Situation Awareness Model Research Articles

Deep learning-based security situational awareness and detection technology for power networks in the context of big data

Abstract With the comprehensive promotion of “big data + energy”, new power network security threats are also more prominent, and the traditional security system mainly based on “protection” will face great challenges. Firstly, this paper proposes four kinds of network security situational awareness detection techniques based on distributed data analysis by combining the characteristics of big data in power networks. Secondly, the CRIT-LSTM power network security situational awareness model is constructed by improving its loss evaluation process using the cross entropy (CE) function and improving the LSTM unit structure using linear unit (ReLU). Finally, the performance of the three models is compared and analyzed under two aspects of neural network training and testing and various metrics to verify the models’ effectiveness. The results show that the improved CRIT-LSTM model based on deep learning, combining LSTM and ReLU algorithms, has an RMSE of 0.717 for the training set and 0.806 for the test set. 7.32% accuracy and 10.51% improvement in recall compared to the LSTM-only model. The power network security situational awareness model based on the CRIT-LSTM model proposed in this paper integrates various security system functions to maximize the defense against attacks and reduce unnecessary security risk losses.

Implementation of Cybersecurity Situation Awareness Model in Saudi SMEs

Implementation of Cybersecurity Situation Awareness Model in Saudi SMEs

A Network Security Situation Awareness Method Based on GRU in Big Data Environment

Aiming at the “bottleneck” problems of the traditional network security situation awareness model, such as large equipment limitations, single data source and poor integration ability, weak level of autonomous learning and data mining, a network security situation awareness framework suitable for big data is constructed. A gate recurrent unit (GRU) model is established to effectively extract features from the situation data set through the deep learning algorithm of big data. It is a method to automatically mine and analyze the hidden relationship and change trend of network security situation, realize the high-speed acquisition and fusion of massive multi-source heterogeneous data, and perceive the network security situation from an all-round perspective. The experimental results show that this method has a good awareness effect on network threats, and has strong representation ability in the face of network threats. It can effectively perceive the network threat situation without relying on data labels, which verifies that this method can effectively improve the efficiency and accuracy of security situation awareness.

Industrial internet security evaluation technology based on digital twin

In the process of industrial Internet security situation analysis, affected by the perception model, the average approximation error of security assessment results is high. Therefore, an industrial Internet security evaluation technology based on digital twin is proposed. Design the industrial Internet assessment mode, design the industrial Internet technical framework according to the digital twin, and clarify the elements of security situation assessment. According to the sliding time window, the fuzzy knowledge base is established. The security situation awareness model is designed based on digital twin, combined with the calculation results of fuzzy closeness to improve the accuracy of automatic perception results. Establish a multi port access protocol and realize the industrial Internet security evaluation technology under the digital twin with the help of the backed up coded key file. The experimental results show that the accuracy of the evaluation results of the design method is always above 95%, the tamper-proof success rate is always above 95%, and the physical value difference between the final values is 0.10. Therefore, this method effectively improves the evaluation accuracy. and tamper-proof success rate, reducing the difference value, it effectively controls the deviation of Internet operation data, provides security, is feasible and effective.

Understanding situation awareness in SOCs, a systematic literature review

Situation awareness is shown through human factors research to be a valuable construct to understand and improve how humans perform while operating complex systems in critical environments. Within cyber security one such environment is the Security Operations Center (SOC). With the increasing threat of hybrid warfare, knowledge about situation awareness within SOC environments, where human error or low performance may be detrimental, must be developed. This paper reports on the results of a Systematic Descriptive Literature Review of the current research on situation awareness within SOCs. The goal of the paper is to analyze how situation awareness is understood in the current research. To achieve this goal three aspects of understanding were addressed: Theoretical foundations; levels of conceptualization; and measurement of situation awareness. Theoretical foundations in the literature were assessed by how situation awareness was defined and the presence of references to theoretical models of SA. The results show a clear trend of basing the research on Endsley's three level situation awareness model; this model has been developed into a domain specific formulation called “Cyber Situation Awareness”. Some parts of the literature, particularly in research aimed at developing tools for improving situation awareness, lack a theoretical foundation; some refer to alternative theoretical foundations of situation awareness like Stanton et al.’s Distributed Situation Awareness. Further, a balance between conceptualizations on the individual, group and system level has been identified. Within research aimed at developing tools for improving situation awareness there are some examples of specialized and precise measurements of situation awareness, but in general the research seems too reliant on indirect measures of situation awareness. The paper concludes with the proposition of connecting the systems-based theoretical perspective of distributed situation awareness into the research, utilizing a systems level conceptualization of situation awareness. This might prove to be a useful bridge between the human cognitive perspective of situation awareness and the development of the complex technical environment of critical importance that SOCs represent.

Supporting Human-AI Teams:Transparency, explainability, and situation awareness

System autonomy and AI are being developed for a wide variety of applications where they will likely work in tandem with people, forming human-AI teams (HAT). Situation awareness (SA) of autonomous systems and AI has been established as critical for effective interaction and oversight of these systems. As AI capabilities grow, and more effective teaming behaviors are expected of AI systems, there will also be an increased need for shared SA between the human and AI teammates. Methods for supporting team SA within HAT are discussed in terms of team SA requirements, team SA mechanisms, team SA displays and team SA processes. A framework for understanding the types of information that needs to be shared within HAT is provided, including a focus on taskwork SA, agent SA, and teamwork SA. AI based on learning systems creates new challenges for the development of good SA and mental models. AI transparency and explainability are discussed in terms of their separate roles for supporting SA and mental models in HAT. The SA Oriented Design (SAOD) process is described as a systematic methodology for developing transparent AI displays for HAT and an example of its application to automated driving in a Tesla is provided.

Fire emergency response systems information requirements' data model for situational awareness of responders: A goal-directed task analysis

Building fire emergencies are considered a high-risk domain for significant loss of lives and property. Accurate information and Situational Awareness (SA) enable fire responders to make timely decisions and perform safe operations during fire emergencies. Although information technologies such as Building Information Modeling (BIM) and the Internet of Things (IoT) have the potential to supply information and support the decision-making processes of fire emergency response, the provided data are not necessarily the needed information at the operation level. This paper uses Goal-Directed Task Analysis (GDTA) to define fire emergency responders' SA Goals, Decisions, and Information (GDI) requirements. The semi-structured scenario-based interviews were conducted with ten Municipal fire department experts to determine GDI requirements. Based on the identified requirements, the SA-oriented use-case and sequence data models for decision-support Fire Emergency Information Systems (FERS) were developed to reveal the dynamic aspect of the FERS and to describe how the system should behave to enhance the SA of responders. The use-case data model visualizes the possible interactions of fire responders with the system, and the sequence data models visualize the order of the interactions and the call/return messages between the lifelines of the FERS. The validation of the GDI requirements and data models were performed by obtaining experts' feedback, and based on the feedback; the models were finalized. The SA GDI requirements and data models can eventually be helpful for FERS's user-friendly graphical interface design to support responders with higher SA. The FERS, which has comprehension and projection levels of information, will enhance effective decision-making, especially in cases where the skills and training of the firefighters are not sufficient to direct the emergency response.

Increasing situation awareness in healthcare through real-time simulation

Research into real-time simulation applications outside of manufacturing environments has extended to sociotechnical systems such as healthcare over the past decade, where a number of published studies have demonstrated proof-of-concept models for near-future resource planning. Using real-time decision-support systems, people take decisions supported by the output of simulations. However real-time simulation frameworks abstract human intervention to an “external decision-maker,” with little regard to the complexities of underlying decision-making constructs, and how design and development decisions can impact the quality of decision-support. One such construct is situation awareness (SA), which is a precursor to decision-making. It is a dynamic state of knowledge about how a situation is unfolding; one approach to enhancing situation awareness is the provision of appropriate real-time information. We argue that design, development and implementation decisions should be focused at the interface between decision-making and decision-support. This integrative literature review proposes a SA framework integrating models of SA with a technical perspective for real-time simulation, to support an understanding of the cognitive needs of users alongside technical details during the development process. The implications for the usefulness and usability of real-time decision-support tools are discussed with application to Emergency Departments.

A dynamic landslide hazard monitoring framework for the Lower Mekong Region

The Lower Mekong region is one of the most landslide-prone areas of the world. Despite the need for dynamic characterization of landslide hazard zones within the region, it is largely understudied for several reasons. Dynamic and integrated understanding of landslide processes requires landslide inventories across the region, which have not been available previously. Computational limitations also hamper regional landslide hazard assessment, including accessing and processing remotely sensed information. Finally, open-source software and modelling packages are required to address regional landslide hazard analysis. Leveraging an open-source data-driven global Landslide Hazard Assessment for Situational Awareness model framework, this study develops a region-specific dynamic landslide hazard system leveraging satellite-based Earth observation data to assess landslide hazards across the lower Mekong region. A set of landslide inventories were prepared from high-resolution optical imagery using advanced image-processing techniques. Several static and dynamic explanatory variables (i.e., rainfall, soil moisture, slope, relief, distance to roads, distance to faults, distance to rivers) were considered during the model development phase. An extreme gradient boosting decision tree model was trained for the monsoon period of 2015–2019 and the model was evaluated with independent inventory information for the 2020 monsoon period. The model performance demonstrated considerable skill using receiver operating characteristic curve statistics, with Area Under the Curve values exceeding 0.95. The model architecture was designed to use near-real-time data, and it can be implemented in a cloud computing environment (i.e., Google Cloud Platform) for the routine assessment of landslide hazards in the Lower Mekong region. This work was developed in collaboration with scientists at the Asian Disaster Preparedness Center as part of the NASA SERVIR Program’s Mekong hub. The goal of this work is to develop a suite of tools and services on accessible open-source platforms that support and enable stakeholder communities to better assess landslide hazard and exposure at local to regional scales for decision making and planning.

An Agent-Based Model for Situational Awareness at Workplace

An Agent-Based Model for Situational Awareness at Workplace

Research on the Identification of Internet Critical Nodes Based on Multilayer Network Modeling

The research goal of cyberspace security situational awareness analysis is to predict the future security development of the target network by acquiring, understanding, and displaying the security elements in the large-scale network environment. Current cyberspace security situational awareness systems are mostly based on traditional single-layer network topology to analyze the security of the target network's operational posture. However, as the scale of the network continues to expand, the network structure becomes more complex, and the information fusion in multiple fields in practical applications deepens, the single-layer topology model can no longer meet the analysis requirements. In this paper, we construct a multilayer network topology model for cyberspace security situational awareness by integrating multidimensional information in the physical device layer network, business application layer network, and user role layer network. Meanwhile, to eliminate the limitations of traditional node importance indicators, a node importance assessment indicator that integrates topological centrality and node dependency factor is proposed in conjunction with model characteristics: multilayer dependency CRITIC indicator ( MDCI ). On the one hand, MDCI fits a variety of evaluation metrics through the CRITIC multi-attribute decision method to comprehensively assess the importance of nodes in network centrality, and on the other hand, MDCI better aggregates the important contributions of nodes in each network layer based on node dependency factor to coordinate multilayer network information. The experimental results show that MDCI has better ordering monotonicity and generates more stable metric sequences, and can effectively cause large-scale failures in multilayer network while destroying fewer physical device components, which can be better adapted to the critical node identification needs of multilayer network.

Research on security situation awareness method of power network Monitoring system based on data mining

In the traditional security situation awareness methods of power network monitoring systems, there are deviations in the analysis of different sample data sets, which affect the security situation threat value perception results of power network monitoring systems. Therefore, this paper designs a security situation awareness method for a power network monitoring system based on data mining. The identification structure of security situation elements is determined, the self-encoder is used for mapping, the security situation elements of the power network monitoring system are extracted according to the obtained parameter samples, and the security situation awareness model of the power network monitoring system is established. The RBF neural network is used for data mining of the monitoring system, and the design of the security situation awareness method of the power network monitoring system based on data mining is completed. The experimental results show that the recognition accuracy of the design method for samples with different threat levels is more than 90%. Compared with the traditional methods, the security situation awareness results obtained by the design method are closer to the expected output threat value.

From scattered data to actionable knowledge: flexible cyber security reporting in the military domain

Numerous cyber situational awareness models have been proposed in recent years. Yet, one of the main challenges still remains mostly unsolved, which is what information sources contribute to the process for establishing cyber situational awareness and how is relevant information collected. While previous scientific works focused on situational awareness models and decision support based on common operating pictures, ingesting and maintaining a consistent data basis for the cyber domain has rarely been studied in detail. However, this is crucial when data distributed across different systems need to be collected, vetted, correlated, de-duplicated, enriched and finally stored as a basis for flexible cyber security reporting. In this paper, we design an approach and a data model that enable to ingest and store the essential information from disparate organizational units and act as a basis for the flexible creation of cyber security reports. We describe the application of this approach and model in a case study together with the Austrian Ministry of Defense (MoD), in which we surveyed existing data sources and transfer paths and rated the applicability of the CCOP data model and accompanying processes in course of a proof-of-concept implementation.

A Vision Inference Action Model for Shared Situational Awareness in Autonomous Agents: Approaches, Challenges, & Future Directions

Although there has been a recent increase of research investment in Human Autonomy Teams (HATs), many significant technical challenges and research gaps persist. Specifically, recent reports indicate the need for shared situational awareness within HATs. Shared situational awareness is a necessary precursor for essential team mechanisms, such as communication, coordination, cooperation, cohesion, and trust. Various modeling techniques have approached agent situational/shared awareness; however, these approaches have been limited to simulation environments. In order to achieve HATs in real-world contexts, agents will need to leverage autonomous perception (e.g., vision, audition, and task knowledge) to gain situational awareness of their environment and teammates. In this paper, we discuss approaches toward agent shared situational awareness, challenges/limitations, and review our efforts toward developing shared situational awareness within our Vision Inference Action (VIA) model and ideas for future research.

Network Security Situational Awareness Based on Genetic Algorithm in Wireless Sensor Networks

How to design an effective and secure user authentication scheme suitable for complex wireless sensor network (WSN) environments has very important research significance. Based on the genetic algorithm theory, the paper constructs the security situational awareness model of wireless sensor network, and studies the WSN user security authentication scheme. The model uses the genetic algorithm extraction technology combined with the hash function to generate the biometric key, which solves the data accuracy problem of network security situational awareness: the user’s biometric key is obtained through the fuzzy extraction technology; the resistance of the node is to be attacked, but it is powerless when most of the nodes are broken, and it limits the scalability of the network. During the simulation process, the authentication of the identity of the cluster head by the base station is added in the topology establishment stage, and a one-way hash function and a shared key are added to the key management, so that the encryption key and the authentication key change periodically and dynamically, so that enhanced network communication security. The analysis results show that the protocol is feasible. The algorithm proposed in this paper reduces about 70% of the features in the original feature set, the classification detection rate is increased from 95.7212% to 97.7379%, and the false alarm rate is reduced from 7.9427% to 3.1072%, effectively improving the balance between safety and design cost.

Information Security Risk Assessment Using Situational Awareness Frameworks and Application Tools

This paper describes the development of situational awareness models and applications to assess cybersecurity risks based on Annex ISO 27001:2013. The risk assessment method used is the direct testing method, namely audit, exercise and penetration testing. The risk assessment of this study is classified into three levels, namely high, medium and low. A high-risk value is an unacceptable risk value. Meanwhile, low and medium risk values can be categorized as acceptable risk values. The results of a network security case study with security performance index indicators based on the percentage of compliance with ISO 27001:2013 annex controls and the value of the risk level of the findings of the three test methods showed that testing with the audit method was 38.29% with a moderate and high-risk level. While the test results with the tabletop exercise method are 75% with low and moderate risk levels. On the other hand, the results with the penetration test method are 16.66%, with moderate and high-risk levels. Test results with unacceptable risk values or high-risk corrective actions are taken through an application. Finally, corrective actions have been verified to prove there is an increase in cyber resilience and security.

Situation-Aware Sensor-Based Wearable Computing Systems: A Reference Architecture-Driven Review

In the last fifteen years, there has been a widespread diffusion of wearable sensorized devices for a plethora of applications in heterogeneous domains. Wearable technology provides fundamental capabilities such as smart sensing, monitoring, data recording, and multi-modal interaction, in a seamless, pervasive, and easy-to-use way. An emerging research trend is the definition of situation-aware wearable computing systems, i.e., wearable devices able to perceive and understand what is happening in the environment in order to adapt their behavior and anticipate users’ needs, a capability known as situation awareness. Although the increasing interest of the research community in situation-aware wearable devices, there is a lack of studies, formal models, methodological approaches, and theoretical groundings on which these systems can be grounded. As a result, a very limited number of smart sensors (physical or virtual) capable of effectively and efficiently supporting Situation Awareness have been proposed so far. In this article, we provide a survey and a classification of state-of-the-art situation-aware wearable systems, outlining current research trends, shortcomings, and challenges, with an emphasis on the models, approaches, and computational techniques of situation awareness and wearable computing on which they are based. The survey has been performed using the PRISMA methodology for systematic reviews. The analysis has been conducted with respect to a reference architecture, namely SA-WCS, of a generic situation-aware wearable computing system that we propose in this article, grounded on Endsley’s model of Situation Awareness. Such reference architecture not only provides a systematic framework for the comparison and categorization of the works, it also aims to promote the development of the next generation WCS.

Imaginaries of omniscience: Automating intelligence in the US Department of Defense.

The current reanimation of artificial intelligence includes a resurgence of investment in automating military intelligence on the part of the US Department of Defense. A series of programs set forth a technopolitical imaginary of fully integrated, comprehensive and real-time 'situational awareness' across US theaters of operation. Locating this imaginary within the history of 'closed world' discourse, I offer a critical reading of dominant scholarship within military circles that sets out the military's cybernetic model of situational awareness in the form of the widely referenced Observe, Orient, Decide, Act or OODA Loop. I argue that the loop's promise of dynamic homeostasis is held in place by the enduring premise of objectivist knowledge, enabled through a war apparatus that treats the contingencies and ambiguities of relations on the ground as noise from which a stable and unambiguous signal can be extracted. In contrast, recent challenges to the closed-world imaginary, based on critical scholarship and investigative journalism, suggest that the aspiration to closure is an engine for the continued destructiveness of US interventions and the associated regeneration of enmity. To challenge these technopolitics of violence we need a radically different kind of situational awareness, one that recognizes the place of ignorance in perpetuating the project of militarism. Only that kind of awareness can inform the public debate required to re-envision a future place for the US in the world, founded in alternative investments in demilitarization and commitments to our collective security.

Exploration of Mobile Device Behavior for Mitigating Advanced Persistent Threats (APT): A Systematic Literature Review and Conceptual Framework.

During the last several years, the Internet of Things (IoT), fog computing, computer security, and cyber-attacks have all grown rapidly on a large scale. Examples of IoT include mobile devices such as tablets and smartphones. Attacks can take place that impact the confidentiality, integrity, and availability (CIA) of the information. One attack that occurs is Advanced Persistent Threat (APT). Attackers can manipulate a device’s behavior, applications, and services. Such manipulations lead to signification of a deviation from a known behavioral baseline for smartphones. In this study, the authors present a Systematic Literature Review (SLR) to provide a survey of the existing literature on APT defense mechanisms, find research gaps, and recommend future directions. The scope of this SLR covers a detailed analysis of most cybersecurity defense mechanisms and cutting-edge solutions. In this research, 112 papers published from 2011 until 2022 were analyzed. This review has explored different approaches used in cybersecurity and their effectiveness in defending against APT attacks. In a conclusion, we recommended a Situational Awareness (SA) model known as Observe–Orient–Decide–Act (OODA) to provide a comprehensive solution to monitor the device’s behavior for APT mitigation.

Synergetic Model of Situational Awareness of a Human Operator in Ergatic Control Systems of Mobile Objects

At present, researches of ergatic control systems for moving objects, in which an important role is assigned to the human operator, are of particular relevance. The effectiveness of the functioning of such systems largely depends on the state of the human operator and, first of all, on his situational awareness. Insufficient or inadequate awareness of the operator about the situation in such systems is one of the main factors of accidents associated with human error. Therefore, the task of creating models of professional activity of a human operator, including models of his situational awareness, is urgent. It is shown that situational awareness is based on mental models of a human operator. Their adequacy depends on many subjective characteristics (factors) peculiar to a person, for example, his intelligence, mental state, accumulated experience. Mathematical formalization will reduce the subjective component in the formation of situational awareness. It is noted that important properties of situational awareness of the human operator are associativity and ranking of information depending on the context of the problem being solved. Therefore, situational awareness provides perception of the current situation and allows you to make the right decisions in response to certain threats. The levels of implementation of situational awareness in a human operator are given. A feature of the first level is the need for joint processing of a large amount of heterogeneous information in order to identify significant facts and critical information about external objects. The task of the second level is to form a holistic picture of the situation, which is based on existing knowledge and previous experience. The third, highest level of understanding of the situation is based on the ability of a person to predict the actions of moving objects and the consequences of these actions. It is proposed to form a model of situational awareness based on Haken’s synergetic approach. Like most other intelligent systems, the synergetic Haken’s model includes learning and recognition processes. A description of the process of recognizing a critical situation using a trained synergetic model is given. The value of the attention parameter, which characterizes the importance of a specific characteristic of the state of the controlled object in the ergatic system, is noted. The associative properties of the synergetic model and its ability to rank the initial information in the process of threat analysis during helicopter control are investigated.