Cybersecurity Systems Research Articles

Cyber-physical Shooting Gallery

While much has been written on the dire need for workers who understand both the IT and OT core concepts necessary to protect the cyber-physical systems of critical infrastructure, practical and specific recommendations for how to meet this need through education and workforce training are lacking. Many of the available programs for teaching cybersecurity of physical systems rely on virtual simulations and students may not encounter relevant physical equipment until they are in the workplace. RADICL’s Cyber-physical Shooting Gallery is a critical missing piece toward a comprehensive system to develop the competent workforce the nation needs. Through a series of cyber-physical capture-the-flag challenges that integrate the Purdue ICS Model with the MITRE ATT&CK framework, the Cyber-physical Shooting Gallery provides an accessible educational model for cyber-physical security education and training.

RADICL CTF

To address the nationwide workforce shortage of skilled and educated cyber-informed engineers, we must develop low-cost and highly effective resources for industrial control systems education and training. College curricula in technology management, cybersecurity, and computer science aim to build students’ computational and adversarial thinking abilities but are often done only through theory and abstracted concepts [1]. To better a student’s understanding of industrial control system applications, post-secondary institutions can use gamification to increase student interest through an interactive, user-friendly, hands-on experience. RADICL CTF can provide post-secondary institutions with new opportunities for low-cost, guided exercises for industrial control system (ICS) education to help students master adversarial thinking. Based on an extension to picoCTF, RADICL CTF is a platform for students to design, implement and evaluate exercises that test their understanding of core concepts in industrial control systems cybersecurity, answering the need for more interactive education methods. The main contributions of this paper are the improvement of the cyber-security curriculum through extending the picoCTF platform to promote the gamification of industrial control system concepts with consideration to the Purdue Reference Architecture.

An efficient cyber security system based on flow-based anomaly detection using Artificial neural network

Cyber security is developing factor for protecting internet resources by handing various monitoring feature based support to improve the security. Increasing internet cries in the defined facts for need of advance met in cyber security. Most internet attacker’s theft the information through malicious activities, false data injection, hacking and make soon creating procedures. In most cases cyber sercuity failed to detect the malicious activities because the monitoring feature analyses improper to predict the result in previous machine learning algorithms. TO resolve this problem to propose an advance cyber security based on flow-based anomaly detection using Min max game theory optimized artificial neural network (MMGT-ANN). The reprocessing was carried out with KDD crime dataset. Then Data driven network model is applied to monitor the feature margins and defect scaling rate. Based on the feature scaling rate Transmission Flow defect rate is estimated and applied with Min max Game theory to select the feature limits. Then features are trained with optimized ANN to detect the crime rate. By the attention of the proposed system achieves higher performance in precision rate to attain higher detection accuracy with lower time complexity compared to the other system.

Controller Cyber-Attack Detection and Isolation

This article deals with the cyber security of industrial control systems. Methods for detecting and isolating process faults and cyber-attacks, consisting of elementary actions named "cybernetic faults" that penetrate the control system and destructively affect its operation, are analysed. FDI fault detection and isolation methods and the assessment of control loop performance methods developed in the automation community are used to diagnose these anomalies. An integration of both approaches is proposed, which consists of checking the correct functioning of the control algorithm based on its model and tracking changes in the values of selected control loop performance indicators to supervise the control circuit. A binary diagnostic matrix was used to isolate anomalies. The presented approach requires only standard operating data (process variable (PV), setpoint (SP), and control signal (CV). The proposed concept was tested using the example of a control system for superheaters in a steam line of a power unit boiler. Cyber-attacks targeting other parts of the process were also included in the study to test the proposed approach's applicability, effectiveness, and limitations and identify further research directions.

International Perspective on Securing Cyberspace Against Terrorist Acts

This research reviews the legal framework for protecting the security of cyberspace from terrorist acts, using the following approaches: the legal approach, the descriptive approach, and the analytical approach. This is achieved by gathering knowledge and data on the protection of cybersecurity and analyzing the different tools and methods that terrorist organizations use to implement their cybercrimes. The goal is to find ways to overcome the various challenges that terrorists pose to regional (Arab-wide) and international cybersecurity systems to find mechanisms and solutions to deal with this phenomenon effectively and to reduce its increasing risks to people and the security, stability, and economies of nations. The most significant conclusion that was reached is the need to continue international efforts to strengthen the fight against cyberterrorism and to establish a binding legal treaty in this regard so as to prevent further harm to the safety of the international community.

A Robust Stackelberg Game for Cyber-Security Investment in Networked Control Systems

We present a resource-planning game for cyber-security of networked control systems (NCSs). The NCS is assumed to be operating in closed loop using a linear state feedback <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\mathcal {H}_{2}$ </tex-math></inline-formula> -controller. A zero-sum, two-player Stackelberg game (SG) is developed between an attacker and a defender for this NCS. The attacker aims to disable communication of selected nodes and thereby render the feedback gain matrix to be sparse, leading to degradation of closed-loop performance, while the defender aims to prevent this loss by investing in the protection of targeted nodes. Both the players trade their <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\mathcal {H}_{2}$ </tex-math></inline-formula> -performance objectives for the costs of their actions. The standard backward induction (BI) method is modified to determine a cost-based Stackelberg equilibrium (CBSE) that saves the players’ costs without degrading the control performance. We analyze the dependence of a CBSE on the relative budgets of the players and on the node “importance” order. Moreover, a robust defense (RD) method is developed for the realistic case when the defender is not informed about the attacker’s resources. The proposed algorithms are validated using examples from wide-area control of electric power systems. It is demonstrated that reliable and RD is feasible unless the defender’s resources are severely limited relative to the attacker’s resources. We also show that the proposed methods are robust to time-varying model uncertainties and thus are suitable for long-term security investment in realistic NCSs. Finally, we use computationally efficient genetic algorithms (GAs) to compute the optimal strategies of the attacker and the defender in realistic large power systems.

Detection of Cyber Attacks in Network Using ML

Cybercrime is on the rise everywhere and takes advantage of different flaws in the computing environment. Paying ethical hackers boosted their focus on finding flaws and suggesting solutions. Due to machine learning's success in solving problems related to cyber security, it has recently become a topic of significant relevance. Major concerns in cyber security, such as intrusion detection, malware categorization, and detection, have been addressed using machine learning approaches. Although though it cannot fully automate a cyber security system, machine learning may be able to identify cyber security threats more effectively than other software-oriented approaches, which lessens the stress on security analysts. In this research, we suggest using a machine learning model to identify the network attack. To obtain reliable predictions, some machine learning approaches, such as Random Forest, SVM, Gradient Boosting have been applied. The dataset CSE-CIC-IDS2018 was used to train the model. As a result, efficient adaptive techniques, including different machine learning algorithms, can increase detection rates. The basic objective is to ascertain whether the network is being attacked. Random Forest gave highest accuracy of 99.99%.

PLC Cybersecurity Test Platform Establishment and Cyberattack Practice

Programming logic controllers (PLCs) are vital components for conveyors in production lines, and the sensors and actuators controlled underneath the PLCs represent critical points in the manufacturing process. Attacks targeting the exploitation of PLC vulnerabilities have been on the rise recently. In this study, a PLC test platform aims to analyze the vulnerabilities of a typical industrial setup and perform cyberattack exercises to review the system cybersecurity challenges. The PLC test platform is a sorting machine consisting of an automatic conveyor belt, two Mitsubishi FX5U-32M PLCs, and accessories for material sorting, and Modbus is the selected protocol for data communication. The O.S. on the attacker is Kali ver. 2022.3, runs Nmap and Metasploit to exploit the target Modbus registers. On the other hand, the target host runs the O.S., Ubuntu 22.04 in the cyberattack exercises. The selected attack method for this study is packet reply which can halt operations sending custom data packets to the PLC. In summary, this study provides a basic step-by-step offensive strategy targeting register modification, and the testbed represents a typical industrial environment and its vulnerabilities against cyberattacks with common open-source tools.

An Intelligent Multi-Stage Model for Countering the Impact of Disinformation on the Cybersecurity System

An Intelligent Multi-Stage Model for Countering the Impact of Disinformation on the Cybersecurity System

An Automated Post-Exploitation Model for Cyber Red Teaming

Red teaming is a well-established methodology for ensuring and augmenting cyber system security; however, the training, expertise, and knowledge of appropriate tools and techniques required to perform effective red teaming come with a significant cost in time and resources. Large organizations such as the Department of Defense (DOD) use vulnerability assessment to identify software patches and other remediations for cyber systems to mitigate cyberspace exploitation. If a patch cannot be applied in a timely manner, for instance to minimize network downtime, measuring and identifying the impact of such unpatched vulnerabilities is left to scarce red teaming services. These services typically concentrate on initial access exploitation, which stops short of exploring the larger security impacts of cyber threats performing post-exploitation actions. This gap in post-exploitation red team analysis results in increased susceptibility to adversary offensive cyberspace operations (OCO) against DOD systems. This research extends the Cyber Automated Red Team Tool (CARTT), developed at the Naval Postgraduate School, by implementing automated red team post-exploitation analysis. The intent of this extended capability is to reduce the workload on limited DOD red teams and penetration testers by providing system administrators with the ability to perform deeper system analysis for the impacts of exploited vulnerabilities.

A Review and Testing of Fault Tolerance Levels of Anti-Poaching Cybersecurity System

The development of anti-poaching networks and systems has created a new environment for animals in game reserves all over the world. Advanced technologies such as heat sensors, drones, and trip wires help prevent poachers from entering the property and therefore, creating a safer environment for animals to roam freely. Radio frequency identification (RFID) systems are used to track the location of animals. These networks are, however, susceptible to being hacked if not properly protected with cybersecurity tools, resulting in cyber-criminals gaining access into the network. Many attacks or threats can be executed on the RFID network due to some exposed vulnerabilities of elements within the anti-poaching network. The purpose of this paper is to explore the empirical methods of common attacks, used by cyber-criminals, to attack the anti-poaching network, and whether these methods used are effective in identifying weaknesses within the network. This will be executed by creating an experimental structure of the anti-poaching system with a specialised focus on the RFID elements, using quantitative research methods to produce findings. GNS3, an open-source software application that has specifically been chosen to conduct this research, is used to build the network simulation in order to analyse the weaknesses of the network. Cybersecurity protocols are implemented to protect the network and aim to protect the animals. The attacks performed, such as Flood and Scapy attacks, have shown that the anti-poaching network is vulnerable to penetration from cyber-criminals. A hypothesis test was conducted to determine whether the attacks had a significant effect on the network, by using the average ping time from specific nodes to Google. It was found that the average ping time increased by 2.0020 units, therefore stating that the elements of the network were successfully attacked. The fault tolerance test shows that the availability of the anti-poaching network is roughly 90 percent which concludes that the network is configured to deliver quality performance and handle failures, should there be any intervention. This will allow game reserves to implement and have information on a better and safer RFID system for the animals.

The Polish Financial Supervision Authority in the national cybersecurity system

The Polish Financial Supervision Authority in the national cybersecurity system

Detection of Cyber Attacks and Network Attacks Using Machine Learning Algorithms

Now a days cyber crime growing and has a big effect everywhere globally. ethical hackers are normally involved in identifying flaws and recommending mitigation measures. the cyber safety international, there's a pressing need for the improvement of powerful techniques. Because of the effectiveness of machine learning in cyber security issues, machine learning for cyber security has recently become a hot topic. In cyber security, machine learning approaches have been utilized to handle important concerns such as intrusion detection, malware classification and detection, spam detection, and phishing detection. Although ML cannot fully automate a cyber-security system, it can identify cyber-security threats more efficiently than other software-oriented approaches, relieving security analysts of their burden. As a result, effective adaptive methods, such as machine learning techniques, can yield higher detection rates, lower false alarm rates, and cheaper computing and transmission costs. Our key goal is that the challenge of detecting attacks is fundamentally different from those of these other applications, making it substantially more difficult for the intrusion detection community to apply machine learning effectively. In this study, the CPS is modeled as a network of agents that move in unison with one another, with one agent acting as a leader and commanding the other agents. The proposed strategy in this study is to employ the structure of deep neural networks for the detection phase, which should tell the system of the attack's existence in the early stages of the attack. The use of robust control algorithms in the network to isolate the misbehaving agent in the leader-follower mechanism has been researched. Following the attack detection phase with a deep neural network, the control system uses the reputation algorithm to isolate the misbehaving agent in the presented control method. Experiment results show that deep learning algorithms can detect attacks more effectively than traditional methods, making cyber security simpler, more proactive, and less expensive and more expensive.

The inverse problem of Q-analysis of complex systems structure in cyber security

&#x0D; &#x0D; &#x0D; It is considered the inverse problem of Q-analysis. In the course of the research, an algorithm for the recovery of simplicial complexes from elementary simplex using local maps and a structural tree was developed. This algorithm will reduce the amount of data stored and improve the management process if the simplicial complex describes a real big complex system wich it can imagine cyber security system.&#x0D; &#x0D; &#x0D;

Review of Cybersecurity Analysis in Smart Distribution Systems and Future Directions for Using Unsupervised Learning Methods for Cyber Detection

In a physical microgrid system, equipment failures, manual misbehavior of equipment, and power quality can be affected by intentional cyberattacks, made more dangerous by the widespread use of established communication networks via sensors. This paper comprehensively reviews smart grid challenges on cyber-physical and cyber security systems, standard protocols, communication, and sensor technology. Existing supervised learning-based Machine Learning (ML) methods for identifying cyberattacks in smart grids mostly rely on instances of both normal and attack events for training. Additionally, for supervised learning to be effective, the training dataset must contain representative examples of various attack situations having different patterns, which is challenging. Therefore, we reviewed a novel Data Mining (DM) approach based on unsupervised rules for identifying False Data Injection Cyber Attacks (FDIA) in smart grids using Phasor Measurement Unit (PMU) data. The unsupervised algorithm is excellent for discovering unidentified assault events since it only uses examples of typical events to train the detection models. The datasets used in our study, which looked at some well-known unsupervised detection methods, helped us assess the performances of different methods. The performance comparison with popular unsupervised algorithms is better at finding attack events if compared with supervised and Deep Learning (DL) algorithms.

AMGmal: Adaptive mask-guided adversarial attack against malware detection with minimal perturbation

Modern cyber security systems increasingly rely on deep neural networks (DNNs) to tackle the surge in security threats. However, it is well-known that DNNs are vulnerable to adversarial examples. The state-of-the-art adversarial malware attacks focus on fooling the detector without losing functionality, but ignore the magnitude of perturbation, which can lead to attack failure in real-world scenarios. This paper proposes a novel technique of generating adversarial malware examples, AMGmal, i.e., Adaptive Mask-Guided adversarial attack against malware detection with minimal perturbation. By prioritizing the modification of critical bytes at slack areas by saliency detection and mask guidance technique, we find an optimal balance between the evasion rate, perturbation magnitude and running time through three strategies, namely Dilation, Erosion and Heuristic. The proposed strategies can be extended to other attack methods as a generic post-processing step to minimize the perturbation. We evaluate the performance of AMGmal on the Malimg and SOREL-20M datasets and five DNN-based malware detectors. Experimental results show that the perturbation magnitude is reduced to one-third of base attack, from 3.34% to 0.90% and 2.32% to 0.73%. Compared to existing methods, AMGmal has the highest success rate of 68.09% and 64.75% when the amount of perturbation is similar, and vice versa. Furthermore, AMGmal is still effective even with defenses in place.

Model-Based Systems Engineering Cybersecurity for Space Systems

As industries in various sectors increasingly adopt model-based systems engineering (MBSE) for system lifecycle design and development, engineers can manage and describe systems of higher complexity than ever before. This is especially true for the field of space systems; while past missions have developed using document-based planning, it is only in the last several years that NASA and other organizations in the space industry have begun using MBSE. One crucial factor of space systems development that is often overlooked is cybersecurity. As space systems become more complex and cyberphysical in nature, cybersecurity requirements become more difficult to capture, especially through document-based methods; a need for a means by which to continuously verify and validate systems cybersecurity for cyberphysical space missions arises. By expanding upon a National Institute of Standards and Technology (NIST) framework for cyber resiliency, this work proposes a methodology that uses MBSE traceability functionality to demonstrate adequate cybersecurity for cyberphysical space systems using SysML requirements modeling capabilities. Key goals, objectives, and strategic principles leading to achieving cybersecurity at all levels of the system’s architectural hierarchy are presented. Recommendations for the future of space cybersecurity include the addition of the space sector to the Department of Homeland Security Cybersecurity &amp; Infrastructure Security Agency’s list of critical infrastructure sectors to improve standardization and control of space cyberinfrastructure.

Kajian Ilmu Pertahanan dalam Strategi Pertahanan Negara Guna Menghadapi Ancaman Teknologi Digital di Indonesia

This article explains the use of people's personal data to state security data that is currently interconnected and circulating on the internet network. Regulation of the Minister of Defense No. 16 years 2010 which mandated the establishment of a digital technology defense concept in Indonesia. Data surveillance is carried out physically and logically with integrity and upholding confidentiality be able to find illegal processes. Continued with this capacity and capability improvement as a must to be able to continue to innovate and develop because over time the types of threats and challenges will change and develop. As a support, qualified digital or cyber technology system is built first. Thus, it is hoped that the cyber defense strategy in Indonesia can guarantee sovereignty and security for the nation and state. With the aim of developing human resources to meet the needs of personnel in national cybersecurity activities. The Indonesian government has realized that this development requires policy as a measurable and clear legal basis which is then followed by the establishment of a strategic cybersecurity system. Thus, it is hoped that the security of citizens in conducting activities in the digital world can be well guaranteed their rights and obligations.

Report on the 3rd International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS - 2022)

Critical Infrastructures (CIs) are vital for modern societies, covering different sectors like banking, emergency services, energy, healthcare, oil and gas, transportation, and water distribution. Over the years, CIs rely on technology for their seamless operations. Their reliable and secure operation is of supreme importance to societal welfare and a nation's economy. This paper reports on the presentation and discussions held during the 3rd International Workshop on Engineering and Cybersecurity of Critical Systems (EnCyCriS - 2022). The main aim of this EnCyCriS workshop is to gather contributions from researchers and practitioners working on challenges and solutions for engineering and cybersecurity of critical systems in the Fourth Industrial Revolution (4IR). This year´s edition has accepted and presented seven papers in addition to a keynote speech from a Principal Analyst in Information Security for Equinor ASA, Norway. This workshop was co-located with the 44th International Conference on Software Engineering (ICSE - 2022), which took place on 16th May 2022.

Factors Influencing User’s Intention to Adopt AI-Based Cybersecurity Systems in the UAE

Aim/Purpose: The UAE and other Middle Eastern countries suffer from various cybersecurity vulnerabilities that are widespread and go undetected. Still, many UAE government organizations rely on human-centric approaches to combat the growing cybersecurity threats. These approaches are ineffective due to the rapid increase in the amount of data in cyberspace, hence necessitating the employment of intelligent technologies such as AI cybersecurity systems. In this regard, this study investigates factors influencing users’ intention to adopt AI-based cybersecurity systems in the UAE. Background: Even though UAE is ranked among the top countries in embracing emerging technologies such as digital identity, robotic process automation (RPA), intelligent automation, and blockchain technologies, among others, it has experienced sluggish adoption of AI cybersecurity systems. This selectiveness in adopting technology begs the question of what factors could make the UAE embrace or accept new technologies, including AI-based cybersecurity systems. One of the probable reasons for the slow adoption and use of AI in cybersecurity systems in UAE organizations is the employee’s perception and attitudes towards such intelligent technologies. Methodology: The study utilized a quantitative approach whereby web-based questionnaires were used to collect data from 370 participants working in UAE government organizations considering or intending to adopt AI-based cybersecurity systems. The data was analyzed using the PLS-SEM approach. Contribution: The study is based on the Protection Motivation Theory (PMT) framework, widely used in information security research. However, it extends this model by including two more variables, job insecurity and resistance to change, to enhance its predictive/exploratory power. Thus, this research improves PMT and contributes to the body of knowledge on technology acceptance, especially in intelligent cybersecurity technology. Findings: This paper’s findings provide the basis from which further studies can be conducted while at the same time offering critical insights into the measures that can boost the acceptability and use of cybersecurity systems in the UAE. All the hypotheses were accepted. The relationship between the six constructs (perceived vulnerability (PV), perceived severity (PS), perceived response efficacy (PRE), perceived self-efficacy (PSE), job insecurity (JI), and resistance to change (RC)) and the intention to adopt AI cybersecurity systems in the UAE was found to be statistically significant. This paper’s findings provide the basis from which further studies can be conducted while at the same time offering critical insights into the measures that can boost the acceptability and use of cybersecurity systems in the UAE. Recommendations for Practitioners: All practitioners must be able to take steps and strategies that focus on factors that have a significant impact on increasing usage intentions. PSE and PRE were found to be positively related to the intention to adopt AI-based cybersecurity systems, suggesting the need for practitioners to focus on them. The government can enact legislation that emphasizes the simplicity and awareness of the benefits of cybersecurity systems in organizations. Recommendation for Researchers: Further research is needed to include other variables such as facilitating conditions, AI knowledge, social influence, and effort efficacy as well as other frameworks such as UTAUT, to better explain individuals’ behavioral intentions to use cybersecurity systems in the UAE. Impact on Society: This study can help all stakeholders understand what factors can increase users’ interest in investing in the applications that are embedded with security. As a result, they have an impact on economic recovery following the COVID-19 pandemic. Future Research: Future research is expected to investigate additional factors that can influence individuals’ behavioral intention to use cybersecurity systems such as facilitating conditions, AI knowledge, social influence, effort efficacy, as well other variables from UTAUT. International research across nations is also required to build a larger sample size to examine the behavior of users.