Malicious Cyber Research Articles

Resilient Frequency-shifted IMC-PID Scheme for Mitigating Scaling and Random Attacks in Thermal Plants Amid Delay

In recent times, several network-related scenarios like Communication Delays (CDs) and malicious Cyber Attacks (CAs) have posed a major challenge in keeping the operational frequency of automatic generation systems within admissible levels. Hence, the proposed work focuses on investigating the applicability of an Frequency-Shifted Internal Model Control-Proportional Integral Derivative (FIMC-PID) controller for Load Frequency Control (LFC) of a non-identical dual-area Power System (PS) in the presence of inherent CDs and CAs. The FIMC approach is based on the integration of concepts like model order reduction and pole-zero shifting of the reduced order transfer function by the constant (ψ) which indicates the amount by which system robustness can be manipulated. In addition to that, an analytical approach for obtaining a stable numerical range of the tunable parameter ψ is introduced using Routh-Hurwitz criteria. This range serves as the input for the Golden Jackal Optimizer (GJO) for finding the optimal value of ψ by minimizing the Integrated Time-Squared Error (ITSE). False Data Injection (FDI) threats to the cyber-physical systems like scaling and random attacks have been modeled and the efficacy of GJO-tuned FIMC strategy in mitigating the same is vindicated. Finally, hardware-in-loop real-time verification of the suggested strategy in mitigating frequency fluctuations is carried out in the OPAL-RT platform.

A Malicious Domains Detection Method Based on File Sandbox Traffic

With the recent increasing number of malicious cyber activities using domain names as attack vectors, malicious domains must be detected and blocked in order to combat cyber attackers. However, current studies of malicious domains detection are limited to Domain Name System (DNS) traffic features or character features, which ignore the associations of malware and malicious domains in the detection. In this paper, we propose a malicious domains detection approach based on domain relationship features extracted from real sandbox traffic. We construct heterogeneous graphs based on sandbox traffic and use the Relational Graph Convolutional Network (RGCN) to build detection models to extract inter-node relationship features. Experiments are conducted using data extracted from real sandbox traffic, and our approach achieves an accuracy of 87.11%. The experimental results demonstrate the effectiveness of using relationship features extracted from sandbox traffic for malicious domains detection.

Dark Web Marketplaces: Data for Collaborative Threat Intelligence

The dark web has become an increasingly important landscape for the sale of illicit cyber goods. Given the prevalence of malware and tools that are used to steal data from individuals on these markets, it is crucial that every company, governing body, and cyber professional be aware of what information is sold on these marketplaces. Knowing this information will allow these entities to protect themselves against cyber attacks and from information breaches. In this article, we announce the public release of a data set on dark web marketplaces’ cybersecurity-related listings. We spent multiple years seeking out websites that sold illicit digital goods and collected data on the available products. Due to the marketplaces’ varied and complex layers of security, we leveraged the flexible Selenium WebDriver with Python to navigate the web pages and collect data. We present analysis of categories of malicious cyber goods sold on marketplaces, prices, persistent vendors, ratings, and other basic information on marketplace storefronts. Additionally, we share the tools and techniques we’ve compiled, enabling others to scrape dark web marketplaces at a significantly lower risk. We invite professionals who opt to gather data from the dark web to contribute to the publicly shared threat intelligence resource.

Leveraging VR/AR/MR/XR Technologies to Improve Cybersecurity Education, Training, and Operations

The United States faces persistent threats conducting malicious cyber campaigns that threaten critical infrastructure, companies and their intellectual property, and the privacy of its citizens. Additionally, there are millions of unfilled cybersecurity positions, and the cybersecurity skills gap continues to widen. Most companies believe that this problem has not improved and nearly 44% believe it has gotten worse over the past 10 years. Threat actors are continuing to evolve their tactics, techniques, and procedures for conducting attacks on public and private targets. Education institutions and companies must adopt emerging technologies to develop security professionals and to increase cybersecurity awareness holistically. Leveraging Virtual/ Augmented/Mixed/Extended Reality technologies for education, training, and awareness can augment traditional learning methodologies and improve the nation’s cybersecurity posture. This paper reviews previous research to identify how distance and remote education are conducted generally, and how Virtual/Augmented/Extended/Mixed reality technologies are used to conduct cybersecurity awareness training, cybersecurity training, and conduct operations. Finally, barriers to adopting these technologies will be discussed. Understanding how these technologies can be developed and implemented provides one potential way of overcoming the cybersecurity workforce gap and increasing the competencies and capabilities of cybersecurity professionals.

Direction of Japan’s New Cybersecurity Policy

The direction of Japan’s cybersecurity policy is shaped by the escalating threat of state-sponsored cyberattacks in peacetime. This surge, notably from Russia, China, and North Korea, involves diverse tactics such as information manipulation, functional disruption, and financially motivated attacks, posing economic and national security risks. In response, nations are increasingly adopting Active Cyber Defense (ACD) strategies. ACD combines real-time attack detection with proactive countermeasures, aiming to impose costs on malicious cyber actors and mitigate potential damage. The United States and the United Kingdom lead in ACD implementation, using technical and policy responses, including hackbacks, to deter and attribute cyber threats. Japan is aligning its security policy with ACD principles, recognizing the need for proactive cyber measures beyond passive cyber defenses. This shift involves enhancing cyber capabilities, increasing cyber-related units, and fostering collaboration with the private sector. However, legal and regulatory challenges hinder ACD implementation in Japan, with existing laws restricting activities such as attack monitoring and attribution. Bridging these gaps is crucial for developing a comprehensive cybersecurity framework and ensuring the nation’s resilience against evolving cyber threats.

Review OSINT tool for social engineering.

In recent years, we observed an increase in cyber threats, especially social engineering attacks. By social engineering, we mean a set of techniques and tools to collect information about a person or target to extort sensitive information. Such information might be used for (industrial) espionage, to blackmail the user, or represent the starting point to perform malicious cyber attacks against the individual or, more often, against the organization they work for. The human factor is often the most vulnerable element in the security of any system, and the mass of information we disseminate online largely facilitates social engineering activities. To prevent and mitigate social engineering attacks, Open Source INTelligence (OSINT) techniques and tools can be used to evaluate the level of exposition of an individual or an organization. OSINT is the collection of information through open sources, that is, sources not protected by copyright or privacy. The article reviews the main OSINT tools for countering and preventing social engineering attacks. Specifically, it proposes the different tools diving them accordingly to the specific information they allow to track (e-mail, social profiles, phone numbers, etc.).

A Comparative Study of EU and US Regulatory Approaches to Cybersecurity in Space

This article addresses a need for enhanced transatlantic cooperation and coordination between the European Union (EU) and the United States (US) to prevent, detect, and respond to malicious cyber activities and the need for legislation to ensure that critical infrastructure is secure and resilient. It examines the cybersecurity of space critical infrastructure based on three pillars: cyber resilience, stable cyberspace, and cyber capacity building, and argues that to build up these pillars, the EU and US must have a shared assessment of space security challenges, a sound evaluation of the current strengths and gaps in both regulatory models, and an understanding of the driving factors to legislative change in the two systems. Although both frameworks converge on the importance of risk assessment as being at the heart of effective cybersecurity, this article underscores that neither model is equipped to cover the entire production value chain of space assets. In light of these findings, this article provides several recommendations for how the frameworks can become more resilient, including, inter alia, using public-private partnerships to develop tailored regulations compatible with existing cyber regimes and ensuring that such regulations are specifically designed to improve the cybersecurity of space infrastructure. Cybersecurity, cyberspace, resilience, legislation, critical infrastructure, space assets, public-private partnerships

Event-based distributed resilient control strategy for microgrids subject to disturbances and hybrid attacks

As a typical class of Cyber-Physical Systems (CPSs), microgrids (MGs) are susceptible to malicious cyber attacks and disturbances that can compromise their security and reliability. To address this issue, an event-triggered distributed resilient control method is proposed in this paper to mitigate the impacts of disturbances, FDI and DoS attacks on MGs. The proposed approach employs a piecewise control strategy and utilizes adaptive method to achieve the secondary control objective of MGs. In order to conserve computing and communication resources, an event-triggered mechanism is adopted and its parameter selection is associated with attacks. This design ensures system stability while also eliminating Zeno behavior. By applying Lyapunov stability theory, it can be proven that the algorithm proposed in this paper is capable of achieving the desired control objective. Finally, the effectiveness and superiority of the developed method are demonstrated through simulation examples.

Shining a light on AIS Blackouts with maritime OSINT

Maritime open source intelligence (maritime OSINT) can be used to capture information, critical to business operations, including when electronic systems like Automatic Identification Systems (AIS) fail. AIS is used to identify vessels in maritime navigation, to plan shipping operations, and ensure safety. This data is collected and sold by global aggregators to maritime operators and industry stakeholders. However, AIS communications are vulnerable to malicious cyber activity, changing legal landscapes, adverse physical conditions, or intentional intervention. It is the latter we will focus on in this report. Often, we won't understand the motivation behind a decision to either switch off or manipulate AIS data. However, this decision can have real world impacts, including on relationships between nation states, and the physical safety of maritime personnel. We believe maritime OSINT may represent an effective method to assist in the management of AIS failures. Maritime OSINT not only captures important maritime information when AIS fails, but it provides valuable context, giving us the who, what, and why for vessel operations. In our cast study, we will use maritime OSINT to track sanctioned Russian oil exports, demonstrating how OSINT can be used in this example to inform sanctions compliance programs.

Operational and economy-wide impacts of compound cyber-attacks and extreme weather events on electric power networks

The growing frequencies of extreme weather events and cyber-attacks give rise to a novel threat where a malicious cyber actor aims to disrupt stressed components of critical infrastructure systems immediately before, during, or shortly after an extreme weather event. In this paper, we initiate the study of Compound Cyber–Physical Threats and develop a two-stage framework for the analysis of operational disruptions in electric power networks and economy-wide impacts under three scenarios: a Heatwave, a Cyber-attack, and a Compound scenario when the Cyber-attack is timed with the Heatwave. In the first stage, we use a bilevel optimization problem to represent the adversarial rationale of a cyber-attacker in the upper level. In the lower level, we model disruptions in the electric power network using an optimal power flow model. In the second stage, we couple the disruption of electricity supply with a Computable General Equilibrium model to elucidate the impacts on all economic sectors. For the New York Independent System Operator, we find that a 9% demand increase in a Heatwave may not lead to unserved load. The cyber-attack can lead to 4% of unserved electric load in Long Island, while the Compound scenario can increase unserved electric load in Long Island to 12% and affect almost 198,000 customers. Our results show that the activity of state and local government enterprises can decrease by 37% in the Compound scenario. We conclude that the vulnerability of federal, state, and local government enterprises to electricity disruptions can affect a broad range of populations.

RDAF-IIoT: Reliable Device-Access Framework for the Industrial Internet of Things

The Internet of Things (IoT) has experienced significant growth and is now a fundamental part of the next-generation Internet. Alongside improving daily life, IoT devices generate and collect vast amounts of data that can be leveraged by AI-enabled big data analytics for diverse applications. However, due to the machine-to-machine communication inherent in IoT, ensuring data security and privacy is crucial to mitigate various malicious cyber attacks, including man-in-the-middle, impersonation, and data poisoning attacks. Nevertheless, designing an efficient and adaptable IoT security framework poses challenges due to the limited computational and communication power of IoT devices, as well as their wide-ranging variety. To address these challenges, this paper proposes an Access Key Agreement (AKA) scheme called the “Reliable Device-Access Framework for the Industrial IoT (RDAF-IIoT)”. RDAF-IIoT verifies the user’s authenticity before granting access to real-time information from IIoT devices deployed in an industrial plant. Once authenticated at the gateway node, the user and IIoT device establish a session key for future encrypted communication. The security of the proposed RDAF-IIoT is validated using a random oracle model, while the Scyther tool is employed to assess its resilience against various security attacks. Performance evaluations demonstrate that the proposed scheme requires lower computational and communication costs compared to related security frameworks while providing enhanced security features.

ExTRUST: Reducing Exploit Stockpiles With a Privacy-Preserving Depletion System for Inter-State Relationships

Cyberspace is a fragile construct threatened by malicious cyber operations of different actors, with vulnerabilities in IT hardware and software forming the basis for such activities, thus also posing a threat to global IT security. Advancements in the field of artificial intelligence accelerate this development, either with artificial intelligence enabled cyber weapons, automated cyber defense measures, or artificial intelligence-based threat and vulnerability detection. Especially state actors, with their long-term strategic security interests, often stockpile such knowledge of vulnerabilities and exploits to enable their military or intelligence service cyberspace operations. While treaties and regulations to limit these developments and to enhance global IT security by disclosing vulnerabilities are currently being discussed on the international level, these efforts are hindered by state concerns about the disclosure of unique knowledge and about giving up tactical advantages. This leads to a situation where multiple states are likely to stockpile at least some identical exploits, with technical measures to enable a depletion process for these stockpiles that preserve state secrecy interests and consider the special constraints of interacting states as well as the requirements within such environments being non-existent. This paper proposes such a privacy-preserving approach that allows multiple state parties to privately compare their stock of vulnerabilities and exploits to check for items that occur in multiple stockpiles without revealing them so that their disclosure can be considered. We call our system EXTRUST and show that it is scalable and can withstand several attack scenarios. Beyond the intergovernmental setting, EXTRUST can also be used for other zero-trust use cases, such as bug-bounty programs.

Defending Cyber–Physical Systems Through Reverse-Engineering-Based Memory Sanity Check

Cyber-physical systems (CPSs) are ubiquitous in critical infrastructures, where programmable logic controllers (PLCs) and physical components intertwine. However, multiple successful attacks targeting safety-related CPSs, in particular the PLCs, manifest their vulnerability towards malicious cyber attacks, which may cause significant damage consequently. Though several kinds of defending techniques exist in the literature, few of them can be practically and widely applied to real-world CPSs equipped with PLCs from leading vendors, primarily due to the lack of specific hardware or unrealistic defense assumptions. In this paper, we propose PLC-READER, a practical memory attacks detection and response framework to secure the CPS. The core of PLC-READER includes 1) a comprehensive semantic analysis solution specifically for PLC’s proprietary protocol based on software reverse engineering and network traffic difference analysis, and 2) a fine-grained memory structure analysis solution to identify the critical memory data. Based on the results of such reverse engineering, PLC-READER further performs sanity checks for the PLC’s critical memory by periodically checking the hash values and dynamic checksum values of these memory data. We extensively evaluated PLC-READER against 4 types of 366 different memory attacks, with some newly developed ones which got 6 CVE IDs from Schneider and Rockwell, by analyzing 3 kinds of proprietary protocols and 6 kinds of memory structures in 6 kinds of real-world PLCs from 3 leading manufacturers. The results demonstrate that the PLC-READER can detect all memory attacks with an accuracy of 100% and perform corresponding emergency responses in time.

Preventing the escalation of cyber conflicts: towards an approach to plausibly assure the non-involvement in a cyberattack

While cyberspace has evolved into a commonly shared space vital to our individual lives and societies, malicious cyber activities by state actors as part of espionage operations, regarding defense strategies, or as part of traditional conflicts have strongly increased. In contrast, attributing the origin of such activities remains problematic. The ambiguity of digital data raises the problem of misinterpreting available information, increasing the risk of misinformed reactions and conflict escalation. In order to reduce this risk, this paper proposes a transparency system based on technologies which usually already exist for IT security measures that an accused actor in a specific incident can use to provide credible information which plausibly assures his non-involvement. The paper analyses the technical requirements, presents the technical concept and discusses the necessary adjustments to existing IT networks for its implementation. Intended as a measure for conflict de-escalation, the paper further discusses the limitations of this approach, especially with regard to technical limits as well as the political motivation and behavior of states.

Attack parameter dependent resilient [formula omitted] path-following control design for autonomous vehicles under cyber attacks

Autonomous vehicles typically transmit information over wireless communication network, which is vulnerable to malicious cyber attacks and poses huge security threats for autonomous vehicles. To address these challenges, this paper is concerned with resilient H∞ path-following control problem for autonomous vehicles under false data injection (FDI) attacks and denial-of-service (DoS) attacks, simultaneously. Firstly, a novel observer is constructed to estimate both sensor FDI attack signal and system state. An attack parameter dependent time-varying piecewise Lyapunov function is constructed to ensure stability of the underlying system. Then, a resilient H∞ path-following control scheme is developed to suppress the impact of FDI attacks and external interference despite the presence of intermittent DoS attacks. The design criterion of resilient controller is derived to assure the exponential stability of the closed-loop system and maintain the desired H∞ performance. Finally, simulation studies are carried out to verify the efficiency and merits of the developed results.

A Policy Analysis of Cybersecurity and Mobile Applications: Implications on the Media Space

This study presents discussion for several examples that illustrates the importance of having a security policy for mobile phones. The study further examines the importance of developing a national security policy created for mobile devices in order to protect sensitive, and personal data to safeguard the media space. By inspection, it was observed from the literature that smartphones are becoming a vehicle to provide an efficient and convenient way to access, find and share information; however, the availability of this information has caused an increase in cyber attacks. Currently, cyber threats range from Trojans and viruses to botnets and toolkits. Presently, 96% of smartphones do not have pre-installed security software. This lack in security is an opportunity for malicious cyber attackers to hack into the various devices that are popular (i.e. Android, iPhone and Blackberry). Traditional security software found in personal computers (PCs), such as firewalls, antivirus, and encryption, is not currently available in smartphones. Moreover, smartphones are even more vulnerable than personal computers because more people are using smartphones to do personal tasks. Nowadays, smartphone users can email, use social networking applications (Facebook and Twitter), buy and download various applications and shop. Furthermore, users can now conduct monetary transactions, such as buying goods, redeeming coupons and tickets, banking and processing point-of-sale payments. Monetary transactions are especially attractive to cyber attackers because they can gain access to bank account information after hacking a user’s smartphone. Lastly, smartphones are small and are easy to carry anywhere. Unfortunately, the convenience of using smartphones to do personal task is the loophole cyber attackers need to gain access to personal data. Keywords: Smartphones, Social Media, Cybersecurity, Computers, E-commerce, Operating Systems, Internets, Browsers DOI: 10.7176/ISDE/13-1-04 Publication date: March 31 st 2023

Fuzzy Observer-Based Consensus Tracking Control for Fractional-Order Multi-Agent Systems Under Cyber-Attacks and Its Application to Electronic Circuits

Consensus control of multi-agent systems (MASs) has applications in various domains. As MASs work in networked environments, their security control becomes critically desirable in response to cyber-attacks. In this paper, the observer-based consensus tracking control problem is investigated for a class of Takagi-Sugeno fuzzy fractional-order multi-agent systems (FOMASs) under cyber-attacks. The malicious cyber attacks can impact the security of topologies of the communication networks of both controllers and observers. To estimate unmeasurable system states, a fuzzy observer is built. It is found that the topology of contact for observer states may be different from that of the feedback signals. A novel mathematical model for T-S fuzzy FOMASs with cyber-attacks is proposed. By using algebraic graph theory, Lyapunov functional, and fractional calculus theory, a distributed feed-back controller is developed for each agent, which guarantee the secure performance of tracking consensus error and observer error. Finally, two numerical examples demonstrate the effectiveness of the suggested control scheme, and the controller design for electronic network circuits shows the applicability of the proposed theoretical results. Simulations results for different differential-orders and coupling strength scenarios are given.

Legal dilemma for combatting malicious cyber activities against space activities

The skyrocketing number and diversity of space activities utilizing cyber technologies have both improved our lives while simultaneously creating new threats to international peace and security. Multiple occurrences of malicious cyber activities against space activities (MCASAs) have compelled policymaker attention at international and national levels. The widening range of MCASAs scenarios is challenging jurisdictional assumptions regarding traditionally separate branches of international law. Due to ambiguous terminology and lacunae of current regulatory regimes, MCASAs pose far-reaching legal and policy questions. This paper identifies the salient legal issues created by MCASAs, focusing on specific weaknesses of the current legal regime while also providing regulatory and policy options addressing the growing legal and regulatory dilemmas posed by MCASAs.

Observable placement of phasor measurement units for defense against data integrity attacks in real time power markets

Integrity data (DI) attacks are considered malicious cyber threats to the economic performance of power markets in current power systems. A cyber attacker could mislead the system operator by implementing a DI attack, through the deviation of measured information, and causes non-optimal power distribution and erroneous participation in the electricity market (EM). This paper proposes a placement scheme of phasor measurement units (PMUs) to defend against these attacks, so that network observability is guaranteed; the possibility of detecting DI attacks by the operator is increased; and the effect of electricity price fluctuations caused by these attacks is prevented. For this purpose, we introduce two possible indices to determine the degree of attack detectability and the magnitude of system congestion variation. Accordingly, the two-objective placement model of PMUs is upgraded, in which the minimum number of PMUs and their placement must be specified to improve the proposed indices so as to minimize the possibility of financial misconduct taking place in the real time market. Using IEEE standard systems, the effectiveness of this PMU placement-based defense scheme has been confirmed.

Unpacking due diligence in cyberspace

ABSTRACT There is controversy as to whether due diligence in cyberspace is required as the result of a general rule in international law – namely, that States must not allow their territory to be used for acts contrary to the rights of other States – or because of a voluntary norm of responsible State behaviour, i.e. something that is expected but not legally required. This paper analyses the legal status and content of due diligence in the cyber context, including with reference to position statements published by a growing number of States on these issues. The paper also considers what due diligence measures are expected of States as a matter of policy, in order for them to act responsibly to tackle – on their own territory – malicious cyber activity that may have harmful effects in the territory of other States. The article concludes with recommendations – including that the debate on legal status should not hinder discussion on the implementation of stronger standards on due diligence as a matter of policy. Those standards should be the focus of the discussions on due diligence in the UN’s Open-Ended Working Group on developments in the field of information and telecommunications (OEWG).