Security-related Events Research Articles

Artificial Intelligence And Cyber Security

The rise of cyber threats has made it necessary for organizations to adopt more advanced and effective security solutions. AI-powered cybersecurity tools can help organizations detect and respond to potential cyber threats faster, more efficiently, and more accurately. These tools use machine learning algorithms to analyze vast amounts of data, including network traffic, user behavior, and security-related events, and can identify patterns and anomalies that could indicate potential threats. However, the use of AI in cybersecurity comes with challenges, including the potential for bias and errors in AI-based systems and a shortage of skilled professionals who can develop, deploy, and maintain these systems. Organizations must weigh the benefits and challenges of using AI in cybersecurity and develop a comprehensive strategy that incorporates the right mix of people, processes, and technology to ensure optimal cybersecurity posture

A review of models for transport security and of their relevance for supply chains

ABSTRACT Security represents one of the most important challenges for the global supply chains that characterise our globalised economic systems. The occurrence of (lack of) security related events has raised the attention of practitioners, governments and scholars. The aim of this paper is twofold. It first wants to propose a review of the models that concern transport security and to highlight that some of them refer to the prevention (regime models, proactive models and participation models) while others attain the efficient and effective reaction and the minimisation of the consequences of security related episodes (barrier models, preparedness models and reactive models). The presentation of the models is complemented by a comparative analysis that will draw some general remarks on the main common topics that emerge in the previous description and highlights the ever-increasing role of coordination and communication among stakeholders for the enhancement of transport security. The second objective of the paper lies in the subsumption of transport security in general Supply Chains. In order to reach this goal, the points of vulnerability and risk factors of the supply chain are considered. This analysis is then extended to a discussion of the main supply chain security practices and activities and of the relevant role played by the transport security models. The review allows to draw several conclusions. A sound security strategy is based on preparation and planning, alongside effective partnerships, structural and managerial adaptation and dedicated communications and technologies both in a static and in a dynamic perspective. Moreover, security strategies need to consider the trade-offs with privacy and with efficiency issues. Security efforts should be concentrated on the preeminent infrastructures, nodal points and arcs according to their degree of weakness and to their centrality in the supply chain. It is also important to plan a set of incentives for the firms that contribute to the security investments and of penalties for those who adopt a free-riding behaviour. Lastly, it is relevant to assess which share of security activities can be accomplished internally and the ones that have to be outsourced to security specialised firms.

Identification of reference scenarios for security attacks to the process industry

The possibility of inducing severe security-related events with damage to people, property, and the environment by deliberate malicious attacks to chemical and process plants handling large quantities of hazardous materials received an increasing attention in recent years. The identification of the credible security scenarios is required by Security Vulnerability/Risk Assessment (SVA/SRA) methodologies. However, the current availability of supporting tools is limited. This may hinder a proper management of the risks, especially in the European context where security threats are only marginally recognized under the Seveso legislation. The present study aims at supporting a harmonized identification of the scenarios triggered by deliberate malicious physical attacks to chemical and process plants. An approach based on Bow-Tie formalism is proposed to identify reference security scenarios. The Bow-Tie diagram is used to link the attack modes (Attack Tree) to the relevant release scenarios (Security Events) and to the physical damage scenarios (Event Tree). Reference Bow-Tie diagrams were defined considering substances commonly present in process plants (e.g. flammable substances and oxidizing solids). The validation of the reference scenarios (both attack scenarios and physical damage scenarios) was provided by the analysis of more than 20 security-related incidents that occurred in chemical and process facilities worldwide in the last 50 years. Application to a case-study proved the effectiveness of the results achieved in supporting SVA/SRA studies and in promoting integration among safety and security management.

Analysis of events involving the intentional release of hazardous substances from industrial facilities

Industrial infrastructures, in particular those where hazardous substances are stored or handled, may be the target of malicious acts aiming at the disruption of normal operations. In the present study a toolbox of complementary and synergic techniques (Correspondence Analysis (CA), Fishbone Diagrams, Cause-Consequence Chains, Adversary Sequence Diagram, Root Cause Analysis) was applied to the in-depth analysis of physical security- and cybersecurity-related events that affected the process industry. The unprecedented original set of information obtained provides novel insights concerning these events. Clear correlations among security threats, including cyber-threats, and specific industrial sectors, as well as among the final scenarios and the different security threats from which they originate were identified by CA. In particular, vandalism resulted strongly correlated with the transportation of hazardous substances, and theft of materials with oil and gas pipelines. When considering chemical and petrochemical sites, cyber-attacks and the use of improvised explosives resulted to be the most common attack modes performed by the threat actors. Personnel and vehicle gateways resulted key elements when designing the Physical Protection System (PPS) of a facility. Insiders having the permission to enter the site bypass such controls, and were responsible of several successful attacks. Overall, the results confirm the concreteness of security-related events in the process industry and provide an original structured and detailed insight on the attack patterns experienced to date. Moreover, the results and the data obtained provide a novel set of baseline information for the application of SVA (Security Vulnerability Assessment) or SRA (Security Risk Assessment) methodologies in facilities where hazardous substances are stored or processed.

Detecting Cyber Threat Event from Twitter Using IDCNN and BiLSTM

In the context of increasing cyber threats and attacks, monitoring and analyzing network security incidents in a timely and effective way is the key to ensuring network infrastructure security. As one of the world’s most popular social media sites, users post all kinds of messages on Twitter, from daily life to global news and political strategy. It can aggregate a large number of network security-related events promptly and provide a source of information flow about cyber threats. In this paper, for detecting cyber threat events on Twitter, we present a multi-task learning approach based on the natural language processing technology and machine learning algorithm of the Iterated Dilated Convolutional Neural Network (IDCNN) and Bidirectional Long Short-Term Memory (BiLSTM) to establish a highly accurate network model. Furthermore, we collect a network threat-related Twitter database from the public datasets to verify our model’s performance. The results show that the proposed model works well to detect cyber threat events from tweets and significantly outperform several baselines.

Značaj analitičke podrške u suprotstavljanju savremenim oblicima kriminaliteta u uslovima evropskih integracija

Police activity is unthinkable without the timely and complete collection of all security-relevant data. As today's greater availability of data and information in police practice does not mean greater predictability of manifestations of security-related events, data analysis should occur on a daily basis. To understand the ways crime incidents happen, to find the elements of the future in them and to predict their development, is an essential task of analysts. Starting from the specifics of decision-making in the police, the paper points to the importance of analytical work and analytical information for policing, but also examines the contribution of analytical support to the drafting of strategic and operational decisions in the European Union and the Republic of Serbia related to combating serious and organized crime.

Mobile agent-based SIEM for event collection and normalization externalization

Purpose This paper aims to propose a mobile agent-based security information and event management architecture (MA-SIEM) that uses mobile agents for near real-time event collection and normalization on the source device. The externalization of the normalization process, executed by several distributed mobile agents on interconnected computers and devices, proposes a SIEM server dedicated mainly for correlation and analysis. Design/methodology/approach The architecture has been proposed in three stages. In the first step, the authors described the different aspects of the proposed approach. Then they implemented the proposed architecture and presented a new vision for the insertion of normalized data into the SIEM database. Finally, the authors performed a numerical comparison between the approach used in the proposed architecture and that of existing SIEM systems. Findings The results of the experiments showed that MA-SIEM systems are more efficient than existing SIEM systems because they leave the SIEM resources primarily dedicated to advanced correlation analysis. In addition, this paper takes into account realistic scenarios and use-cases and proposes a fully automated process for transferring normalized events in near real time to the SIEM server for further analysis using mobile agents. Originality/value The work provides new insights into the normalization security-related events using light mobile agents.

2018

Retracing the pivotal privacy and security-related events and ensuing issues from the past year.

Probabilistic assessment of integrated safety and security related abnormal events: a case of chemical plants

Conventional risk assessment of chemical plants considers process accident related causal factors. In the current geopolitical situation, chemical plants have become the target of terrorism attacks, making security concerns as important as safety. To protect the public and environment from undue risks, security related causal factors need to be considered as part of the risk analysis of chemical plants. This paper presents an integrated approach to dynamically assess the occurrence probability of abnormal events. The abnormal event is a state of a process plant arrived either due to a process accident or an intentional (terrorist) threat. This approach considers both safety and security related risk factors in a unified framework. A Bayesian network is used to model specific evolution scenarios of process accidents directly initiated from security related factors and the interaction of causal factors. This model enables to dynamically analyze the occurrence probabilities of abnormal events and causal factors given evidence; it could also capture the impacts of interaction among safety and security related causal factors on these occurrence probabilities. The proposed approach is applied to an oil storage tank to demonstrate its applicability and effectiveness. It is observed that the effect of dependency between correlative accidental and security related factors significantly change the occurrence probability of abnormal events in dynamical assessment.

Analysis of physical and cyber security-related events in the chemical and process industry

Security threats are becoming an increasing concern for chemical sites and related infrastructures where relevant quantities of hazardous materials are processed, stored or transported. In the present study, security related events that affected chemical and process sites, and related infrastructures, were investigated. The aim of the study is to frame a clear picture of the threats affecting the chemical and process industry, and to issue lessons learnt from past events. A database of 300 security-related accidents was developed and populated, starting from European and American sources. Threat categories that caused such events were identified and analyzed. The attack modes were investigated. Important differences were found with respect to geographical areas and industrial sectors affected. The use of explosives (both military and improvised explosive devices) is by far the more frequent attack mode, although armed attacks and arson are also frequent events and may result in an in-depth penetration of the attackers. In recent years, cyber-attacks are also posing important threats. Lessons learnt call for the implementation of a specific security management system in the chemical and process industry, aiming at the physical and cyber protection of industrial sites.

The nature of maritime security risk

Security hazards pose serious risk concerns. But, what makes them unacceptable dangers, is our inability to accurately assess and manage them. The prevailing method of using threat, vulnerability, and consequence to arrive at a risk value has a limitation of interdependence of these variables. This is because the adversary plans his attack using the desired consequence to identify the actionable hazard. While engineering failures tend to be random and accidental in nature, security related events are opportunistic and intentional. Security assessment is further challenged by lack of reliable data, while usability expert opinion is limited due to optimism and overreaction. We have proposed a derivation of the standard methods of risk assessment to compensate for these biases.

Mining known attack patterns from security-related events

Managed Security Services (MSS) have become an essential asset for companies to have in order to protect their infrastructure from hacking attempts such as unauthorized behaviour, denial of service (DoS), malware propagation, and anomalies. A proliferation of attacks has determined the need for installing more network probes and collecting more security-related events in order to assure the best coverage, necessary for generating incident responses. The increase in volume of data to analyse has created a demand for specific tools that automatically correlate events and gather them in pre-defined scenarios of attacks. Motivated by Above Security, a specialized company in the sector, and by National Research Council Canada (NRC), we propose a new data mining system that employs text mining techniques to dynamically relate security-related events in order to reduce analysis time, increase the quality of the reports, and automatically build correlated scenarios.

Application of Evolving Self-Organizing Maps for Analysis of Human Adverse Events in the Context of Complex Socioeconomic Infrastructure Interactions

The main objective of this study was to investigate complex human socioeconomic infrastructure interactions and information on past human adverse events (AE) in an active war theater in order to predict future AE in a given geographical region. Human AE were defined as those security-related events that threatened human lives. Human socioeconomic infrastructure development data were derived by integrating three different datasets from different sources based on the United States Agency for International Development database. Using empirical data obtained from the country of Afghanistan from 2002 to 2010, we applied evolving self-organizing maps (ESOM) to forecast future patterns of such AE. Records from 2003–2009 were used as training data, while records from year 2010 were used to test the efficacy of ESOM in predicting AE. The socioeconomic data, dates, and geographical location information was used as input for the trained model. ESOM algorithm with supervised learning was effective in understanding future patterns of AE in a war region. The results also showed the possibility of predicting future AE based on the incomplete information pertaining to the geographical location, recent history of AE in the specific region of the country, and relevant socioeconomic infrastructure development data. The differences in applying the classical self-organizing maps and ESOM approaches for modeling of complex human socioeconomic infrastructure interactions were also discussed.

VMInformant: an instrumented virtual machine to support trustworthy cloud computing

We describe how a virtual machine VM owner can increase visibility about how a VM and its data are stored and processed in the cloud. We present 'VMInformant', a monitoring system which can keep the user informed about events that take place on their VM both inside the VM and via calls made through a hypervisor. A taxonomy of VM security-related events is presented, along with performance overheads associated with monitoring such events using CPU and I/O intensive benchmarks. We argue that having this level of transparency is essential to improve trust between a cloud consumer and provider.

Summing up

Considering recent privacy- and security-related events through this column.

Impact of a security event at a TRIGA reactor

The aim of this work is the study of the impact of security-related events and their consequences for research reactors, with particular emphasis on the off-site effects. The study case is done for the ENEA-Casaccia TRIGA RC-1 research reactor near Rome. The RC-1 Safety Report includes three different safety-related accident scenarios, namely the insertion of a step of positive reactivity, the uncontrolled extraction of all control rods at start-up or during a power variation and the emptying of the reactor pool. None of these scenarios imply radioactive releases at all. In this work, the focus is instead the description of the worst case scenario related to a security event and its consequences. Several possible scenarios have been analysed, however, the physical protection measures deter intrusions and, as shown by the Safety Report, even sabotage actions with major effects such as, the emptying of the reactor pool have no consequences on the fuel integrity. For these reasons, the worst security-related scenario considered in this work is a large plane crash with the complete destruction of the reactor hall and the reactor core. Propagation of the source term to the environment and the effective dose calculations have been performed using RASCAL, HOTSPOT and GENII codes following the ICRP-60 standards.

Improving Mobile Device Classification using Security Events for Preventing Wireless Intrusion

In current wireless intrusion prevention system (WIPS), the mobile devices are classified into one of three or four categories by classification algorithm for preventing wireless intrusion. But such a classification mechanism has difficulty to delicate control the wireless access of mobile device to an access point because of its simple classification. And it cannot estimate potential security threats arising from security vulnerability of mobile device itself. In this paper we improve mobile device classification for preventing wireless intrusion. In the proposed algorithm, the mobile devices are classified into nine categories. To do this we utilize the security related events of the device from the mobile device management (MDM) and authorization server.

Realizing Secure Cloud Computing Environment by ECA Rules

Cloud Computing is attracting more and more attention and is becoming the most important paradigm in the new century. However, the security problem has not been solved, which prevents the quick development of cloud computing. This paper proposes how to establish a manageable secure cloud computing environment. The management service for a secure cloud is mainly introduced, among which the security service is specially explained in details. An ECA-rule model is proposed to ensure an automatic activation when security-related events happen. The whole architecture is implemented above Hoodoop which gives the first experience of a secure cloud.

Network Security Alerts Management Architecture for Signature-Based Intrusions Detection Systems within a NAT Environment

Internet is providing essential communication between an infinite number of people and is being increasingly used as a tool for commerce. At the same time, security is becoming a tremendously important issue to deal with. Different network security solutions exist and contribute to enhanced security. From these solutions, Intrusion detection systems (IDS) have become one of the most common countermeasures for monitoring safety in computer systems and networks. The purpose of IDSs is distinguishing between intruders and normal users. However, IDSs report a massive number of isolated alerts. These isolated alerts represent low-level security-related events. Many of these isolated alerts are logically involved in a single multi-stage intrusion incident and a security officer often wants to analyze the complete incident instead of each individual simple alert. Another problem is that IDSs cannot work correctly with an environment managed with a NAT technique (Network Address Translation) since the host information (IP address and port number) are affected by the NAT devices. In order to address these limitations, the paper proposes a well-structured model to manage the massive number of isolated alerts and includes the NAT information in the IDS analysis. In fact, our solution permits to determine the real identities of entities implicated in security issues and abstracts the logical relation between alerts in order to support automatic correlation of those alerts involved in the same intrusion and to construct comprehensible attacks scenarios.

Structural health and bridge security in a multihazard environment

Structural Health Monitoring and multihazard considerations are being increasingly considered by the infrastructure owners and administrators for cost-effective evaluation and management. Besides natural hazards, infrastructure security has also become an essential consideration due to threats faced globally by all the infrastructure owners. Structural behavior to natural hazards and progressive deterioration is quite different than when it is subjected to a security related hazard such as blast loading. Thus, the role of Structural Health Monitoring (SHM) under security related hazard is quite different in temporal scale, i.e., its role before, during, and after a security related hazard event. This role is not well understood or studied in the literature. This paper sheds some light on these topics based on expert opinions and these results will be helpful to the infrastructure and security communities in understanding the role of health monitoring and multiple hazards considerations to focus/prioritize their future efforts in this field.