Threat Scenarios Research Articles

A Methodological Framework for the Risk Assessment of Drone Intrusions in Airports

Drone expansion needs to be considered as a menace in cases of negligent, illicit, or non-cooperative use. In the case of airports, a complete protection against drone intrusion should rely on an intrusion management system, aiming at avoiding the closure of the airport. This system requires the setting of proper risk assessment methodologies for airport operations, to explicitly consider the features of drone intrusion, possibly from a quantitative point of view. This work proposes a methodological framework for the risk assessment of drone intrusions in airports, tailored on drone-intrusion features, airport features, and current operations, and considering both safety-related and security-related causes. The framework is based on the combination of model-based and data-driven approaches in order to: (i) estimate an airport vulnerability index, to measure the susceptibility of the airport to drone intrusions, based on reference datasets; (ii) specify a set of event trees to evaluate the risks of the different threat scenarios related to drone intrusions. The proposed methodological framework is applied to a concrete case study, related to Milan Malpensa airport. The achieved results show the effectiveness of the approach and elicit further requirements for counter-drone systems in airports based on the assessed risks.

Dynamic Assessment of Cyber Threats in the Field of Insurance

The area of digital technologies is currently the subject of many cyber threats, the frequency of which is increasing. One of the areas of cyber security is also the creation of models and estimates of the process of cyber threats and their possible financial impacts. However, some studies show that cyber-threat assessment to identify potential financial impacts for organizations is a very challenging process. A relatively large problem here is the detection of scenarios of cyber threats and their expression in time. This paper focuses on the design of an algorithm that can be applied to the field of cyber-threat assessment in order to express the financial impacts. The study is based on an in-depth analysis of the insurance industry. The results obtained in our research show the importance of the time perspective for determining the potential financial impacts of cyber threats for the field of insurance.

Modeling and Defense of Social Virtual Reality Attacks Inducing Cybersickness

Social Virtual Reality Learning Environments (VRLE) offer a new medium for flexible and immersive learning environments with geo-distributed users. Ensuring user safety in VRLE application domains such as education, flight simulations, military training is of utmost importance. Specifically, there is a need to study the impact of “immersion attacks” (e.g., chaperone attack, occlusion) and other types of attacks/faults (e.g., unauthorized access, network congestion) that may cause user safety issues (i.e., inducing of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">cybersickness</i> ). In this article, we present a novel framework to quantify the security, privacy issues triggered via immersion attacks and other types of attacks/faults. By using a real-world social VRLE viz., vSocial and creating a novel attack-fault tree model, we show that such attacks can induce undesirable levels of cybersickness. Next, we convert these attack-fault trees into stochastic timed automata (STA) representations to perform statistical model checking for a given attacker profile. Using this model checking approach, we determine the most vulnerable threat scenarios that can trigger high occurrence cases of cybersickness for VRLE users. Lastly, we show the effectiveness of our attack-fault tree modeling by incorporating suitable design principles such as <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">hardening</i> , <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">diversity</i> , <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">redundancy</i> and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">principle of least privilege</i> to ensure user safety in a VRLE session.

Evaluation of the maritime security threats and issues to the future of the shipping industry – Maritime Autonomous Surface Ships

Nowadays traditional manned commercial sea-going vessels are facing several difficulties, including shipping accidents that are mainly caused by human errors and the shortage of seafarers with the associated increased manning cost. In 2021, the International Maritime Organisation Maritime Safety Committee (IMO MSC) had finished the Regulatory Scoping Exercise (RSE) regarding Maritime Autonomous Surface Ships (MASS) at its 103rd session, taking its first step towards autonomous shipping that does not involve human vectors. This paper analyses the security issues that are potentially involved in fully autonomous ships (Degree Four of Autonomy) (DOA 4) of MASS operations and recommend measures to adjust and mitigate the issues. This paper reviews six conventional maritime security threats that could threaten a DOA 4 vessel, including piracy and armed robbery at sea, terrorism, smuggling and trafficking, stowaways, cyber security threat and hybrid security threat. The research methodology of this paper reviews different literature as the source of both quantitative data and qualitative evidence. This paper analyses the experience of the security incidents in other comparable sectors and systems in order to identify the characteristics and behaviour of the security threats. Then the information is analysed against the specific characteristics of MASS operations to consider whether the characteristics of MASS operations may become more vulnerable if exploited by perpetrators of security threats. Potential issues and scenarios of the security threats in the operations are also discussed. Risk assessments are applied to explore the risk level of the security threats in DOA 4 MASS. This paper demonstrates that the characteristics of DOA 4 MASS operations may still pose vulnerabilities that can be exploited by all the six security threats. The risk of terrorism, smuggling and trafficking, cyber security, and hybrid security threats are high in DOA 4 MASS operations, while the risk of piracy and armed robbery at sea and stowaways are medium. Both the aspects of cyber security, detection/monitoring equipment, reliability of vessel systems, security in Shore Control Centres (SCC) and security in ports contribute significantly to the security of DOA 4 MASS operations against these security threats. This paper recommends all the aspects mentioned in the above findings should be considered in the development of future instruments regarding DOA 4 MASS operations. The stakeholders involved in DOA 4 MASS operations should apply any possible cyber security and detection/monitoring measures even beyond the legal requirement. The security and personnel management of SCC should be ensured too. Finally, further research on the identified security threats on DOA 4 MASS operations is recommended once more practical data on the operations are available, further research on different DOA of MASS operations and different security threats are also recommended.

Detecting False Data Injection Attacks in Peer to Peer Energy Trading Using Machine Learning

In peer-to-peer (P2P) energy trading, the incorporation of distributed energy resources with unprotected data, originating from sources such as home energy management systems that are connected through the Internet, provokes vulnerabilities that can manifest security breaches. In this article, two threat scenarios based on a novel false data injection attack (FDIA) model in a local P2P energy trading system are explored. In these scenarios, an attacker gains free energy by manipulating prosumers’ consumption and demand. Precise and fast attack detection is needed to guarantee suitable countermeasures to prevent potential risks. We propose a novel instance-based machine learning (ML) classifier for detecting FDIAs. In contrast to black-box ML models, our algorithm provides a transparent decision-making procedure with significant predictive performance. We apply our detection model to a real-world dataset from Austin, Texas. Our experimental results show superior performance as compared to several popular interpretable and non-interpretable ML methods. On average, we achieve a 96.10 percent detection rate, a 96.18 percent accuracy rate, and a false negative rate of 1.97 percent with our approach.

‘Patriotism is not just a Man’s Thing’: Right-wing Extremist Gender Policies within the so-called Identitarian Movement

Taking an analysis of relevant statements and campaigns of the right-wing extremist group ‘Identitarian Movement’ in German-speaking countries as a starting point, this article will reconstruct their key narratives with regard to gender policy, and identify the discourses and forms of organization that are used to integrate women into the Identitarian context. An overview of the origins and characteristics of the Identitarians is followed by a classification of Identitarian gender policy into three phases: its beginning (2012–2015), its peak (2016–2018) and its demise (2019–2020). As can be seen, during the first years it had been necessary to negotiate fundamental questions of the group's gender concepts, whereas during the peak years the focus shifted to threat scenarios involving ‘our women’. At the same time, female activists started to find their own projects. Since 2019, however, the group has started to fall apart, women's issues have lost their appeal and women activists have been leaving. Notwithstanding this decline, the question still remains of what to make of the gender-political commitment of Identitarian women in the context of feminist debates.

Hybrid Threats – Means of Destabilization of Law and Order in Modern Democratics Societes. Idea and Methodology of Proposed Research

Threats are one of the most serious threats to the legal order of a democratic state. Their non-linear, asymmetric nature makes them more dangerous than other threats to the legal order. The use of multifaceted measures as a weapon disrupts, above all, the legal order of the state. Hybrid threats rely heavily on non-military domains. Civilian populations are central to the hybrid threat scenarios as sources for potential socio-political vulnerabilities and as targets for non-military threats and attacks, not least disinformation campaigns. A significant part of the hybrid threat phenomena is psychological. Actors targeting communities/societies to exacerbate weaknesses do not necessarily create social vulnerabilities themselves but make use of divisions that already exist in civil society. Using disinformation, populations are targeted and used as potential weapons within the state/society in question. This paper shows a concrete scientific approach to the study to of this issue.

KRYSTAL: Knowledge graph-based framework for tactical attack discovery in audit data

Attack graph-based methods are a promising approach towards discovering attacks and various techniques have been proposed recently. A key limitation, however, is that approaches developed so far are monolithic in their architecture and heterogeneous in their internal models. The inflexible custom data models of existing prototypes and the implementation of rules in code rather than declarative languages on the one hand make it difficult to combine, extend, and reuse techniques, and on the other hand hinder reuse of security knowledge – including detection rules and threat intelligence. KRYSTAL tackles these challenges by providing a knowledge graph-based, modular framework for threat detection, attack graph and scenario reconstruction, and analysis based on RDF as a standard model for knowledge representation. This approach provides query options that facilitate contextualization over internal and external background knowledge, as well as the integration of multiple detection techniques, including tag propagation, attack signatures, and graph queries. We implemented our framework in an openly available prototype and demonstrate its applicability on multiple scenarios of the DARPA Transparent Computing dataset. Our evaluation shows that the combination of different threat detection techniques within our framework improved detection capabilities. Furthermore, we find that RDF provenance graphs are scalable and can efficiently support a variety of threat detection techniques.

Adversarial Attacks for Intrusion Detection Based on Bus Traffic

A communication bus is used to transmit electronic signals between components, realize functional integration through information sharing, and improve system efficiency. The current research on intrusion detection based on bus traffic is mainly pertaining to machine learning or time logic detection. However, recent studies have shown that machine learning models perform poorly in defense of various adversarial attacks. In this article, we propose a method based on generative adversarial networks to transform normal traffic into adversarial and malicious ones. To be closer to reality, adversarial example generation models on two threat scenarios are proposed. At the same time, the distance metric L <inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</inf> is introduced in the loss function to ensure the authenticity of the generated adversarial examples. To evaluate our method, we use the traffic generated by the model to various intrusion detection systems based on bus. Experimental results show that the model is effective because the detection rate of different intrusion detection models decreases after the traffic is processed. Thus, the traffic generated by our models can be used as training data to enhance the accuracy of intrusion detection systems.

Discourse coalitions against gender and sexual equality: antifeminism as a common denominator between the radical right and the mainstream?

ABSTRACT This study examines whether opposition against gender and sexual equality is a common denominator between the radical right, political actors, and mainstream media in Germany. The study hypothesizes that socially shared sexist beliefs and gender stereotypes offer access points to public discourse for anti-egalitarian counterpublics, legitimizing their contestations of gender and sexual equality. This hypothesis is tested in a quantitative frame analysis of n = 1102 articles in 18 digital media outlets from diverse anti-egalitarian counterpublics (anti-feminist men’s rights activists, feminists, Christian fundamentalists, radical right, and far-left media) and mainstream media. The study results offer a current overview of the framing of gender and sexual equality in mainstream and counterpublic media in Germany: Discourse on gender equality and LGBTQI rights takes up the most space. The framing of these topics is less controversial than the highly contested discussion of gender roles and reproductive rights. Discourse coalitions between anti-egalitarian counterpublics and established actors become visible in the neosexist and gender-traditional frame, pointing to the relevance of neosexist convictions and gender traditionalism as a common denominator between these actors. Across all frames, a common oppositional strategy is reframing gender and sexual equality issues into threat scenarios to families and society.

EvilModel 2.0: Bringing Neural Network Models into Malware Attacks

Security issues have gradually emerged with the continuous development of artificial intelligence (AI). Earlier work verified the possibility of converting neural network models into stegomalware, embedding malware into a model with limited impact on the model’s performance. However, existing methods are not applicable in real-world attack scenarios and do not attract enough attention from the security community due to performance degradation and additional workload. Therefore, we propose an improved stegomalware EvilModel. By analyzing the composition of the neural network model, three new methods for embedding malware into the model are proposed: MSB reservation, fast substitution, and half substitution, which can embed malware that accounts for half of the model’s volume without affecting the model’s performance. We built 550 EvilModels using ten mainstream neural network models and 19 malware samples. The experiment shows that EvilModel achieved an embedding rate of 48.52%. A quantitative algorithm is proposed to evaluate the existing embedding methods. We also design a trigger and propose a threat scenario for the targeted attack. The practicality and effectiveness of the proposed methods were demonstrated by experiments and analyses of the embedding capacity, performance impact, and detection evasion.

EL-NAHL: Exploring labels autoencoding in augmented hidden layers of feedforward neural networks for cybersecurity in smart grids

Reliability and security of power distribution and data traffic in smart grid (SG) are very important for industrial control systems (ICS). Indeed, SG cyber-physical connectivity is subject to several vulnerabilities that can damage or disrupt its process immunity via cyberthreats. Today's ICSs are experiencing highly complex data change and dynamism, increasing the complexity of detecting and mitigating cyberattacks. Subsequently, and since Machine Learning (ML) is widely studied in cybersecurity, the objectives of this paper are twofold. First, for algorithmic simplicity, a small-scale ML algorithm that attempts to reduce computational costs is proposed. The algorithm adopts a neural network with an augmented hidden layer (NAHL) to easily and efficiently accomplish the learning procedures. Second, to solve the data complexity problem regarding rapid change and dynamism, a label autoencoding approach is introduced for Embedding Labels in the NAHL (EL-NAHL) architecture to take advantage of labels propagation when separating data scatters. Furthermore, to provide a more realistic analysis by addressing real-world threat scenarios, a dataset of an electric traction substation used in the high-speed rail industry is adopted in this work. Compared to some existing algorithms and other previous works, the achieved results show that the proposed EL-NAHL architecture is effective even under massive dynamically changed and imbalanced data.

A modelling and simulation framework to assess integrated survivability of naval platforms in high threat environments

Integrated Survivability analysis of naval platforms incorporates the domains of susceptibility, vulnerability and recoverability, measured temporally. These are accepted as key elements when holistically assessing naval platform survivability against threat scenarios. Conversely, traditional naval platform survivability assessment only considered the vulnerability domain or a combination of susceptibility and vulnerability. However, emphasis is now placed on the interdependence of susceptibility, vulnerability and recoverability. Unfortunately, there are shortcomings with historic survivability modelling and assessment capabilities pertaining to Integrated Survivability. This has resulted in the need to clearly define the concept of Integrated Survivability, and identify modelling requirements to assess platforms exposed to the threat environments. A naval platform Integrated Survivability assessment capability, derived from those survivability modelling requirements, will enable naval architects and mission planners to quantify the effects of platform survivability. Assessments will consider platform safety systems and survivability control measures, and changes to those systems and control measures. Outcomes from the assessments will contribute to platform configuration optimisation for resilience against the threat environment and enable mission success. This paper presents the need for an Integrated Survivability assessment capability, defining relevant terminology, and elucidating modelling requirements to develop such a capability.

Community Resilience Related to Community Resources Access to Peatland in Political Ecological Perspectives: A Case Study of Purun (Eleocharis dulcis) Craftmen in Ogan Komering Ilir, South Sumatera, Indonesia

Community resilience is widely used in managing natural resources and the environment as a means of system capacity to cope with stress. However, our findings show that resilience is not easily applied to common-pool resources (CPRs) such as peatlands, which are open access and full of importance. This is experienced by the community of purun craftsmen (Eleocharis dulcis) in Ogan Komering, Ilir Regency, South Sumatra, Indonesia. This paper was conducted to determine the community's social resilience in overcoming pressures originating from environmental, socio-economic, and political changes. We used a qualitative research method with a descriptive approach and obtained data through observation, in-depth interviews, and documentation. Our findings suggest that community resilience on peatlands is influenced by mechanisms to gain and maintain access to the resource. This mechanism is relatively limited, so it can be said that it is less robust, mainly if three threat scenarios co-occur, such as massive activity by companies, weak rules for managing, utilizing, and protecting resources, and extreme weather conditions. In conclusion, from these findings, we show that “access politics” and policy implications also play an essential role in increasing the resilience of socio-ecological systems in important peatland areas.

Games to support disruptive technology adoption: the MUST Game use case

Serious games can be used as a means to explore complex systems and uncertainty related challenges, therefore they may have the potential of supporting the adoption of innovative and disruptive technologies. In this paper we present the use case of the Maritime Unmanned Systems Trust (MUST) Game, which goal is to capture beliefs, attitude and perspectives of the participants with respect to the employment of maritime unmanned systems (MUS) in the maritime domain. This novel game aims at better understanding the relation between trust factors and MUS. Moreover, it explores how players make decisions with respect to MUS deployments in an increasing threat scenario. This allows to capture important information on the trade-offs related to MUS use that have an impact on maritime missions planning activities (e.g., endurance, logistics, maintenance, cost, number of assets, security and type of assets). This paper describes the game and an analysis of the outcomes of its deployment. The results show how the MUST Game design has been effective in eliciting constructive discussion around the use of MUS in maritime missions, as well as in the collection of assessments and decisions, which are currently being used in algorithmic development.

SMART HOME SYSTEM SECURITY RISK ASSESSMENT

The concept of the Internet of Things became the basis of the fourth industrial revolution, which allowed to transfer the processes of automation to a new saber. As a result, automation systems, such as smart homes, healthcare systems and car control systems, have become widespread. The developers of such systems primarily focus their efforts on the functional component, leaving safety issues in the background. However, when designing and operating IoT systems, it is equally important to assess potential bottlenecks and develop complete and comprehensive strategies to mitigate and eliminate the negative effects of cyberattacks.&#x0D; The purpose of this study is to identify possible cyber threats and assess their impact on critical information objects in the smart home system. To achieve this goal, the three-level architecture of the smart home system is considered and a review of known cyber threats for each level is conducted. The critical information objects in the smart home system are the containers in which the information objects are stored, the risk assessment criteria and the cyber threat scenarios. The information security risks of the smart home system were assessed using the OCTAVE Allegro methodology for the information object that presents the information collected by the smart home sensors.

Security that Matters: General Knowledge and Correlations in the Context of Applied Satellite Navigation, Specific Interference-Events and the Use of the GNSS-Technology

Abstract Navigation through global navigation satellite systems (GNSS) has become an indispensable part of modern life with threats such as GNSS interference, making it necessary to uncover relevant psychological aspects in the context of the GNSS construct, diverse interference events, and the use of related technologies. A total of n = 122 subjects participated in an online survey, which included scales and specifically constructed items on GNSS usage, acceptance, dependence, and self-assessed sense of direction and relevance of basic psychological needs. In addition, frequently emphasized factors influencing acceptance and use of diverse technologies were recorded according to the Unified Theory of Acceptance and Use of Technology (UTAUT; Venkatesh et al., 2003). Correlation analyses showed that the frequency of GNSS use was associated with both effort expectation of appropriate technologies, hedonistic motivation, habits of using GNSS-enabled devices, and specific aspects of mobility. In terms of reported GNSS dependency, negative correlations were found with self-assessed orientation ability. It was also possible to identify voluntariness in the use of related technologies, the age of the users, and the relevance of self-determination as essential variables in the context of GNSS use. The results underline the need for further investigation of psychological aspects and contribute to existing discussions in the context of various threat scenarios.

Conservation strategies for endangered arable plant Euphorbia gaditana

AbstractFragmentation and habitat loss are considered among the most important threats to biodiversity. More precisely, transformation of natural habitats into farmlands has been identified as one of the primary causes of plant species extinction. Therefore, understanding the effects of habitat fragmentation is crucial to the successful conservation of threatened species. Metapopulation modeling is one of the prospective tools used in conservation biology to evaluate long‐term survival in fragmented landscapes. In this work, we applied a metapopulation approach to the conservation of the rare plant Euphorbia gaditana Coss., an endangered species growing on the margins of crops in southern Spain. The species is threatened due to herbicide application and intensification of cultivation, which results in a highly patchy distribution, with more than 50 patches of habitat across three separate networks of patches. We used IFM (Incidence Function Modeling) to compare the relative effectiveness of four conservation management scenarios and the effect of three threat scenarios on the risk of extinction of the species. The results of our simulations of population dynamics under plausible management scenarios will aid conservation decision‐making, for example, allowing priority conservation areas to be identified or assessing the effect of future reintroductions.

Knock, knock, log: Threat analysis, detection & mitigation of covert channels in syslog using port scans as cover

In this paper we perform a threat analysis for a covert Command and Control (C2) channel using port scans as cover and syslog as carrier for data infiltration. We describe a theoretical threat scenario in which an adversary makes use of known covert channels in TCP and DNS, and propose a novel method for hiding information in TCP ports scans and the resulting (sys)logs as a carrier for hidden messages. For forensic purposes, we provide details on Indicators-of-Compromise (IoC) as well as mitigating measures aiming at preventing the covert channel apriori. Moreover, we propose a novel detection scheme in order to identify and prevent such threats hidden in port scans and evaluate its effectiveness using datasets generated by a proof of concept implementation of the proposed covert channel based threat scenario.

Imagining total onslaught: South African military threat scenarios and doctrinal change, 1953–1975

ABSTRACT The Apartheid-era South African military (SADF) underwent dramatic peacetime changes, from a small and underfunded expeditionary element of Commonwealth forces in the 1950s to a regime bulwark with regional capabilities under ‘Total Strategy’ in the mid-1970s. By comparing internal assessments, changes in the SADF’s official view of future wars are traced through security crises of the 1960s and 1970s. Shifting future war perceptions were shaped by the interplay of organizational-political needs during crises of legitimacy for the military. These shifts in future war perception motivated strategic and operational-tactical doctrinal change and shaped the military’s view of security crises.