Security Events Research Articles

Digital Communication Forensics in 6G and beyond Networks

6G networks can be truly intelligent wireless systems that have the flexibility for continuous technological improvements. However, security events affecting information systems have grown increasingly complicated and sophisticated. Intruders may be able to operate due to a lack of evidence authenticity. Using network forensics methods can solve many cybercrime instances. These methods can be used to locate the intruder and to determine the intrusion’s origin and how it can be avoided in the future. Existing network forensics techniques confront security threats and vulnerabilities in several networks, such as personal area networks, local area networks, wide area networks, and wireless wide area networks under telecom networks, in practice, but cannot operate in 6G and beyond telecom networks, which are critical at this moment. Thus, a comprehensive literature analysis of telecom networks is conducted to identify existing concerns and challenges in conducting digital communication forensics. Hence, a digital forensics system for 6G and beyond networks is proposed as an initial idea on the basis of the highlighted issues, thereby assessing security incidents and providing justified evidence that explains the footprints of the attackers.

Cyberattacks in Smart Grids: Challenges and Solving the Multi-Criteria Decision-Making for Cybersecurity Options, Including Ones That Incorporate Artificial Intelligence, Using an Analytical Hierarchy Process

Smart grids have emerged as a transformative technology in the power sector, enabling efficient energy management. However, the increased reliance on digital technologies also exposes smart grids to various cybersecurity threats and attacks. This article provides a comprehensive exploration of cyberattacks and cybersecurity in smart grids, focusing on critical components and applications. It examines various cyberattack types and their implications on smart grids, backed by real-world case studies and quantitative models. To select optimal cybersecurity options, the study proposes a multi-criteria decision-making (MCDM) approach using the analytical hierarchy process (AHP). Additionally, the integration of artificial intelligence (AI) techniques in smart-grid security is examined, highlighting the potential benefits and challenges. Overall, the findings suggest that “security effectiveness” holds the highest importance, followed by “cost-effectiveness”, “scalability”, and “Integration and compatibility”, while other criteria (i.e., “performance impact”, “manageability and usability”, “compliance and regulatory requirements”, “resilience and redundancy”, “vendor support and collaboration”, and “future readiness”) contribute to the evaluation but have relatively lower weights. Alternatives such as “access control and authentication” and “security information and event management” with high weighted sums are crucial for enhancing cybersecurity in smart grids, while alternatives such as “compliance and regulatory requirements” and “encryption” have lower weighted sums but still provide value in their respective criteria. We also find that “deep learning” emerges as the most effective AI technique for enhancing cybersecurity in smart grids, followed by “hybrid approaches”, “Bayesian networks”, “swarm intelligence”, and “machine learning”, while “fuzzy logic”, “natural language processing”, “expert systems”, and “genetic algorithms” exhibit lower effectiveness in addressing smart-grid cybersecurity. The article discusses the benefits and drawbacks of MCDM-AHP, proposes enhancements for its use in smart-grid cybersecurity, and suggests exploring alternative MCDM techniques for evaluating security options in smart grids. The approach aids decision-makers in the smart-grid field to make informed cybersecurity choices and optimize resource allocation.

Generating full-stack 5G security datasets: IP-layer and core network persistent PDU session attacks

With the increasing number of users accessing the Internet over 5G systems, security concerns have become a major challenge that needs to be addressed. This paper proposes a solution to this challenge by proposing a system to train defenders to handle cyber attacks and develop intrusion detection systems that can timely notify of security events, also within the 5G core itself. This paper builds on our previous contributions on a containerized 5G testbed and proposes a novel set of full-stack attacks targeting networked hosts and 5G Network Functions (NFs) alike. Importantly, we identify the potential to generate persistent Packet Forwarding and Control Protocol (PFCP) Denial of Service (DoS) attacks to deprive end users of connectivity to the data network, even in the event of a handover to another gNodeB. This framework is envisaged to facilitate the generation of highly diverse and realistic datasets, containing malicious GPRS Tunneling Protocol (GTP) and PFCP traffic captured over 5G interfaces, thereby enhancing the security of next-generation networks.

Intelligent Algorithms for Event Processing and Decision Making on Information Protection Strategies against Cyberattacks

This paper considers the main approaches to building algorithms for the decision support systems of information protection strategies against cyberattacks in the networks of automated process control systems (the so-called recommender systems). The advantages and disadvantages of each of the considered algorithms are revealed, and their applicability to the processing of the information security events of the UNSW-NB 15 dataset is analyzed. The dataset used contains raw network packets collected using the IXIA PerfectStorm software in the CyberRange laboratory of the Australian Cyber Security Centre (Canberra) in order to create a hybrid of the simulation of the real actions and the synthetic behavior of the network traffic generated during attacks. The possibility of applying four semantic proximity algorithms to partition process the data into clusters based on attack type in a distribution control system (DCS) is analyzed. The percentage of homogeneous records belonging to a particular type of attack is used as the metric that determines the optimal method of cluster partitioning. This metric was chosen under the assumption that cyberattacks located “closer” to each other in the multidimensional space have similar defense strategies. A hypothesis is formulated about the possibility of transferring knowledge about attacks from the vector feature space into a semantic form using semantic proximity methods. The percentage of homogeneous entries was maximal when the cosine proximity measure was used, which confirmed the hypothesis about the possibility of applying the corresponding algorithm in the recommender system.

Global Energy Demand and Forecasting: A Managerial Economics Perspective

A military war between Russia and Ukraine resulted from unusual military action by Russia against Ukraine. Comprehensive sanctions were imposed against Russia in the areas of energy, finance, the economy, and other areas by European and American nations. The Russian-Ukrainian wars, which have been the most significant security event in recent international politics, will surely induce changes and adjustments to European geopolitics, political order, the international rule system, as well as economic ties. This paper focuses on the study of Global energy demand and forecasting from the perspective of global management economics. This paper will show the analysis of energy demand in the form of charts and use the Reference method and Time series analysis respectively to forecast the future energy. However, human demand for energy will double in the future as population growth and other factors change.

Who Hacked My Car? Designing Autonomous Vehicles to Support Driver Response to Security Threats

Modern vehicles have evolved into intelligent and autonomous transportation systems, yet such computer-driven developments also create opportunities for unforeseen cyber-security attacks on self-driving cars. These threats may pose critical risks to human lives but there is a considerable lack of understanding in designing vehicle systems to support driver response during rare and hazardous security events. We conducted an interview with autonomous vehicle drivers to understand their perception of automotive threats and design needs for effective response during security events. Results show that drivers expect information relating to malfunction detection, trouble-shooting instructions, and log data from the vehicle. Moreover, drivers were more likely to act based on instincts the more the driver perceives the threat to be urgent, rather than process the situation during the initial stages of an attack. We thus propose a ‘Driver Response Phase’ and corresponding design implications for future vehicles that support user response to security risks.

Emergency Volunteer Participation in the Evolutionary Game of Public Security Governance under Community Incentives

The outbreak of the COVID-19 epidemic has brought profound changes to all aspects of our society and also reflects the importance of community emergency volunteers actively participating in epidemic prevention and control in the face of unexpected public security events. As a bridge between the implementation of government policies and the masses of the community, community emergency volunteers have the characteristics of high efficiency and low cost, which has a great impact on the advancement of modern social governance. In order to motivate volunteers, the community will introduce incentive mechanisms. How does the evolutionary process of a dynamic game between volunteer engagement and community motivation change? How should communities maximize the service investment of volunteers in the game process? However, the current research rarely focuses on the role of community volunteers in the modernization of Community Governance. In order to clarify this game process, this article constructs a public safety governance incentive game model consisting of communities and emergency volunteers. Based on evolutionary game theory, we obtain the evolutionary stable equilibrium point by solving the replicator dynamic equations of all parties in the dynamic system under different constraints. Finally, some numerical examples were provided to simulate the selection of agents. The research results show that the degree of community public security risk, the degree of active involvement of volunteers, the degree of inactive involvement of volunteers, and the level of community incentives have an important impact on the enthusiasm of volunteer community service investment decision-making behavior. In addition, the choice of community incentive-volunteer service investment strategy is a dynamic process, which can converge to the ideal state under certain conditions after continuous adjustment and optimization. In addition, this study puts forward suggestions and measures conducive to the game between both sides, which can provide valuable guidance for the practice of community public security governance and the improvement of government efficiency in China.

SecureLog: Open-Source Security Information and Event Management (SIEM) Solution for Enhanced Threat Detection and Incident Response

Purpose of the study: As organizations face increasingly sophisticated and persistent cyber threats, the need for robust Security Information and Event Management (SIEM) solutions becomes paramount. This paper presents "SecureLog," an open-source SIEM solution designed to enhance threat detection and incident response capabilities.
 Methodology: This paper explores the architecture and components of SecureLog, detailing its data collection and log management capabilities. It examines the threat detection algorithms employed, emphasizing real-time event correlation and alerting mechanisms. The paper addresses the scalability and performance considerations associated with deploying SecureLog in large-scale environments.
 Main Findings: The findings highlight the benefits of using fuzzy logic in cyber threat intelligence and pave the way for further research and development in this promising field. The future prospects and challenges of integrating fuzzy logic with other advanced technologies such as machine learning and artificial intelligence.
 Applications of this study: SecureLog emerges as a valuable open-source SIEM solution, empowering organizations with enhanced threat detection and incident response capabilities. With its feature-rich architecture and active community support, SecureLog proves to be a reliable choice for organizations seeking to fortify their cybersecurity defences.
 Novelty/Originality of this study: The paper also includes practical use cases and case studies to demonstrate the effectiveness of SecureLog in enhancing threat detection and incident response. Security and compliance considerations, including data privacy and regulatory compliance, are examined, along with recommendations for securing the SecureLog deployment.

Converged Security and Information Management System as a Tool for Smart City Infrastructure Resilience Assessment

Current research on smart cities is primarily focused on the area of applicability of information and communication technologies. However, in the context of a multidisciplinary approach, it is also necessary to pay attention to the resilience and converged security of individual infrastructures. Converged security represents a particular security type based on a selected spectrum of certain convergent security types of, assuming the creation of a complementary whole. Considering the outputs of the analysis of security breaches manifestations, this kind of security makes it possible to detect emerging security breaches earlier (still in the symptom stage), thus providing a more efficient and targeted solution suitable for building smart city infrastructure. In its essence, the article refers to the practical application of the converged security theoretical principles presented in the publication to a functional sample, deployed and tested in practical conditions in context of selected smart city infrastructure protection and resilience. Considering the nature of the practical application, the convergence of a wider spectrum of smart security alarm systems in the resilience assessment context is defined. In the beginning, the general principles of security/safety and the need for their convergence are presented. In this context, the mathematical model called Converged Resilience Assessment (CRA) method is presented for better understanding. Subsequently, Physical Security Information Management (PSIM) and Security Information and Event Management (SIEM) systems are described as a technological concept that can be used for resilience assessment. The most beneficial part is the structural, process, and functional description of the Converged Security and Information Management System (CSIM) using the concept of smart security alarm systems converged security.

A novel hybrid machine learning model for prediction of CO2 using socio-economic and energy attributes for climate change monitoring and mitigation policies

Industrial development has contributed to carbon emissions majorly, resulting in high concentrations of greenhouse gases (GHGs) in the environment leading to climate change phenomenon. Climate change threatens people in multiple ways: threatening food security, water scarcity, frequent and extreme weather events, the spread of diseases, economic losses and migration etc. The World Health Organization (WHO) declared that climate change is the greatest threat to global health in the 21st century. Since 1970, CO2 emission has increased by about 90 per cent, making it 78 per cent of the total greenhouse gas emission. Climate change impact, carbon emission factors and social-economic attributes make the prediction of GHG emission a very complex research problem having dynamic scenarios due to a large number of factors and impacting variables. Accurate prediction of carbon emission in such a scenario makes it one of the most important and challenging research works. Artificial intelligence and machine learning approaches are increasingly being used to study complex, dynamic environmental phenomenons with high variability of time, space and other factors. The research paper proposes hybrid machine learning models for the prediction of CO2 emissions using energy and social-economic variables. The work uses energy and socioeconomic variables from 1960 to 2018 to collate them to provide a new perspective on the application of machine learning approaches in the modelling and prediction of GHG emissions. The proposed hybrid model of principal component analysis (PCA) and machine learning approaches is compared on accuracy and efficiency and performs better than other machine learning and deep learning approaches such as Linear regression variants, random forest regression (RFR), support vector regression (SVR), recurrent neural network (RNN), long short term Memory (LSTM) and Tabnet etc. The proposed hybrid model reports MAE equal to 0.0307, RMSE equal to 0.0346, MAPE equals to 5.1447 and SMAPE equal to 5.2267. In terms of efficiency of computation, the proposed hybrid machine learning model PCA+LER took 12.4 ms better than other models. This proposed research work of correlation analysis and prediction can help policymakers and governments in the mitigation and management of carbon emissions.

Attack scenario reconstruction via fusing heterogeneous threat intelligence

Nowadays, new-generation threats often use multiple means or perform several steps to intrude into networks and ultimately reach their objective. These new threats have multi-staged, and we can understand their intrusion pattern from the kill-chain defensive model. This paper focuses on fusing heterogeneous threat intelligence collected from security information and event management systems to reconstruct multi-step attack scenarios and discover critical attack paths. However, the need for an agreed-upon vocabulary to represent the heterogeneous threat intelligence makes it difficult to model the attack scenarios accurately and efficiently. Therefore, we devise a heterogeneous threat intelligence fusing approach for real-time reconstruction of the attack scenarios. Firstly, we use structured threat information expression (STIX) to format heterogeneous threat intelligence (TI). We analyze the causal relationship of each heterogeneous threat intelligence and piece them together. Then, we model the multi-stage attack scenario reconstruction as a community discovery problem. We mine the attack scenarios with semantic correlation weight and a community detection algorithm. We finally use the open-source benchmark datasets (DARPA 2000, CICIDS 2017) and the real Internet traffic captured from the China Education Research Network backbone (CERNET) to evaluate our work. Extensive results demonstrate that our proposal can accurately reconstruct multi-step attack scenarios and discover covert C&C channels.

A Chief Health Security Officer for Every Academic Health Center: Improving Readiness, Response, Recovery, and Resilience.

Academic health centers (AHCs) require expertise to ensure readiness for health security events, such as cyberattacks, natural disasters, and pandemics, as well as the ability to respond to and recover from these events. However, most AHCs lack an individual to coordinate efforts at an enterprise level across academic and operational units during an emergency; elevate the coordination of individual AHCs with local and state public health entities; and through professional organizations, coordinate the work of AHCs across national and international public health entities. Informed by AHCs' responses to the COVID-19 pandemic and a series of focused meetings in 2021 of the Association of Academic Health Centers President's Council on Health Security, the authors propose creating a new C-suite role to meet these critical needs: the chief health security officer (CHSO). The CHSO would be responsible for the AHC's overall health security and would report to the AHC's chief executive officer or president. The authors describe the role of CHSO in relation to the preparation, response, and recovery phases of public health events necessary for health security. They also propose key duties for this position and encourage institutions to offer training and credentials to facilitate the creation and define the portfolios of CHSO positions at AHCs and beyond.

Cloud Services Monitoring: Implementing a Stratified Approach for Enhanced Visibility and Efficiency

- The research paper introduces a novel stratified approach to monitor cloud services, addressing the unique challenges arising from the distributed and dynamic nature of cloud environments. The main objectives of the study are to enhance the effectiveness of cloud service monitoring and management while ensuring the availability, performance, and security of cloud- based applications. The proposed stratified monitoring framework consists of four distinct layers: Infrastructure, Platform, Application, and Security. Each layer focuses on specific monitoring aspects, encompassing infrastructure resources, platform services, application performance, and security events. Methodologically, the paper explores various monitoring tools and techniques suitable for each layer to provide a comprehensive view of the cloud ecosystem. The research includes an empirical case study to demonstrate the practicality and effectiveness of the stratified monitoring approach in real-world cloud deployments. A comparison with traditional monitoring methods is conducted to showcase the advantages of the proposed approach. The obtained results indicate that the stratified monitoring approach significantly improves visibility into the cloud infrastructure, enables early detection of anomalies, and enhances security measures. This approach empowers cloud service providers and users to optimize resource utilization and make informed decisions concerning cloud performance and security. The research paper's significance lies in offering a structured and adaptable framework to monitor cloud services effectively, thus supporting organizations in maintaining reliable and efficient cloud-based applications. The proposed approach fosters a deeper understanding of the cloud ecosystem, mitigates risks, and facilitates prompt issue resolution. Key Words: Cloud computing, Cloud services, Monitoring, Stratified approach, Infrastructure, Platform, Application, Security.

Optimization of Security Information and Event Management (SIEM) Infrastructures, and Events Correlation / Regression Analysis for Optimal Cyber Security Posture

This work integrates logical and physical security processes, and simplifies the manageability of the security infrastructure. The process increases visibility to resources, which makes it easier to prevent security incidents, and provides a platform to manage the response and recovery after an incident occur. Log collection is the heart and soul of a SIEM. Log correlation is employed to identify particular sequences of log events from devices. The comparison between network level and host level events automatically perform initial validation that would not normally be performed. It considers movement of data between systems where it would not normally accounts logging on at unusual times or from unusual places, these may not generate specific security alerts, but can be much more easily spotted and flagged by a log correlation solution that sees everything in the environment. It shows some enhancements to event log normalization and significantly improves correlation rule execution. The event monitoring algorithm and SIEM correlation rules result in false positives or false negatives. Security managers, therefore, may waste time and resources that could be used to respond to real threats and assaults if there are too many false positives. This study hereby, strikes a compromise between lowering false positive alerts and not ignoring any potential abnormalities that could indicate a cyberattack when establishing SIEM correlation rules. In order to decide which data is pertinent and which data is irrelevant in an event pipeline, this research employs the use of filters. Through this examination, it can be inferred that the conditions are advantageous for promoting investment in the growth and enhancement of this technology as an essential component of industrial control systems with security operation centers, as well as offering cyber security management for small and medium-sized enterprises (SMEs) with restricted security expertise and capabilities.

Organisational culture and information security awareness of Chinese grassroots civil servants: A mediated moderation model

AbstractDigital information and data significantly improve the efficiency of government work in China. At the same time, in order to deal with information security and data leakage events, public departments have begun to pay attention to the information security awareness and behaviour of civil servants. Based on organisational culture and protection motivation theory, this study constructed a mediated moderation model to explore the influence mechanism of grassroots civil servants’ awareness of information security. This study collected 324 questionnaires from four regions of China. Results show that organisational culture has a significant positive impact on information security awareness. Professional identity has a significant positive effect on public service motivation and plays a negative moderating role in the relationship between organisational culture and information security awareness. Public service motivation mediates the moderating effect of professional identity on the relationship between organisational culture and information security awareness. The findings of this study offer practical implications and suggestions for further research.Points for practitioners The construction of organisational culture will effectively enhance the information security awareness of Chinese grassroots civil servants. Public departments should consider professional identity as an important factor when selecting grassroots civil servants engaged in information security work. In the implementation of information security management strategy planning, government departments can pay attention to and emphasise the public service motivation of grassroots civil servants.

Research on the Influence of Social Media Emotion on Information Behaviour in Information Security Events

The popularity of the Internet leads to frequent information security events, and emotional differences under different information security events lead to behavioural differences. In order to study the influence of social media emotions on information behaviour under different event types, this study selected emotion-related behavioural data of microblog users based on two types of information security events. The results show that negative emotions negatively affect information adoption behaviour and positively affect information interaction behaviour. Positive emotions are the opposite; Low arousal positively affects information interaction behaviour. High arousal positively affects information adoption behaviour. Hacking events positively moderated the relationship between negative emotion and information interaction behaviour, low arousal emotion and information adoption behaviour. Data disclosure negatively moderates the relationship between positive emotion and information adoption behaviour, low arousal emotion and information interaction behaviour, and positively moderates the relationship between positive emotion and information interaction behaviour. It provides the basis for enterprises to “take appropriate medicine” in the face of different information security events, and has certain reference value.

The Future of SIEM in a Machine Learning-Driven Cybersecurity Landscape

As cyber threats become increasingly sophisticatedand complex, traditional Security Information and Event Management (SIEM) systems are struggling to keep up. The integration of artificial intelligence (AI) and machine learning (ML) into SIEM tools is transforming the way organizations detect, investigate, and respond to security incidents. This paper explores the future of SIEM tools in the context of the evolving cybersecurity landscape and discusses how organizations can prepare for the adoption of ML-enabled SIEM systems.ML-enabled SIEM systems significantly enhance the capabilities of traditional SIEM tools,enabling them to more effectively detect and respond to both known andemergingthreats.Organizations must develop a robust data strategy,invest in talent,and adopt ML-enabled SIEM solutions gradually to fully take advantage ofthepotentialof these technologies.Staying up-to-date with the latest trends in ML and cybersecurity isalsocrucial for organizations to maximize the benefits of ML-enabled SIEM tools.

Research on sustainable development of agricultural product cold chain logistics under public safety emergencies

Under a sudden public security event, as agricultural cold chain logistics has the characteristics of many participating subjects and wide spatial and temporal distribution, it is extremely vulnerable to shocks. Even minor disruptions in logistics can result in a significant impact on the daily lives of residents. Therefore, improving the resilience of agricultural cold-chain logistics is crucial for sustainable development. This paper studies the sustainable development path of agricultural cold chain logistics from a resilience perspective. Through rooting theory, the process of resilience in agricultural cold chain logistics under sudden public safety events is explored. Based on the knowledge meta-model, three elements of resilience events, resilient subjects, and resilience measures are used to contextualize the resilience process, and finally, using Bayesian networks and fuzzy set theory, a contextual derivation model of the resilience process of agricultural cold chain logistics under sudden public safety events is created. The results show that the resilience process of sustainable development consists of a resistance period, an adaptation period, a readjustment period, and an innovation period, during which the government and enterprises jointly take measures to effectively resist the impact of public emergencies, and further enhance the resilience through innovative development to ensure the sustainable development of agricultural cold chain logistics.

Study on the environmental effect on human being detection using the UWB bio-radar

Objective: Non-contact penetrating detection and sensing of human beings (vital signs) through nonmetallic obstacles (ruins, wall, and smog) using the ultra-wideband (UWB) bio-radar plays a significant role in various post-disaster rescue operations in national public security events, like earthquake, building collapse, and factory explosion. In practical application scenarios, the narrowband radio frequency interference (RFI) and surrounding movement interference (SMI) are the two most common and major types of environmental interference (EI), which would cause serious effects on the penetrating detection performance of the UWB bio-radar.Methods: Therefore, through establishing a quantitative and controllable experiment system and combining a proposed quantitative evaluation method, this paper quantitatively investigates and evaluates the influencing characteristics and laws of these two interferences on human vital sign detection using the UWB bio-radar. In the quantitative experiments, two key environmental spatial parameters (interference distance and angle) of interference sources and two kinds of system parameters (main lobe width and time window) of the UWB bio-radar are considered.Results: Numerous experiments at different interference positions and corresponding statistical results demonstrated that both the RFI and SMI have a high negative correlation with the interference distance. Meanwhile, the SMI, which is highly related to the interference angle, could be screened or isolated by the detecting time window and main lobe boundary of UWB bio-radar, but the RFI could not be detected.Discussion: This study shows potential in providing transcendental knowledge and guidance for special EI suppression study, and even for the future design, manufacture, and rational use of the UWB bio-radar, facilitating improvement in the practical performance and effectiveness of the UWB bio-radar search and rescue system.

SELID: Selective Event Labeling for Intrusion Detection Datasets.

A large volume of security events, generally collected by distributed monitoring sensors, overwhelms human analysts at security operations centers and raises an alert fatigue problem. Machine learning is expected to mitigate this problem by automatically distinguishing between true alerts, or attacks, and falsely reported ones. Machine learning models should first be trained on datasets having correct labels, but the labeling process itself requires considerable human resources. In this paper, we present a new selective sampling scheme for efficient data labeling via unsupervised clustering. The new scheme transforms the byte sequence of an event into a fixed-size vector through content-defined chunking and feature hashing. Then, a clustering algorithm is applied to the vectors, and only a few samples from each cluster are selected for manual labeling. The experimental results demonstrate that the new scheme can select only 2% of the data for labeling without degrading the F1-score of the machine learning model. Two datasets, a private dataset from a real security operations center and a public dataset from the Internet for experimental reproducibility, are used.