal-API-2019 dataset by machine learning in malware detection

This study conducts a thorough examination of malware detection using machine learning techniques, focusing on the evaluation of various classification models using the Mal-API-2019 dataset. The aim is to advance cybersecurity capabilities by identifying and mitigating threats more effectively. Both ensemble and non-ensemble machine learning methods, such as Random Forest, XGBoost, K Nearest Neighbor (KNN), and Neural Networks, are explored. Special emphasis is placed on the importance of data pre-processing techniques, particularly TF-IDF representation and Principal Component Analysis, in improving model performance. Results indicate that ensemble methods, particularly Random Forest and XGBoost, exhibit superior accuracy, precision, and recall compared to others, highlighting their effectiveness in malware detection. The paper also discusses limitations and potential future directions, emphasizing the need for continuous adaptation to address the evolving nature of malware. This research contributes to ongoing discussions in cybersecurity and provides practical insights for developing more robust malware detection systems in the digital era.

Opportunities for developing the information security capability at hazardous plants given current challenges

Aim: One of the biggest challenges people face today is the development of an effective and efficient defence capability against cyber attacks. Nowadays, this is not only an expectation at the public level, but also a real need at the corporate and private user level. In this study, the author primarily wishes to draw attention to the global trends of new types of threats in the 21st century, the most vulnerable sectors, as well as to the development possibilities of the cyber security capabilities of domestic hazardous plants.Methodology: The author has conducted a qualitative research method using primary and secondary data to identify current trends and attack vectors of threats in cyberspace at global and regional levels. In addition, the author has also conducted empirical research using primary data to determine the development possibilities of the management/safety management systems of plants dealing with hazardous substances, as well as to build the resilience of the electronic information systems of these plants against cyber threats.Findings: The number of cyber-attacks have continued to grow over the last few decades, and industrial companies have become the main targets of these new types of attacks. In order for Hungary to develop an effective defence capability, especially in the case of industrial actors, it is important to create the cyber defence capability of plants dealing with hazardous materials under the supervision of the disaster management, industrial safety authority.Value: Taking stock of the possibilities of developing the security management system of domestic hazardous materials plants to protect against 21st century threats. This scientific work intends to provide more detailed information on the addition and feasibility of the management system with information security aspects.

Enhancing awareness of cyber crime: a crucial element in confronting the challenges of hybrid warfare In Indonesia

The Cyber Defense Center, abbreviated as Pushansiber, is an institution responsible for carrying out the duties and functions of the Defense Strategic Installation Agency. Pushansiber has an important role in implementing governance, cooperation, operations, and ensuring cyber defense security. However, this year there has been an increase in problems related to cyber attacks, such as phishing, malware, ransomware, spam. These cyber attacks are included in the concept of hybrid warfare which is believed to be a form of conflict that involves the utilization of various elements, one of which is cyber attacks, military, political, economic, and information aspects. This causes conflict situations to be complicated and demands a comprehensive approach in terms of defense and handling, with digital literacy and cybersecurity awareness which has an important role in defense management, the need for awareness and training, simulation, and certification to strengthen cybercrime awareness in every organization. The success of other countries that have established specialized cybersecurity teams and invested in advanced technology can serve as an example for Indonesia. For Indonesia, the cooperation between National Cyber and Crypto Agency (BSSN) and the Ministry of Defense in strengthening cybersecurity capabilities is an important step to safeguard infrastructure, protect sensitive data, and reduce potential disruptions from malicious cyber activities with the aim of strengthening cybersecurity capabilities.

Exploring perceptions of decision-makers and specialists in defensive machine learning cybersecurity applications: The need for a standardised approach

Machine learning (ML) utilisation has achieved a vast global impact. This is evident in the cybersecurity sector, where ML has wide-ranging applications, such as identifying and blocking threats, uncovering unusual software and user behaviour, and many others. However, the increase in successful cyberattacks demonstrates that the effectiveness of ML in cybersecurity applications can be questioned. Although the attacks may be new, ML is often adopted due to its ability to handle diverse and often unforeseen situations – a capability that is not possible using traditional rule-based security mechanisms. As both the rate of attacks and adoption of ML solutions are increasing, there is a need to determine whether ML-based security solutions are meeting the expectations of businesses and whether businesses are genuinely aware of the ML capabilities and limitations. Moreover, current literature shows a significant variation in how ML solutions are evaluated in cybersecurity applications, which might result in a poor understanding of ML capabilities. This paper explores the common perceptions and observations of decision-makers and specialists using ML for cybersecurity regarding its capabilities, implementation, evaluation, and communication. A semi-structured interview is conducted with individuals in various managerial positions to perform this investigation. The finding of this study reveals a pressing need for a standard to manifest ML capabilities. As significant variation in the understanding of Machine Learning Cyber Security (MLCS) capabilities is observed, a standard could help better communicate MLCS capabilities. It is observed that external influences heavily impact ML adoption decisions, potentially leading to misinterpretation of ML capabilities.

Enhancing cybersecurity capability investments: Evidence from an experiment

In recent years, investments in cybersecurity capabilities (CC) have emerged as an essential practice in reducing cyberattacks and optimizing the usage of technologies. Therefore, optimal investments in capabilities must be determined according to the cybersecurity scenario of firms. This experiment pursues an understanding of the effectiveness of the iterative learning process in investments in CC. Through a simulator game, experienced and inexperienced participants overcome challenges related to uncertainties of cyber incidents to decision-making in cybersecurity capability investments. The collected data were empirically tested from 119 participants analyzing 3,808 simulation runs. The findings demonstrated that there is a slight difference in the learning curve between the two groups even if they learn proactively and iteratively. However, experienced, and inexperienced groups did not demonstrate enough capacity to analyze the cybersecurity ecosystems designed in the simulator game to mitigate cyber incidents. Both groups exhibited similar results regarding gaps to invest in CC to address uncertainties associated with cyber threats. In this sense, this experiment highlights the relevance of learning about CC investments in any context to avoid resource losses and time to uncover the complexities related to incident responses.

Reinforcement Learning in Cyber Wargaming Defense

In recent decades the necessity for cyber security has grown for both private companies as well as government agencies. This growth is the result of increasing ability for organizations to mount cyber-attacks. As a response, organizations have been developing cyber defense artificial intelligence (AI), which greatly improves cyber-security capabilities. This ne- cessitates not only the development of cyber-attack, defense, and vulnerability frameworks to simulate a realistic environment, but also methods with which to train the AI. Further, the number and variety of networks necessitates a framework with which AI can be quickly and cost-effectively trained. This paper will explore how our team has worked to develop an efficient and comprehensive framework under which a variety of AI can be trained to fulfill the need for cyber resiliency.

Baltic States Cyber Security Policy: Development of digital capabilities in 2017-2022

Background The Baltic Sea region is currently one of the tensest areas in Europe, with Russia potentially challenging the international order by provoking a new confrontation with the North Atlantic Treaty Organization (NATO). In this context, the Baltic States of Lithuania, Latvia, and Estonia are developing their cyber security capabilities, which provides an intriguing example of how small states with an aggressive neighbour can operate. The perceived threat is driving the development of cyber capabilities, and policymakers are prioritizing efforts to strengthen their digital capabilities. Methods This article aims to examine the security challenges faced by the Baltic States in the digital environment and their strategies for enhancing digital capacity building competencies. Additionally, the article focuses on the Baltic States' efforts to build and strengthen cyber capabilities, which serve as the foundation for their cyber security policies. To accomplish this, data from the Digital Economy and Society Index (DESI) was utilized, employing research methods including quantitative, qualitative, and comparative analyses. This approach aimed to evaluate and compare the progress in digital capabilities among the Baltic States. Additionally, an analysis of strategic documents was conducted to gain insight into each country's perspective on cyber security and to identify opportunities for the development of this field in consideration of available resources. Results The findings emphasize the Baltic states' dedication to bolstering their cyber resilience, primarily motivated by the perceived threat from Russia. The study underscores the intricate relationship between socioeconomic factors and a nation's cyber capabilities. Conclusions The conclusion drawn is that their endeavours to establish and enhance cyber capabilities constitute a pivotal component of their cybersecurity strategy, thus contributing to regional stability and NATO's collective defence.

Improving the Cybersecurity Awareness of Finnish Podiatry SMEs

In the health and welfare sector, many entrepreneurs and employees are not skilled in information and cybersecurity, even when they are constantly dealing with sensitive data. This case study research examines a team of private Finnish podiatrists and their cybersecurity capabilities. The goal of the study is to gather the most important information and cybersecurity topics and create an easy-to-read guide that helps businesses find the framework for their information and cybersecurity and address it in more detail. The results of the case study show that the target organization's most important information and cybersecurity areas are phishing, secure environment, secure communication, passwords, software updates, backups, and physical security. Understanding these topics and following the planned guidelines will strengthen the security posture of all small and medium-sized enterprises (SMEs) in the health and welfare sector.

Edge propagation for link prediction in requirement-cyber threat intelligence knowledge graph

Critical information infrastructure (CII) is a critical component of national socioeconomic systems and one of the primary targets of cyberattacks. Unfortunately, CII's security administration struggles to keep up with the rapidly evolving and complex cyber threats. In this research, we combine cybersecurity threat intelligence (CTI) with management security requirements (SR) data to construct a knowledge graph (KG) named RCTI and predict new knowledge on the heterogeneous graph. In addition, we propose EGNN, a novel GNN-based model that defines the representation of edges and develop an algorithm for propagating edge information. Experiments on three public datasets and the RCTI graph show that the EGNN achieves state-of-the-art performance. Finally, we use the EGNN model to predict new links on the RCTI graph, which by manual analysis achieves a 97% connectivity rate between the CTI and SR entities. Therefore, the EGNN can effectively detect management vulnerabilities and enhance CII's cybersecurity capability in the event of cybersecurity incidents.

Cybersecurity Resilience in SMEs. A Machine Learning Approach

ABSTRACT This study investigates cybersecurity resilience in small and medium-sized enterprises (SMEs), focusing on three key aspects: the capacity to handle potential cyber incidents, the ability to recover from such incidents, and the capability to adapt in the face of possible cyber threats. Grounded in the Resource-Based View (RBV) framework, we conduct an empirical investigation utilizing a survey of 239 UK SMEs. The study makes a theoretical and methodological contribution, with significant implications for managers. First, the study highlights the lack of SMEs’ engagement with the management of cybersecurity and finds cybersecurity incidents to be the most important factor in driving resilience, as compared to cybersecurity capabilities. Moreover, the study also extends the RBV theory, emphasizing the importance of the interaction between cybersecurity capabilities affecting SMEs’ cybersecurity resilience. Second, the study showcases the potential of statistical methods, particularly machine learning techniques to identify the relationships between the factors affecting SMEs’ cybersecurity.

European cyber security law in 2023: A review of the advances in the Network and Information Security 2 Directive 2022/2555

Cyber security capabilities must be designed to mitigate attacks and threats to key network and information systems and ensure continuity in service provision, contribute to the security and effective functioning of economies and societies, and the Network and Information Security 2 Directive (NIS2) seeks to strengthen the European Union (EU) approach to this. Advances in artificial intelligence (AI) have revolutionised industries including banking (FinTech), law (RegTech), insurance (InsureTech), charities (CharityTech) and health (HealthTech). The EU understands this and has therefore introduced the requirement for member states to embrace AI, as a cyber security tool used to protect against and prevent cyber security attacks/threats. The purpose of this paper is to review the NIS2 and the changes it makes to the European approach to cyber security including the use of AI, and the implications for businesses subject to the new rules. The subject is explored through an analysis of literature, EU law and policy documentation. This paper critically reviews a significant advent in European cyber security and technology law: the advances created by the NIS2 Directive, which are considered alongside other key legislation that came into force in January 2023. In addition, the UK’s contrasting evolving position is also critically reviewed. The paper concludes with several practical suggestions on the, if any, steps for businesses as at April 2023. The NIS2 makes some significant inroads to close security gaps that existed in the EU cyber security-related legislative framework; importantly, it creates a requirement for the use of AI in the EU’s cyber security defence armoury. Businesses need to undertake several steps in preparation for full implementation of the NIS2. This research is among the first to review key advances made in EU cyber security and technology law, and to contrast that with the UK position as at April 2023. It is also the first to discuss the likely powers of competent authorities, and the potential results of breaching other EU legislation such as the General Data Protection Regulation (GDPR).

Enhancing patient safety: A national standard for cyber resiliency in healthcare.

With support from Public Safety Canada's Cyber Security Cooperation Program, HealthCareCAN and the Digital Governance Council developed a new standard to support cyber resiliency in Canada's healthcare system. With a clear framework and enhanced cybersecurity capabilities, healthcare organizations will be better protected from cybercrime, allowing them to respond more effectively to evolving threats and defend critical infrastructure. Health and information technology leaders can derive practical guidance and next steps from this three-year national project to enhance cyber resilience and improve safety within their organizations.

Artificial Intelligence In Cyber Security: Rescue Or Challenge

Objective: The objective of this research paper is to explore the potential of artificial intelligence (AI) in enhancing and fortifying cybersecurity measures. In light of the increasing cyber threats and the limitations of traditional computer security systems, the paper aims to shed light on the concept of AI and its components. The central goal is to demonstrate how AI can be leveraged to improve cybersecurity, focusing on key areas such as machine learning, data mining, in-depth learning, and expert programs.
 Method: This research paper utilizes a literature review approach to investigate the intersection of artificial intelligence and cybersecurity. It involves analyzing existing scholarly works and studies to understand the challenges posed by evolving cyber threats and the limitations of conventional security systems. The paper identifies various components of AI that have the potential to enhance cybersecurity measures and delineates their applicability in the digital landscape.
 Results: The analysis of past literature emphasizes the growing significance of adopting artificial intelligence techniques to bolster cybersecurity practices. The results underscore the inadequacies of traditional security systems in predicting and countering the ever-evolving tactics of cyber attackers and terrorists. Through an examination of various AI components, including machine learning, data mining, in-depth learning, and expert programs, the paper demonstrates the potential benefits that these technologies can offer to the field of cybersecurity.
 Conclusions: In conclusion, this research paper highlights the escalating threats to cybersecurity in the face of rapid technological advancement. The imperative of addressing these challenges through AI becomes evident as traditional security systems prove insufficient. By harnessing the power of artificial intelligence techniques such as machine learning, data mining, in-depth learning, and expert programs, institutions can significantly enhance their cybersecurity capabilities. The paper underscores the need for a paradigm shift towards AI-driven cybersecurity strategies to effectively predict, prevent, and counteract cyber threats in the digital age.

Designing An Information Security Framework For The Indonesia Water Industry Sector

The majority of Indonesia's water industry sectors have implemented smart water management systems as part of their business development, which has an indirect impact on enterprise information security. However, in general, water sector enterprises continue to place a low priority on information security, and the development of information system frameworks is based on generic norms employed by financial firms. There has been no research on information security frameworks especially built for water firms in Indonesia that use information security standards in the utilities sector. This article proposes a solution in the form of a new framework for Indonesian water firms that combines international information security requirements in the utilities sector with Indonesian government rules. This approach of development combines worldwide standards with national rules. The Cybersecurity Capability Maturity Model (C2M2) and ISO 27019 are two international standards commonly used by utility businesses globally. Government Regulation or Peraturan Pemerintah (PP) Number 71 of 2019 on the Implementation of Electronic Systems and Transactions is the relevant national regulation. The framework addresses information technology, telecommunications, and operational technology, with four approach categories: governance and ecosystem, protection, defense, and resilience. According to the research findings, the newly integrated framework can be applied and is worthy of recommendation. This framework also meets the standards for information security and can be used by Indonesian water corporations.