Future Cyber-attacks Research Articles

The Future of Cyber Threat Intelligence: Anticipating and Preparing for Evolving Threats

Modern cybersecurity protocols face unprecedented hurdles from the dynamic cyber threat ecology. In this context, the value of cyber threat intelligence as a prophylactic protective strategy increase (Abu, Selamat, Ariffin , & Yusof, 2018). This study provides a futuristic analysis of cyber threat intelligence, emphasizing the vital role that it will play in anticipating and becoming ready for evolving threats. This article also looks at threat actor methods, attack paths, and emerging technologies in an attempt to illustrate the dynamic nature of cyber threats and the need for adaptive intelligence solutions (Abu, Selamat, Ariffin , & Yusof, 2018). Ethical and legal considerations are also explored to highlight the necessity for a thorough and responsible approach to the gathering and implementation of cyber threat intelligence (Wagner, 2019). Through this thorough examination, readers will get a substantial comprehension of the technical developments and strategic requirements that will impact how cyber threat intelligence is developed (Abu, Selamat, Ariffin , & Yusof, 2018) (Wagner, 2019). This will provide enterprises with the agility and resilience to predict, mitigate, and respond to future cyber-attacks.

Cyber Defense Using Cyber Threat Intelligence to Anticipate and Avoid Future Cyber Attacks

Research objective: This study evaluates the efficiency of cyber threat intelligence (CTI) for predicting and mitigating cyber threats, which is important in business today. Organisations endure cyber assaults and fight cyber crimes, which threaten commercial exposure. CTI is a proactive approach to these risks since it gives the finest methods and relevant information on potential cyber crimes. Research significance: This review article analyses the literature in the context to find gaps and include ethical research practices. This systematic study may determine how threat intelligence improves cyber security knowledge and eliminates cyber threats by examining assessable information. It may guide the development of new threat intelligence-influencing methods and frameworks. Methodology: Through a qualitative approach based on the systematic review, the study goals were evaluated, analysed, and explained. PRISMA chart was also used to describe exclusion and inclusion study criteria to ensure correct data gathering. The results were presented in a thematic analysis while examining article dependability, quality, and validity. The author used inductive research to reach the primary study conclusions. Using observations or data, inductive inquiry creates hypotheses or generalisations. Research findings: Threat intelligence may considerably increase an organisation's ability to anticipate and prevent cyber threats. The literature emphasised that threat information improves incident response, identifies new threats, and strengthens cyber security. Organisations should continually train and educate cyber security personnel to increase threat intelligence utilisation. Instruct incident response, threat intelligence analysis, and emerging threat trends.CTI helps a company grow smoothly and achieve its goals.

Development a data mining techniques to detect and prevention cyber attack for cybersecurity

The identification and forecasting of cyber-attacks is crucial process. In this article, we describe a paradigm for cyber security that makes use of data mining to forecast cyberattacks and identify appropriate countermeasures. The framework’s two primary elements are the surveillance and prevention of cyberattacks. The system constructs a predictive model to forecast future cyberattacks after first extracting appropriate timing with cyberattacks from previous data that used a decision tree based on the J48 algorithm. A variety of cyber-attacks, involving DDoS, port scans, and SQL Injection, are described in the datasets. The suggested framework effectively recognizes cyberattacks and gives patterns associated with them. The suggested predictive algorithm for identifying cyberattacks has a 99% average prediction performance. The predictions model’s test outcomes demonstrate how effective it is at spotting potential cyberattacks in the future. Moreover, solutions like malware detection and monitoring were provided using data mining. Given the state of computer networks today Users of computer networks ought to take security very seriously. In this article, implications of data mining for risk evaluation and identification were highlighted, along with a unique method for quickly and accurately detecting malware.

Cyber Operations in Ukraine: Emerging Patterns in Cases

The Ukrainian state has been a target of cyber-related incidents since the annexation of Crimea in 2014. Cyberattacks have targeted Ukrainian critical infrastructure, government offices, and several public and private organisations. Sometimes, these cyberattacks have caused significant impacts within the nation's borders. Some of the most well-known cyber-incidents in Ukraine include attacks on the Ukrainian electrical grid, which cut out the power supply for hundreds of thousands of people in 2015 and 2016. Attacks have also targeted presidential election systems and financial entities operating in Ukraine. The majority of attacks within Ukraine's borders have been attributed to Russian-affiliated non-state actors and organisations, and the number of attacks correlates with the escalation of the war in 2022. This implies previous cyberattacks potentially belonging to a series of hybrid operations related to the Ukrainian conflict and the general geopolitical situation since the annexation of Crimea. The paper focuses on this context by examining cyber incidents targeting Ukraine since 2014. We study the unifying factors related to Ukrainian cyber incidents, and we will discuss emerging patterns related to the attacks during the last ten years. This study will uncover the general traits of state-affiliated attacks in Ukraine, which will help uncover emerging patterns. Our particular focus will be cyber-attacks, where the target is the Ukrainian state and its critical infrastructure. We will examine methods of attacks, the attack targets, and the impacts, among other things. With the patterns emerging from our study, we can predict future cyber-attacks targeting Ukraine, providing tools for preparing for future incidents. We can use the information to improve national cyber-defences, where the attacks are likely to happen in the future. Studying the Ukrainian cases may also provide additional insights for improving cyber defences in other nation-states within the parts that apply to these nation-states and their geopolitical contexts.

Endpoint cybersecurity: When smart devices turn stupid

With the proliferation of ever-cheaper IoTs (or smart devices) from smart doorbells to WiFi security cameras and baby monitors and hybrid work arrangements involving relaxed BYOD (Bring Your Own Device) policies, cybersecurity education must build awareness on the threats that endpoints pose. While securing corporate networks from cyberattack gains much attention, there is a dearth of educational material that exemplifies the processes by which endpoints are used in hacks, and how to build defenses against endpoint vulnerabilities. This teaching case provides a Defense in Depth (DiD) learning framework on how to defend industrial cyber-physical systems, digital infrastructure and assets. The case illustrates the applicability of a DiD framework independent of attack vector yet particular to endpoint vulnerabilities and shows how lessons from the past can help defend and mitigate future cyberattacks.

The Cyber Risk Premium

Cyber risk is an important emerging source of risk in the economy. To estimate its impact on the asset market, we use machine learning techniques to develop a firm-level measure of cyber risk. The measure aggregates information from a rich set of firm characteristics and shows superior ability to forecast future cyberattacks on individual firms. We find that firms with higher cyber risk earn higher average stock returns. When these firms underperform, cybersecurity experts tend to have higher concerns about cyber risk, and cybersecurity exchange-traded funds outperform. Further tests strengthen the identification of the cyber risk premium. This paper was accepted by William Cong, finance. Supplemental Material: The online appendix and data files are available at https://doi.org/10.1287/mnsc.2022.02056 .

False Data Injection Attack with Max-Min Optimization in Smart Grid

With the proliferation of information and communication technology (ICT), the smart grid is critically vulnerable to cyber-attacks such as false data injection (FDI), denial-of-service, and data spoofing. The cyber-attackers defunctionalize critical operations of the smart grid by compromising the ICT. The decisions for the critical operation of the smart grid are processed with a state estimator, and ICT makes the state estimator vulnerable to FDI attacks. Hence, vulnerability analysis of the state estimator needs to be investigated for potential FDI attacks to protect it from future cyber-attacks. This work proposes the FDI attack vector construction without the knowledge of bad data detection (BDD) threshold on linear and non-linear state estimators using max-min optimization considering the partial network information. The optimization problem is formulated from the attacker's perspective to target the manipulation of measurements in the attack zone so as to increase the generation cost. The equivalent power injection model is developed for the attack zone to construct the deceptive attacks using DC and AC power flow models. The effectiveness of the proposed framework has been tested on 5 bus PJM network, modified IEEE 30 bus, IEEE 57 bus, and IEEE 118 bus system. The proposed framework is compared with existing state-of-art methods (viz., linear attack policy, non-linear attack policy, load redistribution attack, and line flow attack) to assess its efficacy. It is observed that the developed FDI attack vector successfully bypasses the bad data detectors such as the chi-square test, largest normalized residue, and l2 detector that is normally used by the system operator. Moreover, the study compares and discusses the impact of FDI attacks on the estimated state variables obtained with state estimators and, thereby, the generation cost calculated with the DC & AC optimal power flow tool.

Improving Network Security: An Intrusion Detection System (IDS) Dataset from Higher Learning Institutions, Mbeya University of Science and Technology (MUST), Tanzania

Nowadays, Internet-driven culture securing computer networks in Higher Learning Institutions (HLIs) has become a major responsibility. Intrusion Detection Systems (IDS) are crucial for protecting networks from unauthorized activity and cyber threats. This paper examines the process of improving network security by creating a comprehensive IDS dataset using real traffic from HLIs, highlighting the importance of accurate and representative data in improving the system's ability to identify and mitigate future cyber-attacks. The IDS model was created using a variety of machine learning (ML) techniques. Metrics like accuracy, precision, recall, and F1-score were used to assess the performance of each model. The dataset used for training and testing was real-world network traffic data obtained from the institution's computer network. The results showed that the developed IDS obtained exceptional accuracy rates, with Random Forest, Gradient Boosting, and XGBoost models all achieving an accuracy of around 93%. Precision and recall values were likewise quite high across all algorithms. Furthermore, the study discovered that data quality has a substantial impact on IDS performance. Proper data preparation, feature engineering, and noise removal were found to be helpful in improving model accuracy and reducing false positives. While the IDS models performed well throughout validation and testing, implementing such systems in a production setting necessitates careful thought. As a result, the essay also examined the procedures for testing and deploying the IDS models in a real-world scenario. It underlined the significance of ongoing monitoring and maintenance in order to keep the model effective in identifying intrusions. The research aids in the progress of network security in HLI. Educational institutions can better protect their precious assets and sensitive information from cyberattacks by understanding the impact of data quality on IDS performance and implementing effective deployment techniques

Cyber Defense Using Cyber Threat Intelligence to Anticipate and Avoid Future Cyber Attacks

Cyber Defense Using Cyber Threat Intelligence to Anticipate and Avoid Future Cyber Attacks

Improving Network Security: An Intrusion Detection System (IDS) Dataset from Higher Learning Institutions, Mbeya University of Science and Technology (MUST), Tanzania

Nowadays, Internet-driven culture securing computer networks in Higher Learning Institutions (HLIs) has become a major responsibility. Intrusion Detection Systems (IDS) are crucial for protecting networks from unauthorized activity and cyber threats. This paper examines the process of improving network security by creating a comprehensive IDS dataset using real traffic from HLIs, highlighting the importance of accurate and representative data in improving the system's ability to identify and mitigate future cyber-attacks. The IDS model was created using a variety of machine learning (ML) techniques. Metrics like accuracy, precision, recall, and F1-score were used to assess the performance of each model. The dataset used for training and testing was real-world network traffic data obtained from the institution's computer network. The results showed that the developed IDS obtained exceptional accuracy rates, with Random Forest, Gradient Boosting, and XGBoost models all achieving an accuracy of around 93%. Precision and recall values were likewise quite high across all algorithms. Furthermore, the study discovered that data quality has a substantial impact on IDS performance. Proper data preparation, feature engineering, and noise removal were found to be helpful in improving model accuracy and reducing false positives. While the IDS models performed well throughout validation and testing, implementing such systems in a production setting necessitates careful thought. As a result, the essay also examined the procedures for testing and deploying the IDS models in a real-world scenario. It underlined the significance of ongoing monitoring and maintenance in order to keep the model effective in identifying intrusions. The research aids in the progress of network security in HLI. Educational institutions can better protect their precious assets and sensitive information from cyberattacks by understanding the impact of data quality on IDS performance and implementing effective deployment techniques

The Impact of a National Cyberattack Affecting Clinical Trials: The Cancer Trials Ireland Experience.

Cyberattacks are increasing in health care and cause immediate disruption to patient care, have a lasting impact, and compromise scientific integrity of affected clinical trials. On the May 14, 2021, the Irish health service was the victim of a nationwide ransomware attack. Patient care was disrupted across 4,000 locations, including 18 cancer clinical trials units associated with Cancer Trials Ireland (CTI). This report analyses the impact of the cyberattack on the organization and proposes steps to mitigate the impact of future cyberattacks. A questionnaire was distributed to the units within the CTI group; this examined key performance indicators for a period of 4 weeks before, during, and after the attack, and was supplemented by minutes of weekly conference call with CTI units to facilitate information sharing, accelerate mitigation, and support affected units. A total of 10 responses were returned, from three private and seven public hospitals. The effect of the attack on referrals and enrollment to trials was marked, resulting in a drop of 85% in referrals and 55% in recruitment before recovery. Radiology, radiotherapy, and laboratory systems are heavily reliant on information technology systems. Access to all was affected. Lack of preparedness was highlighted as a significant issue. Of the sites surveyed, two had a preparedness plan in place before the attack, both of these being private institutions. Of the eight institutions where no plan was in place, three now have or are putting a plan in place, whereas no plan is in place at the five remaining sites. The cyberattack had a dramatic and sustained impact on trial conduct and accrual. Increased cybermaturity needs to be embedded in clinical trial logistics and the units conducting them.

A Comprehensive Review of Cyber Security Vulnerabilities, Threats, Attacks, and Solutions

Internet usage has grown exponentially, with individuals and companies performing multiple daily transactions in cyberspace rather than in the real world. The coronavirus (COVID-19) pandemic has accelerated this process. As a result of the widespread usage of the digital environment, traditional crimes have also shifted to the digital space. Emerging technologies such as cloud computing, the Internet of Things (IoT), social media, wireless communication, and cryptocurrencies are raising security concerns in cyberspace. Recently, cyber criminals have started to use cyber attacks as a service to automate attacks and leverage their impact. Attackers exploit vulnerabilities that exist in hardware, software, and communication layers. Various types of cyber attacks include distributed denial of service (DDoS), phishing, man-in-the-middle, password, remote, privilege escalation, and malware. Due to new-generation attacks and evasion techniques, traditional protection systems such as firewalls, intrusion detection systems, antivirus software, access control lists, etc., are no longer effective in detecting these sophisticated attacks. Therefore, there is an urgent need to find innovative and more feasible solutions to prevent cyber attacks. The paper first extensively explains the main reasons for cyber attacks. Then, it reviews the most recent attacks, attack patterns, and detection techniques. Thirdly, the article discusses contemporary technical and nontechnical solutions for recognizing attacks in advance. Using trending technologies such as machine learning, deep learning, cloud platforms, big data, and blockchain can be a promising solution for current and future cyber attacks. These technological solutions may assist in detecting malware, intrusion detection, spam identification, DNS attack classification, fraud detection, recognizing hidden channels, and distinguishing advanced persistent threats. However, some promising solutions, especially machine learning and deep learning, are not resistant to evasion techniques, which must be considered when proposing solutions against intelligent cyber attacks.

Digital Transformation in Oil and Gas Industry

Digital technology can benefit the oil and gas sector by increasing hydrocarbon recovery, ensuring safety throughout the corporate ecosystem, and improving operational reliability. This study addresses the oil and gas supply chain digital transformation tendencies as well as the Norwegian petroleum refining company Equinor's initiatives. The main objective is to explore the opportunities for digitalisation in the oil and gas industry as well as the state of the industry's digital strategy more generally. The findings support the industry's major players continuing to invest in their collaborative ecosystem by partnering with their suppliers and start-ups and sharing with them a platform where data that can help them improve their economic position can easily be shared. It is recommended that they should develop a digital strategy roadmap, as in the case of Equinor, as a matter of priority. Supporting innovation and technology adoption through continued investment and the hiring of qualified experts is also of critical importance. It is also important to improve the digital skills of employees and spread a digital culture throughout the company so that they can protect themselves against future cyberattacks or other potential risks. On a global level, the successful implementation of a digital solution will reshape market dynamics (in terms of supply, demand, and investment) as well as the way energy networks are managed.

Cyber attacks, discretionary loan loss provisions, and banks’ earnings management

Cyber threats to banks can indicate high operational risks and a weak internal control system. Our paper is the first to study the impact of banks’ discretionary loan loss provisions on cyber attacks. We investigate whether discretionary loan loss provision of banks can predict a cyber attack and whether banks conduct less or more earnings management following a cyber attack. We find that discretionary loan loss provisions are positively associated with future cyber attacks. We also find that banks will engage in less earnings management following such incidents. We establish the close link between banks’ earnings management and cyber attacks.

How will the conflict in Ukraine affect the system of international information security?

The article is devoted to the consideration of the main changes taking place in the system of ensuring international information security after the start of a special military operation in Ukraine. An attempt is made to predict the challenges and risks that the IIS system will face in the future. The priority transformations are connected with the negotiation process within the UN, which, in the context of increasing political antagonism between the key subjects of the dialogue, is becoming increasingly politicized and is beginning to experience some difficulties. It is assumed that in the conditions of the new political reality, the issue of “comprehensive” counteraction to international cybercrime will remain unresolved. There is some fragmentation of the international information security system itself, which is experiencing centrifugal tendencies in terms of promoting alternative approaches to solving key issues in this sphere. Finally, it can be expected that the United States, in interaction with Russia, will more actively engage in a proactive strategy of so-called defend forward, which should be implemented through the concept of persistent engagement. The preliminary conclusions demonstrated by the actions in Ukraine regarding the role and place of cyber attacks directly within the framework of the armed conflict are also considered. It is assumed that in the near future cyber attacks will not be considered as a means of achieving real strategic effects on the battlefield, where conventional weapons play a dominant role. An attempt is made to give some recommendations on maintaining a certain dynamic of the development of the IIS system.

Predictions of Cybersecurity Experts on Future Cyber-Attacks and Related Cybersecurity Measures

The Internet interconnections’ exponential growth has resulted in an increase in cyber-attack occurrences with mostly devastating consequences. Malware is a common tool for performing these attacks in cyberspace. The malefactors would either exploit the present weaknesses or employ the distinctive characteristics of the developing technologies. The cybersecurity community should increase their knowledge on the types and arsenals of cyber-attacks, and security measures against cyber-attacks should be in place as well. Also, advanced and effective malware defense mechanisms should be established. Hence, this study reviews cyber-attack types, measures and security precautions, and professional extrapolations on cyber-attacks future and the associated security measures. Semi-structured interviews were performed, involving five IT managers and nine Cybersecurity Consultants, to obtain the data. The study findings demonstrate prevention as key for data breach risk prevention. Knowledge of common attack methods and the use of cybersecurity software can facilitate individuals and organizations in thwarting hackers and in preserving their data privacy. Two-factor authorization by consumers and new back-end security protocols and security methods, including Artificial intelligence (AI) application, will encumber hacking attempts.

A Novel Two-Stage Deep Learning Model for Network Intrusion Detection: LSTM-AE

Machine learning and deep learning techniques are widely used to assess intrusion detection systems (IDS) capable of rapidly and automatically recognizing and classifying cyber-attacks on networks and hosts. However, when destructive attacks are becoming more extensive, more challenges develop, needing a comprehensive response. Numerous intrusion detection datasets are publicly accessible for further analysis by the cybersecurity research community. However, no previous research has examined the performance of the proposed model on a variety of publicly accessible datasets in detail. Due to the dynamic nature of the attack and its rapidly changing attack techniques, the publicly accessible intrusion datasets must be updated and benchmarked regularly. The deep neural network (DNN) and convolutional neural network (CNN) are examined in this article as types of deep learning models for developing a flexible and effective IDS capable of detecting and comparing them with the proposed model in detecting cyber-attacks. The constant development of network behavior and the fast growth of attacks need the development of IDS and the evaluation of many datasets produced over time through static and dynamic methods. This kind of research enables the identification of the most efficient algorithm for identifying future cyber-attacks. We proposed a novel two-stage deep learning technique hybridizing Long-Short Term Memory (LSTM) and Auto-Encoders (AE) for detecting attacks. The CICIDS2017 and CSE-CICDIS2018 datasets are used to determine the optimum network parameters for the proposed LSTM-AE. The experimental results show that the proposed hybrid model works well and is applicable for detecting attacks in modern scenarios.

Using attack graphs to defend healthcare systems from cyberattacks: a longitudinal empirical study.

Cyber security encompasses a variety of financial, political, and social aspects with significant implications for the safety of individuals and organisations. Hospitals are among the least secure and most vulnerable organisations in terms of cybersecurity. Protecting medical records from cyberattacks is critical for protecting personal and financial records of those involved in medical institutions. Attack graphs, like in other systems, can be used to protect medical and hospital records from cyberattacks. In the current study, a total of 352 real-life cyberattacks on healthcare institutions using common vulnerability scoring system (CVSS) data were statistically examined to determine important trends and specifications in regard to those attacks. Following that, several machine learning techniques and an artificial neural network model were used to model industrial control systems (ICS) vulnerability data of those attacks. The average vulnerability score for attacks on healthcare IT systems was found to be very high. Moreover, this score was found to be higher in healthcare institutions which have experienced cyberattacks in the past and no mitigation actions were implemented. Using Python programming software, the most successful model that can be used in modelling cyberattacks on IT systems of healthcare institutions was found to be the K-nearest neighbours (KNN) algorithm. The model was then enhanced further and then it was tried to make predictions for future cyberattacks on IT systems of healthcare institutions. Results indicate that the overall score is critical indicating that medical records are, in general, at high risk and that there is a high risk of cyberattacks on medical records in healthcare institutions. It is recommended, therefore, that those institutions should take urgent precautionary measures to mitigate such a high risk of cyberattacks and to make them more secure, reliable, and robust.

A coordinated cyberattack targeting load centers and renewable distributed energy resources for undervoltage/overvoltage in the most vulnerable regions of a modern distribution system

An integral step for system operators in protecting modern distribution systems and smart cities against future cyberattacks is to primarily scrutinize complex cyberattack models targeting smart grids from the viewpoint of attackers. This paper proposes a cyberattack framework to result in simultaneous undervoltage and overvoltage in a smart distribution system equipped with renewable energy resources. In the upper level of the framework, attackers separately solve an optimization problem to result in optimal and suboptimal candidates of false data injection attack vectors leading to possible scenarios of under/overvoltage in the system. In the lower level, the attackers solve the second optimization problem collaboratively to identify the attacks targeting the most vulnerable regions of the system to undervoltage and overvoltage at the optimal time. In case the optimal time of attackers is not the same, a trade-off platform is designed within the framework such that they can compromise and identify a reasonable time for such a simultaneous cyberattack.

Cybersecurity Risk

AbstractBased on textual analysis and a comparison of cybersecurity risk disclosures of firms that were hacked to others that were not, we propose a novel firm-level measure of cybersecurity risk for all U.S.-listed firms. We then examine whether cybersecurity risk is priced in the cross-section of stock returns. Portfolios of firms with high exposure to cybersecurity risk outperform other firms, on average, by up to 8.3$\%$ per year. Yet, high-exposure firms perform poorly in periods of high cybersecurity risk. Reassuringly, the measure is higher in information-technology industries, correlates with characteristics linked to firms hit by cyberattacks, and predicts future cyberattacks.Authors have furnished an Internet Appendix, which is available on the Oxford University Press Web site next to the link to the final published paper online