Cybersecurity Problems Research Articles

A zero trust and blockchain-based defense model for smart electric vehicle chargers

Electric vehicles (EVs) have rapidly developed over the last decade due to their environmental benefits. As a key component of EVs, electric vehicle chargers are becoming increasingly digital and intelligent. However, due to the vast attack surface and the lack of systematic study, EV chargers and charging management cloud platforms are facing cyber security problems. These problems include weak cryptographic mechanisms, insecure data communication, and malicious firmware attacks. Through specific vulnerabilities, attackers can tamper with the data communication or replay network requests between EV chargers and cloud platforms. It will cause threats such as user-level privacy leakage, power fluctuations in the smart grid, and damage to Electric vehicles, damaging public life and property safety. Given the above, this paper proposes a security protection scheme incorporating blockchain, zero trust, and ShangMi cryptographic (SM) algorithms. The scheme uses Hyperledger Fabric for key management and trust evaluation event storage to guarantee the authenticity, non-repudiation, and tamper-proof of keys and events. In addition, zero trust is applied to secure valuable resources and enforce identity and access management (IAM) for accessing entities. We adopt the dynamic trust evaluation method to assess the trustworthiness of accessing entities in real time to implement dynamic authorization. Furthermore, the SM algorithms SM2, SM3, and SM4 are used to protect data confidentiality, integrity, and authenticity. Experimental results demonstrate that our scheme can effectively resist replay and tampering attacks, securing data communication between EV chargers and cloud platforms. And the performance of the cryptographic algorithm, blockchain system, and Secure Sockets Layer (SSL) meets Chinese national and industry standards.

Cyber Security in Digitized E-Governance: Evaluating Indian IT Act 2000 (As Amended in2008) in Context

Digital technology and Cyber-based database management system in Indian e-governance has brought about dramatic changes in the mode of operations in all governmental business transactions in India. Government organizations and Government professionals need to depend upon the electronic media and computer-generated e-records for e - governance. Information Technology poses new and complex ethical, legal and extra- legal threats to e-governance. This e-governance inter alia involves the question of security against abuses and misuses of Information Technology The situation demands a fresh look into the problem of Cyber Security in e-governance . Information stored in electronic form is cheaper, faster and easier to store, retrieve and to access than traditional paper –based government records. But the question remains: How far these electronic e-governance records are maintainable in Indian court of law under IT Act 2000 (as amended in 2008)? Government is aware of the advantages of e-records but is reluctant to conduct or conclude business transactions in the electronic form due to lack of legal framework in India. Globalized technological changes have created a new global economy powered by technology, fuelled by information and driven by the concept of e-governance of the ‘government’. The present paper will analyze the challenge of digitized government and will seek answer to the question mentioned above related to Cyber Security in IT- enabled environment of digitized government of India. IT Act 2000 (as amended in 2008) will be critically analyzed and evaluated to find out its efficacy and limitations in ensuring security of e-governance of India.

Text augmentation using a graph-based approach and clonal selection algorithm

Annotated data is critical for machine learning models, but producing large amounts of data with high-quality labeling is a time-consuming and labor-intensive process. Natural language processing (NLP) and machine learning models have traditionally relied on the labels given by human annotators with varying degrees of competency, training, and experience. These kinds of labels are incredibly problematic because they are defined and enforced by arbitrary and ambiguous standards. In order to solve these issues of insufficient high-quality labels, researchers are now investigating automated methods for enhancing training and testing data sets. In this paper, we demonstrate how our proposed method improves the quality and quantity of data in two cybersecurity problems (fake news identification & sensitive data leak) by employing the clonal selection algorithm (CLONALG) and abstract meaning representation (AMR) graphs, and how it improves the performance of a classifier by at least 5% on two datasets.

ℋ∞ filtering for discrete‐time hidden singular Markov jump systems subject to partially known probability information under DoS attacks

SummaryThis paper concentrates on the problem of asynchronous filtering for singular Markov jump systems under DoS attacks, in which the unknown probability information cases are considered. To better describe cyber security problem, DoS attacks are considered as encountered randomly and modeled by a set of stochastic variables obeying Bernoulli distribution. Besides, hidden Markov model with partially known probability information is proposed to handle the cases that the Markov state information of the system is restrictedly accessed, and the transition probability information and observation probability information can not be directly obtained. A set of criteria are derived to analyze the regularity, causality, and stochastic stability for the filtering error system with an performance index. Furthermore, an asynchronous filter design method is proposed to against DoS attacks. Finally, a numerical example and a practical example modeled by a DC motor are given to demonstrate the effectiveness of the proposed method.

ПОСТРОЕНИЕ СОСТАВНЫХ КРИТЕРИЕВ ДЛЯ ОПТИМИЗАЦИИ ТЕРМОВ И ОБОБЩЕННОГО ПОКАЗАТЕЛЯ БАЗ ЗНАНИЙ ИНТЕЛЛЕКТУАЛЬНЫХ СИСТЕМ

The purpose of the research is to develop the concept of systematization of the knowledge base and solving problems of information cybersecurity of systems and when making search decisions based on the construction of a structured semantic content model of terms of a scientific and theoretical nature describing complex active systems. Research methods: statistical analysis, hypothesis testing methods, machine learning methods, reliability models, evaluation type models used in testing reliability indicators, parameters of behavioral systems. The result obtained: The result obtained: experimental results of the application of reliability evaluation models and consent criteria to different sizes of knowledge bases are discussed and the evaluation of the results of measuring the reliability index on these components, taking into account the failure rate, is given. The description of generalized algorithms for the functioning of evaluation and forecasting components, as well as their applicability to solving problems in the field of information security, is given. A general model of a spatial network is proposed, within the framework of which the subject carries out risk management by effectively, in one sense or another, distributing the homogeneous resource at his disposal between its nodes. For the implementation of decision-making, more optimistic criteria than the minimax criterion are recommended. Scientific novelty: consists in the development of mathematical models to maintain the logical and physical integrity of the knowledge bases of cybersystems using the desirability function and consent criteria. The basic requirements for ensuring reliable behavior and operability of an information system using oriented databases are highlighted and described. It is postulated that the best information system reliability is achieved through the use of automated monitoring systems using knowledge bases for continuous monitoring and periodic analysis of cybersystem objects with tracking the dynamics of changes in the event space.

Research on the Effectiveness of Using the Python Language for Creating Cyber Security and Information Protection Applications

The article explores the possibilities of the Python programming language for solving cyber security and information protection problems. The study focuses on comparing Python with other programming languages such as C++, C#, Java, and JS in terms of their application development capabilities for network analysis, data mining, security tools, testing tools, task automation, and web development. The article also provides code examples in Python and JS for developing data encryptors and performing network analysis, and describes the OWASP ZAP Python security testing framework. Overall, the paper shows that Python is a powerful tool for solving cyber security and information protection tasks, capable of competing with other programming languages.

НЕЧІТКІ МНОЖИНИ ТИПУ-2 В ЗАДАЧАХ МОДЕЛЮВАННЯ ТА ОЦІНЮВАННЯ СТАНІВ КРИТИЧНИХ СИСТЕМ З НЕДОВИЗНАЧЕНИМИ ВХІДНИМИ ДАНИМИ ТА ВИКОРИСТАННЯМ ЕКСПЕРТІВ

A method of type-2 fuzzy sets implementation for critical systems’ modeling and state assessment tasks with uncertain input data is proposed. It is shown that the basis for solving the modeling task is designing of a fuzzy logic system with interval membership functions of type-2. The paper presents the task of further developing the process of estimating the interval output of a fuzzy system with experts involvement. An approach based on fuzzy sets is proposed for solving the task of critical systems’ modeling and states assessment. Using the example of energy grid systems, where a high degree of uncertainty is present, it is shown that the main factors that influence the appearance of uncertainty in the initial data set of such systems are caused by the lack of sufficient information in the open print and the high variability of threats under the influence of the growing pace of digitalization of business processes. An analysis of expert evaluations of the interval output of fuzzy systems based on examples of modeling complex objects in various fields of application is given. The first example demonstrates the results of modeling in the field of natural sciences with uncertain initial data for assessing the prospects of an artesian well, where the final assessment is made by an expert. The second example demonstrates the implementation of the interval fuzzy model in the task of social orientation, where the problem of recruiting personnel in social groups from the point of view of professional suitability is modeled. The third task refers to modeling in the field of medical diagnosis of diseases of the endocrine system. Evaluation by experts of the results of interval fuzzy modeling in this field makes it possible to determine the state of a person's disease for endocrine pathology and prescribe timely treatment. The given examples of evaluating the interval output of a fuzzy system, taking into account the opinion of experts, confirm the possibilities for making decisions that are adequate for the subject area in the conditions of uncertain input data. Prospects for the application of the proposed models for the problems of cyber security of critical systems are given.

Risks of IT technology adoption

Automation of technological processes and digitalisation of various spheres of the economy are among the key management tasks. The main threats and risks to development include cross-border threats and illegal use of information and telecommunication technologies, including computer attacks on the information infrastructure and means of communication. The primary task in solving problems of cyber security is introduction of domestic technologies and software products. In this article, we consider the risks of adopting new IT-technologies. Initially, the risks at each stage of project implementation and introduction of IT-technologies were identified, then the methodology of risk assessment was applied based on the determination of risk probability and degree of negative consequences realization (losses for the organization). Each risk was assessed taking into account two items. The first is the probability of risk occurrence. The second is the danger of risk or adverse consequences (losses) which arise at the organisation in case of its realisation. To determine the degree of risk of risks, 4 priority groups were allocated, the weighting values of the groups, and the risks were calculated. Subsequently, each risk was assessed and the risks of implementing new IT technologies were ranked. The research showed that the main risks of IT implementation include innovation risks, information security risks, risks connected with decrease of productivity and capacity of information systems, with changes in the project budget, miscalculations in selection of techniques, equipment, its installation, insufficient qualification of executors. The grouping of risks by stage of their occurrence showed that the risks increase and have the highest aggregate assessment at the stage of operation. Risks are managed throughout the life of the project, but the ability to manage risk decreases as the project progresses towards completion. Identifying, assessing and ranking risks is the basis for developing an effective risk management system

SYSTEM FOR CYBER SECURITY EVENTS CORRELATION AND INCIDENT MANAGEMENT IN CRITICAL INFRASTRUCTURE OBJECTS

Modern information infrastructure consists of a large number of systems and components that require constant monitoring and control. To identify, analyze and eliminate possible cyber threats, it is recommended to use a single common solution - the so-called SIEM systems. SIEM technology collects event log data, detects unusual activity through real-time analysis, identifies threats, generates alerts, and suggests appropriate action scenarios. Today, the number and quality of SIEM systems has grown significantly, and the latest technologies of artificial intelligence, the Internet of Things, and cloud technologies are used to ensure fast and effective detection of threats. Thus, the work carried out a study of modern SIEM systems, their functionality, basic principles of operation, as well as a comparative analysis of their capabilities and differences, advantages and disadvantages of use. In addition, a universal system of event correlation and management of cyber security incidents at critical infrastructure facilities was developed and experimentally investigated. Models of the operation of the hybrid security data storage have been developed, which allow the indexing service to access external data storages, to perform scaling when the volume of data increases, to ensure high search speed, etc. Models, methods and algorithms for the operation of a distributed data bus have been developed, which allow for high speed processing of large flows of information, minimal delays in data processing, high resistance to failures, flexibility and expandability of storage. The proposed system is designed to solve a number of current cyber security problems and meets the main requirements of international standards and best global practices regarding the creation of cyber incident management systems.

Strategic Monitoring for Efficient Detection of Simultaneous APT Attacks with Limited Resources

Advanced Persistent Threats (APT) are a type of sophisticated multistage cyber attack, and the defense against APT is challenging. Existing studies apply signature-based or behavior-based methods to analyze monitoring data to detect APT, but little research has been dedicated to the important problem of addressing APT detection with limited resources. In order to maintain the primary functionality of a system, the resources allocated for security purposes, for example logging and examining the behavior of a system, are usually constrained. Therefore, when facing multiple simultaneous powerful cyber attacks like APT, the allocation of limited security resources becomes critical. The research in this paper focuses on the threat model where multiple simultaneous APT attacks exist in the defender’s system, but the defender does not have sufficient monitoring resources to check every running process. To capture the footprint of multistage activities including APT attacks and benign activities, this work leverages the provenance graph which is constructed based on dependencies of processes. Furthermore, this work studies the monitoring strategy to efficiently detect APT attacks from incomplete information of paths on the provenance graph, by considering both the “exploitation” effect and the “exploration” effect. The contributions of this work are two-fold. First, it extends the classic UCB algorithm in the domain of the multi-armed bandit problem to solve cyber security problems, and proposes to use the malevolence value of a path, which is generated by a novel LSTM neural network as the exploitation term. Second, the consideration of “exploration” is innovative in the detection of APT attacks with limited monitoring resources. The experimental results show that the use of the LSTM neural network is beneficial to enforce the exploitation effect as it satisfies the same property as the exploitation term in the classic UCB algorithm and that by using the proposed monitoring strategy, multiple simultaneous APT attacks are detected more efficiently than using the random strategy and the greedy strategy, regarding the time needed to detect same number of APT attacks.

ІНФОРМАЦІЙНІ ТЕХНОЛОГІЇ ДЛЯ ОБЛІКУ ТА УПРАВЛІННЯ БІЗНЕСОМ: ПРОБЛЕМИ ТА ПЕРСПЕКТИВИ

The article considers the role of information technologies in accounting, reporting and management of business processes of business entities, focusing on the challenges and prospects of automation in these areas, the rapid pace of development of information technologies and their impact on optimization and problem solving in modern society. The current trends in the development and possibilities of using information technology in accounting and business management are analysed. The theoretical and practical aspects of information technologies, problems of their use are revealed and proposals on possible ways to solve them are formulated. The main advantages and disadvantages of using information technology and process automation are presented. Possible obstacles arising from the automation of business process accounting are highlighted, classifying them into four key areas: improving the quality of information, saving time and labour costs, efficiency and relevance of data, and strengthening control. The article highlights the main characteristics and features of an automated company accounting system in the context of global digitalization, which contribute to the establishment of an automated process of collecting, structuring and processing accounting data. Attention is focused on the use of remote technologies based on software and hardware solutions, and the advantages of these technologies, such as cost reduction, access from any device, and real-time synchronization of changes, are presented. Possible information security problems when using remote services are noted. Certain aspects are highlighted, failure to comply with which may lead to the risk of data loss, violation of their integrity and confidentiality, etc. Prospects for the development of artificial intelligence (AI) systems are considered. It is shown how the knowledge base and self-learning capabilities of AI systems can contribute to the construction of integrated management systems and solve problems of various aspects of accounting and management. Attention is paid to the problem of cybersecurity and the importance of computer security measures to prevent the risks of loss and distortion of information is emphasized.

The problem of cybersecurity of society in criminological understanding

The problem of cybersecurity of society in criminological understanding

Establishing IoT Cyber Hygiene Frameworks with Continuous Monitoring and Risk Assessment in Smart City Infrastructures

This study shows a cybersecurity design for Smart City infrastructures that is made up of five programs that work together. There are several tools that work together to make a dynamic and complete strategy. These are Continuous Threat Intelligence Feeds Integration (CTIFI), Machine Learning Anomaly Detection (MLAD), Vulnerability Scanning and Patch Management (VSPM), Network Segmentation and Access Control (NSAC), and Incident Response Planning (IRP). The framework's ablation study shows how important each method is, focusing on how they work together to solve important cybersecurity problems. Comparative tests show that the suggested method is better than others in terms of being able to be used on a larger scale, being accurate, and being cost-effective. For instance, waterfall, bullet, and funnel charts show patterns of scalability, while bar and line charts show signs of dynamic performance. The suggested framework is flexible enough to adapt to new cybersecurity threats thanks to its iterative and linked design. It provides a proactive and effective way to protect Smart City IoT environments.

산업제어시스템 통합에 따른 안전계장 시스템 사이버 보안 취약점 평가 및 대응방안 연구

Although the Safety Instrumented System has been operated independently among industrial control systems for a long time, recently the industrial control system has been released as an integrated Distributed Control System based on an open platform because it is more cost-effective simplified and enhanced approach for advanced functional safety however it could be vulnerable to cybersecurity sector. Without considering of cybersecurity, the SIS has no guarantee its secured from cyberattacks. The discovery of the TRITON melware, which is targeting the SIS in 2017, is emphasized in the connection between the SIS and the DCS. Considering these issues the IEC Standard 61511 Second Edition which guarantees the functional safety of industrial processes updated new explicit requirement to conduct a security risk assessment. This study aims to investigate whether the Safety Instrumentation System (SIS), which has long been independently classified in the industrial control system considered irrelevant to cybersecurity problems, has become an appropriate cybersecurity design due to connection with the DCS, and to present vulnerability measures. For this study four domestic oil refineries and six petrochemical NCC plants were selected to analyze security design and weaknesses. As a result of all of plants were vulnerable to cybersecurity vulnerability therefore, the SIS is needed to be included appropriate design and assessment as part of the enhancement process.

Cybersecurity Problem Impacting Online Banking in FR Peshawar

This study examines cyber security vulnerabilities that affect Pakistani internet banking. This research aims to do this. The banking industry's weaknesses and risks must be examined now more than ever. This tendency is due to the rapid rise of digital technologies and Internet banking. This report examines Pakistan's online banking industry's cyber security. Prospective dangers and mitigation strategies are also considered to improve online banking platform security. The latest research shows that online banking in Pakistan is harmful. Seventy college and university students completed an online questionnaire. The survey was online. SPSS 21 was used to analyse the data. SPSS calculates ANOVA and coefficients. The study found that phishing, identity theft, and hacking affect Internet banking, but other factors also affect it.

Relevant Cybersecurity Aspects of IoT Microservices Architectures Deployed over Next-Generation Mobile Networks.

The design and implementation of secure IoT platforms and software solutions represent both a required functional feature and a performance acceptance factor nowadays. This paper describes relevant cybersecurity problems considered during the proposed microservices architecture development. Service composition mechanisms and their security are affected by the underlying hardware components and networks. The overall speedup of the platforms, which are implemented using the new 5G networks, and the capabilities of new performant IoT devices may be wasted by an inadequate combination of authentication services and security mechanisms, by the architectural misplacing of the encryption services, or by the inappropriate subsystems scaling. Considering the emerging microservices platforms, the Spring Boot alternative is used to implement data generation services, IoT sensor reading services, IoT actuators control services, and authentication services, and ultimately assemble them into a secure microservices architecture. Furthermore, considering the designed architecture, relevant security aspects related to the medical and energy domains are analyzed and discussed. Based on the proposed architectural concept, it is shown that well-designed and orchestrated architectures that consider the proper security aspects and their functional influence can lead to stable and secure implementations of the end user's software platforms.

About one approach to increasing the security of computer systems against intrusion

The article considers an approach to increasing the security of computer systems from intrusion. The importance of the problem of information security and cybersecurity is substantiated. Strategies of attack and destructive actions used by intruders (hackers) are considered. 16 different attack and intrusion strategies are identified. The reasons for the vulnerability of computer systems are analyzed. Two groups of reasons are considered: objective reasons depending on the hardware and software components of the computer system and subjective reasons depending on the human factor. It is noted that one of the main reasons that objectively complicate the protection of a computer from intrusion is that the same computer is assigned the solution of two unrelated problems: the direct solution of tasks, which are essentially an internal problem, and the tasks of communication, which can be seen as an external problem. An approach is proposed to increase the security of computer systems from intrusion through hardware redundancy, in particular, instead of one computer, use a computer unit consisting of two computers – internal and external. The internal computer is used for the direct solution of tasks. The external computer is responsible for performing communication tasks. Additionally, the issues of physical protection of computer systems are considered.

Computer Network Clustering Methods in Cybersecurity Problems

Computer Network Clustering Methods in Cybersecurity Problems

Multiagent-Based Data Presentation Mechanism for Multifaceted Analysis in Network Management Tasks.

Although network management tasks are highly automated using big data and artificial intelligence technologies, when an unforeseen cybersecurity problem or fault scenario occurs, administrators sometimes directly analyze system data to make a heuristic decision. However, a wide variety of information is required to address complex cybersecurity risks, whereas current systems are focused on narrowing the candidates of information. In this study, we propose a multiagent-based data presentation mechanism (MADPM) that consists of agents operating data-processing tools that store and analyze network data. Agents in MADPM interact with other agents to form data-processing sequences. In this process, we design not only the composition of the sequence according to requirements, but also a mechanism to expand it to enable multifaceted analysis that supports heuristic reasoning. We tested five case studies in the prototype system implemented in an experimental network. The results indicated that the multifaceted presentation of data can support administrators more than the selected single-faceted optimal presentation. The final outcome of our proposed approach is the provision of a multifaceted and cross-system data presentation for heuristic inference in network management tasks.

New Obstacles to Smart City Cybersecurity

This article provides a concise description of the criteria that may be evaluated to determine the adoption of smart grid approaches that improve cybersecurity. It is necessary, from a functional point of view, to establish the degree to which cyber resilience may be increased by implementing solutions that are efficient in terms of cost. The problem of cybersecurity for smart grids has been the focus of several research and initiatives. In this study, the detection and diagnosis of False Data Injection (FDI) attacks are investigated in detail concerning their accuracy, processing time, and resilience to outside influences. No one method can be applied to all power systems. Therefore, a comparison and statistical analysis of the newly reported approaches for detecting and recognizing cyberattacks are conducted here.