Cybersecurity Domain Research Articles

Autonomous security assessment model using genetic algorithm in cyber-security domain for healthcare documents

In this article, an organization data security appraisal model dependent on abreast hypothesis was considered and advanced. Based on completely considering the data security issues evaluation interaction and components, the degree and mischief of the assault were broke down, and information sources and the particular techniques for incorporating circumstance factors and key hubs were applied to plan the general model, in this way guaranteeing the precision of healthcare documents through cyber-security approaches. The use of hereditary calculation in the dependability investigation of PC correspondence networks is of extraordinary importance. In this paper, the dependability examination and utilization of PC correspondence network dependent on hereditary calculation were considered. The primary substances of hereditary calculation were presented. Simultaneously, the primary substance and exploration techniques for the unwavering quality investigation of PC correspondence network were talked about. Finally, the exploration results were examined and talked about. The outcomes show that the use of hereditary calculation in PC correspondence network dependability investigation is acceptable, which gives a positive evaluation to attain better efficiency of PC correspondence network.

SARCP

In the domain of cyber security, the defence mechanisms of networks has traditionally been placed in a reactionary role. Cyber security professionals are therefore disadvantaged in a cyber-attack situation due to the fact that it is vital that they maneuver such attacks before the network is totally compromised. In this paper, we utilize the Betweenness Centrality network measure (social property) to discover possible cyber-attack paths and then employ computation of similar personality of nodes/users to generate predictions about possible attacks within the network. Our method proposes a social recommender algorithm called socially-aware recommendation of cyber-attack paths (SARCP), as an attack predictor in the cyber security defence domain. In a social network, SARCP exploits and delivers all possible paths which can result in cyber-attacks. Using a real-world dataset and relevant evaluation metrics, experimental results in the paper show that our proposed method is favorable and effective.

A Comparative Study on the Application of Text Mining in Cybersecurity

Aims:This paper aims to conduct a Systematic Literature Review (SLR) of the relative applications of text mining in cybersecurity.Objectives:worldwide has been attributed to a change in the different activities associated with cyber security and demands a high automation level.Methods:In the cyber security domain, text mining is an alternative for improving the usefulness of various activities that entail unstructured data. This study searched databases of 516 papers from 2015 to 21. Out of which 75 papers are selected for analysis. A detailed evaluation of the selected studies employs source, techniques, and information extraction on cyber security applications.Results:This study extends gaps for future study such as text processing, availability of datasets, innovative methods, intelligent text mining.Conclusion:This study concludes with interesting findings of employing text mining in cybersecurity applications; the researchers need to exploit all related techniques and algorithms in text mining to detect and protect the organization from Cybersecurity applications.

A Mathematical Model for Risk Assessment of Social Engineering Attacks

Social engineering is a very common type of malicious activity conducted on cyberspace that targets both individuals and companies in order to gain access to information or systems. It is part of the broader domain of cybersecurity and the first step to mitigate this type of attack is to know its attack vectors. This way, the risk of becoming a victim of this type of attack can be reduced by technical means, proper security culture and procedural solutions – if organizations are referred to.

Impact of Cybersecurity on Digital Marketing

Digital marketing is a go-to technique for new businesses and established organizations to interact with their target audience. The popularity of digital media has grown ten-fold, every consumer uses some or the other form of media through which companies aim to market their product. Reaching a wide audience has never been easier. Due to consumers’ dependency on online platforms greatly impacting their purchase decisions, marketers have shifted their business to digital means thus making digital marketing the new-age marketing technique. However, with the increased use of the digital platform for marketing, increased security risks arise in the same as well. With the advancement of technology, the occurrence of cyberattacks and data breaches that could compromise sensitive user information is also on the rise. In this study, we look at how digital platforms of various types are at a security risk while also looking at the trends in both digital marketing as well information security. This study is predominantly exploratory as the combination of digital marketing and cybersecurity is not much studied. The methodology for this study includes depth interviews with experts from the digital marketing and cybersecurity domains to get first-hand information about the trends in their respective industries. A questionnaire that tackles aspects of both industries was also formed, the purpose of this questionnaire was to gauge digital marketing employees’ knowledge and awareness about cybersecurity concerning their field of expertise. This study identified different methods of digital marketing and the possible threats that can occur in the same and understand how cybersecurity can help in mitigating risks in digital platforms.

Deep learning model for distributed denial of service (DDoS) detection

Distributed denial of service (DDoS) attacks is one of the serious threats in the domain of cybersecurity where it affects the availability of online services by disrupting access to its legitimate users. The consequences of such attacks could be millions of dollars in worth since all of the online services are relying on high availability. The magnitude of DDoS attacks is ever increasing as attackers are smart enough to innovate their attacking strategies to expose vulnerabilities in the intrusion detection models or mitigation mechanisms. The history of DDoS attacks reflects that network and transport layers of the OSI model were the initial target of the attackers, but the recent history from the cybersecurity domain proves that the attacking momentum has shifted toward the application layer of the OSI model which presents a high degree of difficulty distinguishing the attack and benign traffics that make the combat against application-layer DDoS attack a sophisticated task. Striding for high accuracy with high DDoS classification recall is key for any DDoS detection mechanism to keep the reliability and trustworthiness of such a system. In this paper, a deep learning approach for application-layer DDoS detection is proposed by using an autoencoder to perform the feature selection and Deep neural networks to perform the attack classification. A popular benchmark dataset CIC DoS 2017 is selected by extracting the most appealing features from the packet flows. The proposed model has achieved an accuracy of 99.83% with a detection rate of 99.84% while maintaining the false-negative rate of 0.17%, which has the heights accuracy rate among the literature reviewed so far.

Deep Learning for Phishing Detection: Taxonomy, Current Challenges and Future Directions

Phishing has become an increasing concern and captured the attention of end-users as well as security experts. Existing phishing detection techniques still suffer from the deficiency in performance accuracy and inability to detect unknown attacks despite decades of development and improvement. Motivated to solve these problems, many researchers in the cybersecurity domain have shifted their attention to phishing detection that capitalizes on machine learning techniques. Deep learning has emerged as a branch of machine learning that becomes a promising solution for phishing detection in recent years. As a result, this study proposes a taxonomy of deep learning algorithm for phishing detection by examining 81 selected papers using a systematic literature review approach. The paper first introduces the concept of phishing and deep learning in the context of cybersecurity. Then, taxonomies of phishing detection and deep learning algorithm are provided to classify the existing literature into various categories. Next, taking the proposed taxonomy as a baseline, this study comprehensively reviews the state-of-the-art deep learning techniques and analyzes their advantages as well as disadvantages. Subsequently, the paper discusses various issues that deep learning faces in phishing detection and proposes future research directions to overcome these challenges. Finally, an empirical analysis is conducted to evaluate the performance of various deep learning techniques in a practical context, and to highlight the related issues that motivate researchers in their future works. The results obtained from the empirical experiment showed that the common issues among most of the state-of-the-art deep learning algorithms are manual parameter-tuning, long training time, and deficient detection accuracy.

A New Multistage Encryption Scheme Using Linear Feedback Register and Chaos‐Based Quantum Map

With the increasing volume of data transmission through insecure communication channels, big data security has become one of the important concerns in the cybersecurity domain. To address these concerns and keep data safe, a robust privacy‐preserving cryptosystem is necessary. Such a solution relies on chaos encryption algorithms over standard cryptographic methods that possess multistage encryption levels, including high speed, high security, low compute overheads, and procedural power, among other characteristics. In this work, a secure image encryption scheme is proposed using linear feedback shift register (LFSR) and chaos‐based quantum chaotic map. The focus of the scheme is mainly dependent on the secret keys from the input of the algorithm. The threat landscape, the statistical test analysis, along critical comparisons with other schemes indicate that the presented algorithm is significantly secure and is resistant to a wide range of different attacks such as differential and statistical attacks. The proposed method has sufficiently higher sensitivity and security when compared to existing encryption algorithms. Several security parameters validated the security of proposed work such as correlation coefficient analyses among the neighboring pixels, entropy, the number of pixels change rate (NPCR), unified average change intensity (UACI), mean square error (MSE), brute force, key sensitivity, and peak signal to noise ratio (PSNR) analyses. The randomness of the ciphers produced by the proposed technique is also passed through NIST‐800‐22. The results of NIST indicate that the ciphers are highly random and do not produce any type of periodicity or pattern.

Cyber-Neuro RT: Real-time Neuromorphic Cybersecurity

High throughput environments, such as those found in high performance computing (HPC) clusters, run at substantially greater scales than standard business IT domains. As a result, cybersecurity tools built for businesses utilizing standard machine learning frameworks are unable to handle the increased amount of traffic and connections in high throughput environments. Neural networks, in combination with edge-based next-generation embedded technologies such as neuromorphic processors, offer a solution to cybersecurity challenges in high throughput environments. Deep learning (DL), deep learning to spiking neural network (DL-to-SNN) conversions, and design exploration inside SNNs were among the experiments employed to explore this area. Neuromorphic implementations of deep learning networks often provide the same accuracy as full precision models while saving substantial power and cost. We explore this statement in the cybersecurity domain. Results are promising but will be further investigated.

Combining Long-Term Recurrent Convolutional and Graph Convolutional Networks to Detect Phishing Sites Using URL and HTML

Phishing, a well-known cyber-attack practice has gained significant research attention in the cyber-security domain for the last two decades due to its dynamic attacking strategies. Although different solutions have been exercised against phishing, phishing attacks have dramatically increased in the past few years. Recent studies have shown that machine learning has become prominent in the present anti-phishing context, and the techniques like deep learning have extensively improved anti-phishing tools’ detection ability. This paper proposes PhishDet, a new way of detecting phishing websites through Long-term Recurrent Convolutional Network and Graph Convolutional Network using URL and HTML features. PhishDet is the first of its kind, which uses the powerful analysis and processing capabilities of Graph Neural Network in the anti-phishing domain and recorded 96.42% detection accuracy, with a 0.036 false-negative rate. It is effective against zero-day attacks, and the average detection time which is 1.8 seconds could also be considered realistic. The feature selection of PhishDet is automatic and occurs inside the system, as PhishDet gradually learns URLs and HTML content features to handle constantly changing phishing attacks. This has outperformed similar solutions by achieving a 99.53% f1-score with a public benchmark dataset. However, PhishDet requires periodic retraining to maintain its performance over time. If such retraining could be facilitated, PhishDet could fight against phishers for a more extended period to safeguard Internet users from this Internet threat.

Methodological Framework for the Development of an English-Lithuanian Cybersecurity Termbase

The aim of the paper is to present a methodological framework for the development of an English-Lithuanian bilingual termbase in the cybersecurity domain, which can be applied as a model for other language pairs and other specialised domains. It is argued that the presented methodological approach can ensure creation of high-quality bilingual termbases even with limited available resources. The paper touches upon the methods and problems of dataset (corpora) compilation, terminology annotation, automatic bilingual term extraction (BiTE) and alignment, knowledge-rich context extraction, and linguistic linked open data (LLOD) technologies. The paper presents theoretical considerations as well as the arguments on the effectiveness of the described methods. The theoretical analysis and a pilot study allow arguing that: 1) a combination of parallel and comparable corpora enable to considerably expand the amount and variety of data sources that can be used for terminology extraction; this methodology is especially important for less-resourced languages which often lack parallel data; 2) deep learning systems trained by using manually annotated data (gold standard corpora) allow effective automatization of extraction of terminological data and metadata, which enables to regularly update termbases with minimised manual input; 3) LLOD technologies enable to integrate the terminological data into the global linguistic data ecosystem and make it reusable, searchable and discoverable across the Web.

Analyzing the Impact of Cyber Security Related Attributes for Intrusion Detection Systems

Machine learning (ML) is one of the dominating technologies practiced in both the industrial and academic domains throughout the world. ML algorithms can examine the threats and respond to intrusions and security incidents swiftly in an instinctive way. It plays a critical function in providing a proactive security mechanism in the cybersecurity domain. Cybersecurity ensures the real time protection of information, information systems, and networks from intruders. Several security and privacy reports have cited that there has been a rapid increase in both the frequency and the number of cybersecurity breaches in the last decade. Information security has been compromised by intruders at an alarming rate. Anomaly detection, phishing page identification, software vulnerability diagnosis, malware identification, and denial of services attacks are the main cyber-security issues that demand effective solutions. Researchers and experts have been practicing different approaches to address the current cybersecurity issues and challenges. However, in this research endeavor, our objective is to make an idealness assessment of machine learning-based intrusion detection systems (IDS) under the hesitant fuzzy (HF) conditions, using a multi-criteria decision making (MCDM)-based analytical hierarchy process (AHP) and technique for order of preference by similarity to ideal-solutions (TOPSIS). Hesitant fuzzy sets are useful for addressing decision-making situations in which experts must overcome the reluctance to make a conclusion. The proposed research project would assist the machine learning practitioners and cybersecurity specialists in identifying, selecting, and prioritizing cybersecurity-related attributes for intrusion detection systems, and build more ideal and effective intrusion detection systems.

Augmenting zero trust architecture to endpoints using blockchain: A state‐of‐the‐art review

AbstractWith the purpose of defending against lateral movement in today's borderless networks, zero trust architecture (ZTA) adoption is gaining momentum. With a full‐scale ZTA implementation, it is unlikely that adversaries will be able to spread through the network starting from a compromised endpoint. However, the already authenticated and authorized session of a compromised endpoint can be leveraged to carry out limited, though malicious, activities ultimately rendering the endpoints the Achilles heel of ZTA. To effectively detect such attacks, distributed collaborative intrusion detection systems with an attack scenario‐based approach have been developed. Nonetheless, advanced persistent threats have demonstrated their ability to bypass this approach with a high success ratio. As a result, adversaries can pass undetected or potentially alter the detection logging mechanisms to achieve a stealthy presence. Recently, blockchain technology has demonstrated solid use cases in the cyber security domain. In this paper, motivated by the convergence of ZTA and blockchain‐based intrusion detection and prevention, we examine how ZTA can be augmented onto endpoints. Namely, we perform a state‐of‐the‐art review of ZTA models, real‐world architectures with a focus on endpoints, and blockchain‐based intrusion detection systems. We discuss the potential of blockchain's immutability fortifying the detection process and identify open challenges as well as potential solutions and future directions.

Building Resilient Health Systems Intelligence: Adapting Indicators of Compromise for the Cyber-Bionexus.

The health sector is an underutilized source of actionable health intelligence for responding to threats across the "cyber-bionexus," defined as the convergence of threats from the biological and cybersecurity domains to produce harms with widespread societal consequences. The escalation of concerns about such threats-related to misinformation and disinformation; chemical, biological, radiological, and nuclear events; cyberattacks; natural disease outbreaks; and disasters of various kinds-places health system concerns squarely at the forefront of national critical systems and broader security imperatives. Events such as the COVID-19 pandemic have highlighted the dearth of systems available for generating real-time intelligence in relation to critical functions of health sector operations amidst an unfolding crisis. Drawing on principles from the field of cyberthreat intelligence, and building on existing scholarship in health security intelligence, we propose a model for applying health system indicators of compromise for cyberbio events. We further discuss the relevance of this approach within the broader landscape of the cyber-bionexus to signal new pathways for research, practice, and policy engagement.

The Design of Reciprocal Learning Between Human and Artificial Intelligence

The need for advanced automation and artificial intelligence (AI) in various fields, including text classification, has dramatically increased in the last decade, leaving us critically dependent on their performance and reliability. Yet, as we increasingly rely more on AI applications, their algorithms are becoming more nuanced, more complex, and less understandable precisely at a time we need to understand them better and trust them to perform as expected. Text classification in the medical and cybersecurity domains is a good example of a task where we may wish to keep the human in the loop. Human experts lack the capacity to deal with the high volume and velocity of data that needs to be classified, and ML techniques are often unexplainable and lack the ability to capture the required context needed to make the right decision and take action. We propose a new abstract configuration of Human-Machine Learning (HML) that focuses on reciprocal learning, where the human and the AI are collaborating partners. We employ design-science research (DSR) to learn and design an application of the HML configuration, which incorporates software to support combining human and artificial intelligences. We define the HML configuration by its conceptual components and their function. We then describe the development of a system called Fusion that supports human-machine reciprocal learning. Using two case studies of text classification from the cyber domain, we evaluate Fusion and the proposed HML approach, demonstrating benefits and challenges. Our results show a clear ability of domain experts to improve the ML classification performance over time, while both human and machine, collaboratively, develop their conceptualization, i.e., their knowledge of classification. We generalize our insights from the DSR process as actionable principles for researchers and designers of 'human in the learning loop' systems. We conclude the paper by discussing HML configurations and the challenge of capturing and representing knowledge gained jointly by human and machine, an area we feel has great potential.

Domain adaptation for Windows advanced persistent threat detection

Like many cyber security domains, data availability influences many active decisions and research trajectories in the advanced persistent threat (APT) landscape. Current solutions relying on many temporal constrains have limited generalization for new threats. In this paper, these two challenges are addressed, whereby we introduce domain adaptation to broaden the availability of data to improve APT detection while determining the relevance of separating samples based on their reported use. With the ability to introduce new data, namely in the APT-Executable (APT-EXE) dataset, we propose a new method to adapt over 4500 APT malware log samples to our target domain and achieve superior detection performance. A combination of transductive and inductive adaptation is applied by adapting the distribution of APT file system interaction. Adaptation is applied to retrieve system driven access and usage structure and functionality interaction footprints. The aligned distribution of log entries is projected within a Riemannian manifold. A weighted geodesics distance between APT samples and unseen log entries is measured, and APT driven Bayes net (APT-BN) is probed for queries for respective techniques respectively for adaptation and footprint methods. The proposed method is evaluated on 183 different Windows APT samples for 207 processes from 20 documented APT campaigns 2018 and onward. Comparisons are made based on the proposed method, multiple state-of-the-art log embedding techniques, and established text processing techniques. The proposed method outperforms all techniques in reducing false positives to less than 100 in 100,000 processes and a true positive rate of 0.80%. Thus, domain adaptation methods are promising to mitigate the challenges of detecting APTs.

International Law and Cyberoperations

Foreign cyberattacks and interferences are becoming more frequent and sophisticated. In the continued absence of a general consensus regarding the applicability of concrete international legal rules in the domain of cybersecurity, individual States are beginning to determine unilaterally their national positions. The article introduces and critically assesses the national strategy of France published in late 2019 in light of current international law and further developments in 2020. France confirms the validity of current international legal norms and raises challenging and innovative legal points for an efficient update such as the right to respond to any unlawful cyberoperation that targets France, right to preemptive self-defence, and violation of the due diligence principle. The mission of the article is to evaluate the document as an important source of impetus and the potential of its impact in international law of cybersecurity.

XSRU-IoMT: Explainable simple recurrent units for threat detection in Internet of Medical Things networks

The Internet of Medical Things (IoMT) is increasingly replacing the traditional healthcare systems. However, less focus has been paid to their security against cyber-threats in the implementation of the IoMT and its networks. One of the key reasons can be the challenging task of optimizing typical security solutions to the IoMT networks. And despite the rising admiration of machine learning and deep learning methods in the cyber-security domain (e.g., a threat detection system), most of these methods are acknowledged as a black-box model. The explainable AI (XAI) has become progressively vital to understand the employed learning models to improve trust level and empower security experts to interpret the prediction decisions. The authors propose a highly efficient model named XSRU-IoMT, for effective and timely detection of sophisticated attack vectors in IoMT networks. The proposed model is developed using novel bidirectional simple recurrent units (SRU) using the phenomenon of skip connections to eradicate the vanishing gradient problem and achieve a fast training process in recurrent networks. We also explore the concepts of XAI to improve trust level by providing explanations of the predictive decisions and enabling humans and security experts to understand the causal reasoning and underlying data evidence. The evaluation results on the ToN_IoT dataset demonstrate the effectiveness and superiority of the proposed XSRU-IoMT model as compared to the state-of-the-art compelling detection models, suggesting its usefulness as a viable deployment model in real-IoMT networks.

Human Factors in Interactive Machine Learning: A Cybersecurity Case Study

Cybersecurity is emerging as a major issue for many organizations and countries. Machine learning has been used to recognize threats, but it is difficult to predict future threats based on past events, since malicious attackers are constantly finding ways to circumvent defences and the algorithms that they rely on. Interactive Machine learning (iML) has been developed as a way to combine human and algorithmic expertise in a variety of domains and we are currently applying it to cybersecurity. In this application of iML, implicit knowledge about human behaviour, and about the changing nature of threats, can supplement the explicit knowledge encoded in algorithms to create more effective defences against cyber-attacks. In this paper we present the example problem of data exfiltration where insiders, or outsiders masquerading as insiders, who copy and transfer data maliciously, against the interests of an organization. We will review human factors issues associated with the development of iML solutions for data exfiltration. We also present a case study involving development of an iML solution for a large financial services company. In this case study we review work carried out on developing visualization dashboards and discussing prospects for further iML integration. Our goal in writing this paper is to motivate future researchers to consider the role of the human more fully in ML, not only in the data exfiltration and cybersecurity domain but also in a range of other applications where human expertise is important and needs to combine with ML prediction to solve challenging problems.

A new approach to combine multiplex networks and time series attributes: Building intrusion detection systems (IDS) in cybersecurity

• A new computationally and temporally efficient methodology to represent the relationships between assets through a multiplexed network whose edges include temporal attributes. • A combination of two mathematical domains (signal processing and complex networks) increases the accuracy of each of them separately. • An application of a new methodology in the cybersecurity domain provides promising results with a more computationally efficient effort. Intrusion Detection Systems (IDS) are fundamental tools in cybersecurity environments. In this paper, we present a new methodology for the creation of intrusion detection systems (IDS) based on a strategy that combines the use of multiplex networks and time series analysis to provide a probability that an IP address be an attacker in a certain time. This approach reduces the number of alerts to a small number of IP addresses as well as the computation effort by not having to analyze each event independently. The evaluation of all traffic happens only at pre-defined times. The methodology relies on both the original utilization of some unsupervised machine learning techniques and on the use of certain time series attributes and their representation as a complex multiplex network, achieving a very significant reduction in the dimensionality of the resulting data representation. The result is a very effective intrusion detection system in large corporate environments and a new approach in the representation of the analyzed data as shown in the real case presented.