Threat Information Research Articles

COUNTERING DISINFORMATION POLICY: CHALLENGES FOR UKRAINE’S NATIONAL SECURITY

he article examines the problems of combating disinformation in the conditions of a modern full-scale war and overcoming the challenges facing the national security of Ukraine. The concept of disinformation, its impact on public consciousness and the key mechanisms of the spread of false information are outlined. The main directions of the policy of combating disinformation aimed at ensuring information security and resistance to information attacks have been studied. The importance of the development of media literacy among the population as one of the main tools for countering disinformation campaigns through educational programs and social interaction is revealed. The experience of combating disinformation in the developed countries of the world, the USA and the countries of the European Union, is analyzed. The role of state and international initiatives, the cooperation of governments with technology companies, as well as the implementation of legislative mechanisms are highlighted. The main tools aimed at regulating the spread of false information in the information space are revealed. The study emphasizes the importance of active cooperation with international partners to ensure an effective fight against disinformation at the global level. Special attention is paid to the role of international organizations in the formation of a unified strategy for countering disinformation attacks. Prospects for attracting international support for the development of national information protection systems and Ukraine's participation in global information security initiatives are being considered. Proposed means of an effective policy of combating disinformation, which combine legislative, technical and educational measures. The methods of ensuring resistance to external information threats are characterized. Particular attention is paid to media literacy programs, which have become important elements of national strategies in the fight against fakes and disinformation attacks. The article considers the possibilities of implementing international experience in Ukraine with the aim of strengthening national information security. The expediency of developing complex programs, including the strengthening of modern means of monitoring the information space and raising the level of critical thinking among the population, is analyzed. Emphasis is placed on the need to create a national security strategy for combating disinformation, which will allow effective response to new threats and ensure information security in the conditions of modern warfare.

How distributed subcortical integration of reward and threat may inform subsequent approach-avoidance decisions.

Healthy and successful living involves carefully navigating rewarding and threatening situations by balancing approach and avoidance behaviours. Excessive avoidance to evade potential threats often leads to forfeiting potential rewards. However, little is known about how reward and threat information is integrated neurally to inform approach or avoidance decisions. In this preregistered study, participants (Nbehaviour=31, 17F; NMRI=28, 15F) made approach-avoidance decisions under varying reward (monetary gains) and threat (electrical stimulations) prospects during functional MRI scanning. In contrast to theorized parallel subcortical processing of reward and threat information before cortical integration, Bayesian Multivariate Multilevel analyses revealed subcortical reward and threat integration prior to indicating approach-avoidance decisions. This integration occurred in the ventral striatum, thalamus, and bed nucleus of the stria terminalis (BNST). When reward was low, risk-diminishing avoidance decisions dominated, which was linked to more positive tracking of threat magnitude prior to indicating avoidance than approach decisions across these regions. In contrast, the amygdala exhibited dual sensitivity to reward and threat. While anticipating outcomes of risky approach decisions, we observed positive tracking of threat magnitude within the salience network (dorsal anterior cingulate cortex, thalamus, periaqueductal gray, BNST). Conversely, after risk-diminishing avoidance, characterized by reduced reward prospects, we observed more negative tracking of reward magnitude in the ventromedial prefrontal cortex and ventral striatum. These findings shed light on the temporal dynamics of approach-avoidance decision-making. Importantly, they demonstrate the role of subcortical integration of reward and threat information in balancing approach and avoidance, challenging theories positing predominantly separate subcortical processing prior to cortical integration.Significance statement When deciding whether to approach or avoid situations, our decision-making involves balancing potential rewards and threats. Widespread theories of decision-making in humans propose parallel processing of reward and threat information in subcortical regions, followed by cortical integration. Challenging these notions, we found evidence for dual and integrated processing of reward and threat in subcortical regions during decision-making. In contrast, after decision-making, we observed the expected parallel processing while anticipating decision outcomes. These findings advance our understanding of approach-avoidance decision-making processes, opposing traditional views that segregate brain regions as predominantly reward-sensitive or threat-sensitive, thereby paving the way for a more nuanced perspective that takes into account the stage of decision-making.

Анализ угроз информационной безопасности органов государственной власти с помощью нейронных сетей

<p>Ensuring the information security of public authorities requires the use of specialized tools that take into account various sources of information threats and their constant changes. This study aims to develop a methodology for analyzing these threats using neural networks. The research uses methods such as machine learning and neural network analysis to systematize the data. The authors adapted the Multi-Layer Perceptron (MLP) architecture and configured the hyperparameters of the neural network to achieve their objectives. The neural network was trained using the Python programming language, and its effectiveness was evaluated using metrics such as accuracy, precision, recall, and F1 score. The results of the study included the development of a method for creating a data set that encompasses assessments of threats to the information security of various public authorities and their sources. Additionally, the study evaluated the effectiveness of neural networks in solving classification problems for public authorities. Finally, the study interpreted the results of neural network analysis to determine the resistance of public authorities against information security threats.</p>

TIMFuser: A Multi-granular fusion framework for cyber threat intelligence

Cyber attack campaigns with multiple technical variants are becoming increasingly sophisticated and diverse, posing great threats to institutions and every individual. Cyber Threat Intelligence (CTI) offers a novel technical solution to transition from passive to active defense against cyber attacks. To counter these attacks, security practitioners need to condense CTIs from extensive CTI sources, primarily in the form of unstructured CTI reports. Unstructured CTI reports provide detailed threat information and describe multi-step attack behaviors, which are essential for uncovering complete attack scenarios. Nevertheless, automatic analysis of unstructured CTI reports is challenging. Furthermore, manual analysis is often limited to a few CTI sources. In this paper, we propose a multi-granular fusion framework for CTIs from massive CTI sources, comprising a comprehensive pipeline with six subtasks. Many current CTI extraction systems are limited by mining intelligence from a single source, thereby leading to challenges such as producing a fragmented view of attack campaigns and lower value density. We fuse the attack behaviors and attack techniques of the attack campaigns using innovative and improved multi-granular fusion methods and offer a comprehensive view of the attack. TIMFuser fills a critical gap in the automated analysis and fusion of multi-source CTIs, especially in the multi-granularity aspect. In our evaluation of 739 real-world CTI reports from 542 sources, experimental results demonstrate that TIMFuser can enable security analysts to obtain a complete view of real-world attack campaigns, in terms of fused attack behaviors and attack techniques.

The methods and tools of ensuring information security of networks

Currently, there is an increase in the number of information threats that lead to unstable operation of data networks. This is due to the mass use, the complication of the hierarchy of area networks, the increase in the heterogeneity of software tools, and the complication of the functionality of network services. In such cases, the development and improvement of methods for determining information security in data transmission networks has a great importance. The article discusses ways to increase the information security of the data network by increasing the reliability of detecting deviations in the operation of the main nodes of the data network and reducing the number of false starts when automating the detection of threats. Experimental verification and evaluation of the effectiveness of the methods were considered, it was shown that the developed methods allow skipping the anomaly of the first type and minimizing errors of the second type. The methods were implemented software in the form of a prototype access detection system (ADS).

CLASSIFIERS OF DESTRUCTIVE IMPACTS IN DIGITAL SPACE

The digital format of public relations actualizes the issues of information security and information security. The article analyzes the normative acts containing the concepts of "destructive event" and "destructive action". They describe the sources of information threats emanating from man-made and anthropogenic sources and are associated with violations of confidentiality, accessibility and reliability of information, stability and reliability of information systems. The author came to the conclusion, as a result of the analysis conducted in the article, that the concept of "destructive actions" is more universal and defines the requirement not to take actions aimed at violating the information security of an information system and information. The concept of "destructive events" is used in a narrow technical area related to the disruption of the functioning of information systems at two levels of the OSI model - determining the route and addressing of data and communication between the endpoints of the transmitted data.

SPM-SeCTIS: Severity Pattern Matching for Secure Computable Threat Information Sharing in Intelligent Additive Manufacturing

Sharing Cyber Threat Intelligence (CTI) enables organisations to work together to defend against cyberattacks. However, current methods often fail to adequately protect sensitive information, leading to security risks, especially in Intelligent Additive Manufacturing (IAM) systems. In these systems, the security and privacy of incident data collected by IoT devices are essential, as revealing threat information, such as types, impacts, and organisational interests, could be harmful. To address these challenges, we propose the Severity Pattern Matching for a Secure Computable Threat Information Sharing System (SPM-SeCTIS). This system is designed to maintain privacy by allowing intermediaries to pass along threat information without accessing sensitive details, such as the type or severity of the threats. SPM-SeCTIS ensures that attackers cannot determine which incidents organisations are interested in or what specific threats they monitor. The system employs Homomorphic Encryption (HE) to conduct threat pattern matching on encrypted data, keeping sensitive information confidential even during analysis. Our performance tests indicate that SPM-SeCTIS operates efficiently, requiring minimal time for encryption and decryption processes. Additionally, the system scales effectively, handling a large number of subscribers and incidents with ease. Compared to existing methods, SPM-SeCTIS provides improved security measures and better overall performance, making it a robust solution for protecting sensitive threat information.

Внешние и внутренние угрозы как фактор риска для ведения эффективной политической коммуникации органов местного самоуправления

The article outlines the features of political communication of local governments in the context of new information challenges and threats. The role of municipal administrations in the formation of the information field is determined by the example of the Saratov region. The tasks facing the heads of local administrations in the process of information and communication support of their professional activities in social networks are analyzed. The risk factors for information support of the activities of local governments in the modern information space are identified. The article also examines information threats related to both internal processes and external factors of influence that local administrations of both large and small municipalities have to work with in the information space. The author also defines a number of criteria and recommendations that contribute to reducing information risks and threats, which significantly improve the effectiveness of political communication of local governments.

Cyber Defense Using Cyber Threat Intelligence to Anticipate and Avoid Future Cyber Attacks

Research objective: This study evaluates the efficiency of cyber threat intelligence (CTI) for predicting and mitigating cyber threats, which is important in business today. Organisations endure cyber assaults and fight cyber crimes, which threaten commercial exposure. CTI is a proactive approach to these risks since it gives the finest methods and relevant information on potential cyber crimes. Research significance: This review article analyses the literature in the context to find gaps and include ethical research practices. This systematic study may determine how threat intelligence improves cyber security knowledge and eliminates cyber threats by examining assessable information. It may guide the development of new threat intelligence-influencing methods and frameworks. Methodology: Through a qualitative approach based on the systematic review, the study goals were evaluated, analysed, and explained. PRISMA chart was also used to describe exclusion and inclusion study criteria to ensure correct data gathering. The results were presented in a thematic analysis while examining article dependability, quality, and validity. The author used inductive research to reach the primary study conclusions. Using observations or data, inductive inquiry creates hypotheses or generalisations. Research findings: Threat intelligence may considerably increase an organisation's ability to anticipate and prevent cyber threats. The literature emphasised that threat information improves incident response, identifies new threats, and strengthens cyber security. Organisations should continually train and educate cyber security personnel to increase threat intelligence utilisation. Instruct incident response, threat intelligence analysis, and emerging threat trends.CTI helps a company grow smoothly and achieve its goals.

THE EVOLUTION OF CZECHIA’S SECURITY POLICY UNDER THE INFLUENCE OF THE RUSSIA-UKRAINE WAR

For now, almost all spheres of international life are in the process of transformation. A particularly high level of turbulence characterizes European security, which has faced numerous challenges over the past decade such as the migration crisis, terrorist acts, the COVID-19 pandemic, information threats, etc. Directly threatening the European Union’s eastern borders, Russia’s full-scale invasion has become one of the most crucial security challenges. In this regard, the EU and NATO member states have to review their approaches to ensuring security and stability. Due to Czechia’s membership in both of these blocs and its geographical proximity to a war zone, its security policy has undertaken changes at the current stage, which this article covered.This article defines the reasons for the evolution of the security policy of the Czech Republic. It is worth noting that due to its geographic proximity to the war zone, Czechia perceives Russia’s aggression as a direct threat to its national security. Apart from Russia’s full-scale invasion of Ukraine, the assessment of Russia’s perception of the country is influenced by the Russian military intelligence services’ involvement in the explosions at Czech weapons warehouses in 2014 and Russia’s espionage activities as well. Thus, the increasing regional tensions and the political crisis in international relations prompted the Czech Republic to revise its key security and defense files, according to which Russia and China have been defined as the main security threats.Moreover, the author concludes that support for Ukraine became part of Czechia’s security policy, where the country demonstrated its clear position and declared its intention to sign a security agreement with Ukraine. Also, it is necessary to commend the importance of Czechia’s artillery shells initiative to Ukraine. The Czech Republic has taken several practical steps to respond to security threats increasing its defense spending to 2% of GDP and investments in the defense industry, along with modernizing the military forces and diversifying energy resources in order to get rid of Russia’s dependence. Accordingly, a comprehensive approach to reacting to new security challenges and threats can minimize their impact on Czechia’s security in the future.

"Nobody Here Likes Her"-The Impact of Parental Verbal Threat Information on Children's Fear of Strangers.

Parental verbal threat (vs. safety) information about strangers may induce fears of these strangers in adolescents. In this multi-method experimental study, utilizing a within-subject design, parents provided standardized verbal threat or safety information to their offspring (N=77, Mage=11.62 years, 42 girls) regarding two strangers in the lab. We also explored whether the impact of parental verbal threat information differs depending on the social anxiety levels of parents or fearful temperaments of adolescents. Adolescent's fear of strangers during social interaction tasks was assessed using cognitive (fear beliefs, attention bias), behavioral (observed avoidance and anxiety), and physiological (heart rate) indices. We also explored whether the impact of parental verbal threat information differs depending on the social anxiety levels of parents or fearful temperaments of adolescents. The findings suggest that a single exposure to parental verbal threat (vs. safety) information increased adolescent's self-reported fears about the strangers but did not increase their fearful behaviors, heart rate, or attentional bias. Furthermore, adolescents of parents with higher social anxiety levels or adolescents with fearful temperaments were not more strongly impacted by parental verbal threat information. Longitudinal research and studies investigating parents' naturalistic verbal expressions of threat are needed to expand our understanding of this potential verbal fear-learning pathway.

Improving quality of indicators of compromise using STIX graphs

Cybersecurity relies on Indicators of Compromise (IoCs) to detect and address threats. Although Threat Intelligence Platforms (TIPs) and Open Source Intelligence (OSINT) are common sources for gathering IoCs, their reliability varies. In our study, we enhance the management of IoCs and OSINT by introducing a novel method that reliably assesses IoC’s threat severity and confidence scores, focusing on Structured Threat Information eXpression (STIX) for threat associations. Our approach, implemented on OpenCTI, significantly enhances IoC value, as it aggregates threat intelligence from diverse sources utilizing a STIX graph-based approach, which is a unique feature among TIPs. Additionally, our method employs heuristic analysis to optimize IoC scoring. It takes into account factors such as relevance, completeness, timeliness, accuracy, and consistency while emphasizing the confidence of the source. Notably, the proposed method has enhanced the precision of the confidence score, achieving a 25.18% reduction in the average difference of confidence scores compared to the benchmarked platform. The Emotet and Medusa case studies underscore the importance of source credibility in confidence scores, emphasizing our TIP’s precision in cybersecurity threat assessment and defense enhancement.

Правові механізми забезпечення інформаційної безпеки в Україні

The article considers the legal mechanisms for ensuring information security. It has been proven that today, more than ever, when there is a war in Ukraine, the issue of ensuring information security becomes especially relevant and significant, as the information space becomes a “battlefield” on a par with the war front. Enemy forces actively use informational and psychological operations to destabilize the situation inside our country, create panic, spread fakes and undermine trust in state institutions. In these conditions, the state’s policy becomes important, which should be integral and effective in countering these threats. An effective state policy in the field of information security will help ensure society’s resilience to information threats, strengthen trust in state institutions, and maintain stability in crisis conditions. The author’s understanding of information security is offered as a state of security of information resources and information systems, which ensures their confidentiality, integrity, availability and reliability, as well as protection against unauthorized access, disclosure, modification, destruction and other forms of abuse that may lead to a violation of national security, economic stability and social order. The main components of information security, which are the basis for information security for the state as a whole, individual bodies or private enterprises, are called confidentiality, integrity and availability. The main components of the mechanism for ensuring information security, in the opinion of the author, should be: technical (creation of appropriate technical infrastructure to ensure the functioning of information security), political (development of state policy aimed at ensuring information security) and legal (adoption of high-quality normative legal acts that will determine all information security measures). These three components complement each other and are key to creating an effective system of protection against information threats.

Analysing Multidimensional Strategies for Cyber Threat Detection in Security Monitoring

The escalating risk of cyber threats requires continuous advances in security monitoring techniques. This survey paper provides a comprehensive overview of recent research into novel methods for cyber threat detection, encompassing diverse approaches such as machine learning, artificial intelligence, behavioral analysis and anomaly detection. Machine learning plays a central role in cyber threat detection, highlighting the effectiveness of deep neural networks in identifying evolving threats. Their adaptability to changing attack patterns is emphasized, underlining their importance for real-time security monitoring. In parallel, ensemble learning is explored, combining multiple models to improve overall detection accuracy and create a robust defense against a spectrum of cyber threats. The literature reviewed highlights the importance of behavioral analysis, with a novel approach that integrates user behaviour profiling with anomaly detection. This has proven effective in identifying suspicious activity within a network, particularly insider threats and stealthy attacks. Another behavioral framework using User and Entity Behavior Analytics (UEBA) is presented for enhanced anomaly detection, highlighting the importance of context-aware monitoring in improving threat detection accuracy. Collaborative defense mechanisms emerge as a major focus of the research papers reviewed, exploring the potential of sharing threat information between organisations to enhance collective security monitoring. Their findings underscore the importance of a collaborative approach to staying ahead of rapidly evolving cyber threats. Some types of cyber-attacks are also analysed in the context of a security operations centre (SOC) monitoring environment using a security information and event management (SIEM) tool - Splunk. In conclusion, this survey paper synthesizes recent advances in cyber threat detection methods in security monitoring that integrate machine learning, behavioral analysis, and collaborative defense strategies. As cyber threats continue to evolve, these novel methods provide valuable insights for researchers, practitioners, and organisations seeking to strengthen their cybersecurity defenses. This concise overview emphasises the multi-dimensional approach required to secure digital ecosystems, providing a concise yet comprehensive guide to modern cyber threat detection strategies.

Guide to developing case-based attack scenarios and establishing defense strategies for cybersecurity exercise in ICS environment

Critical infrastructure mainly performs its role through an industrial control system (ICS). Organizations conduct cyber exercises between red and blue teams, focusing on offense and defense. Practical exercises require explicit attack scenarios and corresponding defense strategies. However, systematic guides for deriving cyberattack scenarios or defense strategies still need to be improved. This paper proposes a guide for establishing realistic attack scenarios and defense strategies for cybersecurity exercises in ICS environments. Attack scenario generation is divided into four steps: generating attack references, deriving attack sequences, mapping threat information, and mapping vulnerable implementation patterns. Deriving a defensive strategy consists of two steps parallel to developing an attack scenario: deriving containment and eradication. The methodology we propose guides exercise planning based on a knowledge base, thereby assisting exercise planners in generating various scenarios and deriving clear defense strategies. We showed that a clear exercise plan could be established through a case study.

An ethologically relevant paradigm to assess defensive response to looming visual contrast stimuli

In the animal kingdom, threat information is perceived mainly through vision. The subcortical visual pathway plays a critical role in the rapid processing of visual information-induced fear, and triggers a response. Looming-evoked behavior in rodents, mimicking response to aerial predators, allowed identify the neural circuitry underlying instinctive defensive behaviors; however, the influence of disk/background contrast on the looming-induced behavioral response has not been examined, either in rats or mice. We studied the influence of the dark disk/gray background contrast in the type of rat and mouse defensive behavior in the looming arena, and we showed that rat and mouse response as a function of disk/background contrast adjusted to a sigmoid-like relationship. Both sex and age biased the contrast-dependent response, which was dampened in rats submitted to retinal unilateral or bilateral ischemia. Moreover, using genetically manipulated mice, we showed that the three type of photoresponsive retinal cells (i.e., cones, rods, and intrinsically photoresponsive retinal ganglion cells (ipRGCs)), participate in the contrast-dependent response, following this hierarchy: cones > > rods > > > ipRGCs. The cone and rod involvement was confirmed using a mouse model of unilateral non-exudative age-related macular degeneration, which only damages canonical photoreceptors and significantly decreased the contrast sensitivity in the looming arena.

A content analysis of EPPM’s threat and efficacy information in environmental news: The impact of a community of practice and topic

The extended parallel process model summarizes the positive impact of threat and efficacy messages on behavioral intentions. In news contexts, research to date shows national journalists emphasize threat information and neglect efficacious information. Findings show U.S. university student journalists emphasized efficacy rather than threats countering past content analysis research. We also found environmental and sustainability communities of practice did not predict threat and efficacy information, but topics did.

The Implementation of Value Chain Holistic Model of Ulos Weaving Fabric Creative Industry

This research has a long-term goal to increase the income of stakeholders in the us weaving fabric industry in North Sumatra and the National Gross Domestic Product in Indonesia. The specific target to be achieved is to improve the concept of a value chain holistic model of the Ulos weaving fabric industry, which will soon be implemented. The methods used in achieving this goal are an experimental study by a value chain holistic model of the Ulos weaving fabric industry using the strength and opportunities strategy. Through a Focus Group Discussion involving MUSRENBANG, KOPERINDAG, City Government, Provincial Government, Ulos Weaving Fabric Manufacturers Group, Weaver Group, and Producers Cooperative, information and data will be collected, which will be grouped into Strengths, Weaknesses, Opportunities, and Threats information. The evaluation of data and information through a SWOT analysis shows the results that the proposed model is good and continues to implement a production and marketing strategy, where the establishment of a production cooperative will strengthen SMEs with a joint commitment of members and will facilitate the capital. The Association of SMEs was formed to produce quality production and standardized prices so as to be able to deal with internal competition properly, which will be able to support the Lake Toba tourist destination as a tourism activity in North Sumatera. Standing for marketing is also needed to support the construction of toll roads along the Lake Toba area through the tourist gateways of Medan and Silangit.

Empowering pro-environmental behavior in tourists through digital media: the influence of eco-guilt and empathy with nature.

In the digital economy era, leveraging digital media to foster tourists' pro-environmental behavioral intention (TPEBI) has become crucial in the field of sustainable tourism. While existing studies have mainly focused on the driving mechanism of TPEBI within physical tourism contexts, the correlation between digital media information sharing and TPEBI remains unclear. Our study employs the cognitive-affective-conative framework to construct a theoretical model, considering eco-guilt and empathy with nature as mediating variables. It aims to explore the influencing mechanism of destination environmental information sharing through digital media on TPEBI from a presence perspective. Thereby, two scenario experiments were designed: Study 1 examined the impact of different formats of destination environmental threat information presentation on digital media on the sense of presence, while Study 2 explored the influencing mechanism of presence on TPEBI based on the conclusions of Study 1. Results indicate that (1) vivid and visible presentation formats of destination environmental threat information on digital media enhance individuals' sense of presence; (2) sense of presence positively influences TPEBI; and (3) eco-guilt and empathy with nature mediate between presence and TPEBI. These findings not only contribute to theoretical and empirical research on digital media information sharing in sustainable tourism but also offer guidance for governments and tourism destinations to effectively stimulate TPEBI through digital media, achieve the sustainable development of destinations.

The cybersecurity entrepreneur

AbstractCybersecurity is a major U.S. policy issue with a sizable coalition asserting that self-regulation is failing, primarily due to rampant low quality security products and a dearth of threat information sharing. State intervention proponents, however, generally disregard the role of cybersecurity entrepreneurial activity in fixing disequilibria. My research identifies how entrepreneurs adeptly satisfy consumers’ cybersecurity preferences by developing strong self-regulating mechanisms where data valuations are relatively high. I then empirically examine how entrepreneurial innovations have ameliorated discoordination and significantly improved market outcomes over time through the application of the market process and price theory.