Modern Cybersecurity Research Articles

Implementasi Sistem Manajemen Log untuk Penanggulangan Serangan Server dengan SIEM

In the current digital era, information security has become a primary focus for organizationsworldwide. Rapid technological advancements have brought significant benefits but alsointroduced increasingly sophisticated cyber threats and attacks. One approach to addressing thesechallenges is through Security Information and Event Management (SIEM). SIEM integratesSecurity Information Management (SIM) and Security Event Management (SEM) to collect,analyze, and report security data from various network sources, enabling more effective detection,response, and management of security incidents. This study focuses on handling server attacksusing Wazuh SIEM as an early warning system. The methodology involves setting up a networktopology to detect Distributed Denial of Service (DDoS) attacks using SIEM, collecting andanalyzing log data, correlating data to identify threats, and responding to detected threats. Theresults indicate that SIEM is crucial in modern cybersecurity, providing real-time threat detectionand response capabilities. The system successfully detected and blocked 42 attacks during thetrial. In conclusion, SIEM offers greater security visibility and control, enabling organizations todetect and respond to complex security threats efficiently and effectively. Modern SIEM systems,equipped with advanced analytics and machine learning, can identify anomaly patterns and newthreats, thus strengthening an organization's cybersecurity defenses.

Assessing generalizability of Deep Reinforcement Learning algorithms for Automated Vulnerability Assessment and Penetration Testing

Modern cybersecurity best practices and standards require continuous Vulnerability Assessment (VA) and Penetration Test (PT). These activities are human- and time-expensive. The research community is trying to propose autonomous or semi-autonomous solutions based on Deep Reinforcement Learning (DRL) agents, but current proposals require further investigations. We observe that related literature reports performance tests of the proposed agents against a limited subset of the hosts used to train the models, thus raising questions on their applicability in realistic scenarios. The main contribution of this paper is to fill this gap by investigating the generalization capabilities of existing DRL agents to extend their VAPT operations to hosts that were not used in the training phase. To this purpose, we define a novel VAPT environment through which we devise multiple evaluation scenarios. While evidencing the limited capabilities of shallow RL approaches, we consider three state-of-the-art deep RL agents, namely Deep Q-Network (DQN), Proximal Policy Optimization (PPO), and Advantage Actor–Critic (A2C), and use them as bases for VAPT operations. The results show that the algorithm using A2C DRL agent outperforms the others because it is more adaptable to unknown hosts and converges faster. Our methodology can guide future researchers and practitioners in designing a new generation of semi-autonomous VAPT tools that are suitable for real-world contexts.

NOVEL STUDY ON ETHICAL HACKING AND VULNERABILITY TESTING

Ethical hacking and vulnerability testing represent critical components of modern cybersecurity strategies, aimed at proactively identifying and mitigating potential security threats within organizational systems and networks. Ethical hacking, also known as penetration testing, involves authorized attempts to exploit vulnerabilities in systems, applications, or networks, mirroring the tactics of malicious actors. This proactive approach allows organizations to uncover weaknesses before they are exploited by cybercriminals, thereby strengthening overall security posture. Vulnerability testing complements ethical hacking by systematically assessing systems for known vulnerabilities and configuration errors, providing insights into areas requiring remediation. Together, these practices enable organizations to assess, prioritize, and address security risks effectively, safeguarding sensitive data, maintaining regulatory compliance, and preserving business continuity. This article explores the principles, methodologies, and benefits of ethical hacking and vulnerability testing, emphasizing their role in enhancing cybersecurity resilience in an increasingly interconnected digital landscape. Keywords: Cybersecurity, Ethical Hacking, Mitigation, Networks, Penetration Testing, Security Threats, Systems, Testing, Vulnerabilities.

A Framework for Automated Big Data Analytics in Cybersecurity Threat Detection

This research presents a novel framework designed to enhance cybersecurity through the integration of Big Data analytics, addressing the critical need for scalable and real-time threat detection in large-scale environments. Utilizing technologies such as Apache Kafka for efficient data ingestion, Apache Flink for stream processing, and advanced machine learning models like LSTM and Autoencoders, the framework offers robust anomaly detection capabilities. It also includes automated response mechanisms using SOAR and XDR systems, significantly improving response times and accuracy in threat mitigation. The proposed solution not only addresses current challenges in handling vast and complex data but also paves the way for future advancements, such as the integration of more sophisticated AI techniques and application across various domains, including IoT and cloud security. This research contributes to the field by providing a comprehensive, adaptive, and scalable framework that meets the demands of modern cybersecurity landscapes.

The Future of Cyber Threat Intelligence: Anticipating and Preparing for Evolving Threats

Modern cybersecurity protocols face unprecedented hurdles from the dynamic cyber threat ecology. In this context, the value of cyber threat intelligence as a prophylactic protective strategy increase (Abu, Selamat, Ariffin , & Yusof, 2018). This study provides a futuristic analysis of cyber threat intelligence, emphasizing the vital role that it will play in anticipating and becoming ready for evolving threats. This article also looks at threat actor methods, attack paths, and emerging technologies in an attempt to illustrate the dynamic nature of cyber threats and the need for adaptive intelligence solutions (Abu, Selamat, Ariffin , & Yusof, 2018). Ethical and legal considerations are also explored to highlight the necessity for a thorough and responsible approach to the gathering and implementation of cyber threat intelligence (Wagner, 2019). Through this thorough examination, readers will get a substantial comprehension of the technical developments and strategic requirements that will impact how cyber threat intelligence is developed (Abu, Selamat, Ariffin , & Yusof, 2018) (Wagner, 2019). This will provide enterprises with the agility and resilience to predict, mitigate, and respond to future cyber-attacks.

Organizational Environment, Protection Motives, Adoption of Machine Learning, and Cybersecurity Behavior

The research presented in this intensive study uncovers the complex interaction between organizational and individual drivers affecting cybersecurity behavior within organizations. Its major focus is analyzing the impact of organizational policies and culture, training, and awareness programs on the cybersecurity conduct of employees. This paper also examines self-protective behavior related to risk perception, perceived self-efficiency, and response efficacy, which explains how these variables may influence self-protective behaviors. According to the Protection Motivation Theory (PMT), the study unravels how individuals' different elements of threat appraisal, coping appraisal, and cost-benefit analysis contribute to their decisions to apply cybersecurity behaviors. It also underlines that machine learning is being used more and more in cybersecurity and demonstrates some important ML concepts in modern cybersecurity, such as picking up the right data to train with, coping with adversarial attacks, and, last but not least, making the models interpretable. Ultimately, having a comprehensive understanding of these cybersecurity behaviors may shed new light on mechanisms that can be used to develop cybersecurity strategies and technologies to help protect against the rapidly changing landscape of cyber threats. All research papers have an abstract. It can be created by simply compiling the main points (summary) of each section of the research paper.

Enhanced lightweight encryption algorithm based on chaotic systems

In order to improve security and efficiency, this study presents a novel lightweight encryption technique that makes use of chaotic systems. Our method creatively combines the new chaotic KLEIN_64 algorithm with the Keccak-256 hash function, offering a solid basis for producing initial values essential for causing chaotic maps during the encryption process. After a deep validation with rigorous NIST testing, our chaotic pseudo random generator, LAC, exhibits excellent reliability and cryptographic robustness. Furthermore, the complexity of the cryptographic round function is improved by incorporating a second chaotic pseudo random generator that combines chaotic LFSR and Skew Tent Maps, thereby fortifying security measures.Designed with resource-limited applications in mind, our approach ensures that the cryptosystem remains both lightweight and efficient, meeting the stringent constraints typical of such environments. The practical feasibility and performance of our approach are extensively evaluated through FPGA implementation on the Zybo 7Z010 platform. Our implementation achieves a remarkable throughput of 2.820 Gbps while maintaining optimal resource utilization and efficiency. Extensive experimental results confirm the superior security of our cryptosystem, with correlation tests, entropy measurement, and histogram analysis showcasing robustness against statistical attacks. Moreover, the cryptosystem shows little fluctuation in the Unified Average Changing Intensity (UACI) and Non-Linear Pixel Change Rate (NPCR), confirming its resistance to differential attacks. Overall, our technique advances lightweight cryptography by providing a robust and efficient solution to modern cybersecurity challenges. In particular, our approach is well-suited for applications with limited resources, ensuring that security is maintained without compromising on performance or efficiency, thus fulfilling the needs of modern, constrained environments.

Measuring and Mitigating the Risk of Advanced Cyberattackers

Sophisticated cyberattackers (commonly known as advanced persistent threats (APTs)) pose enormous risks to organizations such as financial institutions, industrial and commercial firms, government institutions, and power grids. This study presents a method and an index to measure the vulnerability of organizations to APT risk and shows why a one-size-fits-all solution to mitigate APT risk does not exist. Our vulnerability index is based on a model that describes the optimal behavior of a cyberattacker (APT) with research and development capabilities aspiring to attack a network that manages the organization and a network operator that deploys blocking and detection measures to protect its organization from the attack. We demonstrate how our vulnerability index, which accounts for the network’s structure and the APTs’ resources and strategy, can be used in realistic risk assessments and optimal resource allocation procedures and serve as a benchmark for organizations’ preparedness against APTs’ cyberattacks. We also propose that regulatory agencies of financial (and other) institutions provide the parameters that define an APT’s profile and request, as part of their periodic assessments of the organizations that they regulate, that our (or similar) vulnerability index will be reported to them by the regulated institutions. Finally, the viability of our index in modeling modern cybersecurity defense procedures shows that not only there is no silver bullet defense against all types of APTs, it is also imperative to account for APTs’ heterogeneity because detection and blocking measures can be complements, substitutes, or even degrade each other. For example, when the attacker’s (defender’s) budget is extremely large (small), the defender should deploy only detection measures, strongly advocating Zero Trust practices. Supplemental Material: The online appendix is available at https://doi.org/10.1287/deca.2023.0072 .

The problem of combating cybercrime: a comparative legal analysis

In the modern world, the development of information technologies opens up new opportunities for communication, business and science. The use and improvement of information technology has led to the emergence of cybercrime. The use and improvement of the field of information technology has led to the emergence of cybercrime. Cybercrime covers a wide range of criminal offenses from identity theft and financial fraud to attacks on critical infrastructure. Cybercrime has become a threat not only to individuals, but also to the state, which involves the destruction of the economic and information spheres, endangering the entire sphere of public life. The problem of countering cybercrime at both the national and international levels is an important issue. Despite the efforts of governments and international organizations to create effective countermeasures against cybercrime, the number and complexity of such criminal offenses continues to grow. This requires constant improvement of legal, technological and organizational protection mechanisms. Unfortunately, the fight against cybercrime in Ukraine is at an initial stage and is not as developed as in other countries of the world. The topic of combating cybercrime is very relevant in the conditions of martial law. Nowadays, a war in the information space can cause no less damage than a war on the battlefield, so cybercrime actors must take all necessary measures to reduce the number of cybercrimes committed by the enemy. One of the priority directions for improving the domestic legal system is the introduction of international concepts, principles and ideas, the use of positive experience of foreign countries in the issue of countering cybercrime.This article examines the main challenges faced by modern cyber security systems, analyzes existing methods of countermeasures in Ukraine and foreign countries, and suggests ways to improve them.

Dimensionality reduction using neural networks for lattice-based cryptographic keys

Post Quantum Cryptography has received an increasing amount of active research. This has been made prominent by the ever-growing field of quantum computing which poses a formidable threat to the modern cybersecurity landscape. Recently, post quantum schemes have been standardized for adoption into existing security services and protocols. In comparison to contemporary cryptographic schemes, these approaches are lagging behind in terms of performance with regards to functional speed and package sizes. A study into the various applications of neural networks used in classical and post quantum cryptographic schemes has been explored to demonstrate their different possible applications within the various fields of cybersecurity. The main contribution of this work is to investigate the feasibility of dimensionality reduction using the autoencoder neural network on lattice-based keys generated by the Kyber key encapsulation mechanism scheme. Moreover, this work also presents a comparative analysis of the different implemented autoencoder models to showcase their relative performance.

Quantum Cryptography in Modern Cybersecurity

This article tends to deal with the fast-evolving world of quantum cryptography, specifically the concept of quantum key distribution (QKD), which has significant importance in modern-day cybersecurity scenarios. The most notable feature of quantum cryptography is its ability to ensure safe communication through principles borrowed from quantum mechanics such as entanglement and superposition. The research comprehensively analyses discrete-variable protocols (DVQKD) and continuous-variable ones (CVQKD), closely investigating their potential roles as re-inventors of secure communications owing to increasing cyber threats. In principle, quantum cryptography is invulnerable to all forms of attacks; however, there are numerous challenges to its implementation including high deployment costs, technology limitations and complex integration with existing systems for protecting data. This paper presents an elaborate state of today's quantum cryptography capturing its advancements, active research efforts as well as barriers towards increased use in build systems based on resistance against attacks utilizing properties specific to quantum mechanics. Key Words: Quantum Key Distribution (QKD), Post – Quantum Cryptography (PQC), Discrete-Variable (DVQKD) and Continuous-Variable (CVQKD), Quantum Superposition, Crypto-Attacks.

TWO-LEVEL CONCEPT FOR SIMULATING UNIFORM INTERFERENCE-RESISTANT DIGITAL DATA TRANSMISSION

The article formalizes, creates and provides for consideration the concept of a single secure interference-resistant data transmission channel. In modern cybersecurity theory and practice, there is the NIST Cybersecurity Framework, which is a set of recommendations for reducing risks for organizations. In order for high-level data to be secure, there are requirements for the SIA triad, namely confidentiality, integrity and availability of information. Therefore, in the future, the expediency of the work and its result will directly depend on the satisfaction of the SIA conditions. As you know, high-level data: such as e-mail, visual data in the GUI of various applications, etc., are transmitted over low-level communication channels: such as cables, wireless radio communication channels, and others. At each of the levels for safe transmission of information, there are specific pests. At high levels, the main threat to information is man and the human factor. The lower the level of information transmission becomes, the more nature, natural obstacles and random short phenomena begin to influence. In order for the user to be able to use various devices without a threat to the confidentiality, integrity and availability of information, it is necessary to actively and continuously develop, improve and improve the existing methods of data protection, restoration, transmission and storage. Each aspect in this struggle for security is both an advantage and a disadvantage: excessive security is not appropriate for mass traffic, complexity does not always provide adequate security, and so on. Therefore, the optimality and expediency of the methods used becomes an important factor. For these reasons, the paper proposes a relatively simple, but no less effective approach to maintaining SIA requirements.

Securing Networks in the Digital Age: A Review of Intrusion Detection and Prevention Strategies

In today's interconnected world, billions of individuals rely on the internet for various activities, from communication and commerce to entertainment and education. However, this widespread connectivity also brings about an increased risk of cyber threats and malicious activities. In response to these challenges, intrusion detection technology has emerged as a vital component of modern cybersecurity strategies. This paper presents a comprehensive literature survey focusing on Internal Intrusion Detection Systems (IIDS) and traditional Intrusion Detection Systems (IDS). These systems utilize a diverse array of data mining and forensic techniques algorithms to monitor and analyze system activities in real-time, thereby detecting and preventing potential security breaches. Additionally, the paper explores the integration of data mining methods for cyber analytics, offering valuable insights into the development and enhancement of intrusion detection capabilities. Through a thorough examination of existing research and methodologies, this study aims to provide a deeper understanding of the evolving landscape of intrusion detection and contribute to the advancement of cybersecurity practices in an increasingly digitized world.

Evaluating SIEM RADAR: A New Metric for Enhancing Regulatory and Compliance Efficiency

This research paper explores the modern cybersecurity landscape, particularly focusing on the risks associated with SIEM products and SOC services. It underscores the critical issue of insufficient logging practices that compromise an organization's threat detection and response capabilities, thereby increasing the risk of security breaches. The importance of real-time log retention to address evolving digital threats is highlighted, with recommended retention periods from authoritative sources such as the White House, OWASP, MITRE, and SANS. The paper also addresses scalability challenges due to the exponential growth of log data, the necessity for effective correlation within SIEM systems for timely threat detection, and the importance of compliance with various standards and regulations to enhance security. This comprehensive analysis provides valuable insights for cybersecurity professionals, organizations, and policymakers.

Understanding and prioritising cyberattack paths amid growing organisational complexity

This paper explores the role of attack path modelling (APM) in modern cyber security, addressing the challenges posed by the rapidly evolving digital landscape. It provides a comprehensive overview of APM frameworks and their application in identifying and prioritising potential attack paths. The challenges associated with manual APM efforts, the need for standardisation and the potential for innovation in automated APM tools are examined throughout. Drawing from real-world examples, the paper demonstrates the practical implications of APM in dissecting attack components and mitigating risks. It emphasises the dual approach of human-led APM initiatives and the integration of APM functionality in technical solutions, advocating for improved hygiene with manual and periodic APM assessments that can be optimised with advanced SecOps APM tooling. The paper serves as a general resource for all cyber security practitioners, providing insights into the historical context, frameworks and practical challenges of APM. The paper describes the significance of human-led APM initiatives, using open frameworks to enhance cyber security posture. Furthermore, the paper explores the evolving landscape of APM tools, anticipating their integration with big data platforms and artificial intelligence (AI) for comprehensive security analyses. This paper presents insights into the current state of cyber security, the practical applications of APM frameworks, and the potential future developments in APM technology.

Fuzzy models for cyber incident detection in military information and communication systems databases

Protecting databases of military information and communication systems is an extremely important task in the modern cybersecurity sphere. Growing threats from cyberattacks, the need to effectively detect, counteract and prevent them require the use of new, more effective models and methods. The main disadvantages of existing models and methods include insufficient sensitivity to new threats, a large number of detection errors, low response to new threats, the possibility of bypassing protective measures, and low scalability, which are key challenges for further improvement and development of cybersecurity. The article analyzes the existing fuzzy models for detecting cyber incidents, identifies their shortcomings and emphasizes the need for their further improvement and development. An improved fuzzy model for detecting cyber incidents in databases of military information and communication systems and an improved fuzzy model for detecting cyber incidents in databases of military information and communication systems with weighted rules based on the expansion of cyber incident signs by obtaining them from different levels of cyber security of the data are proposed. The main levels of database cybersecurity include: the operating system level, the network level, and the database management system level. To eliminate the shortcomings associated with the false triggering of cyber incident detection rules and the complexity of their configuration in a dynamically changing cyberattack landscape, as well as the dimensionality of the knowledge base of the information and security event management system, a fuzzy model for detecting cyber incidents in databases of military information and communication systems with weights of rule antecedents is proposed. The expediency of applying the developed model is shown.

Enhanced Network Security Protection through Data Analysis and Machine Learning: An Application of GraphSAGE for Anomaly Detection and Operational Intelligence

With the Internet's rapid expansion, network security challenges have become increasingly complex and prominent. Traditional protection methods, largely dependent on predefined rules and patterns, demonstrate limited effectiveness against sophisticated and unknown network attacks, failing to harness the full potential of extensive network data. This study addresses the challenges faced by modern cybersecurity, particularly the limitations of traditional defense methods in countering unknown and complex attacks, by proposing a solution that integrates data analysis and machine learning technologies. The focus of this research is placed on network security anomaly detection as well as on intelligent network operations and maintenance exception management based on graph network algorithms, aiming to enhance security defense capabilities and operational efficiency. Specifically, the main contributions and innovations of this paper include: 1. Innovations in sampling, aggregation, and loss functions within the Graph Sample and Aggregation (GraphSAGE) model to improve the accuracy and robustness of the model for network anomaly detection; 2. The introduction of a novel network anomaly root cause analysis and localization model, which, combined with an optimized root cause likelihood assessment method and search scheme, significantly enhances the speed and accuracy of anomaly localization; 3. The design of an integrated decision support system that can automatically adjust protection strategies as network conditions change, achieving a high level of automation and intelligence in cybersecurity management. This work not only provides effective technical support for network security protection but also opens new avenues for future cybersecurity research.

Cyber Threat Intelligence: A Comprehensive Overview and Practical Implementation

Cyber Threat Intelligence (CTI) has emerged as a critical component in modern cybersecurity strategies. CTI encompasses the proactive gathering, analysis, and dissemination of information about potential cyber threats, including threat actors, tactics, techniques, and procedures (TTPs), vulnerabilities, and indicators of compromise (IOCs). By harnessing a combination of technology, human expertise, and collaborative partnerships, CTI enables organizations to enhance their ability to detect, prevent, and respond to cyber attacks effectively. This paper provides a comprehensive examination of CTI, including its definition, importance, lifecycle, sources, and practical implementation strategies. By exploring various CTI frameworks, methodologies, and tools, organizations can effectively leverage threat intelligence to enhance their security posture and proactively defend against cyber threats

Log Analyzer and Anomaly Reporting Framework for Proactive System Monitoring.

Abstract: In an era where organizations increasingly rely on intricate software applications, cloud services, and interconnected networks, the significance of analyses cannot be overstated. These tools serve as vigilant custodians of digital footprints, meticulously dissecting the voluminous records encapsulated in log files to extract valuable insights and detect anomalies. As such, log analyses emerge as linchpins in deciphering the meaning behind recorded events, enabling organizations to obtain a more comprehensive understanding of their digital infrastructures and enhance their security posture. This comprehensive exploration aims to untangle the core attributes of log analyses, bringing clarity to their parsing capabilities, the art of information extraction, and the nuanced algorithms that facilitate the conversion of raw logs into actionable insights. Furthermore, against the backdrop of a dynamically evolving cyber threat landscape, the role of log analyses extends beyond conventional diagnostics. These tools have become instrumental in the proactively orchestrated defense against cyber adversaries, empowering organizations to detect and mitigate threats in real-time. Through an in-depth analysis of log analyses and their evolving functionalities, this paper seeks to provide a comprehensive understanding of their Integral role in modern cybersecurity and system management. By elucidating the significance and impact of log analyses, organizations can leverage these tools to fortify their defenses, mitigate risks, and make informed, data-driven decisions in an increasingly complex digital environment

Ensuring cybersecurity of FPGA as a service with the use of penetration testing of components

The subject of study in this article is modern penetration testing technologies, in which the test object is the implementation of a service based on a platform using Field Programmable Gate Array (FPGA) resources. The goal of this study is to improve modern methods of penetration testing of services provided by FPGA as a Service (FaaS) to find vulnerabilities for further fixing and increasing the level of services security and trust. Task: to analyze the technological capabilities for the development of FPGA as a Service; to analyze possible threats for FPGA as a Service platform; to analyze the structure of the FPGA as a Service platform and the peculiarities of attacks on it; to analyze options for using the penetration testing standard; to propose the classification of possible use of FPGA as a Service platform for solving of cybersecurity tasks; and to propose the sequence of critical components of ensuring of the cybersecurity of FPGA as a Service platform. The following results were obtained based on the tasks. The analysis of the capabilities of existing chips, FPGA accelerator cards, programming technologies, and the integrated environments of a leading company for creation of FPGA as a Service is performed. A study on the cybersecurity problems of FPGA as a Service platforms is conducted, and a set of components to ensure the cybersecurity of FPGA as a Service Platform is proposed. Modern cybersecurity threats of FPGA as a Service platforms are analyzed. A threat structure for FPGA as a Service is proposed. The possibility of applying a penetration testing standard to FPGA services is considered. Regular audits and penetration testing are crucial elements of a cybersecurity strategy and help maintain customer and user trust in FPGA services. Based on the analysis of the possible use of FPGA as a Service to solve cybersecurity tasks, a classification of five variants considering FPGA as an object and tool is proposed. The sequence of critical components of ensuring of the cybersecurity of FPGA as a Service platform is proposed to correspond to modern known threats. Complex activities, including the software updates, security monitoring, auditing, and penetration testing, based on security standards. Conclusions. The primary contribution and scientific novelty of the obtained results is the research into the possibilities of penetration testing for services, where the test object is a platform with access to FPGA. As in many other areas, ensuring the cybersecurity of FPGA as a Service platform is complex, and ignoring any component can lead to critical consequences. Applying only penetration testing is not enough; therefore, a comprehensive list of cybersecurity measures for FPGA as a Service platforms is provided, underlining the urgency and necessity of their implementation.