Threat Scenarios Research Articles

Privacy Threat MOdeling Language

Online Social Networks (OSNs) are becoming pervasive in today’s world. Millions of people worldwide are involved in different forms of online networking. However, this ease of use of OSNs comes with a cost in terms of privacy. Users of OSNs become victims of identity theft, cyberstalking, and information leakage, which are real threats to privacy. Consequently, new solutions need to be developed for addressing the threat scenarios to which a user is potentially exposed. In this sense, this paper presents PTMOL (Privacy Threat MOdeling Language) as an approach for modeling privacy threats in an OSN domain. The proposed language is related to the attempt to mitigate privacy threats at the design level, thus promoting concern about threats in the stages preceding the development of OSNs. Two studies were conducted to evaluate the use of PTMOL at the design stages, which provided insights into the correctness, completeness, ease of use, usefulness, user satisfaction, and feasibility of the proposal. The results indicated that PTMOL can be incorporated into software development during the design phase. Via the language, we expect to support designers in making more pre-emptive decisions about user privacy risk, and help them to introduce privacy early in the development cycle of OSNs.

Anomaly Detection Based on Discrete Wavelet Transformation for Insider Threat Classification

Unlike external attacks, insider threats arise from legitimate users who belong to the organization. These individuals may be a potential threat for hostile behavior depending on their motives. For insider detection, many intrusion detection systems learn and prevent known scenarios, but because malicious behavior has similar patterns to normal behavior, in reality, these systems can be evaded. Furthermore, because insider threats share a feature space similar to normal behavior, identifying them by detecting anomalies has limitations. This study proposes an improved anomaly detection methodology for insider threats that occur in cybersecurity in which a discrete wavelet transformation technique is applied to classify normal vs. malicious users. The discrete wavelet transformation technique easily discovers new patterns or decomposes synthesized data, making it possible to distinguish between shared characteristics. To verify the efficacy of the proposed methodology, experiments were conducted in which normal users and malicious users were classified based on insider threat scenarios provided in Carnegie Mellon University’s Computer Emergency Response Team (CERT) dataset. The experimental results indicate that the proposed methodology with discrete wavelet transformation reduced the false-positive rate by 82% to 98% compared to the case with no wavelet applied. Thus, the proposed methodology has high potential for application to similar feature spaces.

Generative Adversarial Network Based Approach towards Synthetically Generating Insider Threat Scenarios

Generative Adversarial Network Based Approach towards Synthetically Generating Insider Threat Scenarios

Assessment of the Neurological Activation in Law Enforcement under High Threat Situations: A Fuzzy Logic Approach

This paper discusses a law enforcement officer (LEO) study that involved expert and novice police deputies from a small-sized city located in the Southern U.S. A virtual reality range was utilized to simulate high threat scenarios that require split second decisions on the use of deadly force. A fuzzy-logic based controller was constructed to analyze electroencephalogram (EEG) data collected from the participants. The fuzzy controller made use of several functions associated with the different regions of the brain to correlate Brodmann areas to multiple outputs. Electromagnetic Tomography (i.e. LORETA) was used to identify where the signals from the surface electrodes originated within the brain through a process called source localization. Once the sources of the EEG signals were located, they were associated with corresponding Brodmann areas. The fuzzy controller then provided insights on the subjects’ exhibited neural activation behavior indicative of vision, memory, shape/distance, hearing/sound, and theory of mind. Comparing and contrasting experienced and novice officers allowed for a greater understanding of the neurological processes present in police deputies when dealing with high threat situations.

School Level and Urbanicity Differences in Written Plans for Pandemic Flu/Disease Scenarios: A National Analysis

The purpose of this study was to determine the extent to which school level (i.e., elementary, middle, and high schools) and urbanicity (i.e., rural, town, suburb, city) were related to written school safety plans in the area of pandemic flu/disease threat scenarios. Through the use of a causal-comparative research design, archival data from a national survey in the United States for the 2007-2008, 2009-2010, 2015-2016, and 2017-2018 school years were analyzed. Inferential statistical analyses of nationwide survey data revealed the presence of statistically significant differences in the incidence of written plans for pandemic flu/disease threat scenarios by school level and by urbanicity. All school levels represented in the study did not have a written plan for how to address pandemic flu/disease threat scenarios 60% or more of the time. About 60% of schools within the urbanicity groupings did not have a written plan. Implications and recommendations for future research were discussed. Given the recent COVID-19 pandemic, these numbers are expected to show dramatic improvements in the years to come. Policymakers should develop policies mandating written school safety plans and the necessary funding for them to be generated. Future researchers, however, should continue to address this area.

Design methods of blast resistant façades, windows, and doors in Germany: a review

Explosion events represent an extraordinary action for buildings and especially for the building envelope. In addition to accidents in chemical plants or during transport of explosive substances, the threat of terrorist attacks has increased in recent years. Façade constructions, windows, and doors represent weak points in the event of an incident, through which blast waves can enter the building. Debris and fragments resulting from the failure of building components endanger people inside and outside the building. For structures that are threatened, appropriate elements with protective properties must be chosen so that an acceptable level of safety is achieved. The design and execution of a sufficiently blast-resistant building envelope is not a trivial task. In limited cases, necessary protection can be achieved by use of certified products. Since buildings in need of protection mostly have high architectural demands, standard elements can usually not be used. Or the blast load used for certification deviates greatly from the assumed blast load for the threat scenario. There are several methods to verify the explosion resistant properties of façades, windows, doors, etc., e. g. experimental methods, numerical methods, engineering approaches and empirical methods. In this article, an introduction to explosions and their effect on the building envelope is given. Methods for verification of blast resistance are presented and critical discussed. The article presents an overview of the state of the art in practice with a focus on Germany.

A data plane security model of SR-BE/TE based on zero-trust architecture

Facing the untrusted threats of network elements and PKI/CA faced by SR-BE/TE (Segment Routing-BE/TE) data plane in the zero-trust network environment, firstly, this paper refines it into eight specific security issues. Secondly, an SR-BE/TE data plane security model ZbSR (ZTA-based SR) based on zero-trust architecture is proposed, which reconstructs the original SR control plane into a "trust-agent" two-layer plane based on 4 components of the controller, agent, cryptographic center and information base. On one hand, we distinguish between the two segment list generation modes and proposes corresponding data exchange security algorithms, by introducing north–south security verification based on identity authentication, trust evaluation, and key agreement before the terminal device establishes an east–west access connection, so reliable data exchange between terminal devices can be realized. On the other hand, for the network audit lacking SR-BE/TE, a network audit security algorithm based on solid authentication is proposed. By auditing the fields, behaviors, loops, labels, paths, and SIDs of messages, threats such as stream path tampering, SID tampering, DoS attacks, and loop attacks can be effectively detected. Finally, through the simulation test, the proposed model can provide security protection for the SR data plane with a 19.3% average incremental delay overhead for various threat scenarios.

A Methodological Framework for the Risk Assessment of Drone Intrusions in Airports

Drone expansion needs to be considered as a menace in cases of negligent, illicit, or non-cooperative use. In the case of airports, a complete protection against drone intrusion should rely on an intrusion management system, aiming at avoiding the closure of the airport. This system requires the setting of proper risk assessment methodologies for airport operations, to explicitly consider the features of drone intrusion, possibly from a quantitative point of view. This work proposes a methodological framework for the risk assessment of drone intrusions in airports, tailored on drone-intrusion features, airport features, and current operations, and considering both safety-related and security-related causes. The framework is based on the combination of model-based and data-driven approaches in order to: (i) estimate an airport vulnerability index, to measure the susceptibility of the airport to drone intrusions, based on reference datasets; (ii) specify a set of event trees to evaluate the risks of the different threat scenarios related to drone intrusions. The proposed methodological framework is applied to a concrete case study, related to Milan Malpensa airport. The achieved results show the effectiveness of the approach and elicit further requirements for counter-drone systems in airports based on the assessed risks.

Dynamic Assessment of Cyber Threats in the Field of Insurance

The area of digital technologies is currently the subject of many cyber threats, the frequency of which is increasing. One of the areas of cyber security is also the creation of models and estimates of the process of cyber threats and their possible financial impacts. However, some studies show that cyber-threat assessment to identify potential financial impacts for organizations is a very challenging process. A relatively large problem here is the detection of scenarios of cyber threats and their expression in time. This paper focuses on the design of an algorithm that can be applied to the field of cyber-threat assessment in order to express the financial impacts. The study is based on an in-depth analysis of the insurance industry. The results obtained in our research show the importance of the time perspective for determining the potential financial impacts of cyber threats for the field of insurance.

Modeling and Defense of Social Virtual Reality Attacks Inducing Cybersickness

Social Virtual Reality Learning Environments (VRLE) offer a new medium for flexible and immersive learning environments with geo-distributed users. Ensuring user safety in VRLE application domains such as education, flight simulations, military training is of utmost importance. Specifically, there is a need to study the impact of “immersion attacks” (e.g., chaperone attack, occlusion) and other types of attacks/faults (e.g., unauthorized access, network congestion) that may cause user safety issues (i.e., inducing of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">cybersickness</i> ). In this article, we present a novel framework to quantify the security, privacy issues triggered via immersion attacks and other types of attacks/faults. By using a real-world social VRLE viz., vSocial and creating a novel attack-fault tree model, we show that such attacks can induce undesirable levels of cybersickness. Next, we convert these attack-fault trees into stochastic timed automata (STA) representations to perform statistical model checking for a given attacker profile. Using this model checking approach, we determine the most vulnerable threat scenarios that can trigger high occurrence cases of cybersickness for VRLE users. Lastly, we show the effectiveness of our attack-fault tree modeling by incorporating suitable design principles such as <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">hardening</i> , <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">diversity</i> , <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">redundancy</i> and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">principle of least privilege</i> to ensure user safety in a VRLE session.

Evaluation of the maritime security threats and issues to the future of the shipping industry – Maritime Autonomous Surface Ships

Nowadays traditional manned commercial sea-going vessels are facing several difficulties, including shipping accidents that are mainly caused by human errors and the shortage of seafarers with the associated increased manning cost. In 2021, the International Maritime Organisation Maritime Safety Committee (IMO MSC) had finished the Regulatory Scoping Exercise (RSE) regarding Maritime Autonomous Surface Ships (MASS) at its 103rd session, taking its first step towards autonomous shipping that does not involve human vectors. This paper analyses the security issues that are potentially involved in fully autonomous ships (Degree Four of Autonomy) (DOA 4) of MASS operations and recommend measures to adjust and mitigate the issues. This paper reviews six conventional maritime security threats that could threaten a DOA 4 vessel, including piracy and armed robbery at sea, terrorism, smuggling and trafficking, stowaways, cyber security threat and hybrid security threat. The research methodology of this paper reviews different literature as the source of both quantitative data and qualitative evidence. This paper analyses the experience of the security incidents in other comparable sectors and systems in order to identify the characteristics and behaviour of the security threats. Then the information is analysed against the specific characteristics of MASS operations to consider whether the characteristics of MASS operations may become more vulnerable if exploited by perpetrators of security threats. Potential issues and scenarios of the security threats in the operations are also discussed. Risk assessments are applied to explore the risk level of the security threats in DOA 4 MASS. This paper demonstrates that the characteristics of DOA 4 MASS operations may still pose vulnerabilities that can be exploited by all the six security threats. The risk of terrorism, smuggling and trafficking, cyber security, and hybrid security threats are high in DOA 4 MASS operations, while the risk of piracy and armed robbery at sea and stowaways are medium. Both the aspects of cyber security, detection/monitoring equipment, reliability of vessel systems, security in Shore Control Centres (SCC) and security in ports contribute significantly to the security of DOA 4 MASS operations against these security threats. This paper recommends all the aspects mentioned in the above findings should be considered in the development of future instruments regarding DOA 4 MASS operations. The stakeholders involved in DOA 4 MASS operations should apply any possible cyber security and detection/monitoring measures even beyond the legal requirement. The security and personnel management of SCC should be ensured too. Finally, further research on the identified security threats on DOA 4 MASS operations is recommended once more practical data on the operations are available, further research on different DOA of MASS operations and different security threats are also recommended.

MITRE att&amp;ck TM based language for effective training in cyber range

Cyber security exercises and training are critical in ensuring that the people protecting systems have the necessary abilities. For this purpose, cyber range is a significant instrument used to educate security professionals, since it provides threat simulation and training material for adversary attack scenarios. However, the majority of current threat scenario generation takes time and results in static scenarios that are both inefficient and unrealistic. We propose the “MITRE ATT&amp;CKTM Based Language (MABL)” which will streamline the cyber range functions by assimilating and portraying knowledge on attack procedures. The proposed language will give information about attack techniques and be dynamic in nature.

Detecting False Data Injection Attacks in Peer to Peer Energy Trading Using Machine Learning

In peer-to-peer (P2P) energy trading, the incorporation of distributed energy resources with unprotected data, originating from sources such as home energy management systems that are connected through the Internet, provokes vulnerabilities that can manifest security breaches. In this article, two threat scenarios based on a novel false data injection attack (FDIA) model in a local P2P energy trading system are explored. In these scenarios, an attacker gains free energy by manipulating prosumers’ consumption and demand. Precise and fast attack detection is needed to guarantee suitable countermeasures to prevent potential risks. We propose a novel instance-based machine learning (ML) classifier for detecting FDIAs. In contrast to black-box ML models, our algorithm provides a transparent decision-making procedure with significant predictive performance. We apply our detection model to a real-world dataset from Austin, Texas. Our experimental results show superior performance as compared to several popular interpretable and non-interpretable ML methods. On average, we achieve a 96.10 percent detection rate, a 96.18 percent accuracy rate, and a false negative rate of 1.97 percent with our approach.

‘Patriotism is not just a Man’s Thing’: Right-wing Extremist Gender Policies within the so-called Identitarian Movement

Taking an analysis of relevant statements and campaigns of the right-wing extremist group ‘Identitarian Movement’ in German-speaking countries as a starting point, this article will reconstruct their key narratives with regard to gender policy, and identify the discourses and forms of organization that are used to integrate women into the Identitarian context. An overview of the origins and characteristics of the Identitarians is followed by a classification of Identitarian gender policy into three phases: its beginning (2012–2015), its peak (2016–2018) and its demise (2019–2020). As can be seen, during the first years it had been necessary to negotiate fundamental questions of the group's gender concepts, whereas during the peak years the focus shifted to threat scenarios involving ‘our women’. At the same time, female activists started to find their own projects. Since 2019, however, the group has started to fall apart, women's issues have lost their appeal and women activists have been leaving. Notwithstanding this decline, the question still remains of what to make of the gender-political commitment of Identitarian women in the context of feminist debates.

Hybrid Threats – Means of Destabilization of Law and Order in Modern Democratics Societes. Idea and Methodology of Proposed Research

Threats are one of the most serious threats to the legal order of a democratic state. Their non-linear, asymmetric nature makes them more dangerous than other threats to the legal order. The use of multifaceted measures as a weapon disrupts, above all, the legal order of the state. Hybrid threats rely heavily on non-military domains. Civilian populations are central to the hybrid threat scenarios as sources for potential socio-political vulnerabilities and as targets for non-military threats and attacks, not least disinformation campaigns. A significant part of the hybrid threat phenomena is psychological. Actors targeting communities/societies to exacerbate weaknesses do not necessarily create social vulnerabilities themselves but make use of divisions that already exist in civil society. Using disinformation, populations are targeted and used as potential weapons within the state/society in question. This paper shows a concrete scientific approach to the study to of this issue.

KRYSTAL: Knowledge graph-based framework for tactical attack discovery in audit data

Attack graph-based methods are a promising approach towards discovering attacks and various techniques have been proposed recently. A key limitation, however, is that approaches developed so far are monolithic in their architecture and heterogeneous in their internal models. The inflexible custom data models of existing prototypes and the implementation of rules in code rather than declarative languages on the one hand make it difficult to combine, extend, and reuse techniques, and on the other hand hinder reuse of security knowledge – including detection rules and threat intelligence. KRYSTAL tackles these challenges by providing a knowledge graph-based, modular framework for threat detection, attack graph and scenario reconstruction, and analysis based on RDF as a standard model for knowledge representation. This approach provides query options that facilitate contextualization over internal and external background knowledge, as well as the integration of multiple detection techniques, including tag propagation, attack signatures, and graph queries. We implemented our framework in an openly available prototype and demonstrate its applicability on multiple scenarios of the DARPA Transparent Computing dataset. Our evaluation shows that the combination of different threat detection techniques within our framework improved detection capabilities. Furthermore, we find that RDF provenance graphs are scalable and can efficiently support a variety of threat detection techniques.

Adversarial Attacks for Intrusion Detection Based on Bus Traffic

A communication bus is used to transmit electronic signals between components, realize functional integration through information sharing, and improve system efficiency. The current research on intrusion detection based on bus traffic is mainly pertaining to machine learning or time logic detection. However, recent studies have shown that machine learning models perform poorly in defense of various adversarial attacks. In this article, we propose a method based on generative adversarial networks to transform normal traffic into adversarial and malicious ones. To be closer to reality, adversarial example generation models on two threat scenarios are proposed. At the same time, the distance metric L <inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</inf> is introduced in the loss function to ensure the authenticity of the generated adversarial examples. To evaluate our method, we use the traffic generated by the model to various intrusion detection systems based on bus. Experimental results show that the model is effective because the detection rate of different intrusion detection models decreases after the traffic is processed. Thus, the traffic generated by our models can be used as training data to enhance the accuracy of intrusion detection systems.

Discourse coalitions against gender and sexual equality: antifeminism as a common denominator between the radical right and the mainstream?

ABSTRACT This study examines whether opposition against gender and sexual equality is a common denominator between the radical right, political actors, and mainstream media in Germany. The study hypothesizes that socially shared sexist beliefs and gender stereotypes offer access points to public discourse for anti-egalitarian counterpublics, legitimizing their contestations of gender and sexual equality. This hypothesis is tested in a quantitative frame analysis of n = 1102 articles in 18 digital media outlets from diverse anti-egalitarian counterpublics (anti-feminist men’s rights activists, feminists, Christian fundamentalists, radical right, and far-left media) and mainstream media. The study results offer a current overview of the framing of gender and sexual equality in mainstream and counterpublic media in Germany: Discourse on gender equality and LGBTQI rights takes up the most space. The framing of these topics is less controversial than the highly contested discussion of gender roles and reproductive rights. Discourse coalitions between anti-egalitarian counterpublics and established actors become visible in the neosexist and gender-traditional frame, pointing to the relevance of neosexist convictions and gender traditionalism as a common denominator between these actors. Across all frames, a common oppositional strategy is reframing gender and sexual equality issues into threat scenarios to families and society.

EvilModel 2.0: Bringing Neural Network Models into Malware Attacks

Security issues have gradually emerged with the continuous development of artificial intelligence (AI). Earlier work verified the possibility of converting neural network models into stegomalware, embedding malware into a model with limited impact on the model’s performance. However, existing methods are not applicable in real-world attack scenarios and do not attract enough attention from the security community due to performance degradation and additional workload. Therefore, we propose an improved stegomalware EvilModel. By analyzing the composition of the neural network model, three new methods for embedding malware into the model are proposed: MSB reservation, fast substitution, and half substitution, which can embed malware that accounts for half of the model’s volume without affecting the model’s performance. We built 550 EvilModels using ten mainstream neural network models and 19 malware samples. The experiment shows that EvilModel achieved an embedding rate of 48.52%. A quantitative algorithm is proposed to evaluate the existing embedding methods. We also design a trigger and propose a threat scenario for the targeted attack. The practicality and effectiveness of the proposed methods were demonstrated by experiments and analyses of the embedding capacity, performance impact, and detection evasion.

EL-NAHL: Exploring labels autoencoding in augmented hidden layers of feedforward neural networks for cybersecurity in smart grids

Reliability and security of power distribution and data traffic in smart grid (SG) are very important for industrial control systems (ICS). Indeed, SG cyber-physical connectivity is subject to several vulnerabilities that can damage or disrupt its process immunity via cyberthreats. Today's ICSs are experiencing highly complex data change and dynamism, increasing the complexity of detecting and mitigating cyberattacks. Subsequently, and since Machine Learning (ML) is widely studied in cybersecurity, the objectives of this paper are twofold. First, for algorithmic simplicity, a small-scale ML algorithm that attempts to reduce computational costs is proposed. The algorithm adopts a neural network with an augmented hidden layer (NAHL) to easily and efficiently accomplish the learning procedures. Second, to solve the data complexity problem regarding rapid change and dynamism, a label autoencoding approach is introduced for Embedding Labels in the NAHL (EL-NAHL) architecture to take advantage of labels propagation when separating data scatters. Furthermore, to provide a more realistic analysis by addressing real-world threat scenarios, a dataset of an electric traction substation used in the high-speed rail industry is adopted in this work. Compared to some existing algorithms and other previous works, the achieved results show that the proposed EL-NAHL architecture is effective even under massive dynamically changed and imbalanced data.