Potential Cyber Threats Research Articles

الأمن السیبرانی فی ضوء مقاصد الشریعة

الأمن والاستقرار عنصران ضروريان في الحياة لابد من توفيرهما حتى تتمکن الدولة من الارتقاء بنفسها وبمن هم فيها ، فالأمن السيبراني جزء من أمن الدولة؛ لأن الأمن والخوف نقيضان لا يجتمعان. وقد ذکر الله تعالى أهمية الأمن للناس في کثير من المواضع منها قوله تعالي: [وإذ جعلنا البيت مثابة للناس وأمنا] [سورة البقرة:125]، وبما أن الأمن السيبراني جزء من الأمن فتأتي أهميته نسبة لتطور التکنلوجيا في هذا العصر الذي صارت فيه من أکبر الأماکن لتجمع المعلومات المهمة لذلک يسعي کثير من المخترقين للحصول على هذه المعلومات وباتت حمايتها ضرورة لا يمکن الاستغناء عنها ، ومن هنا برزت فکرة الأمن السيبراني للحفاظ على هذه المعلومات. يهدف البحث إلى إلقاء ضوء على أهمية الأمن السيبراني والتعريف به، على ماذا يطلق هذا المصطلح، وبيان أنواعه، ومکوناته، وسلطات القائمين عليه وضمان استمرارية البيانات وتعزيز حمايتها وسريتها وخصوصيتها مع اتخاذ جميع التدابير اللازمة لحماية المواطنين والمستهلکين وأجهزة الدولة ، وتقليص مخاطر وآثار التهديدات السيبرانية المحتملة في مجالات استخدام الشبکات. يلخص البحث بيان مکانة الأمن السبيراني في الإسلام وبيان مکانته في مقاصد الشريعة الإسلامية وآثاره في المقاصد الضرورية في حفظ (الدين، والنفس والعقل والمال والنسل)، ولا يکون حفظ هذه الضروريات وحمايتها بغير الأمن الذي تزدهر به الحياة وتتطور، ولو زال الأمن في أي مجتمع تضطرب الحياة وتسود الفوضى والفساد ولأصبح حفظ هذه الضروريات مستحيلا. اتضح أن من مقاصد الشريعة من العقوبات حفظ الضرورات الخمس من جانب الوجود والعدم، وکلها شرعت لحماية الناس والمجتمع من أي فساد في الأرض بأي وسيلة، ولا شک أن العقوبات التعزيرية شرعت أيضا لحماية تلک المصالح من الاعتداء عليها حتى يعيش الناس في أوطانهم ومجتمعاتهم آمنين ، ووضع الضوابط الأساسية للأمن السيبراني. Security and stability are two necessary elements in life that must be provided so that the state can improve itself and those in it, as cyber security is part of the state's security; Because security and fear are two opposites. God Almighty mentioned the importance of security for people in many places, including the Almighty saying: [And as we made the house a sturdy and safe for people] [Al-Baqarah: 125], and since cyber security is part of security, its importance comes in relation to the development of technology in which it has become the greatest in this era. Places to collect important information. Therefore, many hackers seek to obtain this information, and its protection has become an indispensable necessity, and from here the idea of ​​cybersecurity to preserve this information emerged. The research aims to shed light On the importance of cybersecurity and defining it, what is this term called, indicating its types, components, and the powers of those in charge of it, ensuring the continuity of data, enhancing its protection, confidentiality and privacy, taking all necessary measures to protect citizens, consumers and state agencies, and reducing the risks and impacts of potential cyber threats in the areas of network use. The research summarizes the statement of the status of cyber security in Islam and its position in the purposes of Islamic law and its effects on the necessary purposes in preserving (religion, soul, reason, money and offspring). Preserving and protecting these necessities is nothing but the security with which life flourishes and develops, even if security in any society is disturbed. Life reigns chaos and corruption and I become a save These necessities are impossible. It became clear that one of the purposes of the Sharia from the punishments was to preserve the five necessities from the aspect of existence and nothingness, all of which were legislated to protect people and society from any corruption on the land by any means. Basic Cybersecurity Controls.

Cybersecurity of the Unmanned Aircraft System (UAS)

In recent years, UASs have become more and more popular. There are many reasons for this; one of the most popular is the enhancement of drones’ functionalities and improvement in battery life, stabilization, navigation, sensor technology, and much more. Many benefits drive growth. However, as the number of drones is expanding and their technological functionalities are evolving, drones’ use brings many concerns and challenges that should not be underestimated. This refers to issues in the area of cybersecurity, privacy, and public safety. UASs, under the international, regional, and national regime of aviation law, are considered aircraft. Since there is no existing cybersecurity framework specific to the UASs, the civil aviation cybersecurity framework should apply to their operations. This paper will focus on the potential cyber threats against UASs, providing examples of cyber-attacks from the past. Further, the aviation cybersecurity framework’s overview will follow to determine the current status of maturity at the international, regional (the European Union), and national (the Republic of Poland) levels. The paper’s conclusion will address the proposed recommendations for the UAS and aviation industries to be considered and potential solutions in terms of applying the aviation cybersecurity framework into the operation of UASs.

Internet of Things Meet Internet of Threats: New Concern Cyber Security Issues of Critical Cyber Infrastructure

As a new area of technology, the Internet of Things (IoT) is a flagship and promising paradigm for innovating society. However, IoT-based critical infrastructures are an appealing target for cybercriminals. Such distinctive infrastructures are increasingly sensitive to cyber vulnerabilities and subject to many cyberattacks. Thus, protecting these infrastructures is a significant issue for organizations and nations. In this context, raising the cybersecurity posture of critical cyber infrastructures is an extremely urgent international issue. In addition, with the rapid development of adversarial techniques, current cyber threats have become more sophisticated, complicated, advanced and persistent. Thus, given these factors, prior to implementing efficient and resilient cybersecurity countermeasures, identification and in-depth mapping of cyber threats is an important step that is generally overlooked. Therefore, to solve cybersecurity challenges, this study presents a critical analysis of the most recent cybersecurity issues for IoT-based critical infrastructures. We then discuss potential cyber threats and cyber vulnerabilities and the main exploitation strategies adopted by cybercriminals. Further, we provide a taxonomy of cyberattacks that may affect critical cyber infrastructures. Finally, we present security requirements and some realistic recommendations to enhance cybersecurity solutions.

A Coalitional Cyber-Insurance Design Considering Power System Reliability and Cyber Vulnerability

Due to the development of cyber-physical systems for modernizing power grids, vulnerability assessment has become an emerging focus in power system security studies. With the increasing deployment of cyber-enabled technologies in power systems, modern power system is prevalently exposed to a wide gamut of cybersecurity threats. Thus, there is an urgent need to develop effective cyber risk management mechanisms to mitigate the growing cyberthreats. Recently cyber insurance is emerging as a promising financial instrument for cyber risk management of critical infrastructures such as power grids. In this paper, a new cyber-insurance design framework is proposed to hedge against the risk of massive monetary losses due to potential cyberthreats. Traditionally, insurance companies serve as third-party risk-bearers offering aggregate design of the insurance policy which may stipulate high premiums. However, unusual loss patterns may still lead to excess financial risk for insurance companies. In this paper, coalitional insurance is introduced as a promising alternative or supplement to the traditional insurance plans provided by insurance companies. Under the proposed cyber-insurance model, several transmission operators form an insurance coalition, where the coalitional premiums are derived considering system vulnerabilities and loss distributions. The indemnity which covers the loss of TOs complies with the budget sufficiency. Overall, this study proposes a novel coalitional platform based cyber-insurance design that estimates the insurance premiums via cybersecurity modeling and reliability implication analysis.

Guidance for ports: security and safety against physical, cyber and hybrid threats

The European Commission (EC) has funded the Scalable multidimensionAl sitUation awaReness sOlution for protectiNg european ports (SAURON) project to reduce the vulnerabilities of EU ports, as one of the main European critical infrastructures, and increase their systemic resilience in the face of a physical, cyber or combined cyber-physical threat. The goal of SAURON has been to provide a multidimensional yet installation-specific Situational Awareness platform to help port operators anticipate and withstand potential cyber, physical or combined threats to their businesses and to people. During the SAURON project port authorities and stakeholders stated that it would be very helpful to have generic guidance to help ports respond to the combined cyber-physical security threat. The goal of this paper is to help ports understand the hybrid cyber-physical security threat, and how to reduce port vulnerabilities, based on lessons from the SAURON project. The paper is structured in line with the International Ship and Port Facility Security (ISPS) Code Port Facility security assessment process, and relates port security planning based on the ISPS guidelines to insights and lessons from SAURON. This paper demonstrates the importance of understanding the interdependencies between the cyber and physical domains and improving security situational awareness when incidents (including deliberate attacks) cause cascading effects across these domains. Furthermore, the paper draws conclusions and makes recommendations to ports and policy makers to reduce the vulnerability of ports to hybrid cyber-physical attacks.

Modern legal content of optimization of directions of administrative and legal regulation of the state cybersecurity policy

The article proposes to consider the author's results of determining the conceptual provisions for optimizing the areas of administrative and legal regulation of state cybersecurity policy. The content of the current state of state policy in the field of cybersecurity is considered. Theoretical and practical aspects of optimization of legal relations in the field of state cybersecurity policy are analyzed. The interpretation of the state cybersecurity policy of Ukraine is determined – the activity of state and legal institutions to manage real and potential cyber threats and dangers to meet the cyber needs of man and citizen, as well as the realization of national interests in this area. The own vision of directions of the state cybersecurity policy according to the maintenance of a number of regulatory legal acts is offered, namely: directions of the state cybersecurity policy according to the Law of Ukraine «About the basic principles of maintenance of cybersecurity of Ukraine»; directions of the state cybersecurity policy in accordance with the Law of Ukraine «On Fundamentals of National Security of Ukraine»; directions of the state cybersecurity policy in accordance with the Doctrine of Information Security of Ukraine. It is concluded that the priority areas for optimizing state policy to strengthen the administrative and legal regulation of cybersecurity of the state are the following reforming cyber law as a segment of information legislation of Ukraine, especially in terms of not only clearly defining current threats and threats to cyber security, but also mechanisms public policy, including symmetric cyber measures; research on the protection of critical infrastructure from cyberattacks; promoting the development of domestic innovative products that can be used to strengthen the cybersecurity of the state; completion of the implementation of the provisions of the Council of Europe Convention on Cybercrime into national law; optimization of the training system in the field of cybersecurity for the needs of the Armed Forces of Ukraine and other bodies of the security and defense sector of Ukraine; promoting a more active policy of state security institutions to inform the public about cyber threats; promoting the militarization of cyberspace; support for both existing multilateral training sessions on countering cyberattacks on the state information infrastructure, and initiating new types of such training sessions. Key words:cybersecurity, cyberspace, state policy, cybersecurity policy, cybercrime.

Cybersecurity Resiliency of Marine Renewable Energy Systems Part 2: Cybersecurity Best Practices and Risk Management

Abstract Marine renewable energy (MRE) is an emerging source of power for marine applications, marine devices, and coastal communities. This energy source relies on industrial control systems and IT to support operations and maintenance activities, which create a pathway for an adversary to gain unauthorized access to systems and data and disrupt operations. Incorporating cybersecurity risk prevention measures and mitigation capabilities from inception, development, operation, to decommissioning of the MRE system and components is paramount to the protection of energy generation and the security of network architecture and infrastructure. To improve the resilience of MRE systems as a predictable, affordable, and reliable source of energy, cybersecurity guidance was developed to enable operators to assess cybersecurity risks and implement security measures commensurate with the risk. This publication is the second of a two-part series, with Part 1 addressing a framework to determine cybersecurity risk by assessing the vulnerability of an MRE system to potential cyber threats and the consequences a cyberattack would have on the end user. This Part 2 publication describes an approach to select appropriate cybersecurity best practices commensurate with the MRE system's cybersecurity risk. The guidance includes 86 cybersecurity best practices, which are associated with 36 cybersecurity domains and grouped into nine categories. The best practices follow the core functions of the National Institute of Science and Technology Cybersecurity Framework (e.g., identify, detect, protect, respond, and and recover) and insights from both maritime and energy industry guidance documents to identify security measures effective in protecting information and operational technology assets prevalent in MRE systems.

Information support and cyber security patrol police: the relationship between concepts

The article is devoted to the coverage of scientific approaches and normative-legal definition of the content of the concepts of information support and cybersecurity of the patrol police. The shortcomings of the definition of the terminological apparatus in the field of information support and cybersecurity of the National Police in general and the patrol police in particular were revealed. The concept of cybersecurity of patrol police as a state of protection of official interests of patrol police in cyberspace, which is achieved by complying with legal, organizational, technical requirements for the use of information resources, networks, software, media, photo and video in the work of patrol police for effective information support for the functioning of the patrol police, timely detection, prevention and neutralization of real and potential cyber threats. Information support of the patrol police is defined as a continuous process of creation, use, research, storage, protection, transmission, processing, destruction of information of a certain type, quality, volume, structure, form, provided by a set of normative-legal, organizational-administrative, scientific and technical measures. using information systems, tools, networks, resources and technologies used in the system of the Ministry of Internal Affairs of Ukraine, aimed at meeting the information needs and realization of the information interests of the patrol police. In order to accelerate the process of information and technical improvement of the patrol police and increase the risks of negative impact on the functioning of its information support system, it is proposed to develop a concept of information support of the patrol police, which will contain appropriate definitions and include a separate section on cyber security Among the organizational measures to increase the level of cybersecurity of the patrol police, it is proposed to strengthen cooperation with cyberpolice, develop appropriate guidelines, introduce training on legal support and effective use of databases, information systems, networks, software, video and photography in patrol police.

Security and Privacy for Mobile Edge Caching: Challenges and Solutions

Mobile edge caching is a promising technology for next-generation mobile networks to effectively offer service environments and cloud-storage capabilities at the edge of networks. By exploiting the storage and computing resources at the network edge, mobile edge caching can significantly reduce service latency, decrease network load, and improve the user experience. On the other hand, edge caching is subject to a number of threats regarding privacy violations and security breaches. In this article, we first introduce the architecture of mobile edge caching, and address the key problems regarding why, where, what, and how to cache. Then we examine the potential cyber threats, including cache poisoning attacks, cache pollution attacks, cache side-channel attacks, and cache deception attacks, which result in huge concerns about privacy, security, and trust in content placement, content delivery, and content usage for mobile users, respectively. After that, we propose a service-oriented and location-based efficient key distribution protocol (SOLEK) as an example in response to efficient and secure content delivery in mobile edge caching. Finally, we discuss the potential techniques for privacy-preserving content placement, efficient and secure content delivery, and trustful content usage, which are expected to draw more attention and efforts into secure edge caching.

Cybersecurity challenges in Poland in the face of energy transition

The transformation of the energy sector is one of today’s global megatrends. The main aim of this process includes shifting energy production to renewable sources, decarbonizing the economy, and improving energy efficiency, especially in the most energy-intensive sectors. These changes lead the energy sectors of different states to ensure security and maintain environmental protection in order to guarantee the civilization’s progressive development. One of the tools for the implementation and development of a new model of the energy sector is digitization, which is a direct consequence of the increasing complexity of the energy system. Digitization is an essential element in the management of smart grids and smart meters and for controlling the entire energy system, as well as guaranteeing fair distribution. The digitization process integrates the state energy system; however, it also increases its vulnerability to potential cyber-threats. The aim of this paper is to analyze the cybersecurity challenges facing the Polish power sector in light of the energy transition policy promoted in the EU with a particular focus on the latest legislation presented in the Clean Energy Package. The Polish energy sector is on the verge of structural changes; therefore the main question is: How to implement them to avoid errors? The paper provides a glimpse into the most venerable areas, which should be taken into consideration by political decision-makers.

Cybersecurity Attacks in Vehicular Sensors

Today's modern vehicles contain anywhere from sixty to one-hundred sensors and exhibit the characteristics of Cyber-Physical-Systems (CPS). There is a high degree of coupling, cohesiveness, and interactions among vehicle's CPS components (e.g., sensors, devices, systems, systems-of-systems) across sensing, communication, and control layers. Cyber-attacks in the sensing or communication layers can compromise the security of the control layer. This paper provides a detailed review of potential cyber threats related to the sensing layer. Notably, the focus is mainly towards two categories of sensors: vehicle dynamics sensors (e.g., Tire Pressure Monitoring Systems (TPMS), magnetic encoders, and inertial sensors) and environment sensors (e.g., Light Detection and Ranging (LiDAR), ultrasonic, camera, Radio Detection and Ranging (Radar) systems, and Global Positioning System (GPS) units). The paper also offers perspectives through existing countermeasures from literature and stresses the need for data-driven cybersecurity solutions.

Cybersecurity Resiliency of Marine Renewable Energy Systems‐Part 1: Identifying Cybersecurity Vulnerabilities and Determining Risk

AbstractTechnology innovation, market demand, and the potential impacts of a changing climate are driving the marine renewable energy (MRE) industry to develop market-ready systems to provide low-carbon electricity for emerging, off-grid markets. The advanced operational and information technology devices used in MRE systems create a pathway for a cyber threat actor to gain unauthorized access to data or disrupt operation. To improve the resiliency of MRE systems as a predictable, affordable, and reliable source of energy from oceans and rivers, guidance was developed for an end users' organization that describes a framework for identifying and managing cybersecurity risk. The development of the cybersecurity guidance is based on standards described in the Risk Management Framework and Cybersecurity Framework developed by the National Institute of Standards and Technology (NIST). This paper is the first of a two-part series that describes an approach to determine the cybersecurity risk for MRE systems based on assessing potential cyber threats, identifying vulnerabilities (people, processes, and technology, including physical and operational environment), and evaluating the consequences a cyberattack would have on operation of the MRE system and impact on end users' mission and business objectives. MRE developers and stakeholders can use this approach to assess their current cybersecurity risk posture to incorporate appropriate cybersecurity controls to reduce the consequences and impacts from a cyberattack on MRE systems. This approach can be refined further as MRE systems are deployed and operational configurations are available.

AN IMPLICATION STUDY OF SOCIAL MEDIA LITERACY AT SCHOOL

Internet has become a familiar instrument for the school aged children in Indonesia. The use of social media platforms – has changed the way of communication. In recent years, many students are drawn to social networking sites. This trend has caused the increasing reports of cyberbullying and potential cyber threats. The study took a qualitative approach and used the perimeter of the focus group discussion among 9-12 years old children in an international school in Jakarta. The thematic analysis grounded from observations, interviews and document reviews. The objective of the study is to seek the implication for schools to stand for a policy to promote constructive and safe school environment through social media literacy. It will deal with the aspects to empower students to understand that filtering and evaluating information are fundamental in daily internet browsing as well as understanding about cyberbullying and its consequences. The study concluded an implication towards the needs for schools to have a guideline for social media using among students. The guideline may serve as social media literacy to be implemented along with the digital literacy taught at schools, in expectance that students may become the responsible and ethical users of social media and technology.

Predicting Cyber-Infections Via Web-Browsing Patterns

With the growing risks involved in surfing the web, the ability to protect users from malicious web content has become essential for combatting cybersecurity threats. Extensive studies have shown the correlation between certain personal-traits and user behavior in the context of cybersecurity. Moreover, recent studies showed that it is possible to predict long-term probability of cyber-attack victimization by analyzing a user's browsing and file-downloading history. However, such prediction models often rely on storing and analyzing personal information such as detailed browsing history, the topics and types of sites the user visited, and even physical location history, hence, potentially compromising user privacy. We developed a simple Markovian model that provides real-time predictions of exposure to malicious web pages by identifying behavioral patterns, as manifested in web-browsing dynamics. Utilizing the Markov chain framework, we extracted a small number of features that serve as proxies to the user's current risk level. Our model was tested on a dataset of web-browsing logs collected over three months, including more than 6 million browsing sessions. Using a logistic regression classifier to predict next-step exposure and exposure further into the session, our model allows for proactive intervention to protect from potential cyber-threats while maintaining user privacy.

Topic sentiment analysis using words embeddings dependency in edge social system

AbstractThe topic sentiment analysis is really fundamental in detecting potential cyber threats and cyber attacks in edge social systems. We can detect potential cyber threats and cyber attacks by identifying the sentiment orientation and topics of public opinion information in the edge social system. Topic sentiment joint model is an extended model, which aims to deal with the problem of detecting sentiments and topics simultaneously from the online comment. Most existing topic sentiment joint models ignore the dependency among words so that they lose rich semantic information and the resulting distribution might be not very satisfactory. In this paper, we propose a novel topic sentiment joint model with word embeddings dependency based on recurrent neural network. The model introduces the dependency among word embedding and delivers topic information and sentiment information of words by a recurrent neural network. It fully extends the semantic information and redefines the topic sentiment‐word distribution. Moreover, we obtain more accurate topic detection and sentiment analysis. Experimental results on online review data set show that the proposed model significantly improves the sentiment classification accuracy and achieved better topic detection compared with previous methods.

UAE’s Strategy Towards Most Cyber Resilient Nation

With the fast-paced industrial and Techni revolution, smart nations are emerging with the idea of integrating the developing technologies, like IoT and CPS, to make communications and networks easier and closely interconnected. With increasing technology usage globally, the UAE envisions transitioning into a global smart nation by innovating and deploying world class disruptive technologies for the better connectivity digitally. However, the frequency of cyber threats has also increased drastically with this ever-evolving technology. For a nation like UAE that is transforming into a digital nation at a rapid speed, while still having stakeholders with poor cybersecurity practices, UAE stands as a strong target for attacks by malicious hackers. With cyber-attacks becoming the top most concern globally, especially in the Middle East, UAE has built certain strategies to combat the evolving issue of cybersecurity. In this paper, the authors suggest that just as the collaboration of the key stakeholders – government, academics, industry and society – depicted under the Quadruple Model is needed to develop an innovative and creative nation, so is their coordination required to protect that nation from the potential cyber threats. In light of this theory, the four key stakeholders of the UAE are analyzed for their cybersecurity practices, initiatives and coordination to prove UAE’s commitment towards becoming the most cyber resilient nation in the world.

BUAV: A blockchain based secure UAV-assisted data acquisition scheme in Internet of Things

Internet of things (IoT), mobile edge computing (MEC), and unmanned aerial vehicle (UAV) have attracted significant attention in both industry and academic research. By consolidating these technologies, IoT can be facilitated with improved connectivity, better data transmission, energy saving, and other advantages. However, the communication between these entities is subject to potential cyber threats. In addition, the integrity of the data must be maintained after storing into local storage. Blockchain is a data structure that supports features like pseudonymity, data integrity etc. This paper represents a blockchain based data acquisition process in which information is gathered from IoTs using UAV as a relay and is securely kept in blockchain at MEC server. In the proposed scheme, data are encrypted prior to transfer to MEC server with the assistance of a UAV. Upon receiving the data, MEC server validates the data and the identity of the sender. Successful validation is followed by stocking of the data into blockchain, subsequent to obtaining consent from the validators. Security analysis is conducted in order to show the feasibility of the proposed secure scheme. Finally, the performance of the proposed scheme is analyzed via simulation and implementation.

Distributed Secondary Control for Islanded Microgrids With Mobile Emergency Resources

Truck-mounted mobile emergency resources (MERs) play a significant role in microgrid formation and regulation for power system resilience enhancement. This paper proposes a distributed fixed-time secondary control (DFSC) scheme to regulate the frequency and active power sharing in islanded microgrids with MERs. The proposed DFSC scheme is designed based on a general directed communication graph which considers MER characteristics (e.g., mobility, flexibility, and potential cyber threats). Each DER receives data from its neighbors through directional communication links. The proposed pinning control strategy selects only a small number of DERs for pinning, which have access to the reference frequency information and would guide the operation of remaining local DERs and MERs. In addition, the guaranteed convergence time is determined by control parameters and communication graph without applying the initial operation states. The paper demonstrates that the desired control performances (i.e., frequency restoration and accurate active power sharing) are realized in a timely fashion considering frequent operations of MERs. Case studies are tested and discussed for load variations, different control parameters, communication link failures, and MER operations through time-domain simulations in PSCAD/EMTDC platform.

Network Security Situation Awareness Framework based on Threat Intelligence

Network security situation awareness is an important foundation for network security management, which presents the target system security status by analyzing existing or potential cyber threats in the target system. In network offense and defense, the network security state of the target system will be affected by both offensive and defensive strategies. According to this feature, this paper proposes a network security situation awareness method using stochastic game in cloud computing environment, uses the utility of both sides of the game to quantify the network security situation value. This method analyzes the nodes based on the network security state of the target virtual machine and uses the virtual machine introspection mechanism to obtain the impact of network attacks on the target virtual machine, then dynamically evaluates the network security situation of the cloud environment based on the game process of both attack and defense. In attack prediction, cyber threat intelligence is used as an important basis for potential threat analysis. Cyber threat intelligence that is applicable to the current security state is screened through the system hierarchy fuzzy optimization method, and the potential threat of the target system is analyzed using the cyber threat intelligence obtained through screening. If there is no applicable cyber threat intelligence, using the Nash equilibrium to make predictions for the attack behavior. The experimental results show that the network security situation awareness method proposed in this paper can accurately reflect the changes in the network security situation and make predictions on the attack behavior.

Embedding Encryption and Machine Learning Intrusion Prevention Systems on Programmable Logic Controllers

During its nascent stages, programmable logic controllers (PLCs) were made robust to sustain tough industrial environments, but little care was taken to raise defenses against potential cyberthreats. The recent interconnectivity of legacy PLCs and supervisory control and data acquisition (SCADA) systems with corporate networks and the Internet has significantly increased the threats to critical infrastructure. To counter these threats, researchers have put their efforts in finding defense mechanisms that can protect the SCADA network and the PLCs. Encryption and intrusion prevention systems (IPSs) have been used by many organizations to protect data and the network against cyber-attacks. However, since PLC vendors do not make available information about their hardware or software, it becomes challenging for researchers to embed security mechanisms into their devices. This letter describes an alternative design using an open source PLC that was modified to encrypt all data it sends over the network, independently of the protocol used. Additionally, a machine learning-based IPS was added to the PLC network stack providing a secure mechanism against network flood attacks like denial of service (DoS). Experimental results indicated that the encryption layer and the IPS increased the security of the link between the PLC and the supervisory software, preventing interception, injection, and DoS attacks.