Security Defense Research Articles

On the Way to Automatic Exploitation of Vulnerabilities and Validation of Systems Security through Security Chaos Engineering

Software is behind the technological solutions that deliver many services to our society, which means that software security should not be considered a desirable feature anymore but more of a necessity. Protection of software is an endless labor that includes the improvement of security controls but also the understanding of the sources that induce incidents, which in many cases are due to bad implementation or assumptions of controls. As traditional methods may not be efficient in detecting those security assumptions, novel alternatives must be attempted. In this sense, Security Chaos Engineering (SCE) becomes an innovative methodology based on the definition of a steady state, a hypothesis, experiments, and metrics, which allow to identify failing components and ultimately protect assets under cyber risk scenarios. As an extension of a previous work, this paper presents ChaosXploit, an SCE-powered framework that employs a knowledge database, composed of attack trees, to expose vulnerabilities that exist in a software solution that has been previously defined as a target. The use of ChaosXploit may be part of a defensive security strategy to detect and correct software misconfigurations at an early stage. Finally, different experiments are described and executed to validate the feasibility of ChaosXploit in terms of auditing the security of cloud-managed services, i.e., Amazon buckets, which may be prone to misconfigurations and, consequently, targeted by potential cyberattacks.

Security defense against long-term and stealthy cyberattacks

Modern cyberattacks such as advanced persistent threats have become sophisticated. Hackers can stay undetected for an extended time and defenders do not have sufficient countermeasures to prevent advanced cyberattacks. Reflecting on this phenomenon, we propose a game-theoretic model to analyze strategic decisions made by a hacker and a defender in equilibrium. In our game model, the hacker launches stealthy cyberattacks for a long time and the defender decides when to disable a suspicious user based on noisy observations of the user’s activities. Damages caused by the hacker can be enormous if the defender does not immediately ban a suspicious user under certain circumstances, which can explain the emerging sophisticated cyberattacks with detrimental consequences. Our model also predicts that the hacker may opt to be behavioral to avoid worst cases. This is because behavioral cyberattacks are less threatening and the defender decides not to immediately block a suspicious user to reduce cost of false detection.

Towards Real-Time Warning and Defense Strategy AI Planning for Cyber Security Systems Aided by Security Ontology

Cyber security systems generally have the phenomena of passive defense and low-efficiency early warnings. Aiming at the above problems, this study proposes a real-time warning and plans an AI defense strategy for a cyber security system aided by a security ontology. First, we design a security defense ontology that integrates attack graphs, general purpose and domain-specific knowledge bases, and on this basis, we (1) develop an ontology-driven method of early warnings of real-time attacks, which supports non-intrusive scanning attack detection and (2) combine artificial intelligence planning and bounded rationality to recommend and automatically execute defense strategies in conventional defense scenarios. A case study has been performed, and the results indicate that: (1) the proposed method can quickly analyze network traffic data for real-time warnings, (2) the proposed method is highly feasible and has the ability to implement defense strategies autonomously, and (3) the proposed method performs the best, with a 5.4–11.4% increase in defense effectiveness against the state-of-the-art counterparts considering the APT29 attack. Overall, the proposed method holds the potential to increase the defense effectiveness against cyberattacks under high computing resource constraints.

Turkey’s National Security Perceptions in the Early Republican Period

This study seeks answers to the questions of what the national security environment of Turkey looked like in the early years of the Republic and what the main threat perceptions were. Since the Republic was declared after a war of national independence, Turkey pursued a foreign policy aimed at securing its independence and sovereign rights and tried to consolidate the newly established regime. Security perceptions shaped in this framework played an important role in determining Turkey’s national security policies in the following years. The experience of the War of Independence is one of the most important sources of Turkey’s sensitivity to its full independence and sovereignty rights. The construction of a new political regime and national state with the proclamation of the Republic shaped the perceptions of threats to the security of the regime. The tensions in the European great power politics in the interwar period are one of the important developments that reveal Turkey’s pro-status quo and defensive security understanding. In this context, it is argued that it is important to evaluate Turkey’s historical experience in the early years of the Republic in terms of understanding today’s national security policies.

Enhancing the security in cyber-world by detecting the botnets using ensemble classification based machine learning

With various malware, botnets are the legitimate risk increasing against cybersecurity providing criminal operations like malware dispersal, distributed denial of service attacks, fraud clicking, phishing, and identification of theft. Existing techniques used for detection of botnet, which are suitable only for specific command of botnet and protocol for controlling and do not support botnet detection at earlier stages. In several computer security defense systems, honeypots are deployed successfully by security defenders. As honeypots can attract botnet compromises and expose spies in botnet membership and behaviors of the attacker, they are broadly employed in botnet defense. Thus, attackers whose role is to construct and maintain botnets have to determine honeypot trap avoiding methods. To handle the issues related to botnet attacks, machine learning techniques are used to support detection and prevent bot attacks. An Ensemble Classifier Algorithm with Stacking Process (ECASP) is proposed in this paper to select optimal features fed as input to the machine learning classifiers to estimate the botnet detection performance. As a result, the method achieves proposed achieves 94.08% accuracy, 86.5% sensitivity, 85.68% specificity, and 78.24% F-measure.

AI-based technology adhering in cyber security

Under the background of increasingly serious information security threats, it has attracted wide attention to solve network security problems efficiently. As a security defense technology to protect the network from attacks, intrusion detection system plays a very important role in the field of computer system and network security.

AI-Based Mean Field Game against Resource-Consuming Attacks in Edge Computing

With the rapid development of edge computing, a new paradigm has formed for providing the nearest end service close to the data source. However, insufficient supply of resources makes edge computing devices vulnerable to attacks, especially sensitive to resource-consuming attacks. This article first designs system function module, aiming to deal with resource-consuming attacks based on the general three-layer architecture of edge computing. Combined with the mean field game, an anti-attack model is designed to transform the security defense problem of large terminal-edge-cloud devices into the mean field countermeasure problem, and the self-organizing neural network is used to approximate the mean field coupling equation. On this basis, a distributed AI-driven resource-consuming attack security defense (ARASD) algorithm is designed to obtain the optimal solution for devices security interaction, thereby improving the system’s anti-attack ability. Finally, the effectiveness of the self-organizing neural network is verified through numerical simulation, and the parameters such as the number of initial terminal-edge-cloud devices and the number of iterations of different security defense algorithms are evaluated. The results show that the ARASD algorithm can achieve better resistance to resource-consuming attacks than other state-of-the-art algorithms in a large-scale edge computing architecture.

PeerAmbush: Multi-Layer Perceptron to Detect Peer-to-Peer Botnet

Due to emerging internet technologies that mostly depend on the decentralization concept, such as cryptocurrencies, cyber attackers also use the decentralization concept to develop P2P botnets. P2P botnets are considered one of the most serious and challenging threats to internet infrastructure security. Consequently, several open issues still need to be addressed, such as improving botnet intrusion detection systems, because botnet detection is essentially a confrontational problem. This paper presents PeerAmbush, a novel approach for detecting P2P botnets using, for the first time, one of the most effective deep learning techniques, which is the Multi-Layer Perceptron, with certain parameter settings to detect this type of botnet, unlike most current research, which is entirely based on machine learning techniques. The reason for employing machine learning/deep learning techniques, besides data analysis, is because the bots under the same botnet have a symmetrical behavior, and that makes them recognizable compared to benign network traffic. The PeerAmbush also takes the challenge of detecting P2P botnets with fewer selected features compared to the existing related works by proposing a novel feature engineering method based on Best First Union (BFU). The proposed approach showed considerable results, with a very high detection accuracy of 99.9%, with no FPR. The experimental results showed that PeerAmbush is a promising approach, and we look forward to building on it to develop better security defenses.

Intrusion Detection for Cyber-Physical Security System Using Long Short-Term Memory Model

In the present context, the deep learning approach is highly applicable for identifying cyber-attacks on intrusion detection systems (IDS) in cyber-physical security systems. As a key part of network security defense, cyber-attacks can change and penetrate the security of the network system, then, the role of an IDS is to detect suspicious behaviors and act appropriately to protect the network from the onset of attacks. Machine learning and deep learning techniques are important for current intrusion detection systems. However, traditional intrusion detection systems are far from being able to quickly and accurately identify complex and diverse network attacks and obtained low accuracy and detection rates, thus, these methods frequently fail to manage big amounts of data in a vast network infrastructure and utilize a lot of features leads to poor performance. For addressing these issues and improving the accuracy and scalability, in this paper, we have implemented the deep learning method based on a new approach multilayer long short-term memory (LSTM) model for detecting attacks on a network. The novelty of the proposed scheme is that the optimum multilayer architecture is built to achieve maximum accuracy in the network architecture in order to boost performance using stacking multiple layers of LSTM cells in a more effective manner, and better stability to perform consistently in both binary classification and multiclass classification on NSL-KDD datasets. Experimental tests with KDDTest + datasets show that the proposed multilayer LSTM model provides outstanding results with 95% and 96% accuracy, respectively, in binary and multiclass classification. In order to deal with actual datasets and obtain good performance in the network design, our optimum multilayer architecture must be put into practice in order to execute real-time applications. Therefore, the results are better and more robust than the existing state-of-the-art methods.

Feasibility of critical infrastructure protection using network functions for programmable and decoupled ICS policy enforcement over WAN

Industrial control systems (ICS) represent a major component of our critical infrastructure. With the increasing need for more control and monitoring of such systems, ICS have seen an increase in connectivity to wide area networks (WAN) exposing aging equipment to rapidly evolving cybersecurity threats. Furthermore, the ICS data requires a reliability measure from the networks for critical functions for infrastructure monitoring and control. Especially when remote plant sites are involved such as pipelines, energy distribution networks, and transportation, WAN transport impairments most often provide a best effort delivery with no strict reliability guarantees. Network functions can provide a vendor agnostic, programmable critical infrastructure protection with a single maintenance, policy determination, and reliability assurance surface. A network function (NF) can be utilized for policy enforcement over the communication between remote entities and the main control office. This paper presents the research on transparent integration with existing ICS without disrupting communications, resulting in minimal downtime while decoupling the fast paced evolution of defensive security measures from the upgrade cycle of expensive long term hardware. We report our measurements on the resource requirements and overhead in the network for successful NF insertion under a wide variety of network impairments (network packet delay, reordering, and loss). Our paired NF implementation provides a policy enforcement platform extensible to cover myriad cybersecurity-related communication goals, including packet signing for verification, encryption for data privacy, packet filtering and data diode operation (i.e. protecting against eavesdropping, packet injection, and denial-of-service). Furthermore, bundling communication specifications into packet flows allows for tunability in applying policies as coarse- or fine-grained as the needs of the operator. We report on network function resource requirements in the form of required queue depth and network utilization overhead.

Framing the ‘hanging garden' of Seoul – querying heritage transculturally. Jung Yeondoo re-stages (art) history in South Korea in 2009

The split film installation ‘Hanging Garden’ by South-Korean multi-media artist Jung Yeondoo (b. 1969) presents a creative, meta-institutional reflection on how (art) history is, and should be told, in Korea today. It consists of two HD color film sequences, which Jung realized in 2009 for the exhibition Platform in KIMUSA in the section ‘Void of Memory.’ Crucial for the two films is a sequential spatial display that allows viewers to see only one film after the other, since the second sequence reveals the making of the first and is intended to work as a kind of punch line in response. The article explores the ironic ‘framings’ that Jung uses to expose the multi-layered ways heritage is constituted in South Korea given the colonial and authoritarian roots of the art museum. The analysis here follows and contextualizes the esthetic revealing of the art museum’s most contemporary instantiation built on the former site of the Defense Security Command (DSC) in Sogyeok-dong Seoul as a ‘hanging garden’ that is ambivalently suspended between official efforts to establish national ‘heritage’ and citizens’ memories about conflicted pasts, in which the site saw the torture of civilians.

LDP‐Fed+: A robust and privacy‐preserving federated learning based classification framework enabled by local differential privacy

AbstractAs a distributed learning framework, Federated Learning (FL) allows different local learners/participants to collaboratively train a joint model without exposing their own local data, and offers a feasible solution to legally resolve data islands. However, among them, the data privacy and model security are two challenges. The former means that, if original data are used for trained FL models, various methods can be used to deduce the original data samples, thereby causing the leakage of data. The latter implies that unreliable/malicious participants may affect or destroy the joint FL model, through uploading wrong local model parameters. Therefore, this paper proposes a novel distributed FL training framework, namely LDP‐Fed+, which takes into account differential privacy protection and model security defense. Specifically, firstly, a local perturbation module is added at the local learner side, which perturbs the original data of local learners through feature extraction, binary encoding and decoding, and random response. Then, through using the perturbed data, local neural network model is trained to obtain the network parameters that meet local differential protection, to effectively deal with model inversion attacks. Secondly, a security defense module is added on the server side, which uses the auxiliary model and differential index mechanism to select an appropriate number of local disturbance parameters for aggregation to enhance model security defense and deal with membership inference attacks. The experimental results show that, compared with other federated learning models based on differential privacy, LDP‐Fed+ has stronger robustness for model security and higher accuracy for model training while ensuring strict privacy protection.

Pocket Diagnosis: Secure Federated Learning Against Poisoning Attack in the Cloud

Federated learning has become prevalent in medical diagnosis due to its effectiveness in training a federated model among multiple health institutions (i.e., Data Islands (DIs)). However, increasingly massive DI-level poisoning attacks have shed light on a vulnerability in federated learning, which inject poisoned data into certain DIs to corrupt the availability of the federated model. Previous works on federated learning have been inadequate in ensuring the privacy of DIs and the availability of the final federated model. In this article, we design a secure federated learning mechanism with multiple keys to prevent DI-level poisoning attacks for medical diagnosis, called <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">SFAP</small> . Concretely, <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">SFAP</small> provides privacy-preserving random forest-based federated learning by using the multi-key secure computation, which guarantees the confidentiality of DI-related information. Meanwhile, a secure defense strategy over encrypted locally-submitted models is proposed to resist DI-level poisoning attacks. Finally, our formal security analysis and empirical tests on a public cloud platform demonstrate the security and efficiency of <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">SFAP</small> as well as its capability of resisting DI-level poisoning attacks.

Novel cooperative localization method of over-the-horizon shortwave emitters based on direction-of-arrival and time-difference-of-arrival measurements

The location of long-distance shortwave radiation sources is practically significant in national defense security. Shortwave multistation-positioning systems mainly include direction-of-arrival (DOA) and time-difference-of-arrival (TDOA) intersection locations. These two systems have their advantages and disadvantages in terms of performance. To combine the advantages of these two positioning technologies, this study focuses on the cooperative positioning problem based on DOA and TDOA measurements. First, the two-dimensional DOA and TDOA observation models are established for the over-the-horizon propagation scenario. Subsequently, the Cramér-Rao lower bound (CRLB) of positioning accuracy is derived in the presence of measurement errors in virtual ionosphere height. Aiming at the strong nonlinear characteristics of the observation equations, a new DOA/TDOA cooperative localization method is proposed. Finally, the asymptotic efficiency of the new estimator is proved using the first-order error analysis theory. The new method comprises two stages. In the first stage, the shortwave DOA observation equation is transformed into a pseudo-linear observation equation by introducing an auxiliary variable, as well as solving a quadratic equation with one unknown. Next, an optimization model with two quadratic equality constraints is constructed, and an iterative optimization algorithm based on matrix $~\bf{QR}$ decomposition is proposed to obtain an intermediate estimate of the emitter position. The second stage transforms the shortwave TDOA observation equation into a pseudo-linear observation equation by combining the intermediate estimates given in the first phase. Also, an iterative-constrained weighted-least-squares estimator based on the matrix decomposition is proposed again to localize the emitter. Simulation results show that the new cooperative localization method has good global convergence, the localization performance can reach the CRLB, and the obtained cooperative gain is quite high.

Optical fiber hydrogen sensing system based on dual photodetectors

The safe use of hydrogen energy is expected to solve the dual problems of the environment and energy in the future. However, because of the flammable and explosive characteristics of hydrogen, new sensing technologies that can reliably monitor the concentration of hydrogen are urgently needed. Fiber optic sensing technology has the advantages of good electrical insulation performance, strong anti-electromagnetic interference ability, non-invasive, high sensitivity, easy to realize the long-distance monitoring of the measured signal, corrosion resistance, explosion-proof, flexible optical path, easy to connect with the computer and so on. Based on the above advantages, this paper uses the hydrogen-induced discoloration effect of WO3-Pd2Pt-Pt nanocomposite films to construct a fiber-optic hydrogen sensing system based on dual photodetectors, which is closely integrated with Internet technology. It can realize the real-time monitoring of hydrogen concentration in life and production and is of great significance to the safe operation of national defense security and national economic construction.

PUBLIC POLICY PARADOXES ADVANCE THE DEFENSE INDUSTRY

The onset of the Russian and Ukrainian wars is proof that the existence of physical war is still a real threat to any country at this time. It is common logic that no matter how long our defense and security equipment is still dependent on other countries, we still have limitations in strengthening our country's security defense system. This paper aims to analyze the implementation of policies related to the development of the defense industry to find recommendations in the optimization of the defense industry. The method used is a Literature Study with a descriptive qualitative approach that is the choice and use of George Edward III's policy implementation theory as an operational theory used to analyze problems. The results of the discussion showed that there were still communication constraints between relevant ministries/institutions, limited resources, especially in the priority of using the state budget in other fields, which were the main factors in financing the defense industry. The disposition of relevant ministry/institutional entities that still cannot be fully integrated properly, and also the overlapping authority of the bureaucratic structure. The conclusion of this paper is that the government in this case the President and the House of Representatives of the Republic of Indonesia must firmly decide on priorities to support policies to advance the defense industry that are really realistic to be developed, not stuck with only limited propaganda capable of making their own but the fact is that only separate products from foreign manufacturers

Big data network security defense mode of deep learning algorithm

Abstract With the rapid development and progress of big data technology, people can already use big data to judge the transmission and distribution of network information and make better decisions in time, but it also faces major network threats such as Trojan horses and viruses. Traditional network security functions generally wait until the network power is turned on to a certain extent before starting, and it is difficult to ensure the security of big data networks. To protect the network security of big data and improve its ability to defend against attacks, this article introduces the deep learning algorithm into the research of big data network security defense mode. The test results show that the introduction of deep learning algorithms into the research of network security model can enhance the security defense capability of the network by 5.12%, proactively detect, and kill cyber attacks that can pose threats. At the same time, the security defense mode will evaluate the network security of big data and analyze potential network security risks in detail, which will prevent risks before they occur and effectively protect the network security in the context of big data.

Efficient object detection method based on aerial optical sensors for remote sensing

Object detection technology for images generated by optical sensors is of great significance in areas such as national defense security, disaster prediction, and smart city construction. Aiming at the problems of small target size, arbitrary target direction, and complex background in aerial image object detection using optical sensors. By using the images captured by a wild range of optical sensors such as CCD（Charge Coupled Device） and SAR(Synthetic Aperture Radar), we propose a more efficient rotating frame object detection algorithm that introduces the MCAB (Multi-branch Convolutional Attention Block) that can process these same types of images taken by the aerial platform using light sensors. First, we construct the module by adding identity, residual branch, and CBAM (Convolutional Block Attention Module) structure to the traditional convolution layer and the activation function to substitute the simple conv module in the network. Secondly, we introduce the Transformer layer at the end of the backbone network to enhance the global perception of the model with low overhead, realize the relationship is modeling between the target and the scene content, and reduce the amount of calculation. We improve the structure of the neck layer by BiFPN (Bidirectional Feature Pyramid Network) to speed up network operation, and CBAM is added after C3 to highlight important characteristic information. Our improved YOLOv5 algorithm is tested on the self-made rotating small target aerial data set. Compared with the original algorithm, our model's mean Average Precision (mAP) is improved by 1.8 percentage points, and the accuracy and recall are also enhanced by 0.46 and 0.34 percentage points.

Controllable synthesis of FeSe2/rGO porous composites towards an excellent electromagnetic wave absorption with broadened bandwidth

Due to the escalating demand for electronic dependability and defense security, there has been a surge in research into broadband and lightweight microwave absorbers. Porous composites that are lightweight and plentiful in interfaces have the potential to be high-performance absorbers due to their ability to attenuate waves in a balanced manner and match impedance. “Using a solvothermal technique we generated FeSe2/rGO composites with a porous topology. By varying the weight of rGO, the electromagnetic properties of FeSe2/rGO composites may be finely tuned. Impedance matching and attenuation capability are both improved as a direct result of the porous structure and the appropriate electromagnetic parameters. FeSe2/rGO composites benefit from the tunable composition, porous structure, and strong synergistic effect between FeSe2 and rGO sheets and display outstanding microwave absorption performance with an ultrabroad bandwidth approaching 5.2 GHz with a thin thickness of 1.6 mm which covers 75% of the studied frequency range. At the same thickness, a significant reflection loss of −43.7 dB is attained. This work not only enables the tuning of electromagnetic parameters but also expands the use of high-performance microwave absorption devices. Remarkable microwave absorption ability, of the porous composites FeSe2/rGO can be utilized as a high-performance microwave absorber.”

A comprehensive survey on online social networks security and privacy issues: Threats, machine learning‐based solutions, and open challenges

AbstractOver the past few years, online social networks (OSNs) have become an inseparable part of people's daily lives. Instead of being passive readers, people are now enjoying their role as content contributors. OSN has permitted its users to share their information including the multimedia content. OSN users can express themselves in virtual communities by providing their opinions and interacting with others. As a consequence, the privacy and security threats in OSNs have emerged as a major concern to the research and business world. In the recent past, a number of survey works have been conducted to discuss different security and privacy threats in OSNs. However, till date, no survey work has been conducted that aims to classify and analyze various machine learning (ML)‐based solutions adapted for the security defense of OSNs. In this survey article, we present a detailed taxonomy with a classification of various works done on various security attacks in OSNs. We then review and summarize the existing state of art survey works on OSN security, and indicate the merits and limitations of these survey works. Next, we review all recent works that aim to provide ML‐based solutions toward defense of security attacks on OSNs. Finally, we discuss the future road‐map on OSN security and provide a comprehensive analysis on the open research issues with feasible measurements and possible solutions.