Security Analysts Research Articles

Price Rigidities and the Value of Public Information

ABSTRACTFirms' inflexibility in adjusting output prices to economic shocks exacerbates information asymmetry with respect to firms' profits, but public information on firms' cost structure mitigates this problem. We construct a novel form of public information from economic statistics disclosed by the government and find that such public information significantly reduces inflexible‐price firms' bid–ask spreads, the probability of informed trading, and analyst forecast dispersions, but these results do not hold for flexible‐price firms. Security analysts seek more cost‐related information during conference calls about inflexible‐price firms, but such a phenomenon is observed less frequently if a firm's input cost is more publicly observable. In addition, stock markets react more strongly to earning news announced by inflexible‐price firms, consistent with our intuition.

Independent analyst research: Does it matter who pays?

On April 28, 2003, ten of the largest investment banks reached an agreement with the Securities and Exchange Commission and other regulatory bodies regarding alleged misconduct of security analysts. This agreement, called the Global Research Analyst Settlement, allocated $460 million to source independent analyst research. Unlike other forms of analyst research, this research was not financed through investment banking or trading commissions and was theoretically “unbiased research”. We compare independent research funded by the Global Settlement to research provided by the same firms that was not funded by the Global Settlement. Research funded by the Global Settlement appears to be of lower quality than non-funded research produced by the same set of firms, suggesting that unbiased research does not necessarily generate higher quality research. More specifically, we find that quality declined in the later years of the Global Settlement period when there was no expectation of future funding for this research, commonly referred to as the horizon effect.

Corporate restructuring at Tata Steel Ltd

Research methodology The case was developed from secondary sources and interviews with a security analyst. The secondary sources include company annual reports, news reports, analyst reports, industry reports, company websites, stock exchange websites and databases such as Bloomberg and CMIE Prowess. Case overview/synopsis Increasing competition in product and capital markets has put tremendous pressure on managers to become more cost competitive. To address their firms' uncompetitive cost structures, managers may have to consider dramatic restructuring of their businesses. During 2014–2017, Tata Steel Ltd (TSL) UK considered a series of divestitures and a merger plan to nurse the company back to health. The case considers the economics of the restructuring plan. The case is designed to help students analyze a corporate downsizing program undertaken by a large Indian company in the UK and to highlight the dynamic role of the CFO and governance issues in family firms. It introduces students to issues surrounding a typical restructuring and provides students a platform to practice the estimation of value creation in a restructuring exercise. While some cases on corporate restructuring in the context of developed economies are available, there are very few cases written in an emerging market context. This case bridges that gap. TSL presents a unique opportunity to study corporate restructuring necessitated by a failed cross-border acquisition. It illustrates the potential for value loss in large, cross-border acquisitions. It shows how managerial hubris can prompt family firm owners to overbid in acquisitions and create legacy hot spots. In addition, the case can be used to discuss the causes of governance failures such as weak institutional monitoring and poor legal enforcement in emerging markets that could potentially harm minority shareholders. Complexity academic level The case was developed from secondary sources and interviews with a security analyst. The secondary sources include company annual reports, news reports, analyst reports, industry reports, company websites, stock exchange websites and databases such as Bloomberg and CMIE Prowess.

Black mouth, investor attention, and stock return

We investigate “black mouth” in the Chinese stock market, which is a form of manipulation based on disinformation, and examine how investors react to such “credible signals.” Credible signals simply refer to those that easily gain investor trust and influence investor behavior. Black mouth temporarily leads to abnormal investor attention and triggers an abnormal stock return. We show that different types of manipulators send different credible signals with black mouth by security analysts having a larger impact on stock returns. Media attention impacts investor attention more, while media sentiment has a greater impact on stock return. We also find that publicity supervision enhances the role of credible signals and makes investors more distrustful of information disseminated by ordinary manipulators, indicating the need for regulators to strengthen the supervision of black mouth.

Metamorphic Malware and Obfuscation: A Survey of Techniques, Variants, and Generation Kits

The competing landscape between malware authors and security analysts is an ever-changing battlefield over who can innovate over the other. While security analysts are constantly updating their signatures of known malware, malware variants are changing their signature each time they infect a new host, leading to an endless game of cat and mouse. This survey looks at providing a thorough review of obfuscation and metamorphic techniques commonly used by malware authors. The main topics covered in this work are (1) to provide an overview of string-scanning techniques used by antivirus vendors and to explore the impact malware has had from a security and monetary perspective; (2) to provide an overview of the methods of obfuscation during disassembly, as well as methods of concealment using a combination of encryption and compression; (3) to provide a comprehensive list of the datasets we have available to us in malware research, including tools to obfuscate malware samples, and to finally (4) discuss the various ways Windows APIs are categorized and vectorized to identify malicious binaries, especially in the context of identifying obfuscated malware variants. This survey provides security practitioners a better understanding of the nature and makeup of the obfuscation employed by malware. It also provides a review of what are the main barriers to reverse-engineering malware for the purposes of uncovering their complexity and purpose.

Robust Anomaly-Based Insider Threat Detection Using Graph Neural Network

Misuse or malicious access to critical assets of information systems by insiders usually causes significant loss to organizations. The issue of insider threat detection for information systems has received many researchers’ attention in both security and data mining fields, and a lot of related research results were presented. However, there are still many challenges in capturing the behavior difference between malicious insiders and normal users accurately, such as lack of labeled insider threats, the subtle and adaptive nature of insider threats, complexity, heterogeneity, sparsity of the underlying data, etc. To detect insider threats with large and complex audit data, a Multi-Edge Weight Relational Graph Neural Network method (MEWRGNN) for robust anomaly detection is proposed in this paper. Unlike most existing approaches, the MEWRGNN adopts several graph neural networks to capture the contextual relationship of user behaviors over a period of time, which is a critical factor for achieving accurate anomaly identification. The MEWRGNN achieves a certain degree of interpretability through ranking the contribution of different edge-representation features. Evaluation experimental results demonstrate that the MEWRGNN can learn a model from limited sample data sets, and achieve quick and accurate insider threat detection performance. In addition, other feature ranking results allow providing security analysts with understandable insights for investigating the detected insider threats.

I-DarkVec: Incremental Embeddings for Darknet Traffic Analysis

Darknets are probes listening to traffic reaching IP addresses that host no services. Traffic reaching a darknet results from the actions of internet scanners, botnets, and possibly misconfigured hosts. Such peculiar nature of the darknet traffic makes darknets a valuable instrument to discover malicious online activities, e.g., identifying coordinated actions performed by bots or scanners. However, the massive amount of packets and sources that darknets observe makes it hard to extract meaningful insights, calling for scalable tools to automatically identify and group sources that share similar behaviour. We here present i-DarkVec, a methodology to learn meaningful representations of Darknet traffic. i-DarkVec leverages Natural Language Processing techniques (e.g., Word2Vec) to capture the co-occurrence patterns that emerge when scanners or bots launch coordinated actions. As in NLP problems, the embeddings learned with i-DarkVec enable several new machine learning tasks on the darknet traffic, such as identifying clusters of senders engaged in similar activities. We extensively test i-DarkVec and explore its design space in a case study using real darknets. We show that with a proper definition of services , the learned embeddings can be used to (i) solve the classification problem to associate unknown sources’ IP addresses to the correct classes of coordinated actors and (ii) automatically identify clusters of previously unknown sources performing similar attacks and scans, easing the security analyst’s job. i-DarkVec leverages a novel incremental embedding learning approach that is scalable and robust to traffic changes, making it applicable to dynamic and large-scale scenarios.

New demand on assembly language proficiency in performing binary reverse engineering tasks

Cybersecurity encompasses a wide field of disciplines and as cyber threat landscape changes, there is a need for tools, techniques and skills to provide safe and secure internet environment. The cyber space industry introduced new roles for reverse engineers, malware analysts, digital forensic experts, exploit engineers, etc which demand the new skill set, and in this context, the proficiency in assembly language programming is highly essential. This paper presents an observation on the training programme for software developers from a software integration company to attain the skills of reverse engineers, application penetration testers as well as application security analysts. In preparing for the new generation of reverse engineers and other new roles that are related to cybersecurity, it would be a good step if assembly language could be taught as a separate programming subject, and it would be highly recommended for higher education institutions to collaborate with the industry to undertake co-teaching in supporting the new roles within the realm of cybersecurity. It has been well observed that being endowed with a working knowledge of developing application from scratch using assembly language would offer a foundation to be a good binary reverse engineer.

A framework for designing vulnerability metrics

Vulnerability analysis has long been used to evaluate the security posture of a system. Different approaches, including vulnerability graphs and various vulnerability metrics, have been used to study the vulnerability landscape and provide security analysts with cyber situational awareness. However, most current solutions still lack a principled approach to quantifying various dimensions of known vulnerabilities in a way that can easily adapt to different applicative domains and operating conditions. To address this limitation, we introduce a vulnerability metrics framework that extends and generalizes our previous metrics for evaluating the exploitation likelihood of a vulnerability and the exposure factor of system components to vulnerability exploits. We argue that the factors influencing these metrics and their relative weights depend on the specific applicative domain, defender’s priorities, and attacker’s knowledge. Thus, instead of providing a static set of equations, we establish a framework for instantiating the equations that best model the scenario being considered. We combine likelihood and exposure factor metrics into a severity score that allows us to rank vulnerabilities. In our evaluation, we demonstrate that ranking vulnerabilities solely based on their CVSS scores is not sufficient for effective prioritization, due to the limited number of possible distinct severity values compared to the sheer number of existing vulnerabilities. We define a ranking quality score and show that considering additional information about vulnerabilities helps refine their ranking, providing more actionable intelligence to security analysts.

SCENARIO OF INFORMATION FLOW ANALYSIS IMPLEMENTATION IN PL/SQL PROGRAM UNITS WITH PLIF PLATFORM

Formal proof of security measure effectiveness and computation security is vitally important for trust in critical information systems. It should be realized that formal security verification must be carried out at each infrastructural level (from the hardware level to the application level) in the process of system design. Currently, computation security analysis on the application level remains the major challenge as it requires complex labeling of computing environment elements. Traditionally, to solve this problem, information flow control (IFC) methods are employed. Unlike access control mechanisms widely used in modern operating systems (OSs) and database management systems (DBMSs), IFC has limited application in software design and mostly comes down to trivial taint tracking. This paper describes an approach to full-fledged implementation of IFC in PL/SQL program units with the use of the PLIF platform. In addition, a general scheme of computation security analysis for enterprise applications that work with relational DBMSs is considered. The key advantage of our approach is the explicit separation of functions between software developers and security analysts.

A Hybrid Feature Selection Approach based on Random Forest and Particle Swarm Optimization for IoT Network Traffic Analysis

The complexity and volume of network traffic has increased significantly due to the emergence of the “Internet of Things” (IoT). The classification accuracy of the network traffic is dependent on the most pertinent features. In this paper, we present a hybrid feature selection method that takes into account the optimization of Particle Swarms (PSO) and Random Forests. The data collected by the security firm, CIC-IDS2017, contains a large number of attacks and traffic instances. To improve the classification accuracy, we use the framework's RF algorithm to identify the most important features. Then, the PSO algorithm is used to refine the selection process. According to our experiments, the proposed method performed better than the other methods when it comes to the classification accuracy. It achieves a ~99.9% accuracy when using a hybrid of Random Forest and PSO. The hybrid approach also helps improve the model's performance. The suggested method can be utilized by security analysts and network administrators to identify and prevent attacks on the IoT.

Influence Diagrams in Cyber Security: Conceptualization and Potential Applications

Over the last years, cyber-attacks are increasing in organizations especially due to the use of emerging technologies and transformation in terms of how we work. Informed decision-making in cyber security is critical to prevent, detect, respond, and recover from cyber-attacks effectively and efficiently. In cyber security, Decision Support System (DSS) plays a crucial role especially in supporting security analysts, managers, and operators in making informed decisions. Artificial Intelligence (AI)-based techniques like Bayesian Networks, Decision Trees are used as an underlying approach in such DSSs. Furthermore, Influence Diagrams (IDs) possess the capability to support informed decision-making based on its existing applications in other domains like medical. However, the complete capability and potential of IDs are not utilised in cyber security especially in terms of its explainable nature for different stakeholders and existing applications in other domains. Therefore, this research tackles the following research question: “What are potential applications of Influence Diagrams (IDs) in cyber security?”. We identified applications of IDs in different domains and then translated it to design potential applications for cyber security issues. In the future, this will help both researchers and practitioners to develop and implement IDs for cyber security-related problems, which in turn will enhance decision-making especially due to its explainable nature for different stakeholders.

ENIGMA: An explainable digital twin security solution for cyber–physical systems

Digital Twins (DTs), being the virtual replicas of their physical counterparts, share valuable knowledge of the underlying physical processes and act as data acquisition and dissemination sources to Cyber–Physical System (CPS). Moreover, without obstructing the ongoing operations, DTs also provide an assessment platform for evaluating the operational behavior and security of the CPS. Therefore, they become a potential source of data breaches and a broad attack surface for attackers to launch covert attacks. To detect and mitigate security loopholes in DTs, one of the potential solutions is to leverage a gamification approach that can assess the security level of DTs while providing security analysts with a controlled and supportive virtual training environment. Artificial Intelligence/Machine Learning (AI/ML)-based approaches can complement the idea of security orchestration and automation in the gamification approach. However, AI/ML-based DTs security solutions are generally constrained by the lack of transparency of AI operations, which results in less confidence in the decisions made by the AI models. To address the explainable security challenges of DTs, this article proposes a gamification approach called sEcuriNg dIgital twins through GaMification Approach (ENIGMA). While leveraging DTs as an offensive security platform, ENIGMA provides gaming scenarios to assess DTs’ security and train security analysts. The game players within ENIGMA are humans (the attacker team) and AI agents (the defender team). Furthermore, ENIGMA is supported by an eXplainable AI (XAI)-based DT security assessment model that explains the decisions made based on the SHAP values by the AI model on attack vectors for the defender team, i.e., the AI agent. The SHAP values illustrate the contribution of different features towards predicting the outcome of attack vectors. This explanation can help security analysts to take security measures based on reasoned and trustworthy decisions. Finally, experimental validation has been carried out to demonstrate the viability of ENIGMA.

Security Analysts’ Site Visits and Stock Price Synchronicity

AbstractThis paper investigates how security analysts’ corporate site visits impact listed firms’ stock‐price informativeness. Examining a sample of security analysts’ visits to Chinese listed firms from 2010 to 2019, we find that security analysts incorporate firm‐specific information into share prices through site visits, significantly reducing the visited firms’ stock price synchronicity. This finding is robust to an alternative measure of stock price informativeness and a two‐stage least‐squares approach using the introduction of high‐speed rail as the instrumental variable. We also find that the impact of analysts’ site visits on firms’ stock price synchronicity is more pronounced for firms with lower information disclosure quality and poor corporate governance than for other firms. Further analysis on firm characteristics documents that this effect is stronger for large‐size firms, firms in the manufacturing industry, and state‐owned enterprises.

Racial capitalism and spheres of influence: Australian assertions of white possession in the Pacific

Australian governments and security analysts have long claimed that Australia exercises a sphere of influence in the South Pacific. This paper argues that this assertion of a sphere of influence is driven by a racial capitalist dialectic of possession and dispossession. This dialectic has legitimised and facilitated the expropriation of Pacific land, labour, resources and sovereignty for the building of the Australian colonial settler state. It is premised on geographic moralities consisting of intertwined white supremacist, antiblack, anti-Indigenous and anti-Asian ideologies which confer on Australia a right and obligation to assert influence over the Pacific based on geographic contiguity and racialised discourses of Pacific incapacity. The paper makes this argument using Aileen Moreton-Robinson's notion of white possession, Nancy Fraser's expanded conception of capitalism and José Martí’s concept of geographic morality, tracing the evolution of Australia's sphere of influence politics over four periods: the imperial era, the Cold War period, the post-Cold War period until the 2010s, and the present era of inter-imperial rivalry between China and the United States. This analysis brings together perspectives from critical race and indigenous studies, critical geopolitics, and radical geopolitics to connect race, capitalism and the construction of geopolitical space in Australia's assertion of a sphere of influence in the Pacific. It advances recent conceptual discussions of spheres of influence, which are race-blind because they draw on theories that foreground white subjectivity.

Trust and Risk Assessment in IoT Networks

The Internet of Things (IoT) is a large-scale, heterogeneous ecosystem of connected devices encompassing a range of purposes and computing capabilities. As IoT systems grow ubiquitous, new approaches to security are needed. This work proposes a method of risk assessment for devices that combines the use of trust models based on dynamic behaviors with static capability profiles drawn from immutable device characteristics to determine the level of risk each device poses to network security. A risk-based approach allows security mechanisms and monitoring activities to be more efficiently allocated across IoT networks. Simultaneously, devices can be allowed a greater degree of functionality while ensuring system availability and security. This paper presents a methodology and architecture to integrate risk assessment into IoT networks. This allows additional tailoring of security control application and provides higher-level, more human-readable information for security analysts.

Make room for me! A study of how climate change and environment landed on Spanish national security

ABSTRACT This paper examines how climate change and the environment have been incorporated into Spain’s security documents and policymaking. We have examined forty-plus documents issued by Spain’s National Security Department to identify the evolution of the climate and environmental discourse. A keyword filter helped to single out the eleven most environmentally relevant documents, which have been qualitatively analysed to better understand the context in which environmental language is used. In our work we identify how both common practices of security analysts and policy-makers different level policies have been strongly influenced by environmental knowledge, and, therefore, incorporated new considerations into security policies as well as. Our findings suggest that climate is not the only challenge incorporated into security documents. Other environmental issues such as desertification, access to water, energy transition or loss of biodiversity are also included, which implies that they are part of a broader concept of national security more in line with the new challenges of the twentity-first century.

Securing IoT Networks for Detection of Cyber Attacks using Automated Machine Learning

Cybercriminals are always developing innovative strategies to confound and frustrate their victims. Therefore, maintaining constant vigilance is essential if one wishes to protect the availability, confidentiality, and integrity of digital systems. Machine learning (ML) is becoming an increasingly powerful technique for doing intelligent cyber analysis, which enables proactive defenses. Machine learning (ML) has the potential to thwart future assaults by studying the recurring patterns that have already been successful. Nevertheless, there are two significant drawbacks associated with the utilization of ML in security analysis. To begin, the most advanced machine learning systems have significant problems with their computing overheads. Because of this constraint, firms are unable to completely embrace ML-based cyber strategies. Second, in order for security analysts to make advantage of ML for a wide variety of applications, they will need to develop specialized frameworks. In this study, we aim to put a numerical value on the degree to which a hub can improve the safety of an ecosystem. Typical cyberattacks were carried out on an Internet of Things (IoT) network located within a smart house in order to validate the hub. Further investigation of the intrusion detection system's (IDS) resistance to adversarial machine learning (AML) assaults was carried out. In this method, models can be attacked by supplying adversarial samples that attempt to take advantage of the defects in the detector that are present in the pre-trained model.

Formal concept analysis approach to understand digital evidence relationships

The number of cyber attacks is constantly increasing daily, which demands organizations to respond quickly and adequately to security incidents. Digital forensics plays an essential role in these activities. In the digital investigation process, it is necessary to identify and separate relevant digital evidence from that which is not. In this paper, we describe the construction of ordinary and fuzzy formal contexts based on digital evidence collected from event logs and the filesystem (New Technology File System). We generated four concept lattices for various subsets of attributes regarding timestamps, types of files, or event logs. The association rules and their connections with Formal Concept Analysis are explored, and several algorithms, including GUHA methods, are applied to our data. We compare, evaluate and interpret the various methods for association rules mining. Moreover, we describe the state-of-the-art of fuzzy attribute implications in Formal Concept Analysis and provide the interpretation of implications in our epoch-time attributes. Our solution provides warnings for the security analyst to manually check and inspect the suspicious records in data. Hence, the analyst can quickly find relevant records for the case and perform further analysis.

ОСОБЕННОСТИ ПРОГРАММНОЙ АРХИТЕКТУРЫ ЯЗЫКОВОЙ ПЛАТФОРМЫ PLIF ДЛЯ АНАЛИЗА БЕЗОПАСНОСТИ ИНФОРМАЦИОННЫХ ПОТОКОВ В АВТОМАТИЗИРОВАННЫХ СИСТЕМАХ

A lot of research in the field of formal security models have been conducted so far. Information flow control in automated systems software represents one of important directions. Appropriate mechanisms are being investigated in attempt to embed them into modern programming platforms designated for system and application software creation. Today all such studies are of academic type, they have theoretical meaning and usually end up at stage of prototype. According to those authors the main problem in adopting such mechanisms for industrial use and including respective steps into security development lifecycle is complexity of manual code markup with security labels and security warnings checking. We present a new platform for detecting illegal information flows in database program units and outline the respective testing procedure which explicitly separates the responsibilities of developers from that of security analysts.