Cyber Warfare Research Articles

The bitskrieg that was and wasn’t: the military and intelligence implications of cyber operations during Russia’s war on Ukraine

ABSTRACT The Russian war on Ukraine presents a multifaceted landscape for the analysis of the cyber dimensions of contemporary war and their strategic, operational, and tactical impacts. While the long-anticipated disabling and devastating cyber blitzkrieg did not happen at the beginning of the full-scale Russian invasion of Ukraine in February 2022, the persistent utilization of a variety of cyber tools by both sides in this war points to the hybrid warfare strategy taking place not only on the ground but also in cyberspace. Cyberattacks on Ukrainian critical infrastructure, governmental entities and different parts of the economy have been a constant feature in Ukraine’s struggle to maintain its national security. These cyberattacks had a varying level of success. Yet, their role in the Russia–Ukraine war is still not fully understood or extensively studied. This work analyses cyber incidents from the first period of conflict, starting in November 2013 until 23 February 2022, and examines their objective and subjective impacts at the domestic and the international levels. This work also reviews the post-escalation period starting from 24 February 2022, using the data collected directly from the publicly available Ukrainian governmental sources and international cyber firms. This work aims to address the role and impact of cyber operations in an ongoing Russia–Ukraine war on both the people, networked systems, and other physical contests of warfare and the soldiers in the trenches is the principal subject of this article.

The Role of Civilian Cybersecurity Companies in Military Cyber Operations

Abstract The Russia-Ukraine war has clearly shown that critical infrastructures are prime targets for cyber operations in addition to the physical domain. In practice, in many cases, these critical infrastructures are protected by civilian cybersecurity companies in the context of a managed security service, so their defense operations must necessarily be coordinated with military defense activities. This includes among others the sharing of information classified under different classification systems (national, EU, NATO) between different actors in national cyber defense, the inclusion of appropriate civilian experts in the armed forces, and the usage of cutting-edge cybersecurity technologies (e.g. AI-enabled solutions) that are first introduced for civilian use, with military organizations only having access to them later or possibly not encountering them at all due to procurement difficulties. The main goal of this paper is to introduce the existing opportunities and obstacles to civilians’ involvement in military cyber operations in the areas of legislation, technology, and human resources from the European perspective. Moreover, the paper deals with the actual questions of cybersecurity intelligence sharing between civilian and military entities and the European Union’s actions in order to improve the overall cybersecurity posture of the region.

RRIoT: Recurrent reinforcement learning for cyber threat detection on IoT devices

To address the recent worldwide proliferation of cybersecurity attacks across computing systems, especially internet-of-things devices, new robust and automated methods are needed to detect and mitigate the attacks in real time, ensuring the confidentiality, integrity, and availability of systems. Machine Learning (ML) techniques have shown promise in detecting some types of attacks. However, they are not universally successful in detecting sequential attacks. In this study, we propose RRIoT, to mitigate this issue. RRIoT applies a Deep Deterministic Policy Gradient reinforcement learning (RL) algorithm in conjunction with an LSTM layer within an adversarial environment to detect and identify attacks. We evaluate our method against novel and state-of-the-art ML/RL algorithms which build upon previous RL algorithms such as deep Q-networks (DQN), dueling deep Q-networks (DDQN), and deep deterministic policy gradient (DDPG). Our results indicate that our proposed RRIoT generally performs better than existing ML algorithms and performs as well as or better than novel RL algorithms with new network architectures. We leverage Shapley Additive Global Importance (SAGE) to provide additional insight into which features contribute most to a model's performance and verify feature importance through the implementation of an ablation study across three IoT telemetry datasets.

Analysis of Criminal Policy against Perpetrators of Terrorism Crimes: Perspectives on the Death Penalty and Human Rights in Indonesia

The extent of the terrorist network in Indonesia threatens the threat and integrity of the Republic of Indonesia, manifested in broad trends, organization and systematic networks. Terrorist attacks are increasingly brutal, targeting innocent civilians. The threat is increasingly complex with increasing radicalization and online recruitment, requiring comprehensive action, including cooperation with government agencies, security forces, intelligence, and civil society, as well as a comprehensive approach involving intelligence, community participation, and addressing the root causes of radicalization to eradicate terrorist networks . Eradicating criminal acts of terrorism is a serious challenge for the Indonesian government, with one of the complicated aspects being the implementation of the death penalty against perpetrators of terrorism. This article analyzes Indonesian criminal policy, explains the method of punishment, the Human Rights (HAM) perspective, and critical views on the death penalty. In conclusion, it is important to strike a balance between efforts to enforce the death law and the desire for the principles of human rights and justice in the context of eradicating terrorism. Continuous evaluation of the application of the death law and open dialogue involving various parties are the keys to reaching an agreement that upholds humanitarian values and justice in efforts to overcome criminal acts of terrorism in Indonesia.

Transforming Cyber Education thru Open to All Accessible Pathways

Boise State University’s (BSU) Cyber Operations and Resilience CORe program was intentionally designed so that any student, especially non-traditional and non-technical students, with an interest in cybersecurity could have an education and training pathway to enter the cyber workforce. The CORe curriculum focuses on teaching students how to design, apply, and improve cybersecurity through the interaction of people, processes, and technology. CORe is a stackable curriculum with elective credit hours and options for various academic and industry certificates and certifications that enable students to customize their unique career pathway. The CORe program guides students to think about the system being managed, the risks presented, and the dynamic intersection of system elements when considering how to incorporate resilience frameworks in achieving a resilient system. By developing systems thinking, the students gain an understanding of the interdependencies interacting with the operational system. The CORe program encourages students to integrate cybersecurity knowledge with models and frameworks found in other academic disciplines through a unifying systems approach. CORe is designed around the realities of today’s broad cyber landscape: that breaches will occur in any system over time and proactive design of resilience into systems to detect, respond, and recover in a timely and orderly manner is critical. Students are taught to think holistically about cybersecurity focusing on all system elements. CORe is not a traditional cybersecurity degree. CORe is distinguished by the non-traditional engineering, computer science approach to cybersecurity education with the singular focus on infusing resilience operations and transdisciplinary systems thinking principles throughout the curriculum.

Mitigation of attack detection via multi-stage cyber intelligence technique in smart grid

A smart grid is an electrical system that uses electronic communications to support two distinct data and electricity flows. This makes it possible for the system to recognize, react to, and resolve various problems. Power users of digital technology can take an active role and have the ability to cure themselves. Cybercrimes affecting the security of the smart grid include the compromise of vital client data by attackers, the spread of viruses, cybersecurity mistakes, and vulnerabilities in distributed systems. In order to identify the multi-stage cyberattacks that pose a threat to the smart grid, a novel Multi-Stage Cyber Intelligence (MSCI) technique has been developed in this work. A signal is generated by an intrusion detection system (IDS) sensor and passed through a Chebyshev filter for preprocessing in order to minimize its noise level. The risk will be identified by the security identification block, which also includes risk assessment, risk estimation, and risk identification. The Risk Identification Block finds the risk by gaining access to the Cyber Information Database. If the risk is not found, it is transmitted to the BI-LSTM Network, which verifies if it is an attack. A MATLAB simulator is used to implement the proposed approach. Evaluation criteria like Precision, F1 Score, Specificity, Accuracy, and Detective Rate have been used to assess the effectiveness of the Multi-Stage Cyber Intelligence (MSCI) technique approach that has been provided. The experimental results show that the suggested MSCI strategy has a 99% success rate, which is comparatively high when compared to the current approaches of 9.09%, 22.22%, and 47.47% for the CDS, AD-IOT, and SVM techniques, respectively.

Regression Analysis of The National Cyber Security Index In The Southeast Asia Region

In the current era of the Industrial Revolution 4.0, information and communication technology is rapidly developing in all sectors. In the matrix of non-military defense implementation, technology is one of the dimensions that influence the achievement of a country's general defense policy. Technological development does not always have a positive impact. Cyber threats and attacks are an example of the negative impact in technological development. In the "Cyber Defense Guidelines," national cyber security is defined as all efforts to maintain the confidentiality, integrity, and availability of information and all its supporting facilities at the national level, which are cross-sectoral in nature. According to data from the National Cyber Security Index (NCSI) survey agency, a country's National Cyber Security Index (Y) is measured based on 12 indicators, including: cyber security policy development (X1), cyber threat analysis and information (X2), education and professional development (X3), contribution to global cyber security (X4), protection of digital services (X5), protection of essential services (X6), e-identification and trust services (X7), protection of personal data (X8), cyber incident response (X9), cyber crisis management (X10), fight against cybercrime (X11), and military cyber operations (X12). In this study, a regression analysis will be conducted on the 12 indicators of the National Cyber Security Index against the Total Assessment of the National Cyber Security Index (Y) in Southeast Asia, so that the type of equation in the regression analysis can be identified.

Offensive Cyber Operations and State Power: Lessons from Russia in Ukraine

Offensive cyber operations are an increasingly important tool of authoritarian statecraft, used in the pursuit of foreign policy objectives and functioning as an expression of state power. Our article informs Canadian cybersecurity policy by pulling lessons from Russia's use of cyber aggression against Ukraine between 2014 and 2022. Our analysis explores the nexus between Russian cyber operations and foreign and domestic policy, the relationship between private and public cybersecurity organizations, and the purported intent and effectiveness of Russian cyber operations.

Regional Perspective of Using Cyber Insurance as a Tool for Protection of Agriculture 4.0

The digitalization of the agricultural industry is manifested through the active use of innovative technologies in all its areas. Agribusiness owners have to constantly improve their security to meet new challenges. In this context, the existing cyber risks of the agrarian industry were assessed and their classification by possible consequences, such as data theft or alteration, cyber terrorism, cyber warfare, software hacking or modification, the blocking of markets and transactions on them, was proposed. Cyber insurance is an effective tool for minimizing the likelihood of cyber incidents and for comprehensive post-incident support, with the involvement of cybersecurity specialists. An algorithm for cooperation between an agricultural company and an insurance company when concluding a cyber risk insurance contract is proposed, which takes into account the needs and wishes of insurers at each stage of the interaction. To assess the need to use cyber insurance in agriculture 4.0, a methodology has been developed to evaluate the regional characteristics of cybersecurity and the digitalization of agribusiness. The results of the study show a heterogeneous need for this tool in different regions of the world.

Unraveling the dynamics of the cyber threat landscape: Major shifts examined through the recent societal events

The continuous expansion of cyberspace offers numerous advantages but also broadens the cybersecurity attack surface, thereby affecting the resilience of critical infrastructure and societal systems. Given the complexity of factors affecting cybersecurity, a data-centric approach is needed, which involves leveraging existing datasets on cyber incidents and utilizing advanced data analytics techniques for enhanced preparedness against evolving cyber threats. In this study, we optimize past cyberattack data for statistical analysis and introduce a methodology for detecting significant shifts in cyberattack patterns through intervention analysis. By applying this approach, we correlate major shifts in the cyber threat landscape over the past six years with critical societal events like COVID-19 and the Russia–Ukraine War, offering insights meaningful for both society and policy formulation.

Open-source cyber intelligence research through PESTEL framework: Present and future impact

Recent scholarly endeavors in the domain of Cyber Intelligence have unveiled its multifaceted implications, intricately interwoven with various Sustainable Development Goals (SDGs), notably encompassing Goal 9 (Industry, Innovation, and Infrastructure), Goal 11 (Sustainable Cities and Communities), Goal 16 (Peace, Justice and Strong Institutions), among others. This study intricately dissects the symbiotic nexus between Cyber Intelligence research and these SDGs, whilst simultaneously unraveling its profound reverberations across the diverse dimensions of the PESTEL (Political, Economic, Social, Technological, Environmental, and Legal) framework. Ten critical impacts inherent in current research works on cyber intelligence were identified, subsequently juxtaposing these impacts within the PESTEL dimensions. This analytical process further unraveled an additional eleven critical impacts yet to be addressed by current research works on cyber intelligence. Addressing these additional 11 impacts in forthcoming research endeavors is posited as a catalyst for optimizing societal benefits across the diverse spectra of PESTEL dimensions. Moving on from categorizing and classifying societal impacts of cyber research within PESTEL framework, this study finally establishes a strategic roadmap of 11 future research directions on cyber intelligence like sustainable cyber security practices, mental health aspects of cyber victimhood, ethical AI in cybersecurity among others. Fostering a cross-disciplinary dialog, this work contributes to the broader discourse on harnessing cyber intelligence for societal betterment, mitigating the potential detrimental effects cyber threats.

Enhancing cybersecurity in smart grids: Deep black box adversarial attacks and quantum voting ensemble models for blockchain privacy-preserving storage

Smart grids are getting important in today’s power management, so with that, smart grid technologies are increasingly important too. There have been a lot of concerns about smart grid technologies being hacked, and as a result, some deep black box adversarial attacks have been conducted and presented. We propose a new experimental methodology for benchmarking smart grid security with black box attacks. Additionally, concerning the type of smart grids, Smart Power Grids, deep black box adversarial attacks which can be crafted using virtually no knowledge about the target due to the inherent complexity of content available in cryptographic libraries like SecLib or Bouncy Castle how it affects security of cyber-physical power systems. We identify potential impacts of deep black box attacks on Smart Power Grids as implemented by the Department of Energy in 1996, we evaluate existing protection methods, and we find out the pitfalls thereof. With the aim of overcoming the aforementioned drawbacks, we initiate a study on deep black box adversarial attacks against Smart Power Grids showing that statistically significant effects against a national Smart Power Grid are achievable with absolute security. We also probe detection of cyber security attacks on Smart Power Grids. We illustrate landscape of smart grids with numerous cyber threats and demonstrate the limitations of traditional security practices. We show the importance of machine learning to detect attacks and the unlikelihood of identification of dependable and efficient detection schemes. We describe quantum voting ensemble models as one of the most powerful techniques in the detection of cyber security attacks. Finally, we propose an experimental setup and evaluation criteria to detect cyber security attacks in smart grids using quantum voting ensemble models. Then, we talk about private data storage in blockchain based smart grid infrastructure. We give an introduction of block chain and its essentiality in smart grids. We discuss privacy issues in block chain based smart grids. We acknowledge the strength of privacy safeguards, but on the same wavelength, we realize their weaknesses. Next, we propose a quantum resistant encryption technique that enhances the privacy of smart grids. We propose quantum voting ensemble models as one of the most promising techniques to address the issue of private data storage in block chains. As a result, we provide a comparison between the proposed models and traditional approaches to privacy protection in smart grids based on an experimental performance review. Then, we propose a unified strategy to improve smart grid cyber security by incorporating deep black box attacks with quantum voting ensemble models. Finally, we disclose several benefits of such integration and perform an experimental evaluation to investigate the effectiveness of the unified approach. The results of our study identify security gaps in smart grids and propose state-of-the-art mechanisms to address them. The challenges of smart grids system require the amalgamation of blockchain, quantum voting ensemble models and deep black box adversarial attacks. We achieve this objective proposing a unified strategy. The results of this study will equally be helpful for future research and smart grid cyber security implementations.

Gentlemen, you can't fight in here. Or can you?: How cyberspace operations impact international security

AbstractThe military now views cyberspace as a new warfare domain, with constant cyber operations potentially causing significant consequences. Internationally, countries are heavily involved in cyberspace, but international law lags behind this evolution, raising questions about its application and retaliation measures. This article investigates international law in cyberspace and cyber operations in warfare and terrorism, exploring recent calls for increased legislation. The impact of cyberspace nonregulation on international security is examined from both positive and negative perspectives. It argues that solving anonymity and attribution issues requires state collaboration, with an initial step of cooperation against cyber‐terrorism. The conclusion emphasizes the necessity of cyberspace regulation and legislation for international and national security, offering a starting point for discussion.

Spatial network disintegration based on kernel density estimation

The problem of network disintegration, such as suppression of an epidemic spread and destabilization of terrorist networks, possesses extensive applications and has lately been the focus of growing interest. Many real-world complex systems are represented by spatial networks in which nodes and edges are spatially embedded. However, existing disintegration approaches for spatial network disintegration focus on singular aspects such as geospatial information or network topography, with insufficient modeling granularity. In this paper, we propose an effective and computationally efficient virtual node model that essentially integrates the geospatial information and topology of the network by modeling edges as virtual nodes with weights. Moreover, we employ Kernel Density Estimation, a well-known non-parametric technique for estimating the underlying probability density function of samples, to fit all nodes, comprising both network and virtual nodes, to identify the critical region of the spatial network, which is also the circular geographic region where disintegration occurs. Extensive numerical experiments on synthetic and real-world networks demonstrate that our method outperforms existing methods in terms of both effectiveness and efficiency, which provides a fresh perspective for modeling spatial networks.

Classification of intrusion cyber‐attacks in smart power grids using deep ensemble learning with metaheuristic‐based optimization

AbstractThe most advanced power grid design, known as a ‘smart power grid’, integrates information and communication technology (ICT) with a conventional grid system to enable remote management of electricity distribution. The intelligent cyber‐physical architecture enables bidirectional, real‐time data sharing between electricity suppliers and consumers through smart meters and advanced metering infrastructure (AMI). Data protection issues, such as data tampering, firmware exploitation, and the leakage of sensitive information arise due to the smart power grid's substantial reliance on ICT. To maintain reliable and efficient power distribution, these issues must be identified and resolved quickly. Intrusion detection is essential for providing secure services and alerting system administrators in the case of adversary attacks. This paper proposes an intrusion classification scheme that identifies several types of cyber attacks on modern smart power grids. Grey‐Wolf metaheuristic optimization‐based feature selection is used to learn non‐linear, overlapping, and complex electrical grid properties. An extended deep‐stacked ensemble technique is advanced by putting predictions from weak learners (CNNs) into a meta‐learner (MLP). The outcomes of this approach are explained and confirmed using explainable AI (XAI). The publicly available dataset from Mississippi State University and Oak Ridge National Laboratory (MSU‐ORNL) is used to conduct experiments. The experimental results show that the proposed method achieved a peak accuracy of 96.6% while scrutinizing the original MSU‐ORNL data feature set and a maximum accuracy of 99% when analysing the selected feature set. Therefore, the proposed intrusion classification scheme may protect smart power grid systems against cyber security attacks.

Advanced persistent threats and the “big four”: State-sponsored hackers in China, Iran, Russia, and North Korea in 2003–2021

The author investigates a range of international hacking groups collectively known as advanced persistent threats (APTs), which have conducted a concentrated number of cyber operations from four authoritarian states – China, Iran, Russia, and North Korea. The author collected data on 112 APTs that operated in 2003-2021 across the globe and analyzed their behavior and state affiliations to conclude that APTs’ ties to the “big four” can be explained by the strategic goals of authoritarian states to supplement their military and economic power. The ties have also much to do with states possessing sufficient political capital at home to challenge existing norms of cyberspace behavior. Moreover, the big four boast a high degree of digital expertise and heavy investment into the superiority of cyber offense over defense. The author provides empirical support for the findings in a comparative case study of Chinese and Iranian cyber forces.

Cyber Warfare as a Use of Force against Third-Party Countries: The Perspective of International Law

The use of force in international relations takes different forms and changes year by year due to the development of cyber technology. The problem mentioned in this study is that the Charter of the United Nations (UN Charter) and international law have not considered weapons development and future weapons that may be used in international relations, as Russia has used such weapons during the war against Ukraine. Unfortunately, cyber technologies were used to deter and weaken Ukraine’s chance to gain an advanced result on the ground. Although such cyber operations can cause the same physical damage as other weapons, the international community is still struggling to determine whether using a cyber weapon is considered a use of force. This study argues that cyber attacks against third-party countries that support Ukraine during the war may count as the use of force and a breach of Article 2(4) of the UN Charter.

Machine learning in cybersecurity: A review of threat detection and defense mechanisms

The cybersecurity concerns get increasingly intricate as the digital world progresses. In light of the increasing complexity of cyber threats, it is imperative to develop and implement advanced and flexible security strategies. Machine Learning (ML) has become a potent tool in strengthening cybersecurity, providing the capacity to scrutinise extensive information, recognise trends, and improve threat detection and defence methods. This paper examines the significance of ML in the field of cybersecurity, with a special emphasis on the identification of threats and the implementation of protective measures. By incorporating ML algorithms into cybersecurity frameworks, organisations may automate decision-making processes, facilitating prompt responses to ever-changing threats. The initial segment explores the terrain of cyber threats, highlighting the necessity for dynamic and aggressive security methods. Conventional solutions that rely on signatures are frequently inadequate when it comes to handling sophisticated, shape-shifting attacks. ML algorithms, in contrast, have exceptional proficiency in identifying nuanced patterns and irregularities within extensive datasets, therefore offering a more efficient method of detecting potential threats. The second section delves into several ML methodologies utilised in cybersecurity, including supervised and unsupervised learning, deep learning, and reinforcement learning. Every approach is assessed based on its suitability for threat detection, demonstrating its advantages and constraints. Furthermore, the relevance of feature engineering and data pretreatment in improving machine learning models for cybersecurity applications. The versatility of ML algorithms allows them to grow with emerging threats, making them a useful tool in the ever-changing arena of cyber warfare. The final segment focuses on real-world applications of machine learning in cybersecurity, presenting successful use cases across sectors. From anomaly detection to behavior analysis, ML algorithms contribute to the discovery of dangerous activity, lowering false positives and strengthening the overall security posture. Lastly, the paper covers the obstacles and ethical issues related to the adoption of ML in cybersecurity. Issues like as adversarial assaults, skewed datasets, and the interpretability of ML models are examined, highlighting the necessity for a holistic strategy that integrates modern technology with ethical considerations. The fusion of human expertise and machine intelligence offers a formidable defense against evolving cyber threats, paving the way for a more resilient and secure digital future.

Optimizing Cybersecurity Attack Detection in Computer Networks: A Comparative Analysis of Bio-Inspired Optimization Algorithms Using the CSE-CIC-IDS 2018 Dataset

In computer network security, the escalating use of computer networks and the corresponding increase in cyberattacks have propelled Intrusion Detection Systems (IDSs) to the forefront of research in computer science. IDSs are a crucial security technology that diligently monitor network traffic and host activities to identify unauthorized or malicious behavior. This study develops highly accurate models for detecting a diverse range of cyberattacks using the fewest possible features, achieved via a meticulous selection of features. We chose 5, 9, and 10 features, respectively, using the Artificial Bee Colony (ABC), Flower Pollination Algorithm (FPA), and Ant Colony Optimization (ACO) feature-selection techniques. We successfully constructed different models with a remarkable detection accuracy of over 98.8% (approximately 99.0%) with Ant Colony Optimization (ACO), an accuracy of 98.7% with the Flower Pollination Algorithm (FPA), and an accuracy of 98.6% with the Artificial Bee Colony (ABC). Another achievement of this study is the minimum model building time achieved in intrusion detection, which was equal to 1 s using the Flower Pollination Algorithm (FPA), 2 s using the Artificial Bee Colony (ABC), and 3 s using Ant Colony Optimization (ACO). Our research leverages the comprehensive and up-to-date CSE-CIC-IDS2018 dataset and uses the preprocessing Discretize technique to discretize data. Furthermore, our research provides valuable recommendations to network administrators, aiding them in selecting appropriate machine learning algorithms tailored to specific requirements.

Anomaly Detection IDS for Detecting DoS Attacks in IoT Networks Based on Machine Learning Algorithms.

Widespread and ever-increasing cybersecurity attacks against Internet of Things (IoT) systems are causing a wide range of problems for individuals and organizations. The IoT is self-configuring and open, making it vulnerable to insider and outsider attacks. In the IoT, devices are designed to self-configure, enabling them to connect to networks autonomously without extensive manual configuration. By using various protocols, technologies, and automated processes, self-configuring IoT devices are able to seamlessly connect to networks, discover services, and adapt their configurations without requiring manual intervention or setup. Users' security and privacy may be compromised by attackers seeking to obtain access to their personal information, create monetary losses, and spy on them. A Denial of Service (DoS) attack is one of the most devastating attacks against IoT systems because it prevents legitimate users from accessing services. A cyberattack of this type can significantly damage IoT services and smart environment applications in an IoT network. As a result, securing IoT systems has become an increasingly significant concern. Therefore, in this study, we propose an IDS defense mechanism to improve the security of IoT networks against DoS attacks using anomaly detection and machine learning (ML). Anomaly detection is used in the proposed IDS to continuously monitor network traffic for deviations from normal profiles. For that purpose, we used four types of supervised classifier algorithms, namely, Decision Tree (DT), Random Forest (RF), K Nearest Neighbor (kNN), and Support Vector Machine (SVM). In addition, we utilized two types of feature selection algorithms, the Correlation-based Feature Selection (CFS) algorithm and the Genetic Algorithm (GA) and compared their performances. We also utilized the IoTID20 dataset, one of the most recent for detecting anomalous activity in IoT networks, to train our model. The best performances were obtained with DT and RF classifiers when they were trained with features selected by GA. However, other metrics, such as training and testing times, showed that DT was superior.