Threat Alerts Research Articles

Prioritize Threat Alerts Based on False Positives Qualifiers Provided by Multiple AI Models Using Evolutionary Computation and Reinforcement Learning

Prioritize Threat Alerts Based on False Positives Qualifiers Provided by Multiple AI Models Using Evolutionary Computation and Reinforcement Learning

A Proposed Approach to Integrate Application Security Vulnerability Data with Incidence Response Systems

This paper has proposed a method to develop an attack tree, from application vulnerability data discovered through tests and scans and correlation analysis using incoming transaction requests monitored by a Web Application Firewall (WAF) tool. The attack tree shows multiple pathways for an attack to shape through vulnerability linkages and a deeper analysis of the Common Weakness Enumeration (CWE) and Common Vulnerability Exposure (CVE) mapping to individual vulnerabilities. By further relating to a parent, peer, or child CWE (including CWEs that follow another CWE and in some cases precede other CWEs) will provide more insight into the attack patterns. These patterns will reveal a multi-vulnerability, multi-application attack pattern which will be hard to visualize without data consolidation and correlation analysis. The correlation analysis tied to the test and scan data supports a vulnerability lineage starting from incoming requests to individual vulnerabilities found in the code that traces a possible attack path. This solution, if automated, can provide threat alerts and immediate focus on vulnerabilities that need to be remedied as a priority. SOAR (Security Orchestration, Automation, and Response), XSOAR (Extended Security Orchestration, Automation, and Response), SIEM (Security Information and Event Management), and XDR (Extended Detection and Response) are more constructed to suit networks, infrastructure and devices, and sensors; not meant for application security vulnerability information as collected. So, this paper makes a special case that must be made for integration of application security information as part of threat intelligence, and threat and incident response systems.

TELER Performance as Real-Time Intrusion Detection and Threat Alert Based on Web Log-In Detecting Directory Bruteforce Attacks on Websites

TELER is a real-time intrusion detection and weblog-based alerting tool that runs on the terminal. TELER is designed to be a fast terminal-based threat analyzer. The IDS (intrusion detection system) is needed to help web administrators secure their servers. This study aims to test the TELER performance as real-time intrusion detection and threat alert. This study tries to implement an open-source application called TELER based on Golang. The IDS testing method on the web server this time uses directory brute force with the result that TELER can detect an attack and provide prompt notification to the web administrator when an attack occurs on the web server. The result of this study shows that the TELER successfully sent notifications to the Telegram, Discord, and Slack applications when an attack or intrusion occurs. Based on the experiments conducted in this study, Slack is the most effective application for receiving directory brute-force attack notifications. The average time for Slack to receive attack information is 0.03 seconds. TELER was successfully proven to detect cyberattacks.

No ultrasounds detected from fungi when dehydrated

Many organisms (including certain plant species) can be observed to emit sounds, potentially signifying threat alerts. Sensitivity to such sounds and vibrations may also play an important role in the lives of fungi. In this work, we explore the potential of ultrasound activity in dehydrating fungi, and discover that several species of fungi do not emit sounds (detectable with conventional instrumentation) in the frequency range of 10kHz to 210kHz upon dehydration. Over 5 terabytes of ultrasound recordings were collected and analysed. We conjecture that fungi interact via non-sound means, such as electrical or chemical.

Supplemental Material for Threat Alert: The Effect of Outliers on the Alliance–Outcome Correlation

Supplemental Material for Threat Alert: The Effect of Outliers on the Alliance–Outcome Correlation

Improved Detection and Response via Optimized Alerts: Usability Study

Security analysts working in the modern threat landscape face excessive events and alerts, a high volume of false-positive alerts, significant time constraints, innovative adversaries, and a staggering volume of unstructured data. Organizations thus risk data breach, loss of valuable human resources, reputational damage, and impact to revenue when excessive security alert volume and a lack of fidelity degrade detection services. This study examined tactics to reduce security data fatigue, increase detection accuracy, and enhance security analysts’ experience using security alert output generated via data science and machine learning models. The research determined if security analysts utilizing this security alert data perceive a statistically significant difference in usability between security alert output that is visualized versus that which is text-based. Security analysts benefit two-fold: the efficiency of results derived at scale via ML models, with the additional benefit of quality alert results derived from these same models. This quantitative, quasi-experimental, explanatory study conveys survey research performed to understand security analysts’ perceptions via the Technology Acceptance Model. The population studied was security analysts working in a defender capacity, analyzing security monitoring data and alerts. The more specific sample was security analysts and managers in Security Operation Center (SOC), Digital Forensic and Incident Response (DFIR), Detection and Response Team (DART), and Threat Intelligence (TI) roles. Data analysis indicated a significant difference in security analysts’ perception of usability in favor of visualized alert output over text alert output. The study’s results showed how organizations can more effectively combat external threats by emphasizing visual rather than textual alerts.

ATMoS+: Generalizable Threat Mitigation in SDN Using Permutation Equivariant and Invariant Deep Reinforcement Learning

Software-defined networking creates new opportunities for automated network security management by providing a global network view and a standard interface for configuring network policies. Previously, we proposed a general framework, called ATMoS, for autonomous threat mitigation using reinforcement learning (RL) in software-defined networks. Using a suitable set of host simulations and based on observations from an arbitrary network monitoring infrastructure, ATMoS can autonomously mitigate threats by moving hosts between a set of virtual networks that embody different network policies. In this article, we propose ATMoS+, which extends the RL agent in ATMoS with a novel Deep Q-Network architecture. The deep RL agent in ATMoS+ leverages permutation-invariant and permutation-equivariant set functions to relax previous assumptions on the number of network hosts and their ordering. We showcase that the proposed deep RL agent is scalable and generalizes to an arbitrary-sized network without additional retraining, scales with the number of hosts, and accommodates several different types of threat alerts.

Resource Specific Security Implementation in Network and Cloud System

The current Unified Threat Management (UTM) systems are limited to standard and specific security practices in cloud and network sub system risk evaluations. In this paper, we recommend dynamic security evaluation to counter live threats by analyzing history of attacks and vulnerability score. Our approach introduces Smart Threat Alert admin (STA) into UTM/firewall engine which scans at regular intervals to discover type, target and implications of attacks at all levels. This technique is an enhanced approach of (QUIRC) structure that captures exact threats experienced in the system but fails to discuss the effects of threats surrounded. This limitation is analyzed using cyber security modeling language (CuSeMOL) on features like vulnerability, probability, type and impact of dynamic attacks. This approach is different from threat specific and static asset risk evaluation system conversely, the proposed novel technique STA analyses internet ports, internet protocol addresses, hostnames and other auxiliary port services to countermeasure the security aspects cloud assets. The proposed setup was implemented at university data center firewall with suitable experiments and received satisfying results

Enhancing the security of routing in vehicular ad hoc networks

SummaryVehicular ad‐hoc networks (VANETs) depends on organizing the vehicles as versatile hubs in order to obtain a correspondence arrangement. The arrangement of vehicular specially appointed systems does not just encourage novel telematics applications. The selection of dynamic well‐being application raises new dangers to street well‐being if security issues are not appropriately taken care of. An extraordinary dynamic security application is observed as an empowerment to anticipate the passing trade in threat alerts which depends on singular perceptions. VANET is considered by many specialist co‐ops in urban situations. Where the communicate tempest will corrupt the guiding performance. The issue is addressed and examined by various protocols such as AODV, DSR, DYMO, TORA, and TIHOO. The proposed AESP‐VANET (Advanced and enhanced security protocol for VANET) is an upgraded security version which is developed using improved fluffy and cukoo search algorithm. The steady state between the source and destination hub is considered to deal the location issues in the network. The disclosure of the courses is restricted by AESP‐VANET using fuzzy framework and it constrains the messages which requires the course request. The improved cuckoo calculation in hybrid methodology, which is one of the best meta calculations particularly in the huge inquiry space, brilliantly chooses the most steady and ideal course among realized courses by computing an upgraded wellness work. AESP‐VANET gives out the result using Network Simulator 2. This shows a tremendous improvement in the throughput, overhead, and many more parameters.

Cyber Security System With SIEM And Honeypot In Higher Education

Communication science and information technology (ICT) has been progressing and contain complex implication for individual, groups and inter-country relationship. Along with ICT evolution, threats (including theft of information) increase and electronic systems are adopted. As a government agency in higher education with the country’s strategic data, XYZ cannot escape hackers trying to access the assets. Strategic assets include system and company’s data as well as systems and data which might be taken for granted by irresponsible parties. Therefore, it is necessary to secure information and data systems in XYZ. Moreover to test whether the implemented cyber security system can optimally standardize the company’s information and data systems. The application of Security Information Event Management (SIEM) to cyber security systems to detect incoming threat alerts and block access to suspicious threats. While the honeypot is used to deceive the hacker into a fake system intentionally attacked and learning the tricks that intruders use when performing the action. The results of the test of the application of SIEM and Honeypot at XYZ can monitor the monitoring of information system and data-related threats in real-time, and deter and transmit cyber-attacks to adequately protect information security so that the use of cyber security systems with SIEM & Honeypot can secure the information and data systems owned by XYZ optimal.

Threat Alert Prioritization Using Isolation Forest and Stacked Auto Encoder With Day-Forward-Chaining Analysis

Security Incident and Event Manager (SIEM) is a security management approach designed to identify possible threats within a real-time enterprise environment. The main challenge for SIEM is to find critical security incidents among a huge number of less critical alerts coming from separate security products. The continuously growing number of internet-connected devices has led to the alert fatigue problem, which is defined as the inability of security operators to investigate each incoming alert from intrusion detection systems. This fatigue can lead to human errors and leave many alerts being not investigated. Aiming at reducing the number of less important threat alerts presented to security operators, this paper presents a new method for highlighting critical alerts with a minimal number of false negatives. The proposed method employs isolation forest to ensure unsupervised performance and adaptability to different types of networks. Furthermore, it takes the advantage of day-forward-chaining analysis to ensure the detection of highly important alerts in real time. The number of false positive cases is reduced by employing an autoencoder. The proposed method achieved a recall score of 95.89% and a false positive rate of 5.86% on a dataset comprising more than half a million alerts collected in a real-world enterprise environment over ten months. This study highlights the importance of addressing the alert fatigue problem and validates the effectiveness of unsupervised learning in filtering out less important threat alerts.

From logs to Stories: Human-Centred Data Mining for Cyber Threat Intelligence

An average medium-sized organisation logs approx. 10 to 500 mln events per day on the system. Only less than 5% of threat alerts are being investigated by the specialised staff, leaving the security hole open for potential attacks. Insufficient information in alert message produced in machine-friendly rather than human-friendly format causes cognitive overload on currently limited cybersecurity resources. In this paper, the model that generates the report in natural language by means of applying novel storytelling techniques from security logs is proposed. The solution caters for different levels of reader expertise and preference by providing adjustable templates, filled from both local and global knowledge base. The validation is performed on case study from Security Operations Centre (SOC) at educational institution. The report generated proves superior to existing approach in terms of comprehension (increased cognition) and completeness (enriched context). The evaluation demonstrates power of storytelling in potential threats interpretation in cybersecurity context.

Effectiveness of visual warnings on young drivers hazard anticipation and hazard mitigation abilities

Previous studies have demonstrated that young drivers fail both to scan for and mitigate latent hazards mostly due to their cluelessness. This study aims to investigate whether these skills could be improved by providing young drivers with alerts in advance of the upcoming threat using a driving simulator experiment. In particular, the warning was presented on the head-up displays (HUD) either 2 s, 3 s or 4 s in advance of a latent threat. The hazard anticipation, hazard mitigation and attention maintenance performance of forty-eight young drivers aged 18–25 was evaluated across eight unique scenarios either in the presence or in the absence of latent threat alerts displayed on a HUD. There were four groups overall: one control group (no alert) and three experimental groups (2 s alert, 3 s alert and 4 s alert). The analysis of the hazard anticipation data showed that all three experimental groups with HUD warnings (2 s, 3 s, 4 s) significantly increased the likelihood that drivers would glance towards latent pedestrian and vehicle hazards when compared to the control group. The hazard mitigation analysis showed that in situations involving a pedestrian threat, HUD alerts provided 3 or 4 s in advance of a potential threat led drivers to travel significantly slower than the control group or the 2 s group. No significant effect of a HUD alert on drivers’ speed was found when the latent hazard was a vehicle. An analysis of eye behaviors showed that only 7 out of 597 glances at the HUD were longer than 2 s safety-threshold, indicating that the warnings do not seem to distract the driver.

Design of a Road- side Threat Alert System for Deaf Pedestrians

Listening is an important human skill which plays a vital role in our day to day life. Moreover, the reactions of people are very much correlated to the sounds they hear. Thus, deaf people have to undergo many difficulties in identifying threats when walking along roads. Many deaf pedestrians have lost their lives when walking along a road or crossing a road. Although many devices that support deaf pedestrians are being employed around the world, most of those devices are very expensive and also do not provide a detailed notification to the user. Hence, an improved deaf pedestrian assisting device is highly preferred. This paper proposes an electronic road-side threat alert system which would be a handy device to assist deaf pedestrians to identify objects moving behind them such as vehicles & other threats. With the help of this wearable device, they would be able to sense the environment around them. The proposed system is based on a microcontroller hosting a Bayesian classifier unit and an array of ultrasonic sensors for distance measuring. The notification to the deaf pedestrian is provided via a set of vibrating motors. A prototype implemented has demonstrated very good accuracy in the identification of threats at a low cost.

Rapidly Developing Subdural Empyema in an Adult with Sinusitis- A Neurosurgical Threat Alert!

Sinonasal inflammatory disorders usually have an innocuous clinical course; however, rarely they can affect the orbits, underlying bones, adjacent veins and the intracranial structures. Intracranial extension is the most dangerous complication of these disorders. The commonest form of intracranial involvement is subdural empyema with bacterial sinusitis being its leading cause. We present a rare case of rhinosinusitis that, within a few hours progressed into a large subdural empyema with severe mass effect and midline shift. The case highlights the importance of having a high index of clinical suspicion and low threshold for imaging in cases of sinusitis that present with subtle neurological signs and symptoms. We emphasize on the role of imaging in optimal management of these cases. The imaging helps in identification of catastrophic neurological complications early in the course of disease and thus guides the treatment approach.