Malicious Activities Research Articles

Optimizing IoT Intrusion Detection Using Balanced Class Distribution, Feature Selection, and Ensemble Machine Learning Techniques.

Internet of Things (IoT) devices are leading to advancements in innovation, efficiency, and sustainability across various industries. However, as the number of connected IoT devices increases, the risk of intrusion becomes a major concern in IoT security. To prevent intrusions, it is crucial to implement intrusion detection systems (IDSs) that can detect and prevent such attacks. IDSs are a critical component of cybersecurity infrastructure. They are designed to detect and respond to malicious activities within a network or system. Traditional IDS methods rely on predefined signatures or rules to identify known threats, but these techniques may struggle to detect novel or sophisticated attacks. The implementation of IDSs with machine learning (ML) and deep learning (DL) techniques has been proposed to improve IDSs' ability to detect attacks. This will enhance overall cybersecurity posture and resilience. However, ML and DL techniques face several issues that may impact the models' performance and effectiveness, such as overfitting and the effects of unimportant features on finding meaningful patterns. To ensure better performance and reliability of machine learning models in IDSs when dealing with new and unseen threats, the models need to be optimized. This can be done by addressing overfitting and implementing feature selection. In this paper, we propose a scheme to optimize IoT intrusion detection by using class balancing and feature selection for preprocessing. We evaluated the experiment on the UNSW-NB15 dataset and the NSL-KD dataset by implementing two different ensemble models: one using a support vector machine (SVM) with bagging and another using long short-term memory (LSTM) with stacking. The results of the performance and the confusion matrix show that the LSTM stacking with analysis of variance (ANOVA) feature selection model is a superior model for classifying network attacks. It has remarkable accuracies of 96.92% and 99.77% and overfitting values of 0.33% and 0.04% on the two datasets, respectively. The model's ROC is also shaped with a sharp bend, with AUC values of 0.9665 and 0.9971 for the UNSW-NB15 dataset and the NSL-KD dataset, respectively.

Intrusion Detection System to Secure a Network using ACNN Model and Machine Learning

As cyber threats continue to evolve in sophistication and diversity, the need for robust Intrusion Detection Systems (IDS) becomes paramount to safeguarding network integrity. This research explores the application of an innovative approach by integrating an Attention-based Convolutional Neural Network (ACNN) model with machine learning techniques to enhance the accuracy and efficiency of intrusion detection. The proposed system leverages the ACNN's ability to capture contextual dependencies in network traffic data, enabling the extraction of intricate patterns indicative of potential intrusions. The ACNN's attention mechanism focuses on relevant features within the data, improving the model's discriminative power and adaptability to dynamic cyber threats. To achieve optimal performance, the ACNN is complemented with a machine learning framework that includes feature engineering, dimensionality reduction, and classification algorithms. This integrated approach allows the system to adapt and learn from evolving attack vectors, providing a proactive defense mechanism against both known and unknown threats. The research evaluates the proposed ACNN-based IDS using benchmark datasets and real-world network traffic scenarios. Comparative analysis against traditional IDS models showcases the superiority of the ACNN in terms of detection accuracy, false positive rates, and computational efficiency. Furthermore, the system's adaptability to emerging threats is demonstrated through continuous learning and retraining mechanisms. Results indicate that the ACNN-based IDS not only exhibits superior performance but also demonstrates resilience against evasion techniques employed by malicious actors. The research findings contribute to the advancement of network security by presenting a cuttingedge solution that combines deep learning and machine learning for effective and adaptive intrusion detection.

A method of using modern endpoint detection and response (EDR) systems to protect against complex attacks

The subject of the research in this article is the architecture of Endpoint Detection and Response and the EDR agent as their base parts in terms of mechanisms for detecting and countering complex attacks on information and communication systems (ICS). The aim of the work is to develop of method for improving the efficiency of using Endpoint Detection and Response (EDR) to reduce the risks of compromising ICS information, industrial, and infrastructure objects by effectively redistributing and utilizing the available EDR mechanisms, the cybersecurity team, and other resources available for implementing security measures in an enterprise, institution, or organization. The article addresses the following tasks: reviewing and analyzing existing EDR systems, analyzing the architecture of EDR solutions and EDR agents, the features of their use, the logic behind the construction of methods and mechanisms for detecting threats to the system from malicious actors and malicious code. The task of providing recommendations for the organization of ICS is also separately addressed in terms of the need to protect the entire ICS and its individual elements, as well as in terms of the available resources (the cybersecurity team, their qualifications and level of awareness of the architecture of EDR solutions) and means (available EDR system elements) for organizing protection. The following methods are used: modeling attack mechanisms, modeling attacker behavior. The following results were obtained: general and specific recommendations were formulated for optimizing the operation of EDR systems and ensuring the effective use of EDR system elements in the information and communication networks of enterprises, organizations, and institutions of various types and orientations depending on the available resources and the information requiring protection. Conclusions: The identified recommendations for the application of EDR mechanisms for protecting information systems and networks allow optimizing the costs of creating a protection infrastructure and implementing security measures, taking into account the characteristics of the available tools and the training and awareness of the cybersecurity team both in terms of response time to threats and the complexity and cost of performing protection tasks.

Malware Detection Using Hidden Markov Model

Malware is a broad term for harmful software that poses significant threats by damaging computer systems and spreading across networks. Traditional detection methods include signature-based and heuristic-based techniques, which are effective against known malware but struggle with new, unknown variants, particularly sophisticated ones like metamorphic, encrypted, and polymorphic viruses. Hence, this research aims at improving malware detection, specifically targeting metamorphic malware that can evade traditional detection methods. The study shows the effectiveness of dynamic analysis over static analysis for detecting metamorphic malware due to its ability to adapt to the malware's constant changes. The dynamic analysis involves examining malware behavior during execution, using dynamic software birthmarks and the Hidden Markov Model to identify malicious activities. It therefore recommends the use of dynamic analysis in the detection of patterns of metamorphic malware. Keywords: Hidden markov models, Malware detection, Dynamic analysis and Static analysis

EVASION TECHNIQUES IN MALWARE DETECTION: CHALLENGES AND COUNTERMEASURES

In the ever-evolving digital landscape, the escalating sophistication of malware poses a substantial threat, necessitating continual advancements in detection methods. This paper addresses the pervasive challenge of evasion techniques employed by malware to circumvent standard security measures. Focused on understanding the intricate methods employed by malware developers, our study explores the dynamic nature of this cyber threat. As malicious actors continually refine their approaches, a nuanced understanding of evasion tactics becomes paramount for developing effective countermeasures. The research emphasizes the need for robust defense mechanisms capable of adapting to the constantly changing cyber threat landscape. By unraveling the complexities of evasion techniques, this paper contributes valuable insights to the development of proactive and resilient cybersecurity measures. Through an exploration of specific evasion tactics, we aim to inform and empower cybersecurity professionals, facilitating the creation of strategies capable of effectively mitigating the risks posed by these dynamic digital threats.

Phishing detection tool for financial emails

Phishing attacks have emerged as a significant cybersecurity threat, especially within the financial domain, where email serves as a prevalent vector for malicious activities. This project report outlines the development and evaluation of a Chrome browser extension tailored to bolster email security, specifically focusing on detecting and mitigating phishing attempts in financial communications. The study begins with a thorough examination of the techniques and tactics used by phishing attackers in financial email campaigns. A sophisticated awareness of the changing landscape of phishing assaults is required to develop successful defences. The key contribution of this work is the development of a powerful Chrome browser extension that easily integrates with common email services in the financial sector. This extension harnesses a blend of machine learning algorithms, URL analysis, and user-friendly interfaces to identify potentially malicious financial emails. It rigorously scans email content, scrutinizing hyperlinks and attachments for signs of phishing. The extension evaluates URL reputations, checks for typical phishing indicators, and examines email headers. In case any suspicious elements are identified, users receive real-time alerts, enabling them to make informed decisions about the safety of financial emails. To ensure the extension’s accuracy and effectiveness within the financial context, an extensive dataset of real-world phishing emails and legitimate financial messages is employed for training and testing. The report offers a comprehensive analysis of the extension’s performance, emphasizing its capability to detect and prevent phishing attempts in financial emails while minimizing false positives. In addition to its detection capabilities, the extension actively promotes user awareness and education regarding phishing threats within the financial sector. It provides guidance on recognizing phishing red flags and offers educational resources to enhance user security practices. This work concludes with an evaluation of the extension’s usability and its potential impact on enhancing email security within the financial domain. It underscores the critical role of proactive measures, such as this extension, in addressing the evolving threat landscape of phishing attacks in the digital age, particularly within financial communications.

Sentinel Shield: Leveraging ConvLSTM and Elephant Herd Optimization for Advanced Network Intrusion Detection

Given the escalating intricacy of network environments and the rising level of sophistication in cyber threats, there is an urgent requirement for resilient and effective network intrusion detection systems (NIDS). This document presents an innovative NIDS approach that utilizes Convolutional Long Short-Term Memory (ConvLSTM) networks and Elephant Herd Optimization (EHO) to achieve precise and timely intrusion detection. Our proposed model combines the strengths of ConvLSTM, which can effectively capture spatiotemporal dependencies in network traffic data, and EHO, which allow the model to focus on relevant information while filtering out noise. To achieve this, we first preprocess network traffic data into sequential form and use ConvLSTM layers to learn both spatial and temporal features. Subsequently, we introduce Elephant Herd Optimization that dynamically assigns different weights to different parts of the input data, emphasizing the regions most likely to contain malicious activity. To evaluate the effectiveness of our approach, we conducted extensive experiments on publicly available network intrusion CICIDS2017 Dataset. The experimental results demonstrate the efficacy of the proposed approach (Accuracy = 99.98%), underscoring its potential to revolutionize modern network intrusion detection and proactively safeguard digital assets.

METHODOLOGY FOR DETERMINING THE IMPACT OF DIGITAL TECHNOLOGIES ON ECONOMIC POLICY

The article examines current issues related to the creation of a single international digital market and their impact on economic policy. It is emphasized that the conditions under which the industrial complex of Ukraine should function in the near future are under the influence of globalization. Brief information on the essence of these processes is provided. It is noted that digitization is carried out within the framework of economic policy, which in the EU is aimed at creating a single international digital market. The characteristic features of this process are given. It is also noted that according to the policy adopted by the EU, over the next five years it is planned to focus on three key objectives to ensure that digital solutions will help Europe to follow its own path to a digital transformation that works for the good of people through respect for our values, namely, implementing technologies that work for people, building a fair and competitive economy and an open, democratic and sustainable society. A brief description of each direction is provided. It stands to reason that every citizen, every worker, every businessman should have a fair chance, wherever they live, to reap the benefits of our increasingly digitized society. Digital solutions such as communication systems, artificial intelligence or quantum technologies can enrich our lives in many ways, although the benefits of digital technologies do not come without risks and costs. Citizens are no longer unable to control what happens to their personal data and are increasingly overwhelmed by the demands of their attention. It highlights that malicious cyber activity can threaten our personal well-being or disrupt our critical infrastructure and create wider security challenges. The unforeseen and unpredictable consequences of the intervention of artificial intelligence in the existence of humanity have already worried the inhabitants of the planet and the Governments of almost all countries. This significant societal transformation requires deep reflection at all levels of society on how Europe can best face these risks and challenges. The effectiveness of innovation policy, in particular, of the EU countries, based on the assessment of their level of readiness for the introduction of advanced digital technology - 5G Internet, is indicated. It is noted that the level of digitalization of business is the most significant factor of digitalization of the labor market, as it causes its quantitative and qualitative modifications.

Unveiling The Detection of File Less Malware from Dark Web: A Stealthy Arsenal for Web Application Exploitation

The proliferation of fileless malware poses a significant threat to web application security, especially when sourced from the dark web. This paper presents a novel detection tool designed to identify and mitigate fileless malware sourced from the dark web, specifically targeting web applications. Leveraging advanced anomaly detection and behavioral analysis techniques, the tool monitors real-time traffic and user interactions, enabling the early detection of malicious activities. Additionally, the tool integrates seamlessly with threat intelligence sources, enhancing its ability to recognize emerging threats. A user-centric alerting system ensures that administrators are promptly notified of potential security breaches, allowing for immediate remediation actions. The tool's adaptability and continuous enhancement mechanisms ensure that it stays ahead of evolving threats. By employing this detection tool, organizations can bolster their web application security posture and protect sensitive data from sophisticated fileless malware attacks.

Intelligent Threat Detection—AI-Driven Analysis of Honeypot Data to Counter Cyber Threats

Security adversaries are rampant on the Internet, constantly seeking vulnerabilities to exploit. The sheer proliferation of these sophisticated threats necessitates innovative and swift defensive measures to protect the vulnerable infrastructure. Tools such as honeypots effectively determine adversary behavior and safeguard critical organizational systems. However, it takes a significant amount of time to analyze these attacks on the honeypots, and by the time actionable intelligence is gathered from the attacker’s tactics, techniques, and procedures (TTPs), it is often too late to prevent potential damage to the organization’s critical systems. This paper contributes to the advancement of cybersecurity practices by presenting a cutting-edge methodology, capitalizing on the synergy between artificial intelligence and threat analysis to combat evolving cyber threats. The current research articulates a novel strategy, outlining a method to analyze large volumes of attacker data from honeypots utilizing large language models (LLMs) to assimilate TTPs and apply this knowledge to identify real-time anomalies in regular user activity. The effectiveness of this model is tested in real-world scenarios, demonstrating a notable reduction in response time for detecting malicious activities in critical infrastructure. Moreover, we delve into the proposed framework’s practical implementation considerations and scalability, underscoring its adaptability in diverse organizational contexts.

Hybrid deep architecture for intrusion detection in cyber‐physical system: An optimization‐based approach

SummaryIntrustion Detection System (IDS) refers to the gear or software that monitors a network or system for malicious activity or policy violations. Periodically, the system records any intrusion action or breach, which frequently modifies the administrator. Cyber Physical System (CPS) is particularly called as networked connected system, in which the system components are spatially distributed and integrated via the communication network. The control mechanism ensures computation significance; however, the system does affect attacks. Researchers are trying to handle this issue via the existing anomaly datasets. In this way, this paper follows an intrusion detection system under three major stages including extraction of features, selection of feature, and detection. The primary stage is the extraction of Statistical features like standard deviation, mean, mode, variance, and median, as well as higher‐order statistical features like moment, percentile, improved correlation, kurtosis, mutual information, skewness, flow‐based features, and information gain‐based features. The curse of dimensionality becomes a significant problem in this scenario, so it is crucial to choose the right features. Improved Linear Discriminant Analysis (LDA) is utilized to choose the right features. The selected features are subjected to a Hybrid classifier for final detection. Here, models like CNN (Convolutional Neural Network) and Bi‐GRU (Bidirectional Gated Recurrent Unit) are combined. A new Bernoulli Map Estimated Arithmetic Optimization Algorithm (BMEAOA) is added to train the system by adjusting the ideal weights of the two classifiers, leading to improved detection outcomes. Ultimately, the effectiveness is assessed in comparison to the other traditional techniques.

Onion-Hash: A Compact and Robust 3D Perceptual Hash for Asset Authentication

The digitalization of manufacturing processes and recent trends, such as the Industrial Metaverse, are continuously increasing in adoption in various critical industries, resulting in a surging demand for 3D CAD models and their exchange. Following this, it becomes necessary to protect the intellectual property of content designers in increasingly decentralized production environments where 3D assets are repeatedly shared online within the ecosystem. CAD models can be protected by traditional security methods such as watermarking, which embeds additional information into the file. Nevertheless, malicious actors may find ways to remove the information from a file. To authenticate and protect 3D models without relying on additional information, we propose a robust 3D perceptual hash generated based on the prevalent geometric features. Furthermore, our geometry-based approach generates compact and tamper-resistant fingerprints for a 3D model by projecting multiple spherical sliced layers of intersection points into cluster distances. The resulting hash links the 3D model to an owner, supporting the detection of counterfeits. The approach was benchmarked for similarity search and evaluated against established state-of-the-art shape retrieval techniques. The results show promising resistance against arbitrary transformations and manipulations, with our approach detecting 25.6% more malicious tampering attacks than the baseline.

WCA: Integration of Natural Language Processing Methods and Machine Learning Model for Effective Analysis of Web Content to Classify Malicious Webpages

Malicious websites have become a pervasive concern in the digital realm, targeting careless users as well as organizations. It may result in substantial financial losses, identity theft, data intrusions, and damage to reputation. In order to create efficient countermeasures, it is crucial to comprehend the effects of interacting with such websites. There are several ways to classify malicious webpages. Web content analysis is one such way for protecting internet users from malicious activities. It entails analysing websites to identify potential hazards, such as phishing attempts, malware distribution, and fraudulent activities. Traditional methods relied on rule-based systems, but recent advances in natural language processing and machine learning have opened up new avenues for increasing the precision and scalability of web content analysis to classify malicious webpages. Most of the exciting research work focuses more on URL alone for risk free processing. This paper introduces novel method for analysing web contents especially textual contents of the webpages for classification. Among various tags in web technology, proposed method focuses on div, paragraph and meta tags. The textual contents of these tags are extracted and vectorized using three different vectorizers in natural language processing and classify the webpages using machine learning models. Seven different machine learning models are used for performance evaluation. The result shows that a combined textual content of three distinct tags with count vectorizer + random forest achieves the higher accuracy of 93.46% with 1000 features.

Wargaming in Information Warfare Training: A Study of Finnish Officials

In the digital age, information warfare has become a significant global concern, with malicious actors exploiting various media to manipulate public opinion, destabilising governments, and sowing discord. Automated and algorithmic tools are used to spread false and misleading information on social media platforms, and states have been unable to control the spread of it. In addressing new challenges, national governments globally reassess strategies, communications, and responses to adapt to evolving threat environments. To counter information influence activities, it is crucial to have informed, educated, and well-trained communicators. This case study focuses on the innovative use of wargaming in training government officials, providing them with abilities to respond to different tactics and methods of malign influence operations. This article is based on an information warfare exercise conducted in January 2024 involving 27 Finnish officials from various ministries and agencies critical to national security. The participants participated in an interactive simulation, where they explored and responded to challenges related to disinformation campaigns and other tactics designed to manipulate and influence information within a hybrid warfare context. The players were divided into two teams: red and blue, with the reds assuming the role of the offensive team while the blues took on the defensive role. The teams competed for control over the information space, employing various information warfare methods. After the exercise, each participant was asked to complete a post-exercise survey to evaluate the knowledge acquired and the exercise's overall usefulness, including scenario clarity and the effectiveness of role-playing. We also explored potential differences in perceptions and experiences between inexperienced and experienced players in the wargaming exercise. Key findings revealed the effectiveness of wargaming as an educational tool, particularly benefiting novices over experienced players. Role-playing proved valuable, emphasizing the importance of explicit scenarios for effective engagement. The study highlighted cross-departmental cooperation's significance, facilitating a dynamic learning environment.

A Survey on Network Attack Surface Mapping

Network services are processes running on a system with network exposure. A key activity for any network defender, penetration tester, or red team is network attack surface mapping, the act of detecting and categorizing those services through which a threat actor could attempt malicious activity. Many tools have arisen over the years to probe, identify, and classify these services for information and vulnerabilities. In this article, we survey network attack surface mapping by reviewing several prominent tools and their features and then discussing recent works reflecting unique research using those tools. We conclude by covering several promising directions for future research.

Walkthrough phishing detection techniques

Phishing has emerged as a significant cyber threat, resulting in huge financial frauds for internet users annually. This malicious activity uses social engineering and upgraded methodologies (like file archiver in the browser, content injection, calendar phishing, more convincing fake websites or emails, voice manipulation, or other tools designed to deceive and exploit the target’s confidence) to extract sensitive information from unsuspected victims. In order to mitigate these attacks, several methods and tools have been devised; various detection techniques and block phishing websites, and browser extensions that notify users about suspicious websites. Our work elaborates on meticulous analysis of the detection of phishing attacks by classifying them into four broader categories based on the adopted methodologies like List-Based Detection, Heuristic-Based Detection, machine learning (ML)-based, and deep learning (DL)-based. Additionally, it summarizes the popular devised schemes, highlighting their advantages and limitations, and how these are suitable for the different types of deployments.

Leveraging artificial intelligence for enhanced cybersecurity: insights and innovations

In the digital age, cyber threats have become increasingly sophisticated, necessitating innovative approaches to bolster security measures. Artificial Intelligence (AI) has emerged as a formidable tool in the realm of cyber security, offering advanced capabilities in threat detection, anomaly detection, and response automation. This article provides an overview of AI applications in cyber security, highlighting its role in mitigating risks and fortifying defense mechanisms. AI techniques such as machine learning, deep learning, and natural language processing empower security systems to analyze vast amounts of data in real-time, identifying patterns indicative of malicious activities. Through the utilization of AI-driven algorithms, cyber security platforms can proactively detect and neutralize cyber threats before they inflict substantial damage. Moreover, AI enables the automation of incident response processes, reducing response times and minimizing the impact of security breaches. Case studies from leading cyber security firms from the integral part of the studies and demonstrate the practical implementation of AI-driven solutions in safeguarding critical infrastructures against cyber threats. Resilience towards cyber-attacks and safeguarding sensitive data assets through leveraging AI technologies has been focused in the study.

The Most Important Types of Cyber Attacks that France is Expected to Face in the Future and the Cyber Security Measures it Must Implement to Protect Critical Infrastructure, Telecommunication Networks and Personal Data

As the digital landscape continues to evolve, nations like France find themselves on the frontline of an escalating cyber warfare scenario. This abstract provides an insightful overview of the most significant types of cyber attacks that France is expected to face in the future, offering a comprehensive analysis based on current trends and emerging technologies. The research delves into the realm of advanced persistent threats (APTs), examining the sophisticated techniques employed by state-sponsored actors and cybercriminal organizations to compromise critical infrastructure, sensitive data, and national security. It explores the evolving landscape of ransomware attacks, focusing on the potential impact on both public and private sectors, and the looming threat of extortion campaigns that could cripple essential services. Furthermore, the abstract sheds light on the rising concern of supply chain attacks, as interconnected global networks make businesses and government entities vulnerable to malicious actors seeking to exploit weaknesses in third-party systems. The research also explores the nuances of social engineering attacks, recognizing the human element as a critical vulnerability that threat actors may exploit through targeted phishing campaigns and manipulation tactics. In addition, the abstract touches upon the growing menace of Internet of Things (IoT) vulnerabilities, acknowledging the increased interconnectivity of devices and the potential for large-scale disruptions. It also considers the implications of emerging technologies such as artificial intelligence and quantum computing in shaping the future threat landscape. By examining these diverse aspects of cyber threats, this abstract aims to provide a forward-looking perspective on the challenges France is likely to encounter in the digital realm. As Cyber security becomes an integral component of national defense, understanding these anticipated threats is crucial for policymakers, security experts, and technology professionals seeking to fortify France’s resilience against the evolving nature of cyber attacks.

HARNESSING ARTIFICIAL INTELLIGENCE FOR ADVANCED THREAT DETECTION IN NETWORK INFRASTRUCTURES

As cyber threats grow increasingly sophisticated, traditional security measures are falling behind in the face of these evolving attacks. This article highlights the role of Smart Sentinel, a cutting-edge threat detection system that utilizes Artificial Intelligence (AI) to strengthen network defenses. Unlike conventional security solutions, Smart Sentinel employs machine learning algorithms to continuously learn and adapt, enabling it to detect anomalies and potential threats in real-time. By analyzing a variety of data sources, including network traffic and user behavior, the system establishes a baseline of normal activity and continually enhances its threat detection capabilities. Key features such as anomaly detection, behavioral analysis, real-time response, and adaptive learning contribute to an improved security posture, reduced false positives, enhanced operational efficiency, and cost-effectiveness. Smart Sentinel represents a significant breakthrough in cybersecurity, providing organizations with a proactive and resilient defense against the ever-evolving cyber threat landscape. Key features such as anomaly detection, behavioral analysis, real-time response, and adaptive learning contribute to Smart Sentinel’s effectiveness in protecting organizations against cyber threats. Anomaly detection: Smart Sentinel identifies unusual patterns and activities that deviate from established norms, alerting security teams to potential threats. Behavioral analysis: Smart Sentinel goes beyond simply detecting anomalies by analyzing user and system behavior to identify suspicious patterns that may indicate malicious intent. Real-time response: Smart Sentinel’s real-time response capabilities enable it to take immediate action upon detecting a threat, such as isolating compromised systems, blocking malicious IP addresses, or generating alerts for human intervention. Adaptive learning: Through continuous monitoring and analysis, Smart Sentinel continuously learns and improves its ability to discern between normal and malicious activities, reducing false positives and improving overall security posture. Smart Sentinel’s impact on organizations is multifaceted: Enhanced security posture: Smart Sentinel proactively identifies and mitigates emerging threats, strengthening an organization’s overall security posture. Reduced false positives: Smart Sentinel’s adaptive learning capabilities minimize the number of false positives, preventing alert fatigue and allowing security teams to focus on genuine threats. Operational efficiency: Smart Sentinel automates routine tasks, freeing up security teams to focus on strategic initiatives and improve operational efficiency. Cost-effectiveness: Smart Sentinel optimizes cybersecurity investments by automating threat detection and response, reducing the need for costly manual intervention and minimizing the potential for financial losses from successful cyberattacks.

Cyber risk assessment of cyber-enabled autonomous cargo vessel

The increasing interest in autonomous ships within the maritime industry is driven by the pursuit of revenue optimization, operational efficiency, safety improvement and going greener. However, the industry’s increasing reliance on emerging technologies for the development of autonomous ships extends the attack surface, leaving the underlying ship systems vulnerable to potential exploitation by malicious actors. In response to these emerging challenges, this research extends an existing cyber risk assessment approach called FMECA-ATT&CK based on failure modes, effects and criticality analysis (FMECA), and the MITRE ATT&CK framework. As a part of our work, we have expanded the FMECA-ATT&CK approach to assessing cyber risks related to systems with artificial intelligence components in cyber-enabled autonomous ships (e.g. autonomous engine monitoring and control). This new capability was developed using the information and semantics encoded in the MITRE ATLAS framework. FMECA-ATT&CK has been adopted due to its comprehensive and adaptable nature and its promising venue for supporting continuous cyber risk assessment. It helps evaluate the cyber risks associated with the complex and state-of-the-art operational technologies on board autonomous ships. The cyber risk assessment approach assists cybersecurity experts in aligning mitigation strategies for the cyber defence of autonomous ships. It also contributes towards advancing overall cybersecurity in the maritime industry and ensures the safe and secure sailing of autonomous ships. Our key findings after applying the proposed approach against a model of an autonomous cargo ship is the identification of the Navigation Situation Awareness System (NSAS) of the ship as being at the highest risk followed by the Autonomous Engine Monitoring and Control (AEMC) system. Additionally, we identified 3 high, 48 medium, and 5776 low risks across 29 components.