Threat Model Research Articles

Threat Modeling and Risk Assessment of Nuclear Facility from the Motivation Perspective

Threat Modeling and Risk Assessment of Nuclear Facility from the Motivation Perspective

A Comprehensive Threat Modelling Analysis for Distributed Energy Resources

The exponential rise in popularity of Distributed Energy Resources (DERs) is attributed to their numerous benefits within the power sector. However, the risks that new DERs pose to the power grid have not yet been closely assessed, exposing a gap in the literature. This paper addresses this gap by presenting a comprehensive threat model of the DER architecture, combining the MITRE ATT&CK catalogue for Industrial Control Systems (ICS), and the IDDIL/ATC threat model, to create a hybrid approach. Our first contribution is to propose criteria derived from seven metrics to evaluate and compare the efficacy and usability of threat modelling frameworks for DER systems, allowing more informed framework selection. Our second contribution is to develop a comprehensive hybrid threat modelling approach based on IDDIL/ATC and MITRE ATT&CK and organise attack paths chronologically using the Cyber Kill Chain methodology to categorise attacker techniques. Our third contribution is to perform a comprehensive DER architecture system decomposition, elaborating assets, trust levels, entry points, data, protocols, and entity relations to identify the threat landscape. Our final contribution is to apply the proposed approach to the Distribution System Operator (DSO), mapping potential attacker techniques and illustrating a ransomware attack chain on the DSO’s Energy Management System, with proposed mitigations.

Resilient cloud cluster with DevSecOps security model, automates a data analysis, vulnerability search and risk calculation

Automated, secure software development is an important digitalization task, solved with the DevSecOps approach. An important part of the DevSecOps approach is continuous risk assessment, which is necessary to identify and evaluate risk factors. Combining the development cycle with continuous risk assessment creates software development and operation synergies and minimizes vulnerabilities. The article presents the main methods of deploying web applications and ways to increase information security at all stages of product development. It also compares different types of infrastructures and cloud computing providers and analyzes modern tools used to automate processes. The cloud cluster was deployed using Terraform and the Jenkins pipeline, written in the Groovy programming language, which checks program code for vulnerabilities and allows you to fix violations at the earliest stages of developing secure web applications. The developed cluster implements the proposed algorithm for automated risk assessment based on the calculation (modeling) of cloud infrastructure threats and vulnerabilities, which operates in real-time, periodically collecting all information and adjusting the system according to the risk and applied controls. The algorithm for calculating risk and losses is based on statistical data and FAIR information risk assessment methodology. The risk value obtained using the proposed method is quantitative, which allows more efficient forecasting of information security costs in software development.

Watch the Skies: A Study on Drone Attack Vectors, Forensic Approaches, and Persisting Security Challenges

In the rapidly evolving landscape of drone technology, securing unmanned aerial vehicles (UAVs) presents critical challenges and demands unique solutions. This paper offers a thorough examination of the security requirements, threat models, and solutions pertinent to UAVs, emphasizing the importance of cybersecurity and drone forensics. This research addresses the unique requirements of UAV security, outlines various threat models, and explores diverse solutions to ensure data integrity. Drone forensics, a field dedicated to the investigation of security incidents involving UAVs, has been extensively examined and demonstrates its relevance in identifying attack origins or establishing accident causes. This paper further surveys artifacts, tools, and benchmark datasets that are critical in the domain of drone forensics, providing a comprehensive view of current capabilities. Acknowledging the ongoing challenges in UAV security, particularly given the pace of technological advancement and complex operational environments, this study underscores the need for increased collaboration, updated security protocols, and comprehensive regulatory frameworks. Ultimately, this research contributes to a deeper understanding of UAV cybersecurity and aids in fostering future research into the secure and reliable operation of drones.

An overview of implementing security and privacy in federated learning

Federated learning has received a great deal of research attention recently,with privacy protection becoming a key factor in the development of artificial intelligence. Federated learning is a special kind of distributed learning framework, which allows multiple users to participate in model training while ensuring that their privacy is not compromised; however, this paradigm is still vulnerable to security and privacy threats from various attackers. This paper focuses on the security and privacy threats related to federated learning. First, we analyse the current research and development status of federated learning through use of the CiteSpace literature search tool. Next, we describe the basic concepts and threat models, and then analyse the security and privacy vulnerabilities within current federated learning architectures. Finally, the directions of development in this area are further discussed in the context of current advanced defence solutions, for which we provide a summary and comparison.

Security analysis of the MAP-T IPv6 transition technology

Abstract In this paper, we focus on one of the most prominent IPv6 transition technologies, namely Mapping of Address and Port using Translation (MAP-T), and we give attention to Mapping of Address and Port with Encapsulation (MAP-E) as well. We emphasize the uniqueness of MAP-T and MAP-E, and we discuss the differences between those two technologies, including their topology, functionality, and security vulnerabilities. We apply a threat modeling technique, Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE), to assess potential vulnerabilities in the MAP-T infrastructure. Furthermore, we build a testbed for MAP-T using the open-source software, Jool, and we conduct testing on the translation process capabilities of Jool and its port allocation per subscriber. Finally, we present various attacking scenarios against the main routers of MAP-T, such as IP address spoofing, information disclosure, and source port exhaustion, and we propose mitigation methods for several attacks.

Enhancing Security in Modern Transposition Ciphers Through Algorithmic Innovations and Advanced Cryptanalysis

Abstract Columnar transposition ciphers have various vulnerabilities and limitations that render them vulnerable to modern cryptographic threats and advanced cryptanalysis techniques. It is imperative to strengthen the security of these ciphers through algorithmic developments and a greater understanding of their vulnerabilities as the need for secure communication increases. A systematic search will be conducted to find peer-reviewed journal articles on columnar transposition ciphers, including variations, weaknesses, and security enhancements. The structured data analysis approach will focus on key elements such as known cipher variants, vulnerabilities, new algorithms, proposed improvements, and evaluation metrics. The review will provide a comprehensive overview of the existing variants of columnar transposition ciphers, including the classical columnar transposition cipher, double columnar transposition cipher, mutable columnar transposition cipher, route transposition cipher. It will critically analyze the vulnerabilities and limitations of these variants, such as limited key space, patterns and periodicities, lack of diffusion, and susceptibility to known-plaintext attacks and statistical analysis. Additionally, the review will explore modern cryptographic threats and advanced cryptanalysis techniques, including machine learning, brute force attack, differential cryptanalysis, and chosen plaint-text attack etc. New algorithmic advancements will be developed to enhance the security of columnar transposition ciphers. These advancements involve dynamic key generation, column permutation, integration with other cryptographic primitives, and key scheduling algorithms. Additionally, an enhanced version of the columnar transposition cipher algorithm will be detailed, covering its mathematical basis, theoretical structure, and anticipated security upgrades. The effectiveness of the improved algorithm will be assessed in various attack scenarios and threat models, emphasizing security, computational, and performance aspects. The research will enhance the security of columnar transposition ciphers through algorithmic innovation and advanced cryptanalysis. It will identify gaps in existing techniques, recommend future research directions, and highlight potential applications. The findings will have significant implications for cryptography, addressing the need for secure communication.

Anonymous Complaint Aggregation for Secure Messaging

Private messaging platforms provide strong protection against platform eavesdropping, but malicious users can use privacy as cover for spreading abuse and misinformation. In an attempt to identify the sources of misinformation on private platforms, researchers have proposed mechanisms to trace back the source of a user-reported message (CCS '19,'21). Unfortunately, the threat model considered by initial proposals allowed a single user to compromise the privacy of another user whose legitimate content the reporting user did not like. More recent work has attempted to mitigate this side effect by requiring a threshold number of users to report a message before its origins can be identified (NDSS '22). However, the state of the art scheme requires the introduction of new probabilistic data structures and only achieves a "fuzzy" threshold guarantee. Moreover, false positives, where the source of an unreported message is identified, are possible. This paper introduces a new threshold source tracking technique that allows a private messaging platform, with the cooperation of a third-party moderator, to operate a threshold reporting scheme with exact thresholds and no false positives. Unlike prior work, our techniques require no modification of the message delivery process for a standard source tracking scheme, affecting only the abuse reporting procedure, and do not require tuning of probabilistic data structures.

Privacy and Robustness in Federated Learning: Attacks and Defenses.

As data are increasingly being stored in different silos and societies becoming more aware of data privacy issues, the traditional centralized training of artificial intelligence (AI) models is facing efficiency and privacy challenges. Recently, federated learning (FL) has emerged as an alternative solution and continues to thrive in this new reality. Existing FL protocol designs have been shown to be vulnerable to adversaries within or outside of the system, compromising data privacy and system robustness. Besides training powerful global models, it is of paramount importance to design FL systems that have privacy guarantees and are resistant to different types of adversaries. In this article, we conduct a comprehensive survey on privacy and robustness in FL over the past five years. Through a concise introduction to the concept of FL and a unique taxonomy covering: 1) threat models; 2) privacy attacks and defenses; and 3) poisoning attacks and defenses, we provide an accessible review of this important topic. We highlight the intuitions, key techniques, and fundamental assumptions adopted by various attacks and defenses. Finally, we discuss promising future research directions toward robust and privacy-preserving FL, and their interplays with the multidisciplinary goals of FL.

TMI! Finetuned Models Leak Private Information from their Pretraining Data

Transfer learning has become an increasingly popular technique in machine learning as a way to leverage a pretrained model trained for one task to assist with building a finetuned model for a related task. This paradigm has been especially popular for privacy in machine learning, where the pretrained model is considered public, and only the data for finetuning is considered sensitive. However, there are reasons to believe that the data used for pretraining is still sensitive, making it essential to understand how much information the finetuned model leaks about the pretraining data. In this work we propose a new membership-inference threat model where the adversary only has access to the finetuned model and would like to infer the membership of the pretraining data. To realize this threat model, we implement a novel metaclassifier-based attack, TMI, that leverages the influence of memorized pretraining samples on predictions in the downstream task. We evaluate TMI on both vision and natural language tasks across multiple transfer learning settings, including finetuning with differential privacy. Through our evaluation, we find that TMI can successfully infer membership of pretraining examples using query access to the finetuned model.

STRIDE-Based Cybersecurity Threat Modeling, Risk Assessment and Treatment of an In-Vehicle Infotainment System

In modern automobiles, the infotainment system is crucial for enhancing driver and passenger capabilities, offering advanced features such as music, navigation, communication, and entertainment. Leveraging Wi-Fi, cellular networks, NFC, and Bluetooth, the system ensures continuous internet connectivity, providing seamless access to information. However, the increasing complexity of IT connectivity in vehicles raises significant cybersecurity concerns, including potential data breaches and exposure of sensitive information. To enhance security in infotainment systems, this study applied component-level threat modeling to a proposed infotainment system using the Microsoft STRIDE model. This approach illustrates potential component-level security issues impacting privacy and security concerns. The study also assessed these impacts using SAHARA and DREAD risk assessment methodologies. The threat modeling process identified 34 potential security threats, each accompanied by detailed information. Moreover, a comparative analysis is performed to compute risk values for prioritizing treatment, followed by recommending mitigation strategies for each identified threat. These identified threats and associated risks require careful consideration to prevent potential cyberattacks before deploying the infotainment system in automotive vehicles.

Automated Security Testing in DevOps Environments Using AI and ML

The rapid adoption of DevOps practices has transformed the software development landscape by emphasizing continuous integration, continuous delivery (CI/CD), and agile methodologies. However, this rapid pace of development often introduces significant security challenges, as traditional security testing methods struggle to keep up with the accelerated release cycles. To address these challenges, the integration of Artificial Intelligence (AI) and Machine Learning (ML) into automated security testing has emerged as a promising solution. This paper explores the use of AI and ML to enhance automated security testing within DevOps environments, offering a comprehensive approach to identifying, predicting, and mitigating security vulnerabilities in real time. Automated security testing leverages AI and ML algorithms to analyze code, detect anomalies, and predict potential security threats. These technologies enable the continuous monitoring of codebases, allowing for the early identification of vulnerabilities before they are exploited. By incorporating AI-driven security testing into the CI/CD pipeline, organizations can ensure that security is not an afterthought but a continuous process integrated into every stage of the software development lifecycle. AI and ML models can be trained to recognize patterns associated with security risks, such as code injection, unauthorized access, and data leakage. These models continuously learn from new data, improving their accuracy over time and adapting to evolving threats. The dynamic nature of AI-driven security testing makes it particularly suited for DevOps environments, where frequent code changes and updates can introduce new vulnerabilities. Moreover, AI and ML can assist in automating complex tasks, such as threat modeling, risk assessment, and the prioritization of security issues, enabling security teams to focus on higher-order tasks that require human expertise.

Investigation of associative rule search method for detection of cyber incidents in information management systems and security events using CICIDS2018 test data set

Automated rule generation for cyber incident identification in information management and security event systems (SIEM, SYSTEM, etc.) plays a crucial role in modern cyberspace defense, where data volumes are exponentially increasing, and the complexity and speed of cyber-attacks are constantly rising. This article explores approaches and methods for automating the process of cyber incident identification rule generation to reduce the need for manual work and ensure flexibility in adapting to changes in threat models. The research highlights the need for utilizing modern techniques of Intelligent Data Analysis (IDA) to process large volumes of data and formulate behavior rules for systems and activities in information systems. The conclusion emphasizes the necessity of integrating multiple research directions, including analyzing existing methods and applying IDA algorithms to search for associative rules from large datasets. Key challenges addressed include the complexity of data modeling, the need to adapt to changes in data from dynamic cyber attack landscapes, and the speed of rule generation algorithms for their identification. The issue of the "dimensionality curse" and the identification of cybersecurity event sequences over time, particularly relevant to SIEM, are discussed. The research objective is defined as the analysis and evaluation of various mathematical methods for automated associative rule generation to identify cyber incidents in SIEM. The most effective strategies for enhancing the efficiency of associative rule generation and their adaptation to the dynamic change of the cybersecurity system state are identified to strengthen the protection of information infrastructure.

Building Guardrails in AI Systems with Threat Modeling

Much like cars, AI technologies must undergo rigorous testing to ensure their safety and reliability. However, just as a 16-wheel truck’s brakes are different from that of a standard hatchback, AI models too may need distinct analyses based on their risk, size, application domain, and other factors. Prior research has attempted to do this, by identifying areas of concern for AI/ML applications and tools needed to simulate the effect of adversarial actors. However, currently, a variety of frameworks exist which poses challenges due to inconsistent terminology, focus, complexity, and interoperability issues, hindering effective threat discovery. In this paper, we present a meta-analysis of 14 AI threat modeling frameworks, providing a streamlined set of questions for AI/ML threat analysis. We then review this library, incorporating feedback from 10 experts to refine the questions. This refined set of questions allow practitioners to seamlessly integrate threat analysis for comprehensive manual evaluation of a wide range of AI/ML applications.

Threat Modeling for Cyber Warfare Against Less Cyber-Dependent Adversaries

Cyber warfare poses a substantial threat in today's interconnected world, where digital attacks can transcend physical boundaries and affect targets globally. Technologically, less advanced adversaries, such as smaller nations or organizations with limited resources, face unique challenges in defending against sophisticated cyber attacks from more advanced entities. This paper explores the threat landscape for these adversaries and proposes a tailored threat modeling framework to address their specific vulnerabilities and needs. By examining the evolution of cyber warfare, including historical incidents and the increasing sophistication of cyber attacks, the study highlights the limitations of existing threat modeling approaches like the Cyber Kill Chain, MITRE ATT&CK Framework, and SWOT analysis when applied to less advanced adversaries. A comprehensive literature review underscores the gaps in current research, particularly the necessity for frameworks tailored to asymmetric technological capabilities. Employing a mixed methods approach, the research combines qualitative and quantitative data from primary sources, such as interviews with cybersecurity experts, and secondary sources, including existing literature and case studies. The proposed framework focuses on asset identification and classification, vulnerability assessment, threat analysis, and risk assessment. Proactive measures, such as basic cyber hygiene practices, advanced threat detection systems, and collaboration with technologically advanced allies, are recommended alongside reactive measures like incident response planning and disaster recovery. The importance of international cooperation and information sharing is also emphasized. Case studies of cyber incidents involving less advanced adversaries, such as the attacks on Estonia, Georgia, and Ukraine, validate the framework and demonstrate its practical application. The findings indicate that the tailored threat modeling framework effectively addresses the unique challenges faced by less advanced adversaries, enhancing their ability to mitigate risks and improve their cybersecurity posture. This study provides valuable insights and offers a practical framework to bolster defenses against cyber warfare, with future research needed to explore emerging threats and technologies further.

Unpacking the Complex Socio-Technical Systems Assemblages in Cybersecurity

The ensuing digital transformation means that cybersecurity solutioning increasingly occurs in the context of complex intractable socio-technical systems comprising non-technical elements, including human, social, and societal factors. These evolving cybersecurity ecosystem dynamics, at the confluence of cyber-physical-social spaces, present several challenges to techno-centric cybersecurity solutions including for risk assessment, threat modelling, and incident analysis. This paper unpacks the complexity of the cybersecurity domain and illustrates the associated socio-technical systems assemblages through a case study and situational analysis of a cybersecurity incident. It then reviews socio-technical systems analysis approaches from the safety management domain and discusses the alignment with and relevance for cybersecurity. The utility of these approaches is demonstrated by applying the functional resonance analysis method to the said cybersecurity incident. The situational analysis surfaces the diverse set of factors, including human, non-human, cultural, economic, institutional, and global, that directly played a role in the unfolding of the incident, and which need to be considered in risk assessment and incident analysis. Further, analysing the incident through the functional resonance analysis method shows the functional dependencies and cascade of performance variability between the different elements in this situation, which goes beyond simple, root-cause, linear causality, and purely technical explanations. Overall, the paper explicates the need for cybersecurity risk assessment and incident analysis that is commensurate with the complexity of underlying socio-technical cyber systems.

Trapped Ion Quantum Computing: A Framework for Addressing Security Vulnerabilities

Trapped ion quantum computing has the potential to revolutionize computational paradigms. As the adoption of this technology grows, so does the need for stringent scrutiny of its involvement in cybersecurity, especially when it has implications in national defense or critical infrastructure. While trapped ion quantum computing offers transformative capabilities, it is vital to carefully examine the potential vulnerabilities associated with its use and patch them before implementing this powerful technology. In this paper, we examine the potential vulnerabilities in trapped ion quantum computing systems and propose a framework for addressing them. This framework includes risk assessment for evaluating vulnerabilities, threat modeling for identifying exploits, and prevention and mitigation for reducing their impact.

Multi-SpacePhish: Extending the Evasion-space of Adversarial Attacks against Phishing Website Detectors Using Machine Learning

Existing literature on adversarial Machine Learning (ML) focuses either on showing attacks that break every ML model or defenses that withstand most attacks. Unfortunately, little consideration is given to the actual feasibility of the attack or the defense. Moreover, adversarial samples are often crafted in the “feature-space,” making the corresponding evaluations of questionable value. Simply put, the current situation does not allow one to estimate the actual threat posed by adversarial attacks, leading to a lack of secure ML systems. We aim to clarify such confusion in this article. By considering the application of ML for Phishing Website Detection (PWD), we formalize the “evasion-space,” in which an adversarial perturbation can be introduced to fool an ML-PWD—demonstrating that even perturbations in the “feature-space” are useful. Then, we propose a realistic threat model describing evasion attacks against ML-PWD that are cheap to stage, and hence intrinsically more attractive for real phishers. After that, we perform the first statistically validated assessment of state-of-the-art ML-PWD against 12 evasion attacks. Our evaluation shows (i) the true efficacy of evasion attempts that are more likely to occur; and (ii) the impact of perturbations crafted in different evasion-spaces; our realistic evasion attempts induce a statistically significant degradation (3–10% at p < 0.05), and their cheap cost makes them a subtle threat. Notably, however, some ML-PWD are immune to our most realistic attacks ( p = 0.22). Finally, as an additional contribution of this journal publication, we are the first to propose and empirically evaluate the intriguing case wherein an attacker introduces perturbations in multiple evasion-spaces at the same time . These new results show that simultaneously applying perturbations in the problem- and feature-space can cause a drop in the detection rate from 0.95 to 0. Our contribution paves the way for a much-needed re-assessment of adversarial attacks against ML systems for cybersecurity.

Secure IoT Communication: Implementing a One-Time Pad Protocol with True Random Numbers and Secure Multiparty Sums

We introduce an innovative approach for secure communication in the Internet of Things (IoT) environment using a one-time pad (OTP) protocol. This protocol is augmented by incorporating a secure multiparty sum protocol to produce OTP keys from genuine random numbers obtained from the physical phenomena observed in each device. We have implemented our method using ZeroC-Ice v.3.7, dependable middleware for distributed computing, demonstrating its practicality in various hybrid IoT scenarios, particularly in devices with limited processing capabilities. The security features of our protocol are evaluated under the Dolev–Yao threat model, providing a thorough assessment of its defense against potential cyber threats.

OpenVPN is Open to VPN Fingerprinting

VPN adoption has seen steady growth over the past decade due to increased public awareness of privacy and surveillance threats. In response, certain governments are attempting to restrict VPN access by identifying connections using “dual use” DPI technology. To investigate the potential for VPN blocking, we develop mechanisms for accurately fingerprinting connections using OpenVPN, the most popular protocol for commercial VPN services. We identify three fingerprints based on protocol features such as byte pattern, packet size, and server response. Playing the role of an attacker who controls the network, we design a two-phase framework that performs passive fingerprinting and active probing in sequence. We evaluate our framework in partnership with a million-user ISP and find that we identify over 85% of OpenVPN flows with only negligible false positives, suggesting that OpenVPN-based services can be effectively blocked with little collateral damage. Although some commercial VPNs implement countermeasures to avoid detection, our framework successfully identified connections to 34 out of 41 “obfuscated” VPN configurations. We discuss the implications of the VPN fingerprintability for different threat models and propose short-term defenses. In the longer term, we urge commercial VPN providers to be more transparent about their obfuscation approaches and to adopt more principled detection countermeasures, such as those developed in censorship circumvention research.