Cybersecurity Data Research Articles

The need for cybersecurity data and metrics: empirically assessing cyberthreat

ABSTRACT Without assessment metrics and data, the cybersecurity community maintains no ability to evaluate the success or scope of operations. Calls for the collection of cybersecurity indicators are empty without strategic guidance on what indicators to collect, for what purpose, and for what method of analysis. This paper reviews the purpose, function and need for cybersecurity data and metrics with an in-depth review of United States metrics guidance offered in the National Defense Authorisation Act (NDAA) and National Institute of Standards and Technology (NIST) publications on metrics. Mission assessment is critical to evaluate the efficacy of ongoing and future cybersecurity efforts; assessments require quantitative metrics that place concrete values on indicators rather than subjective judgments.

Application of Machine Learning Technologies for Transport layer Congestion Control

Due to the advent of technology, humans now live in the modern age of information and data. In this form of world, different objects are interlinked to data sources, and every aspect of human’s lives are recorded in a digital form. For example, the present electronic globe has an abundance of distinct forms of data e.g., health data, social media fata, smartphone data, business data, smart city data, cybersecurity data and Internet of Things (IoT) data, including Covid-19 data. Data can be unstructured, semi-structured and structured, and this is increasing on a daily basis. Machine Learning (ML) is significantly employed in different aspects of real-life e.g., Congestion Control (CC). This paper provides an evaluation of the aspect ML employed in CC. CC has emerged as a fundamental viewpoint in communications system infrastructure in the recent years, since network operations, and network capacity have enhanced at a rapid rate.

USING MACHINE LEARNING METHODS IN CYBERSECURITY

Abstract Cybersecurity is an ever-changing field, with advances in technology that open up new opportunities for cyberattacks. In addition, even though serious secu- rity breaches are often reported, small organizations still have to worry about security breaches as they can often be the target of viruses and phishing. This is why it is so important to ensure the privacy of your user profile in cyberspace. The past few years have seen a rise in machine learning algorithms that address major cybersecu- rity issues such as intrusion detection systems (IDS), detection of new modifications of known malware, malware, and spam detection, and malware analysis. In this arti- cle, algorithms have been analyzed using data mining collected from various libraries, and analytics with additional emerging data-driven models to provide more effective security solutions. In addition, an analysis was carried out of companies that are en- gaged in cyber attacks using machine learning. According to the research results, it was revealed that the concept of cybersecurity data science allows you to make the computing process more efficient and intelligent compared to traditional processes in the field of cybersecurity. As a result, according to the results of the study, it was revealed that machine learning, namely unsupervised learning, is an effective method of dealing with risks in cybersecurity and cyberattacks.

Dimensionality reduction of the attributes using fuzzy optimized independent component analysis for a Big Data Intrusion Detection System

Big data cybersecurity has garnered more attraction in recent years with the development of advanced machine learning and deep learning classifiers. These new classifier algorithms have significantly improved Intrusion Detection Systems (IDS). In these classifiers, the performance is positively influenced by high relevant features while less relevant features negatively influence the performance. However, considering all the attributes, especially the high dimensional attributes, increases computational complications. Hence it is essential to diminish the dimensionality of the attributes to improve the classifier performance. To achieve this objective, an efficient dimensionality reduction approach is presented through the development of the Fuzzy Optimized Independent Component Analysis (FOICA) technique. The standard Independent Component Analysis (ICA) is coupled with the fuzzy entropy to transform the high dimension attributes into low dimension attributes and helps in selecting high informative low-dimensional attributes. These selected features are fed to efficient hybrid classifiers namely Hyper-heuristic Support Vector Machines (HH-SVM), Hyper-Heuristic Improved Particle Swarm Optimization based Support Vector Machines (HHIPSO-SVM) and Hyper-Heuristic Firefly Algorithm based Convolutional Neural Networks (HHFA-CNN) to classify the cybersecurity data to identify the intrusions. Experiments are conducted over two cybersecurity datasets and real-time laboratory data whose outcomes specify the supremacy of the suggested IDS model based on FOICA dimensionality reduction.

Cybersecurity data science and threats: an overview from machine learning perspective

Cybersecurity data science and threats: an overview from machine learning perspective

An Efficient Kernel Density Based Algorithm of Big Data in Cybersecurity for Enhancing Smart City

Smart cities are attracting much interest in terms of future development. As new technologies come on stream, ordinary towns are reshaping themselves as smart cities, where technology is used to improve connections between all elements of the town. The technology can be embedded everywhere and can harvest data for dedicated smart city applications. Smart cities will have a huge number of different devices running these applications. There will be a substantial amount of data associated with these devices. In the interlinked smart city environment, many different messages could be shared between them. Such devices will be associated with many security risks and privacy issues, as many of the shared statistics could also hold personal data. A substantial review of research has been recently undertaken to ensure that data will be safe in the smart city environment. This review has included all the latest research in the area and is intended to ensure that all the data required to run green smart cities and the devices required for them will remain secure and confidential.

Cyber (In)security of Personal Data and Information in Times of Digitization

In an employment relationship, work and pay are no longer the only important aspects, as importance is increasingly shifting toward obligations concerning the protection of personal data and privacy arising from the prohibition of causing harm to the employer and the duty of loyalty to the employer. The article deals with the constitutionally protected right to privacy and the protection of personal data from the point of view of ensuring cyber security at the employer. The employer is obligated to protect the right to privacy by legal provisions, whereas from the point of view of ensuring the protection of privacy and information, the employer must protect, first and foremost, the personal data of employees. The main purpose of the legal protection of personal data is the lawful and fair processing of the personal data of individuals. Employers are thus facing an increasing number of risks related to the safety of employees and the security of business processes, and it is therefore important to establish comprehensive corporate security to ensure adequate security across all levels.

European Union ∙ Commission Delegated Regulation (EU) 2022/30 Supplementing Directive 2014/53/EU on Radio Equipment: Strengthening Cybersecurity, Privacy and Personal Data Protection of Wireless Devices

European Union ∙ Commission Delegated Regulation (EU) 2022/30 Supplementing Directive 2014/53/EU on Radio Equipment: Strengthening Cybersecurity, Privacy and Personal Data Protection of Wireless Devices

Systematic Literature Review on Cyber Situational Awareness Visualizations

The dynamics of cyber threats are increasingly complex, making it more challenging than ever for organizations to obtain in-depth insights into their cyber security status. Therefore, organizations rely on Cyber Situational Awareness (CSA) to support them in better understanding the threats and associated impacts of cyber events. Due to the heterogeneity and complexity of cyber security data, often with multidimensional attributes, sophisticated visualization techniques are needed to achieve CSA. However, there have been no previous attempts to systematically review and analyze the scientific literature on CSA visualizations. In this paper, we systematically select and review 54 publications that discuss visualizations to support CSA. We extract data from these papers to identify key stakeholders, information types, data sources, and visualization techniques. Furthermore, we analyze the level of CSA supported by the visualizations, alongside examining the maturity of the visualizations, challenges, and practices related to CSA visualizations to prepare a full analysis of the current state of CSA in an organizational context. Our results reveal certain gaps in CSA visualizations. For instance, the largest focus is on operational-level staff, and there is a clear lack of visualizations targeting other types of stakeholders such as managers, higher-level decision makers, and non-expert users. Most papers focus on threat information visualization, and there is a dearth of papers that visualize impact information, response plans, and information shared within teams. Interestingly, we find that only a few studies proposed visualizations to facilitate up to the projection level (i.e., the highest level of CSA), whereas most studies facilitated only the perception level (i.e., the lowest level of CSA). Most of the studies provide evidence of the proposed visualizations through toy examples and demonstrations, while only a few visualizations are employed in industrial practice. Based on the results that highlight the important concerns in CSA visualizations, we recommend a list of future research directions.

Map-Reduce based Ensemble Intrusion Detection System with Security in Big Data

In Many domains, data is increasing day by day. Moreover, the large amount of data creates the best challenges for the users. Big data is one of the high focus domains in data science. In many organizations, big data plays a major role in processing large datasets and extracts useful information from the data. Security becomes more important to all the domains and applications. Many applications use different types of security approaches to secure sensitive data from attackers. Many real-time applications are providing security for applications such as banking, trading, and e-commerce applications using better security algorithms. Processing a large amount of real-time data gets a lot of benefits to analyzing the threats in cyber-security systems. The data is collected from online real-time sources and this cyber security data consists of network information, sensor data, threat information, analysis of intrusion detection, and identifying the sensitive data in real-time applications. In this collected information various vulnerabilities and attacks are becoming prevalent and develop security solutions accordingly. In this paper, the Map-reduce-based Ensemble Intrusion Detection System (MR-EIDS) is developed to detect intruders and attackers from the real-time datasets. Two benchmark datasets are used to analyze the intrusion data. The proposed system analyzes the dataset and finds interesting patterns in the datasets. Performance is also measured by showing improved results.

On the scalability of Big Data Cyber Security Analytics systems

Big Data Cyber Security Analytics (BDCA) systems use big data technologies (e.g., Apache Spark) to collect, store, and analyse a large volume of security event data for detecting cyber-attacks. The volume of digital data in general and security event data in specific is increasing exponentially. The velocity with which security event data is generated and fed into a BDCA system is unpredictable. Therefore, a BDCA system should be highly scalable to deal with the unpredictable increase/decrease in the velocity of security event data. However, there has been little effort to investigate the scalability of BDCA systems to identify and exploit the sources of scalability improvement. In this paper, we first investigate the scalability of a Spark-based BDCA system with default Spark settings. We then identify Spark configuration parameters (e.g., execution memory) that can significantly impact the scalability of a BDCA system. Based on the identified parameters, we finally propose a parameter-driven adaptation approach, SCALER, for optimizing a system's scalability. We have conducted a set of experiments by implementing a Spark-based BDCA system on a large-scale OpenStack cluster. We ran our experiments with four security datasets. We have found that (i) a BDCA system with default settings of Spark configuration parameters deviates from ideal scalability by 59.5% (ii) 9 out of 11 studied Spark configuration parameters significantly impact scalability and (iii) SCALER improves the BDCA system's scalability by 20.8% compared to the scalability with default Spark parameter setting. The findings of our study highlight the importance of exploring the parameter space of the underlying big data framework (e.g., Apache Spark) for scalable cyber security analytics.

Features of cash audit in the conditions of ensuring the enterprise’s cybersecurity

Introduction. Today, cash accounting transactions are important in the organization and activities of any enterprise, because they cover almost all areas of its financial and economic activities and require significant attention from the auditor, as during their implementation may occur various violations and overuses by officials of the enterprise. Since cash is the most mobile asset and in today’s business environment, basically, all cash payments are non-cash (electronically), there is a high probability of overuse by third parties. Therefore, performing an audit of cash operations and implementation cybersecurity of data about their calculations is an extremely important issue to increase the efficiency of accounting and management them in enterprises. The purpose of the paper is to determine the role of cash audit for the company and ways to increase efficiency of its implementation in terms of cybersecurity of the enterprise. Results. The article acquaints with the work of various economists on the interpretation of the concept of “cash”, so we can say that cash – are the most liquid assets of the company, which are in the form of cash at the box office, cash in the bank accounts and demand deposits. The general strategy and the plan of cash audit in terms of cybersecurity of the enterprise are considered. The main reasons occurrence of problem ensuring of cybersecurity of operations with cash of the enterprise are indicated. An appropriate level of information security for cash transactions has been proposed in order to prevent threats in the enterprise. Ways to damage information security in the process of conducting an audit of cash of the enterprise are improved. Conclusions. Cash audit must be conducted in conjunction with the implementation of the necessary cybersecurity measures in the enterprise in order to reduce the level of disclosure, leakage and unauthorized access to confidential information about cash and to ensure a high level of protection of the company’s own information sources.

Key Factors Affecting User Adoption of Open-Access Data Repositories in Intelligence and Security Informatics: An Affordance Perspective

Rich, diverse cybersecurity data are critical for efforts by the intelligence and security informatics (ISI) community. Although open-access data repositories (OADRs) provide tremendous benefits for ISI researchers and practitioners, determinants of their adoption remain understudied. Drawing on affordance theory and extant ISI literature, this study proposes a factor model to explain how the essential and unique affordances of an OADR (i.e., relevance, accessibility, and integration) affect individual professionals' intentions to use and collaborate with AZSecure, a major OADR. A survey study designed to test the model and hypotheses reveals that the effects of affordances on ISI professionals' intentions to use and collaborate are mediated by perceived usefulness and ease of use, which then jointly determine their perceived value. This study advances ISI research by specifying three important affordances of OADRs; it also contributes to extant technology adoption literature by scrutinizing and affirming the interplay of essential user acceptance and value perceptions to explain ISI professionals' adoptions of OADRs.

A selective ensemble model for cognitive cybersecurity analysis

Dynamic data-driven vulnerability assessments face massive heterogeneous data contained in, and produced by SOCs (Security Operations Centres). Manual vulnerability assessment practices result in inaccurate data and induce complex analytical reasoning. Contemporary security repositories’ diversity, incompleteness and redundancy contribute to such security concerns. These issues are typical characteristics of public and manufacturer vulnerability reports, which exacerbate direct analysis to root out security deficiencies. Recent advances in machine learning techniques promise novel approaches to overcome these notorious diversity and incompleteness issues across massively increasing vulnerability reports corpora. Yet, these techniques themselves exhibit varying degrees of performance as a result of their diverse methods. We propose a cognitive cybersecurity approach that empowers human cognitive capital along two dimensions. We first resolve conflicting vulnerability reports and preprocess embedded security indicators into reliable data sets. Then, we use these data sets as a base for our proposed ensemble meta-classifier methods that fuse machine learning techniques to improve the predictive accuracy over individual machine learning algorithms. The application and implication of this methodology in the context of vulnerability analysis of computer systems are yet to unfold the full extent of its potential. The proposed cognitive security methodology in this paper is shown to improve performances when addressing the above-mentioned incompleteness and diversity issues across cybersecurity alert repositories. The experimental analysis conducted on actual cybersecurity data sources reveals interesting tradeoffs of our proposed selective ensemble methodology, to infer patterns of computer system vulnerabilities.

Multi-type relational clustering for enterprise cyber-security networks

Several cyber-security data sources are collected in enterprise networks providing relational information between different types of nodes in the network, namely computers, users and ports. This relational data can be expressed as adjacency matrices detailing inter-type relationships corresponding to relations between nodes of different types and intra-type relationships showing relationships between nodes of the same type. In this paper, we propose an extension of Non-Negative Matrix Tri-Factorisation (NMTF) to simultaneously cluster nodes based on their intra and inter-type relationships. Existing NMTF based clustering methods suffer from long computational times due to large matrix multiplications. In our approach, we enforce stricter cluster indicator constraints on the factor matrices to circumvent these issues. Additionally, to make our proposed approach less susceptible to variation in results due to random initialisation, we propose a novel initialisation procedure based on Non-Negative Double Singular Value Decomposition for multi-type relational clustering. Finally, a new performance measure suitable for assessing clustering performance on unlabelled multi-type relational data sets is presented. Our algorithm is assessed on both a simulated and real computer network against standard approaches showing its strong performance.

Systematic Review of the Literature on Machine Learning Techniques Employed in Real-World Data Analysis for Patient-Provider Decision Making

Abstract: The Industrial Revolution 4.0 has flooded the virtual world with data, which includes Internet of Things (IoT) data, mobile data, cybersecurity data, business data, social networks, including health data. To analyse this data efficiently and create related efficient and streamlined applications, expertise in artificial intelligence specifically machine learning (ML), is required. This field makes use of a variety of machine learning methods, including supervised, unsupervised, semi-supervised, and reinforcement. Additionally, deep learning, which is a subset of a larger range of machine learning techniques, is capable of effectively analysing vast amounts of data. Machine learning is a broad term that encompasses a number of methods used to extract information from data. These methods may allow the rapid translation of massive real-world information into applications that assist patients and providers in making decisions. The objective of this literature review was to find observational studies that utilised machine learning to enhance patient-provider decision-making utilising secondary data. Keywords: Machine Learning, Real World, Patient, Population, Artificial Intelligence

Deep learning algorithms for cyber security applications: A survey

With the development of information technology, thousands of devices are connected to the Internet, various types of data are accessed and transmitted through the network, which pose huge security threats while bringing convenience to people. In order to deal with security issues, many effective solutions have been given based on traditional machine learning. However, due to the characteristics of big data in cyber security, there exists a bottleneck for methods of traditional machine learning in improving security. Owning to the advantages of processing big data and high-dimensional data, new solutions for cyber security are provided based on deep learning. In this paper, the applications of deep learning are classified, analyzed and summarized in the field of cyber security, and the applications are compared between deep learning and traditional machine learning in the security field. The challenges and problems faced by deep learning in cyber security are analyzed and presented. The findings illustrate that deep learning has a better effect on some aspects of cyber security and should be considered as the first option.

Moving Beyond Criminal Law Responses to Cybersecurity Governance in Africa

Measures to address the security challenges of the information society have given rise to the concept of cybersecurity governance. One major aspect of cybersecurity governance is the establishment of legal measures to criminalize and deter malicious acts that affect the integrity, confidentiality, availability and security of digital data and computer systems. Accordingly, several States and intergovernmental organizations across the world have established legal frameworks to promote cybersecurity governance. This is also the case in Africa. The African Union has adopted a Convention on Cyber Security and Personal Data Protection, while other African regional intergovernmental organizations such as the Economic Community of West African States, the Common Market for Eastern and Southern Africa and the Southern African Development Community have established legal and policy frameworks for cybersecurity governance. In addition, many African States have developed legal and policy frameworks to promote cybersecurity, while some others in the process of developing such frameworks. However, most of Africa’s responses to cybersecurity governance have been focused on the establishment of criminal law measures. Yet while the establishment of criminal law measures is regarded as a critical component of cybersecurity governance, the isolated existence of such measures may not produce desirable outcomes in terms of minimizing cybersecurity vulnerabilities in Africa’s information society. This paper seeks to make a case for the development of other critical components of cybersecurity governance, including technical and organizational measures and user education. It suggests that ‘stand-alone’ criminal law measures will not be able to reduce the rising trends of cyber-criminality in Africa, and that the timely development of other critical components of cybersecurity governance is imperative especially due to the peculiar challenge of weak law enforcement capacities and justice delivery systems in many African States.

Moving Beyond Criminal Law Responses to Cybersecurity Governance in Africa

Measures to address the security challenges of the information society have given rise to the concept of cybersecurity governance. One major aspect of cybersecurity governance is the establishment of legal measures to criminalize and deter malicious acts that affect the integrity, confidentiality, availability and security of digital data and computer systems. Accordingly, several States and intergovernmental organizations across the world have established legal frameworks to promote cybersecurity governance. This is also the case in Africa. The African Union has adopted a Convention on Cyber Security and Personal Data Protection, while other African regional intergovernmental organizations such as the Economic Community of West African States, the Common Market for Eastern and Southern Africa and the Southern African Development Community have established legal and policy frameworks for cybersecurity governance. In addition, many African States have developed legal and policy frameworks to promote cybersecurity, while some others in the process of developing such frameworks. However, most of Africa’s responses to cybersecurity governance have been focused on the establishment of criminal law measures. Yet while the establishment of criminal law measures is regarded as a critical component of cybersecurity governance, the isolated existence of such measures may not produce desirable outcomes in terms of minimizing cybersecurity vulnerabilities in Africa’s information society. This paper seeks to make a case for the development of other critical components of cybersecurity governance, including technical and organizational measures and user education. It suggests that ‘stand-alone’ criminal law measures will not be able to reduce the rising trends of cyber-criminality in Africa, and that the timely development of other critical components of cybersecurity governance is imperative especially due to the peculiar challenge of weak law enforcement capacities and justice delivery systems in many African States.

Infrequent Pattern Detection for Reliable Network Traffic Analysis Using Robust Evolutionary Computation.

While anomaly detection is very important in many domains, such as in cybersecurity, there are many rare anomalies or infrequent patterns in cybersecurity datasets. Detection of infrequent patterns is computationally expensive. Cybersecurity datasets consist of many features, mostly irrelevant, resulting in lower classification performance by machine learning algorithms. Hence, a feature selection (FS) approach, i.e., selecting relevant features only, is an essential preprocessing step in cybersecurity data analysis. Despite many FS approaches proposed in the literature, cooperative co-evolution (CC)-based FS approaches can be more suitable for cybersecurity data preprocessing considering the Big Data scenario. Accordingly, in this paper, we have applied our previously proposed CC-based FS with random feature grouping (CCFSRFG) to a benchmark cybersecurity dataset as the preprocessing step. The dataset with original features and the dataset with a reduced number of features were used for infrequent pattern detection. Experimental analysis was performed and evaluated using 10 unsupervised anomaly detection techniques. Therefore, the proposed infrequent pattern detection is termed Unsupervised Infrequent Pattern Detection (UIPD). Then, we compared the experimental results with and without FS in terms of true positive rate (TPR). Experimental analysis indicates that the highest rate of TPR improvement was by cluster-based local outlier factor (CBLOF) of the backdoor infrequent pattern detection, and it was 385.91% when using FS. Furthermore, the highest overall infrequent pattern detection TPR was improved by 61.47% for all infrequent patterns using clustering-based multivariate Gaussian outlier score (CMGOS) with FS.