Cybersecurity Research Research Articles

Seeing light at the end of the cybersecurity tunnel

After decades of cybersecurity research, Elisa Bertino remains optimistic.

Toward Personalized Deceptive Signaling for Cyber Defense Using Cognitive Models.

Recent research in cybersecurity has begun to develop active defense strategies using game-theoretic optimization of the allocation of limited defenses combined with deceptive signaling. These algorithms assume rational human behavior. However, human behavior in an online game designed to simulate an insider attack scenario shows that humans, playing the role of attackers, attack far more often than predicted under perfect rationality. We describe an instance-based learning cognitive model, built in ACT-R, that accurately predicts human performance and biases in the game. To improve defenses, we propose an adaptive method of signaling that uses the cognitive model to trace an individual's experience in real time. We discuss the results and implications of this adaptive signaling method for personalized defense.

School-based Cybersecurity Education Programme for Schoolchildren in South Africa! A Timely Call from Bloemfontein

The interconnection of many countries of the world today is hugely tied to the overwhelming improvements in the Internet. However, the improved Internet connectivity is not without diverse security risks such as bullying, scamming, hate speech, and identity theft especially for minors. It is unfortunate that the security risks attached to the use of the Internet are often ignored in the rush to log online by schoolchildren in South Africa. The cyber insecurities in South Africa became more precarious as schools do not teach cybersecurity as a subject in South Africa at present. Consequently, it behooves the researcher to unveil how the agents of education in South Africa learning ecologies can use the school-based cyber security education programme to protect schoolchildren against cyber scammers, and propose a blue-print on developing a school-based cybersecurity education programme for South African schoolchildren. In this paper, the space transition theory is used to explain the causation of insecurities confronting cyber savvy schoolchildren in South Africa. This paper methodically explicated related scientific papers that were published from 2005 to 2019 on cybercrimes, cybersecurity, and school-based participatory research. The community-driven model developed by Lavery et al. (2005) was used to design the school-based cybersecurity educational programme. This paper exhaustively explained the operations of the school-based cybersecurity educational programme and illustrated how teachers can use the informal cybersecurity educational programme to teach cybersecurity in South African schools.

Traffic and log data captured during a cyber defense exercise.

Cybersecurity research relies on relevant datasets providing researchers a snapshot of network traffic generated by current users and modern applications and services. The lack of datasets coming from a realistic network environment leads to inefficiency of newly designed methods that are not useful in practice. This data article provides network traffic flows and event logs (Linux and Windows) from a two-day cyber defense exercise involving attackers, defenders, and fictitious users operating in a virtual exercise network. The data are stored as structured JSON, including data schemes and data dictionaries, ready for direct processing. Network topology of the exercise network in NetJSON format is also provided.

Teaching and Learning IoT Cybersecurity andVulnerability Assessment with Shodan through Practical Use Cases.

Shodan is a search engine for exploring the Internet and thus finding connected devices. Its main use is to provide a tool for cybersecurity researchers and developers to detect vulnerable Internet-connected devices without scanning them directly. Due to its features, Shodan can be used for performing cybersecurity audits on Internet of Things (IoT) systems and devices used in applications that require to be connected to the Internet. The tool allows for detecting IoT device vulnerabilities that are related to two common cybersecurity problems in IoT: the implementation of weak security mechanisms and the lack of a proper security configuration. To tackle these issues, this article describes how Shodan can be used to perform audits and thus detect potential IoT-device vulnerabilities. For such a purpose, a use case-based methodology is proposed to teach students and users to carry out such audits and then make more secure the detected exploitable IoT devices. Moreover, this work details how to automate IoT-device vulnerability assessments through Shodan scripts. Thus, this article provides an introductory practical guide to IoT cybersecurity assessment and exploitation with Shodan.

Coronavirus (COVID-19) – ‘Zoom’ Application Boon or Bane

Advances in communication technologies offer new opportunities for the conduct of qualitative research. Among these, Zoom—an innovative videoconferencing platform—has a number of unique features that enhance its potential appeal to qualitative and mixed-methods researchers. Zoom has become nearly synonymous with office meetings and socializing as people around the world have adapted to life at home amid the coronavirus outbreak. That has put the roughly 9-year-old company in the spotlight more than ever before - for both the good and the bad, as an onslaught of security issues have come to light.As the coronavirus pandemic forced millions of people to stay home over the past month, Zoom suddenly became the video meeting service of choice: Daily meeting participants on the platform surged from 10 million in December to 200 million in March.Many Cybersecurity research companies research says that it found security flaws in videoconferencing platform Zoom that would have allowed a potential hacker to join a video meeting uninvited and listen in, potentially accessing any files or information shared during the meeting. While Zoom has addressed the issue, the report raises deeper concerns about the safety of videoconferencing apps that require access to microphones and cameras.

Network security analysis using big data technology and improved neural network

Network security is an important part of the future information world. The degree of social informatization is maturing and network infrastructure is gradually improving, the network has become an indispensable part of human life. With the frequent occurrence of cyber security incidents around the world, cyber security research has become very important. The amount of network data is huge, and it is necessary to use big data (BD) analysis technology and various machine learning algorithms to analyze and predict the network security (NS) situation. In the NS situation awareness technology, the network behavior and the possible impact are mainly identified by analyzing data records. However, existing NS situation awareness models need to be improved, such as large resource overhead, low accuracy of analysis results, low processing efficiency, and inability to apply to real-time and large-scale scenarios. To solve these shortcomings, a new NS BD analysis model is proposed using improved BP neural network. In the model, data is simplified and cleaned according to the characteristics of the data records, thereby solving the problems of heterogeneous data sources and high noise. With the classic BP neural network as the core of the model, the error inverse feedback strategy of the neural network is used to improve the accuracy of the model analysis. The innovation of this article is that when preprocessing the input data, the proposed blocked fuzzy C-means clustering algorithm (BFCM) is used to cluster the features of the data records to strengthen the features of the data, thereby improving the model's precision. First, the structure of the NS awareness model is introduced in detail, and then the relevant steps in the model are described in detail. Finally, a series of experiments have been performed to verify that the proposed model has certain reference value for the perception of NS situations.

An Integrative Review and Analysis of Cybersecurity Research: Current State and Future Directions

ABSTRACT Advances in information technology have greatly changed communications and business transactions between firms and their customers and suppliers. As a result, cybersecurity risk attracts ever increasing attention from firms, regulators, customers, shareholders, and academics. For instance, the Securities and Exchange Commission has released guidance on the disclosure of cybersecurity risks and incidents, along with potential internal control solutions, in the managers' discussion and analysis section of 10-K annual financial reports. Despite increasing interest in cybersecurity research, the literature lacks an integrative review of existing research identifying opportunities for future cybersecurity developments. In this study, we conduct an extensive analysis of cybersecurity-related papers in the accounting, information systems, computer science, and general business disciplines. Our review integrates and classifies 68 cybersecurity papers, examines cybersecurity determinants, consequences, and remedial strategies, and identifies future research opportunities based on the current state of the literature.

Fake Document Generation for Cyber Deception by Manipulating Text Comprehensibility

Advanced cyber attackers can penetrate enterprise networks and steal critical documents containing intellectual property despite all access control measures. Cyber deception is one of many solutions to protect critical documents after an attacker penetrates the network. It requires the generation and deployment of decoys such as fake text. The comprehensibility of a fake text document can affect the required time and effort for an attack to succeed. However, existing cybersecurity research has given limited attention to exploring the comprehensibility features of text for fake document generation. This article presents a novel method to generate believable fake text documents by measuring and manipulating the comprehensibility of legit text within a genetic algorithm (GA) framework. For measuring text comprehensibility, we adopt a set of quantitative measures based on qualitative principles of psycholinguistics and reading comprehension: connectivity , dispersion , and sequentiality . Our user-study analysis indicates that the quantitative comprehensibility measures can approximate the degree of human effort required to comprehend a fake text document in contrast to a legit text. For manipulating text comprehensibility, we develop a multiobjective, multimutation GA that modifies a legit document to Pareto-optimally alter its comprehensibility measures and generate hard-to-comprehend, believable fake documents. Our experiments show that the proposed algorithm successfully generates fake documents for a broader class of legit documents with varied text characteristics when compared to baselines from previous research. Hence, the application of our method can help improve cyber deception systems by providing more believable yet hard-to-comprehend fake documents to mislead cyber attackers.

3DMRI - Elucidating the origin of biometric authentication based on the acoustic characteristics of the ears with high resolution 3D MRI

A world run on cash transactions is rapidly disappearing. The power and connectivity of the Internet has driven most business toward digital solutions. Paying bills and shopping is done online and paying while outside of the home is increasingly done by card or even smartphone apps. The diminished role of cash, while convenient, does require that consumers put their trust into security systems beyond their own control. Someone can safeguard their own wallet but cannot encrypt personal digital payment data. This transition has led to the vast cybersecurity industry which is constantly in need of innovation in order to keep one step ahead of nefarious actors willing to exploit weakness in the system. Digital theft and fraud, especially identity fraud, are now major concerns in the modern world. Our main defence is password protected accounts and encryption in the form of cyphers. As we have seen though, these are fallible and hackers have successfully stolen data from some of the most secure companies on the planet. To combat this, cybersecurity research is increasingly turning to biometric forms of identification which rely on the unique features possessed by every individual. Fingerprints and face scans are the most well-known and employed forms of biometric ID. For example, smartphones can be locked and unlocked with a simple glance at the screen and these methods have considerable benefits. Never having to remember a password again is one and a thief cannot decode your face like they potentially can a cypher. However, there are drawbacks, and impersonations with face ID and fingerprinting can still occur. In order to add another layer of protection, a collaboration between academia and industry is turning to an overlooked feature of the human body, being the ear. Dr Shouhei Yano is using his background studying sound localisation using earphones progressed from entertainment applications to create a new way of providing accurate, secure biometric identification.

Connected Medical Technology and Cybersecurity Informed Consent: A New Paradigm.

BackgroundConnected medical technology is increasingly prevalent and offers both a host of new therapeutic potentials and cybersecurity-related considerations. Current practice largely does not include discussions of cybersecurity issues when clinicians obtain informed consent.ObjectiveThis paper aims to raise awareness about cybersecurity considerations for connected medical technology as they relate to informed consent discussions between patients and clinicians.MethodsClinicians, health care cybersecurity researchers, and informed consent experts propose the concept of a cybersecurity informed consent for connected medical technology.ResultsThis viewpoint discusses concepts designed to facilitate further discussion on the need, development, and execution of cybersecurity informed consent.ConclusionsCybersecurity informed consent may be a necessary component of informed consent practices, as connected medical technology proliferates in the health care environment.

Cyber Security Tool Kit (CyberSecTK): A Python Library for Machine Learning and Cyber Security

The cyber security toolkit, CyberSecTK, is a simple Python library for preprocessing and feature extraction of cyber-security-related data. As the digital universe expands, more and more data need to be processed using automated approaches. In recent years, cyber security professionals have seen opportunities to use machine learning approaches to help process and analyze their data. The challenge is that cyber security experts do not have necessary trainings to apply machine learning to their problems. The goal of this library is to help bridge this gap. In particular, we propose the development of a toolkit in Python that can process the most common types of cyber security data. This will help cyber experts to implement a basic machine learning pipeline from beginning to end. This proposed research work is our first attempt to achieve this goal. The proposed toolkit is a suite of program modules, data sets, and tutorials supporting research and teaching in cyber security and defense. An example of use cases is presented and discussed. Survey results of students using some of the modules in the library are also presented.

Adalward: a deep-learning framework for multi-class malicious webpage detection

ABSTRACT A global village is what the father of digital media and communications, Marshall McLuhan had dreamt of in the late 1970s. In June 2017, reaching over 51.7% of the global population, the Internet has made it a reality. In past couple of decades, with upsurge of wireless communication technologies, the Internet has spread its web to connect all corners of the world. Its undeniable merits aside, interconnectivity on such a massive scale ushered in a whole new era of rampant malfeasance, characterized by an ever-increasing rate of cyber-crimes. Intrinsically, cyber-security researchers around the globe have been trying to develop several effective mechanisms to deal with the threats posed by cybercriminals. In this paper, we are presenting Adalward – a five-layer deep-learning framework, which has the potential for overcoming most of the challenges faced by such existing systems. Unique framework of Adalward allows it to utilize both static and dynamic web features for making accurate classification decisions with unmatched efficiency. Adalward was trained on one million labelled URLs obtained from numerous trustworthy sources. By the end of its training phase, Adalward achieved an overall detection accuracy of 99.76%, with a negligible false-positive rate of 0.10% and a nominal false-negative rate of 0.14%.

Protiv-incidentno dejstvo kao ključni faktor odbrane

According to the ancient Chinese learning our world is governed by two opposite forces being Yin and Yang. Those forces are the force of offense and force of defense and by the same doctrine our world can be in harmony only if those two forces are in balance. The modern security experts would also see a security as a balance between attack and defense. So many defense professionals worldwide would approach their everyday tasks with such an assumption. The similar situation is with the cyber defense - the cybersecurity researchers and practitioners would see cyber defense as a balance between cyber attack and its defense. Also, this doctrine would get led with the theory that there are some passive and active principles in cyber defense. For instance, the passive principals are cyber prevention and monitoring, while the active principle is the incident response. The ongoing experience would suggest that the majority of marketplace actors would invest a lot into the passive factors of cyber defense, while the incident response would get less used due to some objective and realistic parameters. The main concern with the incident response is that it requires a lot of skills and expertise in order to get applied. There is the entire flow in a cybersecurity that would suggest that all three indicators of the cyber defense passive and active principles should get equally distributed. In addition, coping with such a concept so many cyber experts would see the incident response as a key pillar in a cyber defense. In this effort, we intend to provide a deep insight into such learning as well as provide some comments and discussions coming from our own research experience.

SPPBPS: A Secure Privacy-Preservation Bilinear Pairing Scheme for Bitcoin Cryptocurrency

Despite the existing advances on research and education in cybersecurity and its applications, the field is still under discovery and new technologies are evolving. In recent years, Bitcoin as a cryptocurrency cyber application that records all financial transactions present on a blockchain where users can reach a secure and robust consensus on transactions emerges as the most popular peer-to-peer electronic payment system. Cryptocurrencies mostly rely on blockchain, as a secure decentralised append-only ledger to exchange digital currencies, and thereby attracting a billion-dollar economy. Bitcoin allows input transactions to link addresses and this can be used by an adversary to reveal real user identity. This obviously attracts privacy issues such as user’s information and identity leakage. Several existing techniques are found not satisfactory to fulfil practical and compatible anonymity requirements for users and their transaction. We present in this paper, a secure privacy-preservation scheme based on bilinear pairing and other cryptographic primitives. We proved that our proposed scheme is robust and can be implemented to preserve users and transaction privacy in the Bitcoin system by theoretical analysis and evaluation.

A Governance Model of a Collaborative Networked Organization for Cybersecurity Research

A Governance Model of a Collaborative Networked Organization for Cybersecurity Research

Predicting smartphone location-sharing decisions through self-reflection on past privacy behavior

AbstractSmartphone location sharing is a particularly sensitive type of information disclosure that has implications for users’ digital privacy and security as well as their physical safety. To understand and predict location disclosure behavior, we developed an Android app that scraped metadata from users’ phones, asked them to grant the location-sharing permission to the app, and administered a survey. We compared the effectiveness of using self-report measures commonly used in the social sciences, behavioral data collected from users’ mobile phones, and a new type of measure that we developed, representing a hybrid of self-report and behavioral data to contextualize users’ attitudes toward their past location-sharing behaviors. This new type of measure is based on a reflective learning paradigm where individuals reflect on past behavior to inform future behavior. Based on data from 380 Android smartphone users, we found that the best predictors of whether participants granted the location-sharing permission to our app were: behavioral intention to share information with apps, the “FYI” communication style, and one of our new hybrid measures asking users whether they were comfortable sharing location with apps currently installed on their smartphones. Our novel, hybrid construct of self-reflection on past behavior significantly improves predictive power and shows the importance of combining social science and computational science approaches for improving the prediction of users’ privacy behaviors. Further, when assessing the construct validity of the Behavioral Intention construct drawn from previous location-sharing research, our data showed a clear distinction between two different types of Behavioral Intention: self-reported intention to use mobile apps versus the intention to share information with these apps. This finding suggests that users desire the ability to use mobile apps without being required to share sensitive information, such as their location. These results have important implications for cybersecurity research and system design to meet users’ location-sharing privacy needs.

Multi-Agent Based Cyber Attack Detection and Mitigation for Distribution Automation System

As electric power became an essential part of daily life, resiliency and reliability of operation became important. A distribution management system (DMS) enables real-time monitoring and dynamic controls of the power distribution networks. As such, their controls should be designed to be resilient against distribution grid disturbances and cyber events. Due to the high penetration of Information and Communication Technology (ICT) in the DMS, the reliability of power distribution grids is highly dependent on the cyber system. However, most power distribution applications, communication protocols, and devices are vulnerable to the cyber attacks since they are designed and implemented before cybersecurity became a critical issue. Recent reports and cyber attack incidents clearly indicate that cyber-attacks are increasingly likely on the power system infrastructures, e.g., control centers, nuclear power plants, and substations. These attacks may cause significant damages to the power grid. Cybersecurity research for the power distribution grid is a high priority subject in the emerging smart grid environment. This article proposes cybersecurity enhanced distribution automation system (DAS) with a multi-agent system (MAS). The proposed multi-agent based cyber attack detection and mitigation algorithms can identify the anomalies, abnormal activities, and unusual system operations of the DAS. The proposed algorithms have been applied to the existing communication protocols, protection schemes, and restoration applications. The result is validated with a testbed and proposes a new integrated tool for the detection and mitigation of cyber intrusions at a power distribution grid with multiple feeders.

Special Issue on Interdisciplinary Cybersecurity Research: A Critical High-Impact Practice in Cybersecurity Education

Special Issue on Interdisciplinary Cybersecurity Research: A Critical High-Impact Practice in Cybersecurity Education

Evaluating Cybersecurity Theories, Models, Standards and Frameworks

Businesses and organizations around the world are increasingly concerned about cyber security. Understanding the various theories, models, standards and frameworks that underpin current practices is necessary to develop effective cybersecurity strategies. The existing cyber security theories, models, standards and frameworks are assessed in this review paper with a view to comparing their strengths and weaknesses. This paper summarizes findings from a thorough review of relevant peer-reviewed articles and lists key research areas for the coming years. Indeed, the Schwartz theory seems to be promising for improving cybersecurity in business and governance contexts on grounds that it is based upon verifiable observations and factor analysis from data collection. In addition, the Review Paper provides an overview of how different cybersecurity theories, models, standards and frameworks have been implemented in practice as well as highlights their challenges and successes. Finally, there is a summary on key findings and their implications for future cyber security research and practice. Keywords: Cybersecurity, Theories, Models, Standards, Frameworks.