Intelligence Sharing Research Articles

SeCTIS: A framework to Secure CTI Sharing

The rise of IT-dependent operations in modern organizations has heightened their vulnerability to cyberattacks. Organizations are inadvertently enlarging their vulnerability to cyber threats by integrating more interconnected devices into their operations, which makes these threats both more sophisticated and more common. Consequently, organizations have been compelled to seek innovative approaches to mitigate the menaces inherent in their infrastructure. In response, considerable research efforts have been directed towards creating effective solutions for sharing Cyber Threat Intelligence (CTI). Current information-sharing methods lack privacy safeguards, leaving organizations vulnerable to proprietary and confidential data leaks. To tackle this problem, we designed a novel framework called SeCTIS (Secure Cyber Threat Intelligence Sharing), integrating Swarm Learning and Blockchain technologies to enable businesses to collaborate, preserving the privacy of their CTI data. Moreover, our approach provides a way to assess the data and model quality and the trustworthiness of all the participants leveraging some validators through Zero Knowledge Proofs. Extensive experimentation has confirmed the accuracy and performance of our framework. Furthermore, our detailed attack model analyzes its resistance to attacks that could impact data and model quality.

Transforming Cybersecurity: Leveraging Blockchain for Enhanced Threat Intelligence Sharing

Transforming Cybersecurity: Leveraging Blockchain for Enhanced Threat Intelligence Sharing

Eight Principles for Intelligence Sharing: A Holistic and Strategic Approach

This paper reviews the strategic use of warning intelligence to pre-emptively address threats in complex geopolitical scenarios through rapid intelligence sharing. Specifically, the paper reviews the question How, based on research and experience, can a set of principles be applied by states to enhance situational awareness and tackle threat actors through a holistic and collaborative approach to intelligence sharing? The paper examines historical and contemporary alliances like the Five Eyes and reviews a Signals Intelligence Alliance as a case in point, highlighting the importance of collaborative approaches to enhance situational awareness and tackle threat actors. The study, grounded in the philosophical paradigm of interpretivism, adheres to the principles for transparent science when researchers use tools such as large-language-models as grammar editors or research assistants. The paper also acknowledges limitations such as the generalisability of the SIGINT model and the need for continuous adaptation of intelligence sharing practices. The results discuss policy, process, and people challenges to intelligence sharing. The paper concludes that successful intelligence sharing should follow eight general principles. Future research directions include exploring the impact of emerging technologies, human aspects of intelligence sharing, and context-based intelligence sharing alliances.

Energy-Efficient Intelligence Sharing in Intelligence Networking-Empowered Edge Computing: A Deep Reinforcement Learning Approach

Energy-Efficient Intelligence Sharing in Intelligence Networking-Empowered Edge Computing: A Deep Reinforcement Learning Approach

The Dark Web's Influence on International Relations: Unravelling the Hidden Threads

Using a blended-techniques approach, this looks at explores the diffused effect of the dark net on worldwide family members. According to a quantitative network study, kingdom actors are not unusual on the dark web, which is regular with new scholarly debate. Key topics that represent present day scholarly worries, including "Covert Operations and Espionage," "Eroding Trust in Intelligence Sharing," "Extremism and Terrorism," and "Challenges in Law Enforcement," are found out via thematic evaluation of qualitative statistics. This research sticks out for its thorough evaluation of the dark web's complex results, which connects quantitative and qualitative findings. The effects highlight the vital want for worldwide cybersecurity regulations and tips in light of the converting digital environment. This examine adds a super deal to the frame of knowledge via illuminating the outcomes of the darkish net for global relations and global security. Research ethics are a essential factor of the examine and are meticulously tested at each stage. This observer’s breadth perfectly fits the dreams of the magazine and provides insightful information on how cybersecurity, geopolitics, and diplomatic relations engage.

Cyber Threat Intelligence Sharing for Co-Operative Defense in Multi-Domain Entities

Cloud-hosted applications are prone to targeted attacks such as DDoS, advanced persistent threats, Cryptojacking which threaten service availability. Recently, methods for threat information sharing and defense require cooperation and trust between multiple domains/entities. There is a need for mechanisms that establish distributed trust to allow for such a collective defense. In this paper, we present a novel threat intelligence sharing and defense system, namely “DefenseChain,” to allow organizations to have incentive-based and trustworthy cooperation to mitigate the impact of cyber attacks. Our solution approach features a consortium Blockchain platform and an economic model to obtain threat data and select suitable peers to help with attack detection and mitigation. We apply DefenseChain in the financial technology industry for an insurance claim processing use case to demonstrate the effectiveness of DefenseChain in a real-world application setting. Our evaluation experiments with DefenseChain implementation are performed on an Open Cloud testbed with Hyperledger Composer and in a simulation environment. Our results show that the DefenseChain system overall performs better than state-of-the-art decision making schemes in choosing the most appropriate detector and mitigator peers. Lastly, we validate how DefenseChain helps mitigate the threat risk of incidents relating to potential fraudulent insurance claims or cyber attacks.

The Role of Cyber Threat Intelligence Sharing in the Metaverse

The emergence of the Metaverse promises to provide several benefits to society, e.g., fully immersive and interactive environments in health-care, the workplace, and everyday life. However, it introduces a number of privacy and security concerns, including identity, network, and economy-related threats, for both providers and users of Metaverse-based applications, which remain unaddressed. In this article, we high-light the potential role of Cyber Threat Intelligence (CTI) sharing within the Metaverse context as a promising opportunity to address such privacy and security issues. CTI refers to the relevant, timely and actionable information about the latest threats and attacks. In particular, we examine how organizations could proactively manage the cyber risks associated with their digital infrastructure by participating in CTI sharing within a Metaverse context. We also propose that user-based CTI sharing should be considered within the Metaverse given the potential prevalence of a number of user-specific threats, e.g., identity-related threats. Finally, we emphasise that the integration of user-based sharing creates additional threat sharing flows between users as well as between organizations and users that are lacking from existing CTI sharing approaches, e.g., user-to-user, organization-to-user, and user-to-organization.

Blockchain-Based Cyber Threat Intelligence Sharing Using Proof-of-Quality Consensus

Cyber threat intelligence (CTI) is contextualised knowledge, built on information that is collected, processed, analysed, and disseminated to the right audience, in order to comprehend a malicious threat actor’s motivation, goals, objectives, targets, and attack behaviours. The CTI value increases by the ability to be shared, consumed, and actioned timely, by the right stakeholders, based always on quality standards and parameters, which boost the cyber security community to understand how adversaries act and to counter the constantly emerging sophisticated cyber threats. In this article, along with the identification of research gaps, after a comparison between existing research studies in the similar scope of CTI evaluation and sharing mechanisms, we propose a blockchain-based cyber threat intelligence system architecture, which collects, evaluates, stores, and shares CTI, enabling tamper-proof data and exclusion of untrustworthy evaluation peers, while evaluating, at the same time, the quality of CTI Feeds against a defined set of quality standards. The evaluation of the data is performed utilising a reputation and trust-based mechanism for selecting validators, who further rate the CTI feeds using quality-based CTI parameters, while the consensus for preserving the fairness of the results and their final storage is performed via the recently introduced proof-of-quality (PoQ) consensus algorithm. The data, which are stored in the proposed ledger, constitute a reliable, distributed, and secure repository of CTI Feeds and contain their objective evaluation, as well as the performance of the validators who participated in each evaluation, while these data can be further used for assessing the reputation of CTI Sources. Finally, in order to assess the proposed system’s reliability, integrity, and tolerance against malicious activities, the model is subject to a theoretical analysis using a probabilistic simulation, taking into account various aspects and features of the integrated mechanisms. The results show that the tolerance against malicious validators is acceptable, even when the ratio between legitimately vs. maliciously behaving validators is 1 : 50.

Intelligence Sharing in Big Data Forensics

Intelligence Sharing in Big Data Forensics

Cyber Threat Intelligence Sharing Scheme Based on Federated Learning for Network Intrusion Detection

The uses of machine learning (ML) technologies in the detection of network attacks have been proven to be effective when designed and evaluated using data samples originating from the same organisational network. However, it has been very challenging to design an ML-based detection system using heterogeneous network data samples originating from different sources and organisations. This is mainly due to privacy concerns and the lack of a universal format of datasets. In this paper, we propose a collaborative cyber threat intelligence sharing scheme to allow multiple organisations to join forces in the design, training, and evaluation of a robust ML-based network intrusion detection system. The threat intelligence sharing scheme utilises two critical aspects for its application; the availability of network data traffic in a common format to allow for the extraction of meaningful patterns across data sources and the adoption of a federated learning mechanism to avoid the necessity of sharing sensitive users’ information between organisations. As a result, each organisation benefits from the intelligence of other organisations while maintaining the privacy of its data internally. In this paper, the framework has been designed and evaluated using two key datasets in a NetFlow format known as NF-UNSW-NB15-v2 and NF-BoT-IoT-v2. In addition, two other common scenarios are considered in the evaluation process; a centralised training method where local data samples are directly shared with other organisations and a localised training method where no threat intelligence is shared. The results demonstrate the efficiency and effectiveness of the proposed framework by designing a universal ML model effectively classifying various benign and intrusive traffic types originating from multiple organisations without the need for inter-organisational data exchange.

Trusted Threat Intelligence Sharing in Practice and Performance Benchmarking through the Hyperledger Fabric Platform

Historically, threat information sharing has relied on manual modelling and centralised network systems, which can be inefficient, insecure, and prone to errors. Alternatively, private blockchains are now widely used to address these issues and improve overall organisational security. An organisation’s vulnerabilities to attacks might change over time. It is utterly important to find a balance among a current threat, the potential countermeasures, their consequences and costs, and the estimation of the overall risk that this provides to the organisation. For enhancing organisational security and automation, applying threat intelligence technology is critical for detecting, classifying, analysing, and sharing new cyberattack tactics. Trusted partner organisations can then share newly identified threats to improve their defensive capabilities against unknown attacks. On this basis, organisations can help reduce the risk of a cyberattack by providing access to past and current cybersecurity events through blockchain smart contracts and the Interplanetary File System (IPFS). The suggested combination of technologies can make organisational systems more reliable and secure, improving system automation and data quality. This paper outlines a privacy-preserving mechanism for threat information sharing in a trusted way. It proposes a reliable and secure architecture for data automation, quality, and traceability based on the Hyperledger Fabric private-permissioned distributed ledger technology and the MITRE ATT&CK threat intelligence framework. This methodology can also be applied to combat intellectual property theft and industrial espionage.

Resenha do livro Intelligence Sharing, Transnational Organized Crime and Multinational Peacekeeping

Resenha de: Chido, Diane E., 2018. Intelligence Sharing, Transnational Organized Crime and Multinational Peacekeeping. Palgrave MacMillan. 110p. ISBN: 9783319711829. https://doi.org/10.1007/978-3-319-71183-6

A Reputation-Based Approach Using Consortium Blockchain for Cyber Threat Intelligence Sharing

The CTI (Cyber Threat Intelligence) sharing and exchange is an effective method to improve the responsiveness of the protection party. Blockchain technology enables sharing collaboration consortium to conduct a trusted CTI sharing and exchange without a centralized institution. However, the distributed connectivity of the blockchain-based CTI sharing model proposed before exposes the systems to byzantine attacks. The compromised members of partner organizations will further decrease the accuracy and trust level of CTI by generating false reporting. This paper proposes a new blockchain-based CTI model to address the unbalance issues of performance in speed, scalability, and security, which combines consortium blockchain and distributed reputation management systems to achieve automated analysis and response of tactical threat intelligence. In addition, the novel consensus algorithm of consortium blockchain that is fit for CTI sharing and exchange is introduced in this paper. The new consensus algorithm is called “Proof-of Reputation” (PoR) consensus, which meets the requirements of transaction rate and makes the consensus in a creditable network environment through constructing a reputation model. Finally, the effectiveness and security performance of the proposed model and consensus algorithm is verified by experiments.

Optimal Scheduling of Reconfigurable Microgrids in Both Grid-Connected and Isolated Modes Considering the Uncertainty of DERs

In this study, an operation strategy is introduced for distributed energy resources (DERs) in reconfigurable microgrids (MGs) to improve voltage profiles, minimize power losses, and boost the system performance. The proposed methodology aims to minimize power loss and energy not supplied (ENS) in MGs with an intelligent share of DERs and network reconfiguration in grid-connected and islanded modes. Due to the inherent uncertain nature of renewable DERs, these sources’ power output is considered as an uncertain parameter, and its effect on the system characteristics is analyzed. The state-of-the-art information gap decision theory (IGDT) approach is utilized to explore different decision-making strategies in the energy scheduling of reconfigurable MGs to deal with such uncertainty. To validate the effectiveness of the proposed method, the IEEE 33-bus radial system is utilized as the test MG. The simulation results show the importance of energy storage systems and reconfiguration in dealing with uncertainty and improving system reliability.

Collective Deep Reinforcement Learning for Intelligence Sharing in the Internet of Intelligence-Empowered Edge Computing

Edge intelligence is emerging as a new interdiscipline to push learning intelligence from remote centers to the edge of the network. However, with its widespread deployment, new challenges arise in terms of training efficiency and service of quality (QoS). Massive repetitive model training is ubiquitous due to the inevitable needs of users for the same types of data and training results. Additionally, a smaller volume of data samples will cause the over-fitting of models. To address these issues, driven by the Internet of intelligence, this paper proposes a distributed edge intelligence sharing scheme, which allows distributed edge nodes to quickly and economically improve learning performance by sharing their learned intelligence. Considering the time-varying edge network states including data collection states, computing and communication states, and node reputation states, the distributed intelligence sharing is formulated as a multi-agent Markov decision process (MDP). Then, a novel collective deep reinforcement learning (CDRL) algorithm is designed to obtain the optimal intelligence sharing policy, which consists of local soft actor-critic (SAC) learning at each edge node and collective learning between different edge nodes. Simulation results indicate our proposal outperforms the benchmark schemes in terms of learning efficiency and intelligence sharing efficiency.

Enhancing Cyber Threat Intelligence Sharing through a Privacy-Preserving Federated Learning Approach

This paper proposes a privacy-preserving federated learning approach to enhance cyber threat intelligence sharing. Cyber threats are becoming more sophisticated and are posing serious security risks to organizations. Sharing threat intelligence information can help to detect and mitigate these threats quickly. However, privacy concerns and data protection regulations hinder the sharing of sensitive information. Federated learning is a promising approach that allows multiple parties to collaborate in building a global model while preserving data privacy. We propose a framework that utilizes federated learning to train a global threat intelligence model without compromising the privacy of individual organizations' data. Our approach also includes a differential privacy mechanism to ensure the anonymity of the participating organizations. We demonstrate the effectiveness of our approach through experiments conducted on real-world datasets, showing that it achieves high accuracy while maintaining data privacy. The proposed approach has the potential to facilitate more effective and secure cyber threat intelligence sharing among organizations.

Exploring Incentives and Challenges for Cybersecurity Intelligence Sharing (CIS) across Organizations: A Systematic Review

Cybersecurity intelligence sharing (CIS) has gained significance as an organizational function to protect critical information assets, manage cybersecurity risks, and improve cybersecurity operations. However, few studies have synthesized accumulated scholarly knowledge on CIS practices across disciplines. Synthesizing the pertinent literature through a structured literature review, we investigated the incentives and challenges that influence organizations around adopting CIS practices. We used the overarching TOE framework to categorize these factors and propose a theoretical framework to establish common ground for future studies. We also developed a holistic and inclusive definition for cybersecurity intelligence that we present in the paper. We found 46 papers on CIS in different disciplines and analyzed them to answer our research questions. We identified 35 factors that we classified according to the TOE framework. With this paper, we facilitate further theory development by overviewing theories that researchers can use as a basis for CIS studies, suggesting future directions, providing a reference source, and developing a reference CIS framework for IS scholars.

Robust Botnet DGA Detection: Blending XAI and OSINT for Cyber Threat Intelligence Sharing

We investigated 12 years DNS query logs of our campus network and identified phenomena of malicious botnet domain generation algorithm (DGA) traffic. DGA-based botnets are difficult to detect using cyber threat intelligence (CTI) systems based on blocklists. Artificial intelligence (AI)/machine learning (ML)-based CTI systems are required. This study (1) proposed a model to detect DGA-based traffic based on statistical features with datasets comprising 55 DGA families, (2) discussed how CTI can be expanded with computable CTI paradigm, and (3) described how to improve the explainability of the model outputs by blending explainable AI (XAI) and open-source intelligence (OSINT) for trust problems, an antidote for skepticism to the shared models and preventing automation bias. We define the XAI-OSINT blending as aggregations of OSINT for AI/ML model outcome validation. Experimental results show the effectiveness of our models (96.3% accuracy). Our random forest model provides better robustness against three state-of-the-art DGA adversarial attacks (CharBot, DeepDGA, MaskDGA) compared with character-based deep learning models (Endgame, CMU, NYU, MIT). We demonstrate the sharing mechanism and confirm that the XAI-OSINT blending improves trust for CTI sharing as evidence to validate our proposed computable CTI paradigm to assist security analysts in security operations centers using an automated, explainable OSINT approach (for second opinion). Therefore, the computable CTI reduces manual intervention in critical cybersecurity decision-making.

Intelligent Scheduling Method Supporting Stadium Sharing

At present, the fast-paced work and life make people under great pressure, and people’s enthusiasm for fitness is getting higher and higher, which is in contradiction with the shortage of existing stadiums. So it is considerably significant to open shared stadiums near where citizens live for booking. Therefore, how to allow citizens to book a suitable stadium according to their own needs through mobile phones or computers is an urgent problem to be solved. The booking of the shared stadium can be regarded as a mobile edge computing (MEC) scenario, and the problem can be transformed into task scheduling research under MEC through intelligent scheduling method. When using edge computing (EC) technology for service calculation, the mobile terminal needs to offload the service to the edge computing server. After the server completes the calculation, the calculation results will be sent back to the mobile terminal. Therefore, the calculation time and system energy consumption in the calculation process can be further reduced through task scheduling to improve user satisfaction. In this study, joint scheduling of service caching and task algorithm is proposed to reduce the latency of booking shared stadium request and improve user experience. The simulation results show that the proposed algorithm with edge cooperation idea can achieve lower average system latency at lower load level and can significantly reduce the cloud offloading ratio under low and middle pressure. In addition, the proposed algorithm uses the secondary transfer of more tasks to reduce the pressure of local task running. Finally, the quality of experience (QoE) satisfaction rate under low pressure is guaranteed.

E-CIS: Edge-based classifier identification scheme in green & sustainable IoT smart city

• E-CIS changes the traditional centralized architecture and realizes low time delay and efficient identification of IoT devices based on edge computing. • The types of IoT devices E-CIS can identify keeps growing. • All gateways of E-CIS have the continuous learning ability synchronously. Smart city has brought the unprecedented development and application of Internet of things (IoT) devices. Meanwhile, since both of the quantity and the type of IoT devices are growing rapidly, how to quickly identify the type of IoT devices is of paramount importance, especially in the fields of IoT Device Security, IoT Forensics, Cyber Defense, and Cyber Threats Intelligence Sharing, to make the IoT smart city green and sustainable. Traditional identification mode based on device or gateway often suffers from their limited computing and storage resources. Our work is motivated by the observation of the emergence of edge computing, in which computing and storage servers are placed in close proximity to IoT/mobile devices. In this paper, we propose an Edge-based Classifier Identification Scheme (E-CIS) for IoT Devices, where the neighboring edge servers provide powerful computing and storage capabilities. E-CIS changes the traditional centralized architecture and realizes low time delay and efficient identification of IoT devices based on edge computing. Experiments show that the average identification accuracy is as high as 99.2%. Besides, the optimization and security of the classification model can be maintained by the edge servers at the same time.