Threat Environment Research Articles

Wargaming in Information Warfare Training: A Study of Finnish Officials

In the digital age, information warfare has become a significant global concern, with malicious actors exploiting various media to manipulate public opinion, destabilising governments, and sowing discord. Automated and algorithmic tools are used to spread false and misleading information on social media platforms, and states have been unable to control the spread of it. In addressing new challenges, national governments globally reassess strategies, communications, and responses to adapt to evolving threat environments. To counter information influence activities, it is crucial to have informed, educated, and well-trained communicators. This case study focuses on the innovative use of wargaming in training government officials, providing them with abilities to respond to different tactics and methods of malign influence operations. This article is based on an information warfare exercise conducted in January 2024 involving 27 Finnish officials from various ministries and agencies critical to national security. The participants participated in an interactive simulation, where they explored and responded to challenges related to disinformation campaigns and other tactics designed to manipulate and influence information within a hybrid warfare context. The players were divided into two teams: red and blue, with the reds assuming the role of the offensive team while the blues took on the defensive role. The teams competed for control over the information space, employing various information warfare methods. After the exercise, each participant was asked to complete a post-exercise survey to evaluate the knowledge acquired and the exercise's overall usefulness, including scenario clarity and the effectiveness of role-playing. We also explored potential differences in perceptions and experiences between inexperienced and experienced players in the wargaming exercise. Key findings revealed the effectiveness of wargaming as an educational tool, particularly benefiting novices over experienced players. Role-playing proved valuable, emphasizing the importance of explicit scenarios for effective engagement. The study highlighted cross-departmental cooperation's significance, facilitating a dynamic learning environment.

Meta-Fed IDS: Meta-learning and Federated learning based fog-cloud approach to detect known and zero-day cyber attacks in IoMT networks

The Internet of Medical Things (IoMT) is a transformative fusion of medical sensors, equipment, and the Internet of Things, positioned to transform healthcare. However, security and privacy concerns hinder widespread IoMT adoption, intensified by the scarcity of high-quality datasets for developing effective security solutions. Addressing these challenges, we propose a novel framework for cyberattack detection in dynamic IoMT networks. This framework integrates Federated Learning with Meta-learning, employing a multi-phase architecture for identifying known attacks, and incorporates advanced clustering and biased classifiers to address zero-day attacks. The framework's deployment is adaptable to dynamic and diverse environments, utilizing an Infrastructure-as-a-Service (IaaS) model on the cloud and a Software-as-a-Service (SaaS) model on the fog end. To reflect real-world scenarios, we introduce a specialized IoMT dataset. Our experimental results indicate high accuracy and low misclassification rates, demonstrating the framework's capability in detecting cyber threats in complex IoMT environments. This approach shows significant promise in bolstering cybersecurity in advanced healthcare technologies.

Strategic Management of Financial and Economic Security: Modern Challenges and Threats in a Hyperdynamic External Environment

The main purpose of the article is to increase the efficiency of strategic management of the financial and economic security of a modern enterprise in the face of new challenges and threats. The object of the study is the system of financial and economic security of a modern company. The scientific task is to assess modern surpluses and threats in the system of ensuring the financial and economic security of an enterprise. The research methodology involves the use of modern methods of system analysis, pairwise comparison and hierarchical analysis to assess challenges and threats. As a result, a matrix of the most significant challenges and threats in the system of ensuring the financial and economic security of a modern enterprise was built. The innovativeness of the results obtained is revealed through the proposed methodological approach to assessing and streamlining challenges and threats in the system of ensuring the financial and economic security of a modern enterprise.

Sea blindness in grey zone preparations

ABSTRACT Although grey zone and hybrid threats, such as cyberattacks, information campaigns, and sabotage against critical infrastructure, are becoming increasingly common in the contemporary world, relatively little attention has been directed to similar threats in the maritime environment. The recent global pandemic, Russian aggression against Ukraine, the Nord Stream sabotage in 2022, the sabotage of the Finnish-Baltic pipeline in 2023 in the Baltic Sea, as well as drone attacks on shipping in the Persian Gulf are but a few examples that illustrate the fragility of international maritime communications. The present article explores the topic of grey zone and hybrid threats within the maritime environment. Based on an analysis of recent security events, particularly hybrid threats in the maritime environment, the article proposes that it is essential to seek a broader role for naval forces in supporting national sovereignty and international law and order regarding the Open Seas. The article aims to conceptualize and explore the foundations of maritime grey zone threats and the new roles of naval forces operating within this new context, asking whether the UN, through the International Maritime Organization, NATO, and the European Union, suffer from “sea blindness” concerning how they are preparing for the new world order.

МОДЕЛЮВАННЯ МУЛЬТИАГЕНТНИХ СИСТЕМ ЗАХИСТУ ІНФОРМАЦІЙНИХ РЕСУРСІВ

Traditional centralized information protection systems do not provide an adequate level of adaptability and efficiency in a dynamically changing threat environment. Multi-agent systems, having a distributed architecture and the possibility of autonomous decision-making, represent a promising direction for solving information security problems. The novelty of the research lies in the development of a multi-agent information protection system with enhanced capabilities for vulnerability analysis and intrusion detection. Unlike existing solutions, the proposed system provides active analysis of threats, reduction of the number of false positives, adaptation to new types of attacks, and minimization of the impact on the target traffic of information flows. In the proposed formal model and prototype of the agent-oriented attack modeling system (ASMA), distributed coordinated attacks on a computer network are considered as a sequence of joint actions of hacker agents, which are performed from different hosts. Hackers are supposed to coordinate their actions according to some common script. At each step of the attack scenario, they try to implement a specific private subgoal. The developed agent-oriented attack modeling system (ASMA) allows simulating distributed coordinated attacks on computer networks. It is based on a hierarchy of grammars, each of which is interpreted as a finite automaton. The system takes into account both macro- and micro-levels of attack description, providing detailed simulation of each stage of the attack. The use of KQML for communication between agents and XML for describing the content of messages allows effective coordination of agents' actions and ensures realistic simulation of attacks.

Enhancing the Efficiency of a Cybersecurity Operations Center Using Biomimetic Algorithms Empowered by Deep Q-Learning.

In the complex and dynamic landscape of cyber threats, organizations require sophisticated strategies for managing Cybersecurity Operations Centers and deploying Security Information and Event Management systems. Our study enhances these strategies by integrating the precision of well-known biomimetic optimization algorithms-namely Particle Swarm Optimization, the Bat Algorithm, the Gray Wolf Optimizer, and the Orca Predator Algorithm-with the adaptability of Deep Q-Learning, a reinforcement learning technique that leverages deep neural networks to teach algorithms optimal actions through trial and error in complex environments. This hybrid methodology targets the efficient allocation and deployment of network intrusion detection sensors while balancing cost-effectiveness with essential network security imperatives. Comprehensive computational tests show that versions enhanced with Deep Q-Learning significantly outperform their native counterparts, especially in complex infrastructures. These results highlight the efficacy of integrating metaheuristics with reinforcement learning to tackle complex optimization challenges, underscoring Deep Q-Learning's potential to boost cybersecurity measures in rapidly evolving threat environments.

Performance Evaluation of Deep Learning Models for Classifying Cybersecurity Attacks in IoT Networks

The Internet of Things (IoT) presents great potential in various fields such as home automation, healthcare, and industry, among others, but its infrastructure, the use of open source code, and lack of software updates make it vulnerable to cyberattacks that can compromise access to data and services, thus making it an attractive target for hackers. The complexity of cyberattacks has increased, posing a greater threat to public and private organizations. This study evaluated the performance of deep learning models for classifying cybersecurity attacks in IoT networks, using the CICIoT2023 dataset. Three architectures based on DNN, LSTM, and CNN were compared, highlighting their differences in layers and activation functions. The results show that the CNN architecture outperformed the others in accuracy and computational efficiency, with an accuracy rate of 99.10% for multiclass classification and 99.40% for binary classification. The importance of data standardization and proper hyperparameter selection is emphasized. These results demonstrate that the CNN-based model emerges as a promising option for detecting cyber threats in IoT environments, supporting the relevance of deep learning in IoT network security.

Эра персонализации: развитие креативного потенциала личности, «стена фильтров» и «информационные пузыри»

The prospects for the development of the personal potential of the student relate to the possibilities of personalised learning. The study identified key methodological approaches in understanding the process of personalisation of learning. On the basis of analysis of domestic and foreign sources, the main consequences of wide distribution and increasing influence on the person of digital personalisation tools have been determined. In education, they can become an insurmountable obstacle to the development of students' personal potential. The concepts of “wall of filters” and “information bubbles” are considered in order to determine the causes of shortage of creative resources of the person in a competitive digital environment. The development of a personalised learning model must take into account the potential dangers of Internet technology. The author focuses on the emerging anthropological threats in the digital environment to the development of the creative potential of the individual. The conclusions were confirmed by the results of sociological research. The importance of finding solutions to minimise and overcome risks of digital bases of personalisation was emphasised.

Securing IoT Healthcare Data Using Machine Learning Techniques

The internet of Things has become a crucial technology, enabling the interconnection of everyday devices like home appliances, medical equipment and vehicles. However, the sensitive data handled by IoT systems, particularly in the healthcare sector, requires robust security measures to prevent tampering or theft. Detecting security threats in IoT environments requires sophisticated techniques. Different machine learning algorithms are used to identify the attacks in IoT network traffic and predict snooping behavior based on unidentified patterns. This paper proposed a method to identify network traffic attacks by employing different strategies utilizing the NT-ToN-IoT dataset. The classifier utilized Naïve Bayes(NB), Random Forest(RF), Support Vector Machine, Artificial Neural Network. These algorithms favoured over centralized methods to construct streamlined security system for IoT devices. Prior to analysis the dataset underwent preprocessing to eliminate irrelevant or missing data. Following this, a feature engineering approach is applied to extract crucial features. The results from applying each classifier demonstrated a significant maximum classification accuracy of 98% achieved by the RF model.

US–UK–France relations amid the Russia–Ukraine war: a new strategic alignment?

Abstract The Russian invasion of Ukraine and the recognition of the rising challenge from China have resulted in a closer alignment of American, British and French strategic interests. This policy paper explores how the strategic relationship between the United States, the United Kingdom and France has evolved amid this changed threat environment. The Russia–Ukraine war exposed the limitations of France's policy of ‘strategic autonomy’ and reasserted the importance of an American role in European security. The war has re-focused attention upon the Lancaster House framework in which the UK and France have the potential to enhance their contribution to European defence. The UK still regards its ‘special relationship’ with the US as being of critical importance to its foreign policy. But the UK's diminishing military power makes it a less valuable ally to the US whose attention is increasingly upon the Indo-Pacific region. The paper argues that the alignment between the three countries has been closer over the Russian war in Ukraine compared to attitudes towards China, where tensions between France and the ‘Anglo-Saxons’ persist. France has been unwilling to adopt the American approach towards China and has stuck to its vision of a multipolar world. The AUKUS deal arranged between the US, UK and Australia had the effect of alienating France. The policy paper contends that the temporary alignment between US, UK and French interests will erode as long-standing conflicts of interest re-emerge. In particular, the unpredictability of US leadership will damage the trilateral relationship if Donald Trump regains the presidency in November 2024.

Transforming Cybersecurity into Critical Energy Infrastructure: A Study on the Effectiveness of Artificial Intelligence

This work explores the integration and effectiveness of artificial intelligence in improving the security of critical energy infrastructure, highlighting its potential to transform cybersecurity practices in the sector. The ability of artificial intelligence solutions to detect and respond to cyber threats in critical energy infrastructure environments was evaluated through a methodology that combines empirical analysis and artificial intelligence modeling. The results indicate a significant increase in the threat detection rate, reaching 98%, and a reduction in incident response time by more than 70%, demonstrating the effectiveness of artificial intelligence in identifying and mitigating cyber risks quickly and accurately. In addition, implementing machine learning algorithms has allowed for the early prediction of failures and cyber-attacks, significantly improving proactivity and security management in energy infrastructure. This study highlights the importance of integrating artificial intelligence into energy infrastructure security strategies, proposing a paradigmatic change in cybersecurity management that increases operational efficiency and strengthens the resilience and sustainability of the energy sector against cyber threats.

Predicting the changing insect threat in the UK heritage environment

Environmental changes affecting museums and historic properties will probably result in increased numbers of insect pests or new species. Databases such as WhatsEatingYourCollection (WEYC) and the Global Biodiversity Information Facility have been used along with academic publications to predict such changes in the research presented here. The species mix in the WEYC database seems consistent across major London historic properties. Overall, common silverfish (Lepisma saccharinum) are often reported, although in future there may be an increase in other species such as Ctenolepisma longicaudatum and Ctenolepisma calvum given their increased frequency. Dermestidae (carpet and furniture beetles) may benefit from wood with increasing moisture content, and although not especially abundant, Attagenus smirnovi (brown carpet beetle) and Reesa vespulae (skin beetle) may increase as they have done on the European continent. Tineola bisselliella, a damaging moth, has invoked increasing concern over the last two decades and Cryptophagus spp. (fungus beetles) could mobilise fungal spores under a future climate more favourable to germination. Lyctus brunneus (powderpost beetle) may find future conditions favourable and attack sapwoods used in repairs. Furthermore, Reticulitermes flavipes (subterranean termite) is potentially an accidental import to the UK and may become more common given current temperatures are suitable for survival in well-drained loamy soils, and future climates would allow a presence in the north of England. Warmer conditions can lead to the presence of new species or a migration of species across the British Isles and their spread can also be encouraged through the loan of objects or on packing materials. Factors other than climate, such as changing indoor habitats, new food sources and novel uses of heritage venues can also encourage expanding insect populations. This article summarises these predicted changes in species distribution and outlines their potential threat to heritage.

Detection of Botnet in IOT Using Machine Learning

The proliferation of Internet of Things (IoT) devices has introduced unprecedented connectivity and convenience but also heightened the vulnerability to botnet attacks. There are an increasing number of Internet of Things (IoT) devices connected to the network these days, and due to the advancement in technology, the security threads and cyberattacks, such as botnets, are emerging and evolving rapidly with high-risk attacks. These attacks disrupt IoT transition by disrupting networks and services for IoT devices. Many recent studies have proposed ML and DL techniques for detecting and classifying botnet attacks in the IoT environment. This project presents a straightforward approach to detect botnet activity within IoT networks through the utilization of machine learning techniques. By analyzing network traffic patterns and employing unsupervised learning algorithms, we demonstrate an effective method to identify and mitigate botnet threats in IoT environments. By this project we intend to offer a valuable contribution in enhancing the security of IoT ecosystem. Key Word: Internet of Things(IoT),cybersecurity, botnet attacks, machine learning(ML),UNSW-NB15 dataset, exploratory data analysis, XgBoost

A Survey on Satellite Communication System Security.

In recent years, satellite communication systems (SCSs) have rapidly developed in terms of their role and capabilities, promoted by advancements in space launch technologies. However, this rapid development has also led to the emergence of significant security vulnerabilities, demonstrated through real-world targeted attacks such as AcidRain and AcidPour that demand immediate attention from the security community. In response, various countermeasures, encompassing both technological and policy-based approaches, have been proposed to mitigate these threats. However, the multitude and diversity of these proposals make their comparison complex, requiring a systemized view of the landscape. In this paper, we systematically categorize and analyze both attacks and defenses within the framework of confidentiality, integrity, and availability, focusing on specific threats that pose substantial risks to SCSs. Furthermore, we evaluate existing countermeasures against potential threats in SCS environments and offer insights into the security policies of different nations, recognizing the strategic importance of satellite communications as a national asset. Finally, we present prospective security challenges and solutions for future SCSs, including full quantum communication, AI-integrated SCSs, and standardized protocols for the next generation of terrestrial-space communication.

Identity Threat and Strategic Responses in a Remote Work Environment

Le télétravail est devenu un phénomène planétaire depuis le début de la pandémie et semble s’installer durablement dans le monde du travail. Cette étude examine l’impact du télétravail sur la relation de l’individu au travail et les stratégies mises en œuvre pour y répondre. Eu égard à la nature peu connue du sujet et à la possibilité d’une construction théorique, on a utilisé une approche inductive du type SÉSAME. Précisément, 51 entretiens semi-directifs ont été réalisés en trois phases avec des intervenants en France, États-Unis, Allemagne et Royaume-Uni, entre 2020 et 2021. En outre, des données complémentaires ont été rassemblées grâce à des réunions d’équipes d’une durée de 52 heures sur des plates-formes variées, suivies de comptes-rendus et enregistrements de conversations. Les conclusions suggèrent que le travail à distance peut provoquer une menace considérable sur le psychisme de l’individu et modifier sa relation au travail. Trois types de menaces sur l’identité apparaissent : la reconstitution d’une identité limitée, le mélange d’identités et la perte de sens. Face à cette menace, les individus réagissent en protégeant ou/et en construisant leur identité propre comme réponse stratégique. En effet les personnes confrontées à une perte de sens, menace sur leur identité plus forte que celle de l’identité limitée ou du mélange d’identités, utiliseront très probablement une construction d’identité comme réponse stratégique. Les conclusions de la présente étude font progresser notre compréhension de l’identité dans le télétravail et la relation entre identité et espace. Cette investigation met aussi en lumière la dynamique d’un réseau identitaire dont les liens à l’identité et leur hiérarchie sont transformés. Des recherches à venir pourraient explorer les causes des menaces d’identité et la façon dont le travail à distance saurait créer de nouvelles opportunités d’identité.

EHealth Innovation for Chronic Obstructive Pulmonary Disease: A Context-Aware Comprehensive Framework

Chronic Obstructive Pulmonary Disease (COPD) poses a significant global healthcare challenge. It is a progressive lung disease that causes breathing difficulties and can significantly impact a person's quality of life. COPD is primarily caused by smoking, but other factors, such as air pollution and genetic predisposition, can also contribute to its development. This paper introduces a novel Context-Aware Framework for the Diagnosis and Personalized Management of COPD. We discuss the limitations of traditional COPD management, highlighting the importance of early detection and remote monitoring. Early detection and remote monitoring are crucial in managing COPD as they allow for timely interventions and better disease management. In this paper, we propose a framework based mostly on contextual data and other parameters of COPD as put forth by the World Health Organization (WHO) in the form of the International Classification of Functioning, Disability, and Health. Ontologies drive this architecture and incorporate dynamic contextual information from patient environments, user profiles, and sensor data. In addition to the various obvious data items like patient personal details (gender, contact, medical history) and COPD risks and symptoms, the COPD ontology also considers the details about the caregiver and healthcare professional. This is in addition to the contextual data processed separately using the Context Ontology. The ontology we constructed using Protégé serves as the framework for the structured representation and logical inference of contextual information. By harnessing dynamic contextual data, our ontology enables real-time decision-making tailored to individual patient requirements. It empowers healthcare professionals to make informed choices and deliver timely interventions, enhancing healthcare services by offering proactive care to detect early signs of health deterioration and suggest preventive measures. This approach improves patient experiences and optimizes resource allocation within the healthcare system. To uphold ethical standards and prioritize the needs of patients, we emphasize the significance of safeguarding data, obtaining informed permission, and recognizing data ownership. The ontology-based approach presented in this study offers a scalable and flexible framework that can be readily incorporated into existing healthcare systems, redefining the management of COPD in response to evolving demands. Security poses one of the biggest threats in context-based environments due to the different data formats acquired by the diverse sensors. Another essential consideration is confidentiality because the data in hand is sensitive patient information.

STRATEGIC PLANNING AS AN EFFECTIVE TOOL OF ORGANISATIONAL CHANGE

It is possible to understand strategic planning as a process consisting of defining a vision of the future, systematically analysing opportunities and threats in the external environment, as well as strengths and weaknesses of the organisation to develop strategies and actions that contribute to achieving this vision. Strategic management relies on strategic administration and planning, with some administrative aspects added during its implementation, such as organisational change, human resources management, control, performance, and organisational effectiveness. A factor of great importance for the success of strategic management is the strategy implementation process. However, the models of organisational change developed in recent years are designed to manage general changes in organisations and do not have a specific approach to managing and implementing strategic planning and the changes caused by it, i.e., they are not models with a direct emphasis on strategic management. The article aims to define the concepts of strategic planning and management, analyse strategic planning models, and determine strategic problems of developing a model of organisational change. In the course of the research, we defined the concepts of strategic planning and strategic management by analysing the theoretical approaches of various authors. As a result of the analysis, we concluded that strategic management, in which the structuring basis is strategic planning and strategic administration, in its implementation added some administrative aspects, such as system thinking, integrated control, change management, organisational learning, performance, and organisational effectiveness. The article proposes a model of organisational change for efficient implementation of an organisation’s strategic planning. Thus, the strategic planning process requires a model of organisational change that will ensure its successful implementation. The proposed strategic planning process and the associated model of organisational change should be subject to constant refinement and improvement, both in theory and their application, to a particular organisation. Keywords: strategic planning, plan, management, organisational change, strategic management.

146 Intracranial Correlates of Fear Memory in Freely Moving Humans During Virtual Reality

INTRODUCTION: Distressing reactions to perceived threats in safe environments is a hallmark feature of anxiety-related disorders such as post-traumatic stress disorder (PTSD) and generalized anxiety disorder (GAD). The development of targeted neural circuit therapies requires an understanding of how neurophysiological activity relates to behavior and subjective emotional experience. METHODS: The task induced memories fear memories, a critical component of anxiety-related disorders etiology, using a novel virtual reality platform. Here, participants freely explored a virtual reality environment via walking or joystick. Participants were instructed to stop movement following color change of the room. When the room turned green (CS+), a noxious virtual reality stimulus (insect) attacked the participant (US) 6 seconds following color change onset. When the room turned blue (CS-), no noxious VR stimulus occurred. In addition to intracranial electroencephalography (iEEG) activity, we recorded physiological and behavioral metrics of fear. RESULTS: We found that the same neural signature indicative of fear memory retrieval in rodents (increased amygdala theta oscillations) was significantly elevated for the fear compared to the neutral cue in freely behaving humans. CONCLUSIONS: These findings represent an important step in translating decades of research in rodents to humans and provide putative electrophysiological signatures of fear behavior that can be used as putative targets for treatment with closed loop brain stimulation therapies. We believe that this combined collection of simultaneous autonomic responses to subjective emotional (fear ratings and physiology), clinical symptoms (anxiety scales) and neural activity has immense transdiagnostic clinical potential for anxiety-related disorders and can inform neurosurgical approaches to treating severe psychopathology.

인공지능 기반의 자동화된 통합보안관제시스템 모델 연구

In today's growing threat environment, rapid and effective detection and response to security events is essential. To solve these problems, many companies and organizations respond to security threats by introducing security control systems. However, existing security control systems are experiencing difficulties due to the complexity and diverse characteristics of security events. In this study, we propose an automated integrated security control system model based on artificial intelligence. It is based on deep learning, an artificial intelligence technology, and provides effective detection and processing functions for various security events. To this end, the model applies various artificial intelligence algorithms and machine learning methods to overcome the limitations of existing security control systems. The proposed model reduces the operator's workload, ensures efficient operation, and supports rapid response to security threats.

Combating Insider Threat in the Open-World Environments: Identification, Monitoring, and Data Augmentation

Recent years have witnessed a dramatic increase in a class of security threats known as "insider threats". These threats occur when individuals with authorized access to an organization's network engage in harmful activities, potentially leading to the disclosure of vital information or adversely affecting the organization's systems (e.g., financial loss, system crashes, and national security challenges). Distinct from other types of terror attacks, combating insider threats exhibits several unique challenges, including (1) rarity, (2) non-separability, (3) label scarcity, (4) dynamics, and (5) heterogeneity, making themselves extremely difficult to identify and mitigate. We target the challenging problem of combating insider threats in open-world environments by leveraging a variety of data sources (e.g., internal system logs, employee networks, human trafficking, and smuggling networks). To effectively combat these intricate threats, we introduce an interactive learning mechanism that is composed of three mutually beneficial learning modules: insider identification, insider monitoring, and data augmentation. Each module plays a crucial role in enhancing our ability to detect and mitigate insider threats, thereby contributing to a more secure and resilient organizational environment.