Cyberspace Situational Awareness Research Articles

A Two-Stage Anomaly Detection Method Based on User Preference Features and the Deep Fusion Model

Rapid and accurate anomaly traffic detection is one of the most important research problems in cyberspace situational awareness. In order to improve the accuracy and efficiency of the detection, a two-stage anomaly detection method based on user preference features and a deep fusion model is proposed. First, a user-preference list of attack detection tasks is constructed based on the resilient distributed dataset. Following that, the detection tasks are divided into multiple stages according to the detection framework, which allows multiple worker hosts to work in parallel. Finally, a deep fusion classifier is trained using the features extracted from the input traffic data. Experimental results indicate that the proposed method achieves better detection accuracy compared to the existing typical methods. Furthermore, compared with stand-alone detection, the proposed method can effectively improve the time efficiencies of the model’s training and testing to a large extent. The ablation experiment justifies the use of the machine learning method.

A Cybersecurity Knowledge Graph Completion Method for Penetration Testing

Penetration testing is an effective method of making computers secure. When conducting penetration testing, it is necessary to fully understand the various elements in the cyberspace. Prediction of future cyberspace state through perception and understanding of cyberspace can assist defenders in decision-making and action execution. Accurate cyberspace detection information is the key to ensuring successful penetration testing. However, cyberspace situation awareness still faces the following challenges. Due to the limited detection capability, the information obtained from cyberspace detection intelligence is incomplete. There are some errors in the cyberspace detection intelligence, which may mislead the penetration testing workers. The knowledge graph can store and manage the cybersecurity data. In order to ensure the integrity and accuracy of cyberspace information, we design a knowledge graph completion model called CSNT to complete cybersecurity data. CSNT uses the BiLSTM to capture the interaction information between entities and relationships. It models the relationship between entities by combining the neural network and tensor decomposition. The Pearson Mix Net is designed to control the generation of joint vectors. We also design a novel self-distillation strategy to reduce catastrophic forgetting during model training. After learning the relationship pattern between entities in the cyberspace detection intelligence, the model can be used to mine the knowledge not found in the cybersecurity detection intelligence and correct the erroneous records. Experiments show that our method has certain advantages for the knowledge graph completion.

Theoretical basis and technical methods of cyberspace geography

Cyberspace is a new spatial realm of activities involving both humans and data, and it has become a cornerstone of the national security of every country. A scientific understanding of cyberspace is essential for analyzing cyberspace incidents, governing cyberspace and ensuring cybersecurity. Accordingly, cyberspace has become a new field of geographic research in the Information Age. Against the backdrop of fierce international competition over cyberspace, there has been an urgent need to strengthen research between the fields of geography and cybersecurity, leading to theoretical and methodological innovations that have created the sub-discipline of cyberspace geography. Cyberspace geography (CG) extends geographical research from real spaces to virtual spaces, and its theoretical basis is the evolution of the traditional geographic human-land relationship theory into a human-land-network relationship theory. CG research includes constructing mapping rela-tionships between cyberspace and real space, redefining the traditional geographic concepts of distance and regions for cyberspace, creating a language, models and methodologies for visually representing cyberspace, drawing maps of cyberspace, and researching the principles governing the evolution of cyberspace structures and behaviors. The technical methods of CG include collecting and integrating data on elements of cyberspace, visually representing cyberspace and conducting cyberspace situational and behavioral intelligence awareness. Intelligence awareness covers cyberspace situational status assessments, network hotspot event dissemination and traceability analysis, and network event situational simulations and risk predictions. CG offers new perspectives on the scientific understanding of cyberspace, the development of disciplines such as geography and cybersecurity, and the creation of national cybersecurity prevention and control mechanisms as well as a community of common future in cyberspace.

Malware target recognition via static heuristics

Organizations increasingly rely on the confidentiality, integrity and availability of their information and communications technologies to conduct effective business operations while maintaining their competitive edge. Exploitation of these networks via the introduction of undetected malware ultimately degrades their competitive edge, while taking advantage of limited network visibility and the high cost of analyzing massive numbers of programs. This article introduces the novel Malware Target Recognition (MaTR) system which combines the decision tree machine learning algorithm with static heuristic features for malware detection. By focusing on contextually important static heuristic features, this research demonstrates superior detection results. Experimental results on large sample datasets demonstrate near ideal malware detection performance (99.9+% accuracy) with low false positive (8.73e-4) and false negative rates (8.03e-4) at the same point on the performance curve. Test results against a set of publicly unknown malware, including potential advanced competitor tools, show MaTR’s superior detection rate (99%) versus the union of detections from three commercial antivirus products (60%). The resulting model is a fine granularity sensor with potential to dramatically augment cyberspace situation awareness.