Cybersecurity Domain Research Articles

INDIA’S GROWING CYBER PARTNERSHIPS AND CHALLENGES FOR PAKISTAN

With the emergence of new technologies, the potential of cyberspace is immense; however, the growing number of cyber-attacks on states’ critical infrastructure has highlighted the need for cyber security. Although it is challenging to achieve foolproof security, states can maximise safety in the cyber domain through cyber partnerships with technologically advanced countries. This study finds that India is maximising its cyber security while enhancing its offensive cyber capabilities by concluding agreements with most cyber-secure states. Furthermore, India’s cyber capabilities are more focused on Pakistan due to longstanding tensions between the two countries. On the other hand, Pakistan lacks focus on cyber security and has yet to take sufficient measures. Pakistan can maximise its cyber security through technological advancements and taking advantage of friendly countries' expertise in the cyber security domain. Cyber security partnerships will strengthen Pakistan against threats emerging from state and non-state actors. Following a qualitative exploratory research design, this study provides a detailed understanding of India’s growing cyber security partnership and cyber posture, besides highlighting Pakistan’s approach towards cyber security. Bibliography Entry Farooq, Ammad and Ahmad Ali. 2022. "India’s Growing Cyber Partnerships and Challenges for Pakistan." Margalla Papers 26 (2): 49-61.

Application of grounded theory in construction of factors of internal efficiency and external effectiveness of cyber security and developing impact models

PurposeAs evident from the literature review, the research on cyber security performance is centered on security metrics, maturity models, etc. Essentially, all these are helpful for evaluating the efficiency of cyber security organization but what matters is how the factors of internal efficiency affect the business performance, i.e. the external effectiveness. The purpose of this research paper is to derive the factors of internal efficiency and external effectiveness of cyber security and develop impact model to identify the most and least preferred parameters of internal efficiency with respect to all the parameters of external effectiveness.Design/methodology/approachThere are two objectives for this research: Deriving the factors of internal efficiency and external effectiveness of cyber security; Developing a model to identify the impact of internal efficiency factors on the external effectiveness of cyber security since there is not much evidence of research in defining the factors of internal efficiency and external effectiveness of cyber security, the authors have chosen grounded theory methodology (GTM) to derive the parameters. In this study emic approach of GTM is followed and an algorithm is developed for administering the grounded theory research process. For the second research objective survey methodology and rank order was used to formulate the impact model. Two different samples and questionnaires were designed for each of the objectives.FindingsFor the objective 1, 11 factors of efficiency and 10 factors of effectiveness were derived. These are used as independent and dependent variable respectively in the later part of the research for the second objective. For the objective 2 the impact models among independent and dependent variables were formulated to find out the following. Most and least preferred parameters lead to internal efficiency of cyber security organization to identify the most and least preferred parameters of internal efficiency with respect to all the parameters external effectiveness.Research limitations/implicationsThe factors of internal efficiency and external effectiveness constructed by using grounded theory cannot remain constant in the long run, because of dynamism of the domain itself. Over and above this, there are inherent limitations of the tools like grounded theory, used in the research. Few important limitations of GTM are as below in grounded theory, it is comparatively difficult to maintain and demonstrate the rigors of research discipline. The sheer volume of data makes the analysis and interpretation complex, and lengthy time consuming. The researchers’ presence during data gathering, which is often unavoidable and desirable too in qualitative research, may affect the subjects’ responses. The subjectivity of the data leads to difficulties in establishing reliability and validity of approaches and information. It is difficult to detect or to prevent researcher-induced bias.Practical implicationsThe internal efficiency and external effectiveness factors of cyber security can be further correlated by the future researchers to understand the correlations among all the factors and predict cyber security performance. The grounded theory algorithm developed by us can be further used for qualitative research for deriving theory through abstractions in the areas where there is no sufficient availability of data. Practitioners of cyber security can use this research to focus on relevant areas depending on their respective business objective/requirements. The models developed by us can be used by the future researchers to for various sectoral validations and correlations.Social implicationsThough the financial costs of a cyber-attack are steep, the social impact of cyber security failures is less readily apparent but can cause lasting damage to customers, employees and the company. Therefore, it is always important to be mindful of how the impact of cyber security affects society as well as the bottom line when they are calculating the potential impact of a breach. Underestimating either impact can destroy a brand. The factor of internal efficiency and external effectiveness derived by us will help stakeholder in focusing on relevant area depending on their business. The impact model developed in this research is very useful for focusing a particular business requirement and accordingly tune the efficiency factor.Originality/valueDuring literature study the authors did not find any evidence of application of grounded theory approach in cyber security research. While the authors were exploring research literature to find out some insight into the factor of internal efficiency and external effectiveness of cyber security, the authors did not find concrete and objective research on this. This motivated us to use grounded theory to derive these factors. This, in the authors’ opinion is one of the pioneering and unique contribution to the research as to the authors’ knowledge no researchers have ever tried to use this methodology for the stated purpose and cyber security domain in general. In this process the authors have also developed an algorithm for administering GTM. Further developing impact models using factors of internal efficiency and external effectiveness has lots of managerial and practical implication.

Review on Semantic Modeling and Simulation of Cybersecurity and Interoperability on the Internet of Underwater Things

As maritime and military missions become more and more complex and multifactorial over the years, there has been a high interest in the research and development of (autonomous) unmanned underwater vehicles (UUVs). Latest efforts concern the modeling and simulation of UUVs’ collaboration in swarm formations, towards obtaining deeper insights related to the critical issues of cybersecurity and interoperability. The research topics, which are constantly emerging in this domain, are closely related to the communication, interoperability, and secure operation of UUVs, as well as to the volume, velocity, variety, and veracity of data transmitted in low bit-rate due to the medium, i.e., the water. This paper reports on specific research topics in the domain of UUVs, emphasizing interoperability and cybersecurity in swarms of UUVs in a military/search-and-rescue setting. The goal of this work is two-fold: a) to review existing methods and tools of semantic modeling and simulation for cybersecurity and interoperability on the Internet of Underwater Things (IoUT), b) to highlight open issues and challenges, towards developing a novel simulation approach to effectively support critical and life-saving decision-making of commanders of military and search-and-rescue operations.

A new feature popularity framework for detecting cyberattacks using popular features

We propose a novel feature popularity framework, and introduce this new framework to the cybersecurity domain. Feature popularity has not yet been used in machine learning or data mining, and we implement it with three web attacks from the CSE-CIC-IDS2018 dataset: Brute Force, SQL Injection, and XSS web attacks. Feature popularity is based upon ensemble Feature Selection Techniques (FSTs) and allows us to more easily understand common and important features between different cyberattacks. Three filter-based and four supervised learning-based FSTs are used to generate feature subsets for each of our three different web attack datasets, and then our feature popularity frameworks are applied. Classification performance for feature popularity is mostly similar as compared to when “all features” are evaluated (with feature popularity subsets having better performance in 5 out of 15 experiments). Our feature popularity technique effectively builds an ensemble of ensembles by first building an ensemble of FSTs for each dataset, and then building another ensemble across a dataset agreement dimension. The Jaccard similarity is also employed with our feature popularity framework in order to better identify which attack classes should (or should not) be grouped together when applying feature popularity. The four most popular features across all three web attacks from this experiment are: Flow_Bytes_s, Flow_IAT_Max, Fwd_IAT_Std, and Fwd_IAT_Total. When only using these four features as input to our models, classification performance is not seriously degraded. This feature popularity framework granted us new and previously unseen insights into the web attack detection process with CSE-CIC-IDS2018 big data, even though we had intensely studied it previously. We realized these four particular features cannot properly identify our three web attacks, as they operate mainly from the time dimension and NetFlow features from layers 3 and 4 of the OSI model. Conversely, our three web attacks operate in the application layer (7) of the OSI model and should not leave signatures in these four features. Feature popularity produces easier to explain models which provide domain experts better visibility into the problem, and can also reduce the complexity of implementing models in real-world systems.

Do Neural Transformers Learn Human-Defined Concepts? An Extensive Study in Source Code Processing Domain

State-of-the-art neural networks build an internal model of the training data, tailored to a given classification task. The study of such a model is of interest, and therefore, research on explainable artificial intelligence (XAI) aims at investigating if, in the internal states of a network, it is possible to identify rules that associate data to their corresponding classification. This work moves toward XAI research on neural networks trained in the classification of source code snippets, in the specific domain of cybersecurity. In this context, typically, textual instances have firstly to be encoded with non-invertible transformation into numerical vectors to feed the models, and this limits the applicability of known XAI methods based on the differentiation of neural signals with respect to real valued instances. In this work, we start from the known TCAV method, designed to study the human understandable concepts that emerge in the internal layers of a neural network, and we adapt it to transformers architectures trained in solving source code classification problems. We first determine domain-specific concepts (e.g., the presence of given patterns in the source code), and for each concept, we train support vector classifiers to separate points in the vector activation spaces that represent input instances with the concept from those without the concept. Then, we study if the presence (or the absence) of such concepts affects the decision process of the neural network. Finally, we discuss about how our approach contributes to general XAI goals and we suggest specific applications in the source code analysis field.

Cybersecurity Awareness and Training (CAT) Framework for Remote Working Employees.

Currently, cybersecurity plays an essential role in computing and information technology due to its direct effect on organizations' critical assets and information. Cybersecurity is applied using integrity, availability, and confidentiality to protect organizational assets and information from various malicious attacks and vulnerabilities. The COVID-19 pandemic has generated different cybersecurity issues and challenges for businesses as employees have become accustomed to working from home. Firms are speeding up their digital transformation, making cybersecurity the current main concern. For software and hardware systems protection, organizations tend to spend an excessive amount of money procuring intrusion detection systems, antivirus software, antispyware software, and encryption mechanisms. However, these solutions are not enough, and organizations continue to suffer security risks due to the escalating list of security vulnerabilities during the COVID-19 pandemic. There is a thriving need to provide a cybersecurity awareness and training framework for remote working employees. The main objective of this research is to propose a CAT framework for cybersecurity awareness and training that will help organizations to evaluate and measure their employees' capability in the cybersecurity domain. The proposed CAT framework will assist different organizations in effectively and efficiently managing security-related issues and challenges to protect their assets and critical information. The developed CAT framework consists of three key levels and twenty-five core practices. Case studies are conducted to evaluate the usefulness of the CAT framework in cybersecurity-based organizational settings in a real-world environment. The case studies' results showed that the proposed CAT framework can identify employees' capability levels and help train them to effectively overcome the cybersecurity issues and challenges faced by the organizations.

Cascaded Reinforcement Learning Agents for Large Action Spaces in Autonomous Penetration Testing

Organised attacks on a computer system to test existing defences, i.e., penetration testing, have been used extensively to evaluate network security. However, penetration testing is a time-consuming process. Additionally, establishing a strategy that resembles a real cyber-attack typically requires in-depth knowledge of the cybersecurity domain. This paper presents a novel architecture, named deep cascaded reinforcement learning agents, or CRLA, that addresses large discrete action spaces in an autonomous penetration testing simulator, where the number of actions exponentially increases with the complexity of the designed cybersecurity network. Employing an algebraic action decomposition strategy, CRLA is shown to find the optimal attack policy in scenarios with large action spaces faster and more stably than a conventional deep Q-learning agent, which is commonly used as a method for applying artificial intelligence to autonomous penetration testing.

Explainable artificial intelligence for cybersecurity: a literature survey

With the extensive application of deep learning (DL) algorithms in recent years, e.g., for detecting Android malware or vulnerable source code, artificial intelligence (AI) and machine learning (ML) are increasingly becoming essential in the development of cybersecurity solutions. However, sharing the same fundamental limitation with other DL application domains, such as computer vision (CV) and natural language processing (NLP), AI-based cybersecurity solutions are incapable of justifying the results (ranging from detection and prediction to reasoning and decision-making) and making them understandable to humans. Consequently, explainable AI (XAI) has emerged as a paramount topic addressing the related challenges of making AI models explainable or interpretable to human users. It is particularly relevant in cybersecurity domain, in that XAI may allow security operators, who are overwhelmed with tens of thousands of security alerts per day (most of which are false positives), to better assess the potential threats and reduce alert fatigue. We conduct an extensive literature review on the intersection between XAI and cybersecurity. Particularly, we investigate the existing literature from two perspectives: the applications of XAI to cybersecurity (e.g., intrusion detection, malware classification), and the security of XAI (e.g., attacks on XAI pipelines, potential countermeasures). We characterize the security of XAI with several security properties that have been discussed in the literature. We also formulate open questions that are either unanswered or insufficiently addressed in the literature, and discuss future directions of research.

A model to reduce insider cybersecurity threats in a South African telecommunications company

Background: Cybersecurity breaches have become a growing challenge in today’s digital economy. Organisations are faced with the responsibility of protecting their information resources from cybersecurity threats, and insider threats are one of them. Organisations have sophisticated technologies to protect themselves against these attacks, and their employees are often less guarded when it comes to protecting valuable company information systems.Objectives: This research was aimed to develop and conceptualise a model to reduce cybersecurity insider threats in a South African telecommunication organisation.Method: This study was conducted using a survey research approach, where close-ended questionnaires were utilised to collect data from respondents. The collected data was then analysed using IBM Statistical Package for Social Science (SPSS).Results: The findings of the study indicated that personal norms in the domain of cybersecurity have a positive influence on individuals’ attitude towards engaging in cybersecurity misbehaviour, and this has a significant relationship with their reduction of insider threats (RIT).Conclusion: This study suggests that management should give close and thoughtful attention to factors that encourage their employees to engage in cybersecurity misbehaviour. As an efficient and effective approach to mitigate the risk of cybersecurity insider threats, identification and classification of these factors should be followed by proper planning with a goal of reducing their negative effect on employees’ behaviour.

Designing a Game to Promote Equity in Cybersecurity

Cybersecurity faces a persistent problem with attracting and retaining diverse workers. Most exposure to cybersecurity as a discipline tends to come through formal experiences in higher education, often requiring extensive prior experience with computer science content. Therefore, informal learning environments that can serve to both introduce youth to concepts found within cybersecurity, as well as aiding them in building identities as the type of person who can ‘do’ cybersecurity, may be able to advance the goal of diversifying the field. Game-based learning is an effective approach for attracting new learners to specific domains of knowledge in informal contexts. Players who might not otherwise think of themselves as being capable participants within a field can use the structures and supports commonly found in well-designed digital games to build a personal identity as a novice practitioner of that domain. Previous work has found that while cybersecurity is represented in some commercial games, the depiction tends to be either superficial, or when there is a deeper engagement with content, tends to represent a stereotypical personage of a cybersecurity professional. In this paper, we present a digital game, called HEX of The Turtle Islands (HEX), designed to introduce players from historically underrepresented populations to the domain of cybersecurity. HEX leverages several gameplay elements to immerse players in a learning experience centered on cybersecurity: rich, multi-layered narratives; building player self-efficacy and identity within the domain of cybersecurity through challenges rooted in concepts that are authentic to the field; and making the game broadly accessible in terms of technology and design. In introducing HEX, we discuss how the design of the game can broaden participation in cybersecurity and conveys authentic cybersecurity concepts to players. Drawing from 2 years of playtesting data with a diverse group of youth play testers, we discuss both challenges and opportunities for introducing underrepresented youth to cybersecurity through play.

Role enactment and the contestation of global cybersecurity governance

ABSTRACT This research seeks to unpack the development of the EU as a security actor in cyberspace. Drawing on the theoretical approach of role theory, this article shows that the EU’s role in cyberspace should be understood in relationality to the other poles. On the one hand, the declining hegemonic role of the US in cyberspace as well as the divergence between the US and the EU with regard to cybersecurity governance has made the EU more aware of the need for cyber sovereignty and strategic autonomy. Therefore, the EU seeks to pursue a role of an autonomous cybersecurity player through the enactment of cybersecurity at institutional and operational level. On the other hand, under conditions of increasing interdependence, the EU has considered international cooperation to address challenges in cyberspace as a strategic priority, therefore seeking to act as a promoter of a multi-stakeholder model. Moreover, interpolariy in cyberspace determines the contestation of EU role by other poles. While the EU has recorded some small successes as a regulation-setter, emerging poles of power in the cybersecurity domain contest the EU’s desired role, promoting more state-centric approaches and seeking to transfer regulatory authority in the cybersecurity domain to the UN.

The PIVO process for identifying vulnerabilities impact for organisation risks: An automated solution

Risk management (RM) and vulnerability management (VM) are both essential cyber security domains. They are often managed independently without a proper interface to provide context information to each other and share information. This paper proposes an approach to connect RM and VM processes based on data standardisation through referential and automation to relate vulnerabilities to operational risk scenarios. The focus is mainly on the identification of the referential and their added value to complement a method described in a previous paper.

Cybersecurity Knowledge Extraction Using XAI

Global networking, growing computer infrastructure complexity and the ongoing migration of many private and business aspects to the electronic domain commonly mandate using cutting-edge technologies based on data analysis, machine learning, and artificial intelligence to ensure high levels of network and information system security. Transparency is a major barrier to the deployment of black box intelligent systems in high-risk domains, such as the cybersecurity domain, with the problem getting worse as machine learning models increase in complexity. In this research, explainable machine learning is used to extract information from the CIC-IDS2017 dataset and to critically contrast the knowledge attained by analyzing if–then decision tree rules with the knowledge attained by the SHAP approach. The paper compares the challenges of the knowledge extraction using the SHAP method and the if–then decision tree rules, providing guidelines regarding different approaches suited to specific situations.

Argumentation-Based Query Answering under Uncertainty with Application to Cybersecurity

Decision support tools are key components of intelligent sociotechnical systems, and their successful implementation faces a variety of challenges, including the multiplicity of information sources, heterogeneous format, and constant changes. Handling such challenges requires the ability to analyze and process inconsistent and incomplete information with varying degrees of associated uncertainty. Moreover, some domains require the system’s outputs to be explainable and interpretable; an example of this is cyberthreat analysis (CTA) in cybersecurity domains. In this paper, we first present the P-DAQAP system, an extension of a recently developed query-answering platform based on defeasible logic programming (DeLP) that incorporates a probabilistic model and focuses on delivering these capabilities. After discussing the details of its design and implementation, and describing how it can be applied in a CTA use case, we report on the results of an empirical evaluation designed to explore the effectiveness and efficiency of a possible world sampling-based approximate query answering approach that addresses the intractability of exact computations.

Cybersecurity challenges in the knowledge economy

Abstract The paper aims to study cybersecurity correlations with the knowledge economy, focusing on its challenges in this new age of economy. The relevance of the cybersecurity concept is sustained by the academic literature that shows its important role in the business environment, where disruptive changes will become the norm. In the digital age the disruptions are happening frequently which gives organizations less time to manage the change and the fact that they are almost constrained to develop new strategies to answer the challenges of the changing business environment. The knowledge economy has evolved and with that, new concepts began to appear out of necessity and the need to secure the dynamic environment of knowledge management systems. Considering the unprecedented access to information and advancements in conducting academic research, in the present landscape of the knowledge economy and cybersecurity domain, new methods are available to structure and examine a body of literature. The text mining and scientific mapping analysis conducted with VOSviewer software version 1.6.18 is allowing us to identify meaningful insights about the knowledge economy concept, such as the (1) existing research gaps, at least on cybersecurity challenges in the knowledge economy and the (2) the research interests seen for the time period between 2019 and 2021. To achieve this, a database derived from Web of Science’s core collection has been used, and the text mining based on term co-occurrence analysis contributed to a deeper understanding of current and future workspace dynamics.

Reliable detection of compressed and encrypted data

Several cybersecurity domains, such as ransomware detection, forensics and data analysis, require methods to reliably identify encrypted data fragments. Typically, current approaches employ statistics derived from byte-level distribution, such as entropy estimation, to identify encrypted fragments. However, modern content types use compression techniques which alter data distribution pushing it closer to the uniform distribution. The result is that current approaches exhibit unreliable encryption detection performance when compressed data appear in the dataset. Furthermore, proposed approaches are typically evaluated over few data types and fragment sizes, making it hard to assess their practical applicability. This paper compares existing statistical tests on a large, standardized dataset and shows that current approaches consistently fail to distinguish encrypted and compressed data on both small and large fragment sizes. We address these shortcomings and design EnCoD, a learning-based classifier which can reliably distinguish compressed and encrypted data. We evaluate EnCoD on a dataset of 16 different file types and fragment sizes ranging from 512B to 8KB. Our results highlight that EnCoD outperforms current approaches by a wide margin, with accuracy ranging from sim 82% for 512B fragments up to sim 92% for 8KB data fragments. Moreover, EnCoD can pinpoint the exact format of a given data fragment, rather than performing only binary classification like previous approaches.

Cybersecurity Threats and Their Mitigation Approaches Using Machine Learning—A Review

Machine learning is of rising importance in cybersecurity. The primary objective of applying machine learning in cybersecurity is to make the process of malware detection more actionable, scalable and effective than traditional approaches, which require human intervention. The cybersecurity domain involves machine learning challenges that require efficient methodical and theoretical handling. Several machine learning and statistical methods, such as deep learning, support vector machines and Bayesian classification, among others, have proven effective in mitigating cyber-attacks. The detection of hidden trends and insights from network data and building of a corresponding data-driven machine learning model to prevent these attacks is vital to design intelligent security systems. In this survey, the focus is on the machine learning techniques that have been implemented on cybersecurity data to make these systems secure. Existing cybersecurity threats and how machine learning techniques have been used to mitigate these threats have been discussed. The shortcomings of these state-of-the-art models and how attack patterns have evolved over the past decade have also been presented. Our goal is to assess how effective these machine learning techniques are against the ever-increasing threat of malware that plagues our online community.

A framework for conceptual characterization of ontologies and its application in the cybersecurity domain

A framework for conceptual characterization of ontologies and its application in the cybersecurity domain

The local self-government’s place in the cybersecurity domain. Examples of Poland and Hungary

The local self-government’s place in the cybersecurity domain. Examples of Poland and Hungary

An adaptive randomized and secured approach against adversarial attacks

ABSTRACT With the rising trends and use of machine learning algorithms for classification and regression tasks, deep learning has been widely accepted in the Cyber and as well as non-Cyber Domain. Recent researches have shown that machine learning classifiers such as Deep Neural Networks (DNN) can be used to improve the detection against adversarial samples as well as to detect malware in the cyber security domain. However, a recent study in deep learning has found that DNN classifiers are highly vulnerable and can be evaded simply by either performing small modifications in the training model or training data. The work proposed a randomized defensive mechanism with the use of generative adversarial networks to construct more adversaries and then defend against them. Interestingly, we encountered some open challenges highlighting common difficulties faced by defensive mechanisms. We provide a general overview of adversarial attacks and proposed an Adaptive Randomized Algorithm to enhance the robustness of models. Moreover, this work aimed to ensure the security and transferability of deep learning classifiers.