Identify Security Threats Research Articles

Integrating Security Information and Event Management (SIEM) with Data Lakes and AI: Enhancing Threat Detection and Response

The evolving threat landscape in cybersecurity necessitates more advanced and efficient solutions for threat detection and response. Traditional Security Information and Event Management (SIEM) systems have limitations in handling large volumes of data and identifying sophisticated threats. This research explores the integration of SIEM solutions with data lakes, offering a scalable and flexible approach to managing security data. By leveraging artificial intelligence (AI) and machine learning (ML) algorithms, SIEM platforms can enhance their capabilities in real-time threat detection, automated response, and advanced analytics. This integration enables organizations to process vast amounts of structured and unstructured data from various sources, improving both the speed and accuracy of identifying security threats. The article examines the architecture, benefits, and challenges of combining SIEM with data lakes and AI, providing insights into how these technologies can collectively strengthen organizational security postures.

Enhancing Digital Forensics Readiness in Big Data Wireless Medical Networks: A Secure Decentralised Framework

Wireless medical networks are pivotal for chronic disease management, yet the sensitive Big Data they generate presents administration challenges and cyber vulnerability. This Big Data is valuable within both healthcare and legal contexts, serving as a resource for investigating medical malpractice, civil cases, criminal activities, and network-related incidents. However, the rapid evolution of network technologies and data creates complexities in digital forensics investigations and audits. To address these issues, this paper proposes a secure decentralised framework aimed at bolstering digital forensics readiness (DFR) in Big Data wireless medical networks by identifying security threats, complexities, and gaps in current research efforts. By improving the network's resilience to cyber threats and aiding in medical malpractice investigations, this framework significantly advances digital forensics, wireless networks, and healthcare. It enhances digital forensics readiness, incident response, and the management of medical malpractice incidents in Big Data wireless medical networks. A real-world scenario-based evaluation demonstrated the framework's effectiveness in improving forensic readiness and response capabilities, validating its practical applicability and impact. A comparison of the proposed framework with existing frameworks concluded that it is an advancement in framework design for DFR, especially in regard to Big Data processing, decentralised DFR storage and scalability.

Enhancing security in smart healthcare systems: Using intelligent edge computing with a novel Salp Swarm Optimization and radial basis neural network algorithm

A smart healthcare system (SHS) is a health service system that employs advanced technologies such as wearable devices, the Internet of Things (IoT), and mobile internet to dynamically access information and connect people and institutions related to healthcare, thereby actively managing and responding to medical ecosystem needs. Edge computing (EC) plays a significant role in SHS as it enables real-time data processing and analysis at the data source, which reduces latency and improves medical intervention speed. However, the integration of patient information, including electronic health records (EHRs), into the SHS framework induces security and privacy concerns. To address these issues, an intelligent EC framework was proposed in this study. The objective of this study is to accurately identify security threats and ensure secure data transmission in the SHS environment. The proposed EC framework leverages the effectiveness of Salp Swarm Optimization and Radial Basis Functional Neural Network (SS-RBFN) for enhancing security and data privacy. The proposed methodology commences with the collection of healthcare information, which is then pre-processed to ensure the consistency and quality of the database for further analysis. Subsequently, the SS-RBFN algorithm was trained using the pre-processed database to distinguish between normal and malicious data streams accurately, offering continuous monitoring in the SHS environment. Additionally, a Rivest-Shamir-Adelman (RSA) approach was applied to safeguard data against security threats during transmission to cloud storage. The proposed model was trained and validated using the IoT-based healthcare database available at Kaggle, and the experimental results demonstrated that it achieved 99.87 % accuracy, 99.76 % precision, 99.49 % f-measure, 98.99 % recall, 97.37 % throughput, and 1.2s latency. Furthermore, the results achieved by the proposed model were compared with the existing models to validate its effectiveness in enhancing security.

A risk-aware and recommender distributed intrusion detection system for home robots

The increasing adoption of home robots, driven by technological advancements and realistic goals, underscores the critical importance of ensuring their security, safety, and privacy. An Intrusion Detection System (IDS) is vital in safeguarding home robots by identifying and responding to potential security threats. However, home robot controllers’ limited computational and energy resources pose challenges. To enhance a home robot’s performance, especially its IDS, one potential solution is to connect it to a home network with a more robust computing infrastructure. Our proposed IDS comprises two components: one resides on a remote PC equipped with substantial computing power, and the other operates directly within the robot controller. By leveraging the remote PC, we achieve enhanced intrusion detection performance and gain valuable recommendations for fine-tuning the intrusion detection component situated in the controller. Simultaneously, it becomes imperative to swiftly identify security threats and prioritize high-risk attacks within the robot controller In this study, we employed machine learning techniques within the IDS. The dataset was generated by simulating robot actions within a home network. Based on our evaluation results, adopting a deep learning model for detecting intrusions in a remote PC and with its recommendations for fine-tuning the intrusion detector in the controller would significantly enhance intrusion detection performance. Additionally, leveraging ensemble learning to identify intrusions in the robot controller component while carefully considering potential risks promises satisfactory outcomes in terms of intrusion detection.

ANOMALY XPERT: A Deep Learning Approach to Anomaly Detection

Abstract: In response to increasing crime rates, organizations are deploying surveillance systems with CCTV cameras to detect suspicious activities autonomously. This paper proposes an automated system using transfer learning-based CNN models to track and classify activities like 'Shoplifting,' 'Robbery,' or 'Break-In' in real-time CCTV footage. The framework processes raw camera data, detects objects, tracks activities, and classifies them, generating alerts for authorized personnel. Leveraging transfer learning enhances the precision and effectiveness of the CNN model in identifying security threats. Preliminary evaluations demonstrate promising outcomes, yet additional investigation is warranted to address obstacles such as occlusions and lighting variations. Overall, this system offers a proactive security solution for retail environments, ensuring timely detection and intervention against potential security breaches

Assessing the Effectiveness of ADS-B Mitigations

The rise in aerial traffic necessitates aircraft localisation methods that go beyond radar technology's built-in capabilities. The Automated Dependent Surveillance-Broadcast (ADS-B) system is a novel aircraft localisation method that promises to provide the necessary precision to handle the current air traffic surge. The Federal Aviation Administration has, therefore, enforced ADS-B's deployment. However, the architecture of the ADS-B system holds several vulnerabilities. Most of these vulnerabilities are because ADS-B is designed to rely on wireless networks. This paper provides an in-depth analysis of the ADS-B threat landscape and potential mitigations to better understand their distinct characteristics and impact on the ADS-B system. Addressing these security concerns is imperative to ensure ADS-B systems' robustness and trustworthiness and safeguard the aviation industry from potential cyber threats. The paper concludes with a critical review of how well the proposed mitigations address the identified security threats.

Proposal of a Service Model for Blockchain-Based Security Tokens

The volume of the asset investment and trading market can be expanded through the issuance and management of blockchain-based security tokens that logically divide the value of assets and guarantee ownership. This paper proposes a service model to solve a problem with the existing investment service model, identifies security threats to the service model, and specifies security requirements countering the identified security threats for privacy protection and anti-money laundering (AML) involving security tokens. The identified security threats and specified security requirements should be taken into consideration when implementing the proposed service model. The proposed service model allows users to invest in tokenized tangible and intangible assets and trade in blockchain-based security tokens. This paper discusses considerations to prevent excessive regulation and market monopoly in the issuance of and trading in security tokens when implementing the proposed service model and concludes with future works.

Formal Security Analysis of ISA100.11a Standard Protocol Based on Colored Petri Net Tool

This paper presents a formal security analysis of the ISA100.11a standard protocol using the Colored Petri Net (CPN) modeling approach. Firstly, we establish a security threat model for the ISA100.11a protocol and provide a detailed description and analysis of the identified security threats. Secondly, we use the CPN tool to model the protocol formally and conduct model checking and security analysis. Finally, we analyze and discuss the results of the model checking, which demonstrate that the ISA100.11a standard protocol may have vulnerabilities when certain security threats exist, and provide some suggestions to enhance the security of the protocol. This research provides a certain level of security assurance for the ISA100.11a standard protocol and serves as a reference for similar security research on protocols.

Applicances of Different Kind of Storage Systems for Network Traffic Analysis Results

Network Traffic Analysis (NTA) helps identify security threats, monitor network performance, and plan for future capacity. While real-time analysis is ideal, it can be difficult due to high data volume and complexity. Large amounts of traffic require parsing, and real-time data may miss hidden threats. Post-analysis can address these challenges. It hardly depends on choosing an effective and appropriate storage solutions. A variety of storage systems exist, each employing different approaches and formats to retain data. This article explores the applications of various storage systems for NTA results. Three different types of storage systems considered, including Greenplum, Nebula graph and OpenSearch. A comparative approach is employed, analyzing the same dataset across various storage systems.This allows to examine how different database structures and query capabilities influence the efficiency and accuracy of NTA. The resulting insights will not only provide valuable guidance for selecting the optimal storage solution for specific NTA tasks, but also serve as a foundation for future research in this area.

Securing Smart Farms: An Integrated IoT-Based Security System with Arduino and SIM Module

The rise of smart farming, driven by technologies like the Internet of Things (IoT), has opened up new possibilities in agriculture. However, it has also brought about significant security challenges. This study aims to address the need for a comprehensive security system designed specifically for smart farms. The authors developed this system using camera technology, Arduino microcontrollers, vibration sensors, and the SIM900A SIM module. It enhances intrusion detection, provides precise location tracking, and enables real-time incident reporting through Multimedia Messaging Service (MMS) alerts and Short Message Service (SMS). By capturing visual data and leveraging vibration sensors, it offers an effective means of identifying security threats. Importantly, the SIM900A module ensures swift communication, even in remote agricultural areas. This research helps fill the gap in smart farm security, offering a practical and scalable solution to protect assets and data in the evolving landscape of digital agriculture.

Juridical Analysis of the Implementation of the ISPS Code (International Ship and Port Security Code) by Shipping Service Providers to Improve Security for Ships and Port Facilities (Research Study at the Port of Bintan Inti Industrial Estate Lobam)

The International Ship and Port Security Code (ISPS Code) is a comprehensive rule regarding measures to increase security for ships and port facilities, this rule was developed in response to perceived threats that could occur to ships and port facilities following the September 11, 2001 attacks on the United States. The problems in this research are legal regulations regarding the implementation of the ISPS Code in Indonesia, the implementation of the ISPS Code (International Ship And Port Security Code) by shipping service providers to improve security for ships and port facilities at the Port of Bintan Inti Industrial Estate Lobam, Obstacle Factors and Obstacles as well as solutions regarding ISPS (International Ship And Port Security) at Bintan Inti Industrial Estate Lobam Port. The research method used in this research is combined normative and empirical research with a juridical approach. The juridical approach is an approach taken by exploring the laws and regulations relating to the problem to be researched. The research method explains the entire series of activities that will be carried out in order to answer the main problem to prove the assumptions put forward. Legal regulations regarding the implementation of the ISPS Code (International Ship And Port Security Code) in Indonesia. ISPS Code (International Ship And Port Security Code) is an international regulation regarding the security of ships and port facilities. The ISPS Code consists of two parts, part A and part B. Part A contains mandatory requirements for: Government, Ships / Companies and Port Facilities. Part B contains guidelines: Background, Fulfillment, and Assistance. Maritime Security in the present and future tends to be disturbed/threatened. It is recommended for shipping service providers to establish a framework that involves cooperation between the governments of signatory countries, government agencies, local governments and the shipping industry and port industry to identify security threats and take preventive action against security incidents that impact ships or facilities. ports used for international trade to ensure sufficient confidence in the maritime and proportional security measures in place.

ARTIFICIAL INTELLIGENCE AND NATIONAL SECURITY: PERSPECTIVE OF THE GLOBAL SOUTH

More than six decades since its inception, Artificial Intelligence (AI) stands at the cusp of a transformative shift. The global perspective on AI has evolved optimistically, as it increasingly permeates every facet of human life. AI is revolutionizing national security strategies and capabilities worldwide, but its impact on the Global South remains a topic of growing significance and concern. Every nation actively seeks to bolster internal security through AI-driven initiatives, including surveillance, cyber security, and autonomous technologies. This review paper delves into AI's role in analyzing vast datasets, uncovering patterns, and identifying security threats and challenges focusing specifically on the Global South. It considers the potential advantages AI offers in enhancing national security capabilities while addressing concerns surrounding its integration. Drawing from existing literature, it presents a comprehensive analysis of AI's prospective future in the cyber and national security domains within these nations. Ultimately, this paper aims to answer whether AI serves as a facilitator in strengthening internal security or poses unforeseen challenges and raises the importance of capacity-building, technology transfer, and international cooperation. It provides valuable insights into the evolving landscape of AI in the context of national security in the Global South.

Introducing packet-level analysis in programmable data planes to advance Network Intrusion Detection

Programmable data planes offer precise control over the low-level processing steps applied to network packets, serving as a valuable tool for analysing malicious flows in the field of intrusion detection. Albeit with limitations on physical resources and capabilities, they allow for the efficient extraction of detailed traffic information, which can then be utilised by Machine Learning (ML) algorithms responsible for identifying security threats. In addressing resource constraints, existing solutions in the literature rely on compressing network data through the collection of statistical traffic features in the data plane. While this compression saves memory resources in switches and minimises the burden on the control channel between the data and the control plane, it also results in a loss of information available to the Network Intrusion Detection System (NIDS), limiting access to packet payload, categorical features, and the semantic understanding of network communications, such as the behaviour of packets within traffic flows. This paper proposes P4DDLe, a framework that exploits the flexibility of P4-based programmable data planes for packet-level feature extraction and pre-processing. P4DDLe leverages the programmable data plane to extract raw packet features from the network traffic, categorical features included, and to organise them in a way that the semantics of traffic flows are preserved. To minimise memory and control channel overheads, P4DDLe selectively processes and filters packet-level data, so that only the features required by the NIDS are collected. The experimental evaluation with recent Distributed Denial of Service (DDoS) attack data demonstrates that the proposed approach is very efficient in collecting compact and high-quality representations of network flows, ensuring precise detection of DDoS attacks.

Automated threat modelling and risk analysis in e-Government using BPMN

Recent progress integrates security requirements into BPMN, enhancing its framework. Extensions aim to seamlessly embed security concepts, yet the inherent ambiguity of security terms may lead to misinterpretations and vulnerabilities. Unfortunately, many business process experts lack the expertise to accurately interpret and integrate vital security concepts. In this study, we present an innovative automated methodology tailored to assist business process experts in identifying security threats and conducting risk assessments, particularly in the context of e-Government processes. Our approach streamlines the process, requiring only a business specialist to annotate BPMN entities with high-level, non-security-related information. Based on these annotations, potential threats to the system can be automatically identified. To develop our methodology, we leverage the standard BPMN annotation mechanism. From the annotated BPMN, the methodology utilises the ENISA Threat Landscape knowledge base for threat identification and employs the OWASP Risk Rating Methodology for risk assessment. To demonstrate the effectiveness of our approach, we applied it to a straightforward case study within the e-Government domain. Through this example, we illustrate how our methodology can be employed to ensure compliance with the General Data Protection Regulation and meet the mandatory Data Protection Impact Assessment requirements.

A Review of Anomaly Detection Strategies to Detect Threats to Cyber-Physical Systems

Cyber-Physical Systems (CPS) are integrated systems that combine software and physical components. CPS has experienced rapid growth over the past decade in fields as disparate as telemedicine, smart manufacturing, autonomous vehicles, the Internet of Things, industrial control systems, smart power grids, remote laboratory environments, and many more. With the widespread integration of Cyber-Physical Systems (CPS) in various aspects of contemporary society, the frequency of malicious assaults carried out by adversaries has experienced a substantial surge in recent times. Incidents targeting vital civilian infrastructure, such as electrical power grids and oil pipelines, have become alarmingly common due to the expanded connectivity to the public internet, which significantly expands the vulnerability of CPS. This article presents a comprehensive review of existing literature that examines the latest advancements in anomaly detection techniques for identifying security threats in Cyber-Physical Systems. The primary emphasis is placed on addressing life safety concerns within industrial control networks (ICS). A total of 296 papers are reviewed, with common themes and research gaps identified. This paper makes a novel contribution by identifying the key challenges that remain in the field, which include resource constraints, a lack of standardized communication protocols, extreme heterogeneity that hampers industry consensus, and different information security priorities between Operational Technology (OT) and Information Technology (IT) networks. Potential solutions and/or opportunities for further research are identified to address these selected challenges.

SCOUT: Security by computing OUTliers on activity logs

The current increase in cybercrime is demanding more effective and efficient data exploration and analysis solutions that can help analysts to detect cyberattacks. However, the huge amount of data generated continuously confronts a number of technological difficulties and classical algorithms must be often redesigned to be able to deal with this seemingly endless stream of information coming from past activity logs and real-time data. In this paper, we propose a novel methodology able to identify security threats in activity logs. The contribution of the paper is twofold: we propose an encoding technique, based on prime numbers, that can be used to represent in a compact way a set of activities, we then describe an outlier detection algorithm which, based on the encoded activities, is able to detect malicious behavior. The extensive experimental analysis proved the effectiveness of the proposed methodology.

Incorporating software security: using developer workshops to engage product managers

Evidence from data breach reports shows that many competent software development teams still do not implement secure, privacy-preserving software, even though techniques to do so are now well-known. A major factor causing this is simply a lack of priority and resources for security, as decided by product managers. So, how can we help developers and product managers to work together to achieve appropriate decisions on security and privacy issues? This paper explores using structured workshops to support teams of developers in engaging product managers with software security and privacy, even in the absence of security professionals. The research used the Design Based Research methodology. This paper describes and justifies our workshop design and implementation, and describes our thematic coding of both participant interviews and workshop discussions to quantify and explore the workshops’ effectiveness. Based on trials in eight organizations, involving 88 developers, we found the workshops effective in helping development teams to identify, promote, and prioritize security issues with product managers. Comparisons between organizations suggested that such workshops are most effective with groups with limited security expertise, and when led by the development team leaders. We also found workshop participants needed minimal guidance to identify security threats, and a wide range of ways to promote possible security improvements. Empowering developers and product managers in this way offers a powerful grassroots approach to improve software security worldwide.

Proposal of Decentralized P2P Service Model for Transfer between Blockchain-Based Heterogeneous Cryptocurrencies and CBDCs

This paper proposes a solution to the transfer problem between blockchain-based heterogeneous cryptocurrencies and CBDCs, with research derived from an analysis of the existing literature. Interoperability between heterogeneous blockchains has been an obstacle to service diversity and user convenience. Many types of cryptocurrencies are currently trading on the market, and many countries are researching and testing central bank digital currencies (CBDCs). In this paper, existing interoperability studies and solutions between heterogeneous blockchains and differences from the proposed service model are described. To enhance digital financial services and improve user convenience, transfer between heterogeneous cryptocurrencies, transfer between heterogeneous CBDCs, and transfer between cryptocurrency and CBDC should be required. This paper proposes an interoperable architecture between heterogeneous blockchains, and a decentralized peer-to-peer (P2P) service model based on the interoperable architecture for transferring between blockchain-based heterogeneous cryptocurrencies and CBDCs. Security threats to the proposed service model are identified and security requirements to prevent the identified security threats are specified. The mentioned security threats and security requirements should be considered when implementing the proposed service model.

Evaluation of the maritime security threats and issues to the future of the shipping industry – Maritime Autonomous Surface Ships

Nowadays traditional manned commercial sea-going vessels are facing several difficulties, including shipping accidents that are mainly caused by human errors and the shortage of seafarers with the associated increased manning cost. In 2021, the International Maritime Organisation Maritime Safety Committee (IMO MSC) had finished the Regulatory Scoping Exercise (RSE) regarding Maritime Autonomous Surface Ships (MASS) at its 103rd session, taking its first step towards autonomous shipping that does not involve human vectors. This paper analyses the security issues that are potentially involved in fully autonomous ships (Degree Four of Autonomy) (DOA 4) of MASS operations and recommend measures to adjust and mitigate the issues. This paper reviews six conventional maritime security threats that could threaten a DOA 4 vessel, including piracy and armed robbery at sea, terrorism, smuggling and trafficking, stowaways, cyber security threat and hybrid security threat. The research methodology of this paper reviews different literature as the source of both quantitative data and qualitative evidence. This paper analyses the experience of the security incidents in other comparable sectors and systems in order to identify the characteristics and behaviour of the security threats. Then the information is analysed against the specific characteristics of MASS operations to consider whether the characteristics of MASS operations may become more vulnerable if exploited by perpetrators of security threats. Potential issues and scenarios of the security threats in the operations are also discussed. Risk assessments are applied to explore the risk level of the security threats in DOA 4 MASS. This paper demonstrates that the characteristics of DOA 4 MASS operations may still pose vulnerabilities that can be exploited by all the six security threats. The risk of terrorism, smuggling and trafficking, cyber security, and hybrid security threats are high in DOA 4 MASS operations, while the risk of piracy and armed robbery at sea and stowaways are medium. Both the aspects of cyber security, detection/monitoring equipment, reliability of vessel systems, security in Shore Control Centres (SCC) and security in ports contribute significantly to the security of DOA 4 MASS operations against these security threats. This paper recommends all the aspects mentioned in the above findings should be considered in the development of future instruments regarding DOA 4 MASS operations. The stakeholders involved in DOA 4 MASS operations should apply any possible cyber security and detection/monitoring measures even beyond the legal requirement. The security and personnel management of SCC should be ensured too. Finally, further research on the identified security threats on DOA 4 MASS operations is recommended once more practical data on the operations are available, further research on different DOA of MASS operations and different security threats are also recommended.

An Efficient Identification of Security Threats in Requirement Engineering Methodology.

Today, we completely rely on Information Technology (IT) applications for every aspect of daily life, including business and online transactions. In addition to using these IT-enabled applications for business purposes, we also use WhatsApp, Facebook, and a variety of other IT applications to communicate with others. However, there will undoubtedly be a drawback to every benefit. Since everything is linked to the Internet, there are many opportunities for security to be compromised. To address this, we are working to identify security threats early on in the software development process, specifically during the requirements phase. During the requirement engineering process, an engineer can recognize the security specifications in a more structured manner to create threat-free software. In our research work, we suggest the Identification of Security Threats during Requirement Engineering (ISTDRE) technique for detecting security risks throughout the requirement engineering process. The four points that make up this ISTDRE technique are Hack Point (HP), Speculation Point (SP), Trust Point (TP), and Reliable Point (RP). The new ISTDRE methodology will be validated using a case study of an ERP system involving two currently used methodologies: Model Oriented Security Requirements Engineering (MOSRE) and System Quality Requirements Engineering (SQUARE).