Kill Chain Model Research Articles

The Cyber Kill Chain Model and Its Applicability on The Protection of Students Academic Information Systems (SAIS) in Tanzanian HEIs

The Cyber Kill Chain Model and Its Applicability on The Protection of Students Academic Information Systems (SAIS) in Tanzanian HEIs

Navigating the Cyber Kill Chain: A modern approach to pentesting

The Cyber Kill Chain is a strategic model that outlines the stages of a cyberattack, from initial reconnaissance to achieving the final objective. This framework is often mirrored in penetration testing (pentest), a legal and authorized simulated attack on a computer system performed to evaluate its security. By understanding the steps in the Cyber Kill Chain, penetration testers can mimic the strategies of malicious attackers, exploring vulnerabilities at each stage of the chain. This approach allows organizations to evaluate their defensive measures across the full spectrum of an attack, identifying weaknesses and enhancing their security protocols accordingly. In essence, the Cyber Kill Chain provides a roadmap for pen-testers to systematically evaluate an organization's cyber defences. The research method of this article involves a systematic analysis of the Cyber Kill Chain model, examining how penetration testers can employ this strategic framework to emulate the tactics of malicious attackers and identify methodology at each stage of the chain.

Protective Factors for Developing Cognitive Skills against Cyberattacks

Cyberattacks capitalize on human behaviors. The prevalence of cyberattacks surged during the COVID-19 pandemic, fueled by the increased interconnectivity of individuals on online platforms and shifts in their psychological dynamics due to the pandemic’s context. The enhancement of human factors becomes imperative in formulating a robust cybersecurity strategy against social engineering in the post-COVID-19 era and in anticipation of analogous pandemics. This study aims to propose a model for delineating strategies across various phases of cyberattacks, grounded in the cyber kill chain model, while also encompassing cognitive mechanisms for adaptive responses. This approach aims to cultivate defensive cognitive factors like resilience and self-efficacy. To achieve this objective, we conducted an exploratory study adhering to Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) guidelines. Subsequently, we pursued a descriptive and correlational study based on prevalent attacks during the pandemic. The intention was to pinpoint proactive factors conducive to the development of cognitive capabilities to counter cyberattacks. These insights could pave the way for the creation of training programs and technological solutions aimed at mitigating the impact of such cyberattacks.

The outcome efficacy of the entity risk management requirements of the NIS 2 Directive

The NIS 2 Directive (2022/2555) of the European Union (EU) identifies the cybersecurity risk management requirements for essential and important entities in EU member states. The principal question we address is, how effective are the cybersecurity risk management measures of the NIS 2 Directive against cyberattacks on essential and important entities in EU member states? It was observed, through statutory interpretation and cyber kill chain model analysis, that the cybersecurity risk management measures of the NIS 2 Directive may be significantly limited in their effectiveness against cyberattacks on essential and important entities in EU member states. The limited effectiveness is primarily due to the narrow scope of the cybersecurity risk management measures, including the lack of specific measures focused on the reconnaissance phase of a cyberattack.

Cyber Kill Chain Analysis Using Artificial Intelligence

Artificial Intelligence (AI) tools are promising multifaceted techniques for addressing the most mundane tasks for greater efficiency and high productivity. Cyber security space is one of the areas that AI is promising to revolutionize. This study will develop a conceptual and theoretical framework to support a research design that can simulate research in understanding how AI can be applied to Cyber Kill Chain phases. This study has reviewed 21 journal and conference articles mostly from IEEE Xplore database. An overview of the application of artificial intelligence (AI) in cybersecurity, particularly within the framework of the Cyber Kill Chain was provided in this study. It also emphasizes the limitations of traditional security approaches and the necessity for innovative and intelligent defense methodologies. The results of reviewing the relevant literatures discovered that the key components of cybersecurity, includes identity, asset management, automated configuration management, security control validation, governance, risk assessment, and vulnerability identification. A theoretical framework was developed which introduces the Cyber Kill Chain model with a Unified Kill Chain model to address its shortcomings. Application of AI in cybersecurity offers an optimistic solutions to address the evolving threat landscape. AI techniques, such as machine learning, anomaly detection, and behavioural analysis, have shown great potential in enhancing various aspects of cybersecurity. However, challenges related to data quality, adversarial attacks, and privacy concerns need to be addressed for successful implementation. Further research and development are crucial to fully harness the power of AI in cybersecurity and stay ahead of evolving cyber threats.

Fronesis: Digital Forensics-Based Early Detection of Ongoing Cyber-Attacks

Traditional attack detection approaches utilize predefined databases of known signatures about already-seen tools and malicious activities observed in past cyber-attacks to detect future attacks. More sophisticated approaches apply machine learning to detect abnormal behavior. Nevertheless, a growing number of successful attacks and the increasing ingenuity of attackers prove that these approaches are insufficient. This paper introduces an approach for digital forensics-based early detection of ongoing cyber-attacks called Fronesis. The approach combines ontological reasoning with the MITRE ATT&CK framework, the Cyber Kill Chain model, and the digital artifacts acquired continuously from the monitored computer system. Fronesis examines the collected digital artifacts by applying rule-based reasoning on the Fronesis cyber-attack detection ontology to identify traces of adversarial techniques. The identified techniques are correlated to tactics, which are then mapped to corresponding phases of the Cyber Kill Chain model, resulting in the detection of an ongoing cyber-attack. Finally, the proposed approach is demonstrated through an email phishing attack scenario.

Cross Deep Learning Method for Effectively Detecting the Propagation of IoT Botnet.

In recent times, organisations in a variety of businesses, such as healthcare, education, and others, have been using the Internet of Things (IoT) to produce more competent and improved services. The widespread use of IoT devices makes our lives easier. On the other hand, the IoT devices that we use suffer vulnerabilities that may impact our lives. These unsafe devices accelerate and ease cybersecurity attacks, specifically when using a botnet. Moreover, restrictions on IoT device resources, such as limitations in power consumption and the central processing unit and memory, intensify this issue because they limit the security techniques that can be used to protect IoT devices. Fortunately, botnets go through different stages before they can start attacks, and they can be detected in the early stage. This research paper proposes a framework focusing on detecting an IoT botnet in the early stage. An empirical experiment was conducted to investigate the behaviour of the early stage of the botnet, and then a baseline machine learning model was implemented for early detection. Furthermore, the authors developed an effective detection method, namely, Cross CNN_LSTM, to detect the IoT botnet based on using fusion deep learning models of a convolutional neural network (CNN) and long short-term memory (LSTM). According to the conducted experiments, the results show that the suggested model is accurate and outperforms some of the state-of-the-art methods, and it achieves 99.7 accuracy. Finally, the authors developed a kill chain model to prevent IoT botnet attacks in the early stage.

APT-Dt-KC: advanced persistent threat detection based on kill-chain model

APT-Dt-KC: advanced persistent threat detection based on kill-chain model

SOC Critical Path: A Defensive Kill Chain Model

Different kill chain models have been defined and analyzed to provide a common sequence of actions followed in offensive cyber operations. These models allow analysts to identify these operations and to understand how they are executed. However, there is a lack of an equivalent model from a defensive point of view: this is, there is no common sequence of actions for the detection of threats and their accurate response. This lack causes not only problems such as unstructured approaches and conceptual errors but, what is most important, inefficiency in the detection and response to threats, as defensive tactics are not well identified. For this reason, in this work we present a defensive kill chain approach where tactics for teams in charge of cyber defense activities are structured and arranged. We introduce the concept of SOC Critical Path (SCP), a novel kill chain model to detect and neutralize threats. SCP is a technology–independent model that provides an arrangement of mandatory steps, in the form of tactics, to be executed by Computer Network Defense teams to detect hostile cyber operations. By adopting this novel model, these teams increase the performance and the effectiveness of their capabilities through a common framework that formalizes the steps to follow for the detection and neutralization of threats. In this way, our work can be used not only to identify detection and response gaps, but also to implement a continuous improvement cycle over time.

MCKC: a modified cyber kill chain model for cognitive APTs analysis within Enterprise multimedia network

The emerging cyber security threats pose many challenges to security analysts of enterprise multimedia environments when analysts attempting to analyze and reconstruct advanced persistent threats (APTs). APTs analysis activities are both time-consuming and labor-intensive. Attack modeling technology represented by kill chain can reduce the burden of manual provenience analysis. However, existing Cyber Kill Chain models represent attacks as several stages solidly, and they cannot reflect the characteristics of progressive penetration. It is difficult for security analysts to automate the correlation analysis of attack events in practical usage. In this paper, we first analyze current Cyber Kill Chain models and heterogeneous data sources for APTs detection. Then we propose MCKC (Modified Cyber Kill Chain model) that can be used for standardized correlation analysis. MCKC organizes sub-chains into a recursive structure, and different kill chain penetration processes in the same attack scenario are better connected The proposed MCKC model offers a novel approach for bi-directional attack analysis: forward analysis and backward reasoning which can facilitate threat detection effectively without relying too much on expert knowledge. The advantage of MCKC model is that it is more suitable for cognitive reasoning and APTs scenario reconstruction. Compared with existing models MCKC gives a feasible technological process for threat analysis. The result of case study shows that the modified kill chain model is effective in discovering security events and reconstructing APT attacks.

Continuous terrain remodelling: gaining the upper hand in cyber defence

ABSTRACT This paper seeks to shed light on the implications of the malleability of cyberspace for the offence-defence balance. We argue that defenders’ authority over their ‘cyber terrain’ which results from genuine ownership of its comprising assets gives them a unique advantage over attackers. Namely, the advantage to alter the state and composition of any assets over which cyberattackers and defenders contend. We suggest that this advantage is optimally suited for employment in a defensive paradigm of continuous remodelling of the cyber terrain (CTR). We demonstrate that various technologies are emerging as potential facilitators of such an approach to cyber defence. We also substantiate CTR’s capacity for granting defenders the upper hand by demonstrating its thwarting of most phases of cyberattacks and the imposition of an asymmetric disadvantage on attackers. Specifically, we analyse the promise of such remodelling in light of Lockheed Martin’s cyber kill chain model, and exemplify its disruptive effects on infamous malware. We also discuss what constitutes an owner’s cyber terrain in the age of the cloud, the obstacles to CTR, its implications for the industry, and propose an expected trajectory for offensive actions in cyberspace in an era of terrain remodelling.

ADDRR: A counter kill chain cyber security model

In his book Black Box Thinking, Matthew Syed compares the open approach the aviation industry takes in learning from disasters with the response often taken by the medical profession — the latter more reluctant to investigate incidents and share findings. The ADDRR model introduced in this paper advocates taking aviation’s ‘black box’ approach by having the tenacity to investigate the cause of breaches, learn from mistakes and share lessons learned. This will help all organisations improve their security posture. The ever-changing cyber threat environment also means that current models that guide defence strategies and tactics (for example Lockheed Martin’s Cyber Kill Chain Model and frameworks such as NIST) cannot remain static. The ADDRR model’s contribution to evolving cyber security thinking can be summarised in five key messages: 1) invest in a beefed-up ‘assess’ function that is thirsty for understanding and intelligence sharing; 2) incorporate a new ‘redesign’ objective that demands business and technology teams work together to create more secure products, processes and services that earn trust and generate sustainable growth; 3) consider the maturity and effectiveness of your investments in the five layers of the ADDRR model (assess, defend, detect, respond, redesign) and in protecting against five threat vectors (internal, external, third parties, compliance, IoT/OT devices); 4) mature your SOC capability into a ‘cyber nerve centre’ (incorporating automation and AI) that proactively manages the security of IT, facilities and business operations and provides the Board with a 360-degree view of its business resilience and cyber risk posture; and 5) evaluate the value to the business from investment in security and translate the greater resilience and lower risk/cost of a breach into Goodwill and shareholder value. The final message is a positive one. By introducing a redesign function, the model harnesses the creativity of the human resources of an organisation and gives employees, partners and customers the opportunity to work together to generate new services and stronger, more resilient businesses and ecosystems.

AI4SAFE-IoT: an AI-powered secure architecture for edge layer of Internet of things

With the increasing use of the Internet of things (IoT) in diverse domains, security concerns and IoT threats are constantly rising. The computational and memory limitations of IoT devices have resulted in emerging vulnerabilities in most IoT-run environments. Due to the low processing ability, IoT devices are often not capable of running complex defensive mechanisms. Lack of an architecture for a safer IoT environment is referred to as the most important barrier in developing a secure IoT system. In this paper, we propose a secure architecture for IoT edge layer infrastructure, called AI4SAFE-IoT. This architecture is built upon AI-powered security modules at the edge layer for protecting IoT infrastructure. Cyber threat attribution, intelligent web application firewall, cyber threat hunting, and cyber threat intelligence are the main modules proposed in our architecture. The proposed modules detect, attribute, and further identify the stage of an attack life cycle based on the Cyber Kill Chain model. In the proposed architecture, we define each security module and show its functionality against different threats in real-world applications. Moreover, due to the integration of AI security modules in a different layer of AI4SAFE-IoT, each threat in the edge layer will be handled by its corresponding security module delivered by a service. We compared the proposed architecture with the existing models and discussed our architecture independence of the underlying IoT layer and its comparatively low overhead according to delivering security as service for the edge layer of IoT architecture instead of embed implementation. Overall, we evaluated our proposed architecture based on the IoT service management score. The proposed architecture obtained 84.7 out of 100 which is the highest score among peer IoT edge layer security architectures.

Predictive model for multistage cyber-attack simulation

Adoption of information and communication technologies (ICT) in railway has improved the reliability, maintainability, operational efficiency, capacity as well as the comfort of passengers. This adoption introduces new vulnerabilities and entry points for hackers to launch attacks. Advanced cybersecurity threats with automated capabilities are increasing in such sectors as finance, health, grid, retail, government, telecommunications, transportation, etc. These cyber threats are also increasing in railways and, therefore, it needs for cybersecurity measures to predict, detect and respond these threats. The cyber kill chain (CKC) model is a widely used model to detect cyber-attacks and it consists of seven stages/chains; breaking the chain at an early stage will help the defender stop the adversary’s malicious actions. Due to lack of real cybersecurity data, this research simulates cyber-attacks to calculate the attack penetration probabilities at each stage of the cyber kill chain model. The objective of this research is to predict cyber-attack penetrations by implementing various security controls using modeling and simulation. This research is an extension of developed railway defender kill chain which provides security controls at each stage of CKC for railway organizations to minimize the risk of cyber threats.

Railway Defender Kill Chain to Predict and Detect Cyber-Attacks

Most organizations focus on intrusion prevention technologies, with less emphasis on prediction and detection. This research looks at prediction and detection in the railway industry. It uses an extended cyber kill chain (CKC) model and an industrial control system (ICS) cyber kill chain for detection and proposes predictive technologies that will help railway organizations predict and recover from cyber-attacks. The extended CKC model consists of both internal and external cyber kill chain; breaking the chain at an early stage will help the defender stop the adversary’s malicious actions. This research incorporates an OSA (open system architecture) for railways with the railway cybersecurity OSA-CBM (open system architecture for condition-based maintenance) architecture. The railway cybersecurity OSACBM architecture consists of eight layers; cybersecurity information moves from the initial level of data acquisition to data processing, data analysis, incident detection, incident assessment, incident prognostics, decision support, and visualization. The main objective of the research is to predict, prevent, detect, and respond to cyber-attacks early in the CKC by using defensive controls called the Railway Defender Kill Chain (RDKC). The contributions of the research are as follows. First, it adapts and modifies the railway cybersecurity OSA-CBM architecture for railways. Second, it adapts the cyber kill chain model for the railway. Third, it introduces the Railway Defender Kill Chain. Fourth, it presents examples of cyber-attack scenarios in the railway system.

A Cyber-Kill-Chain based taxonomy of crypto-ransomware features

In spite of being just a few years old, ransomware is quickly becoming a serious threat to our digital infrastructures, data and services. Majority of ransomware families are requesting for a ransom payment to restore a custodian access or decrypt data which were encrypted by the ransomware earlier. Although the ransomware attack strategy seems to be simple, security specialists ranked ransomware as a sophisticated attack vector with many variations and families. Wide range of features which are available in different families and versions of ransomware further complicates their detection and analysis. Though the existing body of research provides significant discussions about ransomware details and capabilities, the all research body is fragmented. Therefore, a ransomware feature taxonomy would advance cyber defenders’ understanding of associated risks of ransomware. In this paper we provide, to the best of our knowledge, the first scientific taxonomy of ransomware features, aligned with Lockheed Martin Cyber Kill Chain (CKC) model. CKC is a well-established model in industry that describes stages of cyber intrusion attempts. To ease the challenge of applying our taxonomy in real world, we also provide the corresponding ransomware defence taxonomy aligned with Courses of Action matrix (an intelligence-driven defence model). We believe that this research study is of high value for the cyber security research community, as it provides the researchers with a means of assessing the vulnerabilities and attack vectors towards the intended victims.

A holistic review of Network Anomaly Detection Systems: A comprehensive survey

Network Anomaly Detection Systems (NADSs) are gaining a more important role in most network defense systems for detecting and preventing potential threats. The paper discusses various aspects of anomaly-based Network Intrusion Detection Systems (NIDSs). The paper explains cyber kill chain models and cyber-attacks that compromise network systems. Moreover, the paper describes various Decision Engine (DE) approaches, including new ensemble learning and deep learning approaches. The paper also provides more details about benchmark datasets for training and validating DE approaches. Most of NADSs’ applications, such as Data Centers, Internet of Things (IoT), as well as Fog and Cloud Computing, are also discussed. Finally, we present several experimental explanations which we follow by revealing various promising research directions.

Modified cyber kill chain model for multimedia service environments

The sudden rise in the frequency and sophistication of cyber threats has become a hindrance to the steady development of internet of things (IoT)-based multimedia service environments. The framework currently in use for understanding and analyzing cyber threats in the information security (IS) field is the cyber kill chain model. Of these threats, a particular threat that involves advanced and persistent attacks on a designated target (company that provides multimedia services) and causes large-scale damage is referred to as an advanced persistent threat (APT). As there can be numerous threat points in an IoT-based multimedia service environment with networks of various heterogeneous devices connected through multiple routes, an understanding of the potential routes of the threats is crucial. APTs are generally divided into the infiltration stage from the outside into the inside of an organization, and a threat stage that occurs within an organization. The existing kill chain model in the IS field is problematic in that it cannot fully express the actions that occur inside an organization. However, many attacks that occur in today’s IoT-based multimedia service environments are performed after infiltration of an insider or the organization. Thus, it is important for actions that occur on the inside to be clearly schematized to secure visibility in the multimedia service environment. This study analyzes the limitations of the existing model, and proposes a revised cyber kill chain model for multimedia security that can explain threats within an organization in addition to external threats.

Kill Chain for Industrial Control System

Attacks in industrial control systems vary widely and are influenced by many factors, including the intent of the attacker, the capabilities of the attacker, the sophistication of the attacking techniques, and his familiarity with the industrial control systems and industrial processes. Attacks against industrial control systems are not a simple network intrusion, but are accomplished through a series of activities to achieve precise attack. This article expands the cyber kill chain model to improve it so that it can be applied to industrial control systems to ensure that defenders in industrial control can understand the attackers' attack activities so as to reasonably allocate limited security resources, take effective security measures and make well-informed risk management decision.

A novel kill-chain framework for remote security log analysis with SIEM software

Network security investigations pose many challenges to security analysts attempting to identify the root cause of security alarms or incidents. Analysts are often presented with cases where either incomplete information is present, or an overwhelming amount of information is presented in a disorganized manner. Either scenario greatly impacts the ability for incident responders to properly identify and react to security incidents when they occur. The framework presented in this paper draws upon previous research pertaining to cyber threat modeling with kill-chains, as well as the practical application of threat modeling to forensic. Modifications were made to conventional kill-chain models to facilitate logical data aggregation within a relational database collecting data across disparate remote sensors resulting in more detailed alarms to security analysts. The framework developed in this paper proved effective in identifying the relationship of security alarms along a continuum of expected behaviors conducive to executing security investigations in a methodical manner. This framework effectively addressed incomplete or inadequate alarm information through aggregation, and provided a methodology for organizing related data and conducting standard investigations. Both improvements proved instrumental in the effective identification of security threats in a more expeditious manner.