Threat Scenarios Research Articles

Simulation of Cognitive Electronic Warfare System With Sine and Square Waves

Today’s Electronic Warfare (EW) receivers need advanced technology to achieve real-time surveillance operations. Dynamic and intelligent systems are required for UAVs and other airborne applications. The airborne Electronic Warfare systems must be knowledge-based systems, learning from the threat scenario with highly integrated capabilities to detect, react, and adapt to radar threats in real-time. Artificial intelligence is a machine-dependent process, by adapting certain rules and logic supported by human intelligence, AI can be used for cognitive processing. Cognitive signal processing is required for making the system autonomous and dynamic in nature. Military action on radar signatures requires a set of commands to be executed dynamically with the help of the proposed EW system. It is proposed to design and develop a cognitive EW architecture and simulation of machine learning that combines neural network architecture with the help of sine and square waves as input. This paper presents the Cognitive signal processing for EW systems with Neural Network, Recurrent Neural Network (RNN), Machine learning (ML), and Deep learning (DL) techniques with their simulation with sine and square waves.

Detection of Security and Privacy Attacks Disrupting User Immersive Experience in Virtual Reality Learning Environments

Virtual Reality Learning Environments (VRLEs) are a new form of immersive environments which are integrated with wearable devices for delivering distance learning content in a collaborative manner in e.g., <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">special education</i> , <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">surgical training</i> . Gaining unauthorized access to these connected devices can cause security, privacy attacks (SP) that adversely impacts the user immersive experience (UIX). In this paper, we identify potential SP attack surfaces that impact the application usability and immersion experience, and propose a novel anomaly detection method to detect attacks before the UIX can be disrupted. Specifically, we apply: (i) machine learning techniques such as a <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">multi-label KNN classification</i> algorithm to detect anomaly events of network-based attacks that include potential threat scenarios of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">DoS (packet tampering, packet drop, packet duplication)</i> , and (ii) statistical analysis techniques that use a combination of boolean and threshold functions ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Z-scores</i> ) to detect an anomaly related to application-based attacks ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Unauthorized access</i> ). We demonstrate the effectiveness of our proposed anomaly detection method using a VRLE application case study viz., vSocial, specifically designed for teaching youth with learning impediments about social cues and interactions. Based on our detection results, we validate the impact of network and application based SP attacks on the VRLE UIX.

Development of a high-performance blast energy-absorbing system for building structures

Shock absorbers have been widely used in the automotive and aeronautical industries for many years. Inspired on these devices, the paper presents an analytical and numerical assessment of a high performance protective system for building structures against blast loads, which is composed of a shielding element connected to the main structure, at the floor levels, through ductile Energy Absorbing Connectors (EACs). The EACs exploit the external tube inversion mechanism to absorb a significant part of the imparted kinetic energy from the blast wave. While the system prototype has been developed in laboratory, it was characterized and tested in a full-scale blast testing campaign. A validated finite element model was used next to analyze its performance in a more demanding design scenario. The introduction of EACs notably reduces the peak horizontal loads and the kinetic energy transferred to the protected structure, being expected a significant reduction of the stresses in the supporting vertical elements, in addition to the protection of structural and non-structural members. These results encourage further studies of the presented protective system that can be potentially employed for a large variety of blast threat scenarios, especially when increasing the stand-off is not a possible/viable option and sensitive facilities have to be protected.

Smart Terminal System of Systems’ Cyber Threat Impact Evaluation

Systems of system-level thinking is required when the purpose is to develop a coherent understanding of the ecosystem where every user and system requirements are divided into specific parts. The smarter project, as a part of the Sea4value program of DIMECC, aims to develop harbor operations, including passenger and cargo transportation, in a way that port processes will improve, emissions will decrease, and overall security will enhance in smart ports. This paper describes cyber-attack impacts against the Smart terminal system of systems in the cyber realm by utilizing the MITRE ATTACK® framework to map the objectives of threat actors. The Smart Terminal system environment includes ICT, ICS networks and components, communication systems, and port service systems. Internal and external threat sources or actors are hard to divide exactly because of the diversity of the threats. Hybrid threats challenge maritime domain awareness globally. The cyber threat impacts on IT and OT environments are connected to each other because of the use of internal and external networks that impact each other by combining vulnerabilities and threats. Well-working port and terminal operations require not only protected operational systems or sensor systems, but human errors must also be minimized. Objectives of threat actors are presented, categorized, and listed. Threat scenarios illustrate that cyber threats and risks are mainly similar in the maritime global-linked port community and basic hinterland trade. The networked supply chain of the business causes evolving and combined threat scenarios. European and international standards, regulations, policies, recommendations, and, e.g., guidelines by the IMO, set new cyber-threat requirements for port and terminal services and facilities. Therefore, overall security must be considered when cyber-security is the development area. Information exchange in an understandable form is essential for maintaining business continuity. Threat information has to be transferred among stakeholders as well as cyber security codes have to be followed in the port operations of partners that are involved, for example, in operational and system-level actions. Digitalization in smart ports and terminals enhances the capacity to handle cargo and passengers more efficiently, but cyber threats evolve.

Adaptive monitoring, detection, and response for agile digital service chains

Modern business is increasingly adopting fully-digital workflows composed of complementary services (in terms of infrastructures, software, networks, data and devices) from different domains, hence giving rise to complex and heterogeneous digital chains. The substantial fragmentation in service operation and ownership between these domains impacts cybersecurity operations, by hindering a coherent and cooperative defense strategy for the entire chain. As a result, this situation gives attackers more opportunity to move laterally within the chain once they have found and compromised the weakest link.A ground-breaking evolution of legacy cybersecurity processes is necessary towards collaborative and adaptive models that fit the dynamic, agile, and heterogeneous nature of federated environments. In this paper, we elaborate on the necessary convergence between complementary workflows for response, analysis, and intelligence, by considering the peculiarity of these operations and the relevant threat scenario. Our analysis points out the main research challenges to fill the existing gap between management and protection practice for digital service chains. Moreover, we outline a reference architecture that combines such workflows. The objective is to foster researchers to broaden the scope of their work, in order to address open security issues for modern business and computing paradigms.

Ensuring Academic Integrity and Trust in Online Learning Environments: A Longitudinal Study of an AI-Centered Proctoring System in Tertiary Educational Institutions

The credibility of online examinations in Higher Education is hardened by numerous factors and use-case scenarios. This paper reports on a longitudinal study, that spanned over eighteen months, in which various stakeholders from three European Higher Education Institutions (HEIs) participated, aiming to identify core threat scenarios experienced during online examinations, and to, accordingly, propose threat models, data metrics and countermeasure features that HEI learning management systems can embrace to address the identified threat scenarios. We also report on a feasibility study of an open-source intelligent and continuous student identity management system, namely TRUSTID, which implements the identified data metrics and countermeasures. A user evaluation with HEI students (n = 133) revealed that the TRUSTID system is resilient and effective against impersonation attacks, based on intelligent face and voice identification mechanisms, and scored well in usability and user experience. Aspects concerning the preservation of privacy in storing, retrieving and processing sensitive personal data are also discussed.

Interaction Networks Help to Infer the Vulnerability of the Saproxylic Beetle Communities That Inhabit Tree Hollows in Mediterranean Forests

Insect communities are facing contrasting responses due to global change. However, knowledge on impacts of communities' reorganizations is scarce. Network approaches could help to envision community changes in different environmental scenarios. Saproxylic beetles were selected to examine long-term variations in insect interaction/diversity patterns and their vulnerability to global change. We evaluated interannual differences in network patterns in the tree hollow-saproxylic beetle interaction using absolute samplings over an 11-year interval in three Mediterranean woodland types. We explored saproxylic communities' vulnerability to microhabitat loss via simulated extinctions and by recreating threat scenarios based on decreasing microhabitat suitability. Although temporal diversity patterns varied between woodland types, network descriptors showed an interaction decline. The temporal beta-diversity of interactions depended more on interaction than on species turnover. Interaction and diversity temporal shifts promoted less specialized and more vulnerable networks, which is particularly worrisome in the riparian woodland. Network procedures evidenced that saproxylic communities are more vulnerable today than 11 years ago irrespective of whether species richness increased or decreased, and the situation could worsen in the future depending on tree hollow suitability. Network approaches were useful for predicting saproxylic communities' vulnerability across temporal scenarios and, thus, for providing valuable information for management and conservation programs.

Exploring the Cyber-Physical Threat Landscape of Water Systems: A Socio-Technical Modelling Approach

The identification and assessment of the cyber-physical-threat landscape that surrounds water systems in the digital era is governed by complex socio-technical dynamics and uncertainties that exceed the boundaries of traditional risk assessment. This work provides a remedy for those challenges by incorporating socio-technical modelling to account for the adaptive balance between goal-driven behaviours and available skills of adversaries, exploitable vulnerabilities of assets and utility’s security posture, as well as an uncertainty-aware multi-scenario analysis to assess the risk level of any utility against cyber-physical threats. The proposed risk assessment framework, underpinned by a dedicated modelling chain, deploys a modular sequence of processes for (a) the estimation of vulnerability-induced probabilities and attack characteristics of the threat landscape under a spectrum of adversaries, (b) its formulation to a representative set of stochastically generated threat scenarios, (c) the combined cyber-physical stress-testing of the system against the generated scenarios and (d) the inference of the system’s risk level at system and asset level. The proposed framework is demonstrated by exploring different configurations of a synthetic utility case study that investigate the effects and efficiency that different cyber-security practices and design traits can have over the modification of the risk level of the utility at various dimensions.

An Effective Approach to Detect and Prevent ARP Spoofing Attacks on WLAN

Address Resolution Protocol (ARP) is used to resolve a host’s MAC address, given its IP address. ARP is stateless, as there is no authentication when exchanging a MAC address between the hosts. Hacking tactics using ARP spoofing are constantly being abused differently; many previous studies have prevented such attacks. However, prevention requires modification of the underlying network protocol or additional expensive equipment, so applying these methods to the existing network can be challenging. In this paper, we examine the limitations of previous research in preventing ARP spoofing. In addition, we propose a defense mechanism that does not require network protocol changes or expensive equipment. Before sending or receiving a packet to or from any device on the network, our method checks the MAC and IP addresses to ensure they are correct. It protects users from ARP spoofing. The findings demonstrate that the proposed method is secure, efficient, and very efficient against various threat scenarios. It also makes authentication safe and easy and ensures data and users’ privacy, integrity, and anonymity through strong encryption techniques.

Development of the framework for quantitative cyber risk assessment in nuclear facilities

Industrial control systems in nuclear facilities are facing increasing cyber threats due to the widespread use of information and communication equipment. To implement cyber security programs effectively through the RG 5.71, it is necessary to quantitatively assess cyber risks. However, this can be challenging due to limited historical data on threats and customized Critical Digital Assets (CDAs) in nuclear facilities. Previous works have focused on identifying data flows, the assets where the data is stored and processed, which means that the methods are heavily biased towards information security concerns. Additionally, in nuclear facilities, cyber threats need to be analyzed from a safety perspective. In this study, we use the system theoretic process analysis to identify system-level threat scenarios that could violate safety constraints. Instead of quantifying the likelihood of exploiting vulnerabilities, we quantify Security Control Measures (SCMs) against the identified threat scenarios. We classify the system and CDAs into four consequence-based classes, as presented in NEI 13–10, to analyze the adversary impact on CDAs. This allows for the ranking of identified threat scenarios according to the quantified SCMs. The proposed framework enables stakeholders to more effectively and accurately rank cyber risks, as well as establish security and response strategies.

Game Theory Classification in Cybersecurity: A Survey.

Cyber security is a field designed to protect computers connected to the internet from attacks, and hence prevent unauthorized users from accessing the sensitive data present in it. Lately, it has witnessed intensified research from both academia and the industry. However, traditional cyber security technologies still face inadequacies in tackling the ever-dynamic frontier of cyber-attacks as a result of inability to incorporate behavioral tendencies of adaptive and intelligent adversaries in their security models. Game theory is often the first choice as a mathematical tool among researchers and industry practitioners for modeling conflict and cooperation among intelligent and rational actors. With its rich modeling and analytical techniques, and ability to forecast cyber-attacks and optimal defense strategies accurately, cyber security attacks are much easier to mitigate than traditional approaches. This paper reviews several game theoretic concepts and applications in the never-ending dynamic contradiction between the defender and the attacker. These concepts are classified according to applications and scenarios. Present research challenges are discussed and future directions for the need to incorporate attackers risk attitude as a determinant factor of the Nash Equilibrium is emphasized in the malicious insider threat scenario.

Simulating Cybersecurity Risk Using Advanced Quantitative Risk Assessment Techniques

This paper; a scenario-based teaching case study, aims to introduce students in a Cybersecurity Risk Management course to advanced quantitative risk assessment techniques. The case study utilizes a fictitious company for which a risk assessment is underway. Assuming the role of the Cybersecurity Risk Team of the company, students are tasked with determining the risk exposure the company faces from a threat scenario against one of its mission-critical information resources. Specifically, the students are required to (1) quantify the monetary losses that could result from a threat scenario, (2) compute the inherited risk exposure from the threat scenario, (3) compute the residual risk given the implantation of certain security controls, and (4) compute the rate of return on the security controls. The case study holds the promise of enhancing the overall learning of the students and boosting their marketability as future cybersecurity professionals.

Elaborarea scenariilor în planificarea acțiunilor militare pentru prevenirea unei situații de criză

The Russian-Ukrainian military conflict is the most unexpected event having a major societal impact, not only on the conflicting parties, but also on the entire international community. The irreparable damage to critical infrastructures, the loss of human life and the constantly increasing considerable material damage are just three indicators that signal possible future crisis situations. The question that is justifiably raised is “Could this military conflict have been prevented?” Implicitly, another series of questions arises, such as “Can future crisis situations generated by this military conflict be prevented?” When expressing the answers to such questions, the military and societal security specialists turn to specific tools such as threat predictions and scenarios. In this context, we can talk about planning military actions in a much more realistic way, observing the battles taking place in the Ukrainian space, which is a new reality in Eastern Europe. The lessons learned following recent military conflicts refer to the complexity of the combat actions generated by the digitalization of the confrontation space and the interaction of the societal domains in a difficult-to-decipher manner. The experimental vignette methodology – EVM – applied in the development of the threat scenarios by using podcasts, supports the planning of the military actions as a solution to prevent crisis situations. The optimization of the process of teaching and training the military specialist through experimental vignettes opens new horizons on planning the military actions as interactions of the military component with the other components of the societal domains that ensure the transition from a macro- to a micromilitary confrontational environment.

Scenario Development in Planning Military Actions to Prevent a Crisis Situation

The Russian-Ukrainian military conflict is the most unexpected event having a major societal impact, not only on the conflicting parties, but also on the entire international community. The irreparable damage to critical infrastructures, the loss of human life and the constantly increasing considerable material damage are just three indicators that signal possible future crisis situations. The question that is justifiably raised is “Could this military conflict have been prevented?” Implicitly, another series of questions arises, such as “Can future crisis situations generated by this military conflict be prevented?” When expressing the answers to such questions, the military and societal security specialists turn to specific tools such as threat predictions and scenarios. In this context, we can talk about planning military actions in a much more realistic way, observing the battles taking place in the Ukrainian space, which is a new reality in Eastern Europe. The lessons learned following recent military conflicts refer to the complexity of the combat actions generated by the digitalization of the confrontation space and the interaction of the societal domains in a difficult-to-decipher manner. The experimental vignette methodology – EVM – applied in the development of the threat scenarios by using podcasts, supports the planning of the military actions as a solution to prevent crisis situations. The optimization of the process of teaching and training the military specialist through experimental vignettes opens new horizons on planning the military actions as interactions of the military component with the other components of the societal domains that ensure the transition from a macro- to a micromilitary confrontational environment.

Geopolitics of Technological Futures: Warfare Technologies and Future Battlefields in German Security Debates

ABSTRACT Germany’s role in global geopolitics is being renegotiated within current debates about future security architecture, weapons technology capabilities, and the spatiality of future battlefields. This paper introduces a critical geopolitics of technological futures approach and analyses weapons technology discourses through poststructuralist discourse theory and scholarship on technological expectations. It investigates German security policy documents’ construction of future threat scenarios, technological visions, battlefields, and the material-technological consequences associated with these futures. It identifies how the geopolitical scenario of ‘Westlessness’ discursively shifted after Russia’s war in Ukraine. It also considers the socio-technical imagination of ‘hyperwar’, which justifies the development of artificial intelligence-based weapons technologies. Such socio-technical imaginations construct desirable weapons and influence geopolitical leitmotifs. In turn, geopolitical imaginaries affect expectations of future weapons technologies and legitimate the acquisition of specific technologies. Therefore, this paper offers an approach to examining geopolitical power-knowledge constructions in relation to (new) technologies of killing.

Framework for multirisk climate scenarios across system receptors with application to the Metropolitan City of Venice.

Climate change influences the frequency of extreme events that affect both human and natural systems. It requires systemic climate change adaptation to address the complexity of risks across multiple domains and tackle the uncertainties of future scenarios. This paper introduces a multirisk analysis of climate hazard, exposure, vulnerability, and risk severity, specifically designed to hotspot geographic locations and prioritize system receptors that are affected by climate-related extremes. The analysis is demonstrated for the Metropolitan City of Venice. Representative scenarios (RCP4.5 and RCP8.5) of climate threats (i.e., storm surges, pluvial flood, heat waves, and drought) are selected and represented by projections of Regional Climate Models for a 30-year period (2021-2050). A sample of results is as follows. First, an increase in the risk is largely due to drought, pluvial flood, and storm surge, depending on the areas of interest, with the overall situation worsening under the RCP8.5 scenario. Second, particular locations have colocated vulnerable receptors at higher risk, concentrated in the urban centers (e.g., housing, railways, roads) and along the coast (e.g., beaches, wetlands, primary sector). Third, risk communication of potential environmental and socio-economic losses via the multirisk maps is useful to stakeholders and public administration. Fourth, the multirisk maps recommend priorities for future investigation and risk management, such as collection of sensor data, elaboration of mitigations, and adaptation plans at hotspot locations.

#NotDying4Wallstreet: A Discourse Analysis on Health vs. Economy during COVID-19

This paper combines political/poststructuralist discourse theory with actor–network theory to explore dystopian visions in the context of a discourse around the hashtag #NotDying4Wallstreet. The call for protest against former US president Donald Trump’s demand to reopen the economy during lockdown dominates the discourse. The tweets were analyzed with quantitative discourse analysis and network analysis to identify key terms and meaning clusters leading to two main conclusions. The first (A) is an imaginary dystopic future with an accelerated neoliberal order. Human lives, especially elderly people, are sacrificed for a well-functioning economy in this threat scenario. The second (B) includes the motive of protest and the potential of the people’s demands to unite and rally against this threat. Due to the revelation of populist features, this (online) social movement seems to be populist without a leader figure. The empirical study is used to propose a research approach toward a mixed-methods design based on a methodological discussion and the enhancement of PDT with ANT. Thus, the article has a double aim: an update of contemporary approaches to social media analysis in discourse studies and its empirical demonstration with a study.

Defining the reporting threshold for a cybersecurity incident under the NIS Directive and the NIS 2 Directive

Abstract The NIS Directive and sector-specific cybersecurity regulations require the reporting of (security) incidents to supervisory authorities. Following the risk-based approach adopted in the NIS Directive, the NIS 2 Directive enlists as a basic security element the reporting of significant incidents that (i) have caused or (ii) are capable to cause harm, as well as (iii) notifying the service recipients of cyber threats. Although during the interinstitutional negotiations between the European Commission, the European Parliament, and the Council of the European there was consensus that the NIS Directive’s reporting framework needs to be reformed, views on the determination of what needs to be reported varied. This paper outlines and analyses the different concepts of a report-worthy significant incident that have been proposed during the legislative procedure for the NIS 2 Directive from a legal and policy perspective. Irrespective of further motives that may inhibit reporting, legal compliance is difficult to achieve where legal requirements are vague. In that regard, the difficulties to determine the reporting thresholds in the past and in the future are addressed. In consideration of the increased attack surface and threat scenario, it is argued that incidents where no harm has materialized should not be treated any different than incidents that have actually resulted in harm in order to acquire the envisaged full picture of the threat landscape and create value for business and society.

SoK: Secure E-Voting with Everlasting Privacy

Vote privacy is a fundamental right, which needs to be protected not only during an election, or for a limited time afterwards, but for the foreseeable future. Numerous electronic voting (e-voting) protocols have been proposed to address this challenge, striving for everlasting privacy. This property guarantees that even computationally unbounded adversaries cannot break privacy of past elections. The broad interest in secure e-voting with everlasting privacy has spawned a large variety of protocols over the last three decades. These protocols differ in many aspects, in particular the precise security properties they aim for, the threat scenarios they consider, and the privacy-preserving techniques they employ. Unfortunately, these differences are often opaque, making analysis and comparison cumbersome. In order to overcome this non-transparent state of affairs, we systematically analyze all e-voting protocols designed to provide everlasting privacy. First, we illustrate the relations and dependencies between all these different protocols. Next, we analyze in depth which protocols do provide secure and efficient approaches to e-voting with everlasting privacy under realistic assumptions, and which ones do not. Eventually, based on our extensive and detailed treatment, we identify which research problems in this field have already been solved, and which ones are still open. Altogether, our work offers a well - founded reference point for conducting research on secure e - voting with everlasting privacy as well as for future - proofing privacy in real - world electronic elections.

Climate security in the Northern Mediterranean: Threat scenarios and the prospects for resiliency

Climate change is transforming everyday around the world. From how we live our daily lives to how we grow our food, where we can build our homes, and even how we protect ourselves and those we love, climate change is forcing us to reconsider long-held beliefs and habits. In this paper, we map and analyze four sea-level-rise (SLR) scenarios for countries in the Northern Mediterranean to explore numerically and visually increasingly likely climate threats to the region. We argue that climate change generates primary (direct), secondary and even tertiary impacts that indicate that securitization has occurred, even if some policy-makers choose to ignore that reality.