Threat Actors Research Articles

Enhance Security and Privacy in VANET Based Sensor Monitoring and Emergency Services

VANET performs analysis of patient records and sends security warnings to the carer through VANET so that they may provide urgent assistance while keeping patient data safe. Threat actors might potentially access data packets that go between biological sensors and smart ambulances in the vehicular network. When healthcare professionals use a VANET, they run the risk of receiving inaccurate or delayed data as a result of assaults like the Sybil attack, denial of service attacks, and impersonation attacks. As a result, protecting people’s personal information and data has become an important task for academics. In this research, we propose the use of an Urbanized Block Chain Key Agreement Protocol (UB-KAP) based on a one-way hash chain model to increase protections for individual privacy and data integrity in VANET-based healthcare networks. The messages include timestamps in case the messages that have already expired cause excessive delays. The beacons’ packet classification mechanism separates them into benign and harmful emergency signals to speed up response times. The suggested model is tested by road traffic simulation using SUMO (Simulation of Urban Mobility). Data collection per user, message delivery ratio, total data gathered, delay, and energy usage are all included in the model’s overall evaluation.

2022 WEST COAST SECURITY CONFERENCE WELCOMING REMARKS

On November 21, 2022, Candyce Kelshall, President of the Canadian Association for Security and Intelligence Studies Vancouver, delivered her welcome remarks for the 2022 West Coast Security Conference. During her welcoming remarks she stated that the conference was designed for Canada, its military, law enforcement, and the public safety community. Kelshall spoke about the importance of the public safety community considering the emergence of new threat actors and new technologies, changing from state-based responses to identity-based responses when assessing new threats, adapting to changing norms, and collaborating beyond boundaries. Received: 2022-12-27Revised: 2022-12-27

Enhancing cyber security in health care industry by using ISO 27001 accreditation

Healthcare Industry plays a pivotal role in every one's life and with rapid advancements in cyber-attack vectors, threat actors and their strategies it has in-need created a necessity and a challenge to the numerous organizations and to the Governments as well, to stand guard and secure the institutes and the data stored with them. To design a secure healthcare system involves several considerations to protect sensitive patient data and ensure the confidentiality, integrity, and availability of information. Lot of work has been published on cyber security along with importance of protecting the Personally Identifiable Information (PII) and patient health records stored in hospitals, and also comparisons were made between paid or licensed tools and open source; however, implementation of the tools in real time was not in place where the financial limitations are a real concern and security is a need. This paper has given insight into important parameters such as risk assessment and security policies etc.

AI-based Cybersecurity Attacks and Countermeasures in IoT Environment: A Survey

The Internet of Things (IoT) has been considered an innovative integrated solution that opened opportunities for intelligent appliances to communicate over the Internet. However, IoT suffers from various cybersecurity threats because of its openness and the constraints of the used devices that share substantial amounts of classified information. Artificial intelligence (AI) is an effective key technology in solving cybersecurity issues. Cybercriminals are adopting AI techniques to conduct sophisticated attacks on IoT environments. Precise and elusive attacks across various applications have exemplified the deliberate employment of artificial intelligence for malicious intentions. Threat actors are constantly changing and improving their attack strategies with particular emphasis on applying AI-driven techniques in the attack process, called AI-based cybersecurity attacks, which can be used with conventional attack techniques to cause considerable damage. Moreover, AI techniques can be utilized in cyber-attack countermeasures and have proven effective. Unfortunately, these types of attacks and countermeasures have not been investigated enough in the existing literature. This paper surveys the current studies of AI-based cybersecurity attacks and countermeasures in the IoT environment. The aspects captured by this paper highlight future research in this field and will assist in recognizing the power and impact of using AI in cybersecurity, especially in the IoT environment.

Attack Behavior Extraction Based on Heterogeneous Cyberthreat Intelligence and Graph Convolutional Networks

The continuous improvement of the cyber threat intelligence sharing mechanism provides new ideas to deal with Advanced Persistent Threats (APT). Extracting attack behaviors, i.e., Tactics, Techniques, Procedures (TTP) from Cyber Threat Intelligence (CTI) can facilitate APT actors’ profiling for an immediate response. However, it is difficult for traditional manual methods to analyze attack behaviors from cyber threat intelligence due to its heterogeneous nature. Based on the Adversarial Tactics, Techniques and Common Knowledge (ATT&CK) of threat behavior description, this paper proposes a threat behavioral knowledge extraction framework that integrates Heterogeneous Text Network (HTN) and Graph Convolutional Network (GCN) to solve this issue. It leverages the hierarchical correlation relationships of attack techniques and tactics in the ATT&CK to construct a text network of heterogeneous cyber threat intelligence. With the help of the Bidirectional Encoder Representation from Transformers (BERT) pretraining model to analyze the contextual semantics of cyber threat intelligence, the task of threat behavior identification is transformed into a text classification task, which automatically extracts attack behavior in CTI, then identifies the malware and advanced threat actors. The experimental results show that F1 achieve 94.86% and 92.15% for the multi-label classification tasks of tactics and techniques. Extend the experiment to verify the method’s effectiveness in identifying the malware and threat actors in APT attacks. The F1 for malware and advanced threat actors identification task reached 98.45% and 99.48%, which are better than the benchmark model in the experiment and achieve state of the art. The model can effectively model threat intelligence text data and acquire knowledge and experience migration by correlating implied features with a priori knowledge to compensate for insufficient sample data and improve the classification performance and recognition ability of threat behavior in text.

The law that is changing the telco sector for the better

Our national infrastructure is at risk. Telecommunications companies provide essential services, but are major targets for cyber threat actors. However, new legislation in the UK is aiming to push telco organisations towards more-secure practices and technologies.

ANALYSIS OF CURRENT THREATS TO THE INFORMATION SECURITY OF ORGANIZATIONSAND THE FORMATION OF THE INFORMATION PLATFORM AGAINST THEM

Taking into account the process of complication of the geopolitical and geoeconomic landscape space, the development of information technologies and the formation of new security challenges associated with the emergence of new cyber threats, there is a need for constant monitoring and forecasting of them in order to prevent consequences in the form of damage and leakage of valuable and confidential information. The authors analyzed the new predictable cyber security threats to organizations, with special attention paid to the protection of endpoints. Threats identified in the field of artificial intelligence development (underground development of malicious Large Language Models (LLM); “Script Kiddies” update; voice fraud for social engineering, which is created by artificial intelligence); changing trends in the behavior of threat actors (attacks on supply chains against managed file transfer solutions, malware threats that are becoming multilingual); as new emerging threats and attack methods (growing QR code rivalry; stealth attacks on peripheral devices; Python implementation in Excel creating a potentially new vector for attacks; LOL drivers changing action algorithms). The resulting detection of future threats emphasizes the need for strategic planning for the adoption of new technologies and platforms: such as Endpoint Detection and Response (EDR) capabilities, as well as the use of EDR as part of a multi-instrumented enhanced detection and response (XDR) architecture. Gartner’s research has been proven to have a tremendous impact on improving organizations’ threat detection capabilities by providing valuable insight into the strengths and weaknesses of each cybersecurity service provider with respect to emerging threat intelligence, by focusing organizations’ attention on opportunities to identify gaps in their existing security infrastructure and adopt sound decisions to invest in additional solutions or services that effectively address these gaps. The spheres of activity of the world’s leading companies were analyzed, their connection with Ukrainian companies was found, and further cooperation was proposed for the effective protection of national cyberspace.

Holistic attack methods against power systems using the IEC 60870-5-104 protocol

IEC 60870-5-104 is a widely used protocol for telecontrol in European power systems. However, security was not a design goal when it was originally published: This protocol lacks built-in security features such as encryption, integrity protection, or authentication. In this paper, we describe novel types of attacks against the protocol in a holistic way. Therefore, we also enumerate the possible entry points of the threat actors and demonstrate a new technique, where the malicious actor can precisely target the attack. These methods are demonstrated both on simulated environment and actual devices and compared with already published methods.

Spheres of influence and tools for implementing hybrid threats: models and mechanisms

The article provides a solution to the current scientific problem of substantiating and distinguishing spheres of influence and tools for the implementation of hybrid threats in the context of defining models and relevant mechanisms. It is comprehensively argued that hybrid threats are aimed at changing states and creating necessary situations in several areas by applying combinations of tools. Each tool targets one or more areas or the interaction between them, creating or exploiting a vulnerability or exploiting an opportunity. This is why it is important to identify the areas of possible influence or critical functions that a state must ensure resilience against hybrid threats, as they are strongly related to national security and the state's decision-making capacity. According to the results of the analysis of literary sources on hybrid threats, thirteen spheres of influence are distinguished: political, economic, infrastructural, legal, social, cultural, military, informational, cybernetic, public administration, diplomatic, intelligence, communication. It has been proven that in each sphere there are specific models and mechanisms by which a hybrid threat actor can cause the desired effect for him, moreover, this effect can cover different spheres, as they are closely related to each other. It was established that before the emergence and spread of the concept of hybrid threats, the main approach always included military intervention and physical occupation as a prerequisite for capturing an independent country. But in modern conditions, significant control of an actor over a certain object can be achieved without mandatory participation in open military operations. In addition, actors can use a hybrid threat strategy to weaken the target state without any intention of physical control. This means that a military-oriented approach may not provide an accurate picture of the entire spectrum of current threats and challenges. It is shown that in any conceptual work it is important to find a balance between detail and analytical value of generalization. It may be worth noting that there are still multiple subfields, and some of the examples below show combinations of different fields, so there may be alternative approaches to both consolidation and expanding the domain list.

Should the Private Sector and Prime Contractors Adhere to the Federal FASC and FedRAMP Regulations?

This article argues that it is in the best interest of private sector organizations and prime contractors to adhere to the Federal Acquisition Supply Chain Security (FASC) and the Federal Risk and Authorization Management Program (FedRAMP) regulations. The paper opines that an organization should follow a supply chain security program, whether from the federal government or otherwise, because such obedience tends to reduce the risk of loss from various factors, including cybercrime. In the modern world, where cyber-attacks from threat actors are common, and the illicit profits gained from such activities can be huge, devotion to a supply chain risk management program is paramount. Thus, loyalty to a supply chain risk mitigation program is critical.

Why deep learning holds the key to preventing cyberattacks before they can strike

Cyber security has always been a game of cat and mouse, with both sides reacting and attempting to outflank each other. While the security industry continuously develops new solutions for identifying and preventing attacks, the threat actors are innovating and evolving their techniques to bypass these defences. In order to break away from a reactive approach, organisations must prevent and neutralise the threat before it can execute inside their network. This is where deep learning (DL) comes in.

Cyber threat attribution using unstructured reports in cyber threat intelligence

Cyber-threat attribution is the identification of attacker responsible for a cyber-attack. It is a challenging task as attacker uses different obfuscation and deception techniques to hide its identity. After an attack has occurred, digital forensic investigation is conducted to collect evidence from network/system logs. After investigation and collecting evidence reports are published in multiple formats such as text and PDF. There is no standard format for publishing these reports, so extracting meaningful information from these reports is a challenging task. Manual extraction of features from unstructured cyber-threat intelligence (CTI) is a difficult task. There is a need for an automated mechanism to extract features from unstructured reports and attribute cyber-threat actor (CTA). The aim of this research is to develop a mechanism to attribute or profile cyber threat actors (CTA) by extracting features from CTI reports. Moreover define a methodology to extract features from unstructured CTI reports by using natural language processing (NLP) techniques and then attributing cyber threat actor by using machine learning algorithms. Extracting features i.e., tactics, techniques, tools, malware, target organization/country and application by using novel embedding model known as” Attack2vec” which is trained on domain specific embeddings. Training model on domain specific embedding produces high results as compared to model train on general embeddings specially in the field of cyber security. Results of this novel model is compared with different methods. Machine learning algorithms such as decision tree, random forest, support vector machine is used for classification of CTA. This novel model produces high results as compared to other models with Accuracy of 96%, Precision of 96.4%, Recall of 95.58% and F1-measure of 95.75%.

A Systematic Review on Social Robots in Public Spaces: Threat Landscape and Attack Surface

There is a growing interest in using social robots in public spaces for indoor and outdoor applications. The threat landscape is an important research area being investigated and debated by various stakeholders. Objectives: This study aims to identify and synthesize empirical research on the complete threat landscape of social robots in public spaces. Specifically, this paper identifies the potential threat actors, their motives for attacks, vulnerabilities, attack vectors, potential impacts of attacks, possible attack scenarios, and mitigations to these threats. Methods: This systematic literature review follows the guidelines by Kitchenham and Charters. The search was conducted in five digital databases, and 1469 studies were retrieved. This study analyzed 21 studies that satisfied the selection criteria. Results: Main findings reveal four threat categories: cybersecurity, social, physical, and public space. Conclusion: This study completely grasped the complexity of the transdisciplinary problem of social robot security and privacy while accommodating the diversity of stakeholders’ perspectives. Findings give researchers and other stakeholders a comprehensive view by highlighting current developments and new research directions in this field. This study also proposed a taxonomy for threat actors and the threat landscape of social robots in public spaces.

Evaluating the Strategic Consequences of Cyber Targeting Strategies on Road Transport Networks

The explosive growth in connected vehicle infrastructures and IoT-enabled traffic systems opens the potential for novel societal impacts stemming from cyber-attacks on transportation systems. Researchers and threat actors have demonstrated that they can gain control of safety-critical vehicle functions, compromise poorly authenticated third-party apps, as well as modify supervisory control and data acquisition (SCADA) systems. This raises the question of where policy makers should invest to reduce the most significant consequences of a cyberattack on road infrastructure. In this paper, the authors develop a network-based approach in conjunction with historical trip information to quantify the network impacts of cyberattacks on road networks in Washington DC. They find that a highly targeted attack on only 10 SCADA-controlled signaling devices at specific locations disrupts a third of the most efficient paths in Washington DC. The results open the possibility of layered deterrence strategies that minimize the disruptive consequences of cyberattacks, thereby reducing benefits to attackers.

Defence against the dark art of zero-day attacks

Many organisations remain vulnerable to zero-day attacks. Zero-day attacks, by definition, give developers zero time to find and patch existing vulnerabilities that could be exploited, because the threat actor got in first. The damage is done and then it's a mad scramble to fix both the software and reputational damage to the business. Attackers are always at an advantage, and reducing that edge as much as possible is crucial.

Detection of Fake Replay Attack Signals on Remote Keyless Controlled Vehicles Using Pre-Trained Deep Neural Network

Keyless systems have replaced the old-fashioned methods of inserting physical keys into keyholes to unlock the door, which are inconvenient and easily exploited by threat actors. Keyless systems use the technology of radio frequency (RF) as an interface to transmit signals from the key fob to the vehicle. However, keyless systems are also susceptible to being compromised by a threat actor who intercepts the transmitted signal and performs a replay attack. In this paper, we propose a transfer learning-based model to identify the replay attacks launched against remote keyless controlled vehicles. Specifically, the system makes use of a pre-trained ResNet50 deep neural network to predict the wireless remote signals used to lock or unlock doors of a remote-controlled vehicle system. The signals are finally classified into three classes: real signal, fake signal high gain, and fake signal low gain. We have trained our model with 100 epochs (3800 iterations) on a KeFRA 2022 dataset, a modern dataset. The model has recorded a final validation accuracy of 99.71% and a final validation loss of 0.29% at a low inferencing time of 50 ms for the model-based SGD solver. The experimental evaluation revealed the supremacy of the proposed model.

MultiRHM: Defeating multi-staged enterprise intrusion attacks through multi-dimensional and multi-parameter host identity anonymization

Advanced and persistent multi-staged intrusion attacks are usually conducted by elite well-resourced cyber threat actors with the goal of bypassing the defense-in-depth and zoning policies of enterprise networks and accessing critical internal assets which are embedded deep in the target network (Hutchins et al., 2011; Wilkens et al., 2021). Starting from an externally reachable host, these attacks compromise a chain of network hosts until they reach their targets. Each compromised host could provide attackers access to new systems and network zones, thus enabling them to intrude deeper into the network. While conventional detection-based mechanisms are necessary to defeat such attacks, they are not enough as they can be evaded by stealthy or zero-day attack techniques.To complement these conventional approaches, in our previous works (Jafarian et al., 2015b; 2016; 2014a), we have proposed several proactive defense techniques based on the paradigms of cyber agility and cyber deception to defeat various types of cyber intrusions through disrupting their reconnaissance. While each of these techniques can individually defeat a specific type of reconnaissance, none is individually enough to defeat different types of reconnaissance on which multi-staged intrusions rely.In this paper, we first show that defeating multi-staged intrusion attacks requires a synergistic fusion of a group of coordinated strategies for (1) disrupting both external and internal reconnaissance, (2) defeating both active (e.g., port-scanning) and passive (e.g., sniffing) reconnaissance, as well as (3) disrupting collaborative reconnaissance and information reuse as attackers laterally move inside the internal network. Then, building on our previous approaches, we present a novel proactive technique, called MultiRHM, that anonymizes different identifying attributes of network hosts (IP address, MAC address, domain name responses to rDNS queries, and fingerprints) over different dimensions (time and space) to obfuscate identities of network hosts against all aforementioned types of reconnaissance. We present the necessary architectures, protocols, and algorithms for the deployment of MultiRHM in an enterprise network. Through both theoretical analysis and simulation, we show that MultiRHM is highly effective in defeating multi-staged intrusion attacks.

The Forensics Artifacts on Remote Desktop Protocol and Service

Remote Desktop Protocol provides users with a graphical user interface to access the system remotely and its implementation is called “remote desktop services”. This is widely used by network administrators and remote workers. Due to vulnerabilities and weak configurations, the protocol is hugely abused by threat actors and hackers to perform malicious acts such as data infiltration, deploying backdoors, malware, and lateral movements. In this article, there will be a discussion on the importance of RDP in digital forensics, understanding RDP-based artifacts and there use in forensics investigations where RDP was suspected to be involved.

The AI-Cybersecurity Nexus: The Good and the Evil

AI is both good and bad for cybersecurity defenders—and for adversaries. This article outlines the nexus between AI and cybersecurity and explores how artificial intelligence (AI) can enhance information systems security. It discusses how threat actors also could use AI to create sophisticated attacks that evade detection, and how AI could become a victim of new sophisticated cyberattacks.

Identifying Vulnerabilities and Reducing Cyber Risks and Attacks Using a Cyber Security Lab Environment

Abstract: In the present digital world where everyone is trying to digitalize their data and assets, cyber-attacks and cyber-crimes have made their presence felt much more than when compared to the previous period. During the pandemic days, the number of state sponsored and nation sponsored threat actors who pose the threat of attacking our organizational assets has increased rapidly. Organizations, especially which fall under the critical information infrastructure are becoming an increasingly common target for cyber-attacks. The rate has alarmingly gone up that the national and state government have started to give more attention and focus to cyber security and cyber-crimes. Specific bodies have been assigned by the government to notify about threats/attacks and also to suggest possible techniques to mitigate these threats/attacks. Most devices that are used in these organization are either using older versions of devices or the devices used are not properly cyber secured. This vulnerability is most often taken advantage of by the attacker when trying to access and compromise the organization. Another factor leading to cyber breaches and attacks is the limited or low competency level of employees who work in these organizations. Employees with weak cybersecurity knowledge are the main entry point for online fraud, viruses, and other threats. This creates a situation where business owners and managers should focus on teaching employees the importance of strong digital security. This report describes different techniques and tools which can be used to detect vulnerabilities or threats present in our system, the different cyber-attacks that can take place exploiting these identified vulnerabilities: How to generate an attack, How to identify an attack and How to prevent an attack. Further on, how we can create an environment, where individuals can have hands-on experience on how to detect different cyber threats or vulnerabilities present on a device which makes them confident enough to identify a cyber-attack or threat at an early stage and deploy preventive measures against it is also discussed.