Cybersecurity Threats Research Articles

A Unified Model for Chinese Cyber Threat Intelligence Flat Entity and Nested Entity Recognition

In recent years, as cybersecurity threats have become increasingly severe and cyberattacks have occurred frequently, higher requirements have been put forward for cybersecurity protection. Therefore, the Named Entity Recognition (NER) technique, which is the cornerstone of Cyber Threat Intelligence (CTI) analysis, is particularly important. However, most existing NER studies are limited to recognizing single-layer flat entities, ignoring the possible nested entities in CTI. On the other hand, most of the existing studies focus on English CTIs, and the existing models performed poorly in a limited number of Chinese CTI studies. Given the above challenges, we propose in this paper a novel unified model, RBTG, which aims to identify flat and nested entities in Chinese CTI effectively. To overcome the difficult boundary recognition problem and the direction-dependent and distance-dependent properties in Chinese CTI NER, we use Global Pointer as the decoder and TENER as the encoder layer, respectively. Specifically, the Global Pointer layer solves the problem of the insensitivity of general NER methods to entity boundaries by utilizing the relative position information and the multiplicative attention mechanism. The TENER layer adapts to the Chinese CTI NER task by introducing an attention mechanism with direction awareness and distance awareness. Meanwhile, to cope with the complex feature capture of hierarchical structure and dependencies among Chinese CTI nested entities, the TENER layer solves the problem by following the structure of multiple self-attention layers and feed-forward network layers superimposed on each other in the Transformer. In addition, to fill the gap in the Chinese CTI nested entity dataset, we further apply the Large Language Modeling (LLM) technique and domain knowledge to construct a high-quality Chinese CTI nested entity dataset, CDTinee, which consists of six entity types selected from STIX, including nearly 4000 entity types extracted from more than 3000 threatening sentences. In the experimental session, we conduct extensive experiments on multiple datasets, and the results show that the proposed model RBTG outperforms the baseline model in both flat NER and nested NER.

Generative AI for Vulnerability Management: A Blueprint

Cybersecurity threats continue to evolve in complexity and scale every year. The need for more effective vulnerability management has become more important now than ever.

Advanced Detection Techniques to neutralize Supply Chain Cyber-attacks on small and medium businesses in the United States: The Machine Learning and AI Approach.

Cyber-attacks targeting supply chains represent a significant and increasing risk for small and medium-sized businesses (SMBs) in the United States. This paper examines the role of machine learning (ML) and artificial intelligence (AI) in detecting and mitigating these cybersecurity threats. Key challenges faced by SMBs include high implementation costs, a shortage of skilled personnel, inadequate data quality, and the complexity of integrating advanced technologies into existing systems. Despite these hurdles, the paper identifies strategic approaches that can empower SMBs to effectively leverage ML and AI, including affordable solutions, targeted training, and improved data management practices. It emphasizes the importance of addressing privacy and usability concerns to facilitate successful technology adoption. Recommendations include pursuing cost-effective, subscription-based AI and ML models, utilizing government incentives, and enhancing workforce skills through training and partnerships. Additionally, collaboration with larger organizations can improve data management and system efficacy. By implementing robust protective measures and increasing awareness through educational initiatives, SMBs can strengthen their cybersecurity posture and better navigate the evolving landscape of cyber threats.

Digitalisation and Cybersecurity: Towards an Operational Framework

As businesses increasingly adopt digital processes and solutions to enhance efficiency and productivity, they face heightened cybersecurity threats. Through a systematic literature review and concept development, this article examines the intersection of digitalisation and cybersecurity. It identifies the methodologies and tools used for cybersecurity assessments, factors influencing the adoption of cybersecurity measures, and the critical success factors for implementing these measures. The article also puts forward the concept of cybersecurity governance process categories, which are used to classify the factors uncovered in the research. Findings suggest that current information security standards tend to be too broad and not adequately tailored to the specific needs of small and medium-sized enterprises (SMEs) when implementing emerging technologies, like Internet of Things (IoT), blockchain, and artificial intelligence (AI). Additionally, these standards often employ a top-down approach, which makes it challenging for SMEs to effectively implement them, as they require more scalable solutions tailored to their specific risks and limited resources. The study thus proposes a new framework based on the Plan-Do-Check model, built around the cybersecurity governance process categories and the three core pillars of governance, culture and standards. This is essentially a bottom-up approach that complements current top-down methods, and will be of value to both information technology (IT) professionals as an operational guide, and to researchers as a basis for future research in this field.

Cybersecurity threats and preparedness: Implications for dental schools.

Cybersecurity threats are a growing concern in healthcare, where digital systems now underpin patient care, financial management, and educational operations. A cybersecurity breach in a Dental school environment can have widespread consequences to the mission of the school-patient care, research, education and service. For dental school administrators, these risks highlight the necessity of robust cybersecurity measures. For student learners, the impact may include interruptions to their education. For patients, it could mean compromised personal data and reduced access to clinical care. While many sectors have responded to increasing cyber threats by enhancing their defenses, healthcare and dental schools, often lag in implementing necessary protections. This emphasizes the need for proactive measures, such as regular system audits, advanced encryption methods, and ongoing cybersecurity training for administrators and students alike, to mitigate future risks and safeguard institutional integrity.

From Monitoring to Observability: A Paradigm Shift in IT Operations

This article explores the paradigm shift from traditional monitoring to observability in IT operations, driven by the increasing complexity of modern distributed systems, data overload, evolving cybersecurity threats, and the need for proactive problem-solving. Observability platforms, built on the four pillars of events, metrics, traces, and logs, provide comprehensive insights into system behavior and performance. Adopting observability practices offers numerous benefits, including automated discovery of system components, dependency mapping, topology visualization, correlative intelligence, faster root cause diagnosis, and more accurate anomaly detection through auto-baselining. Organizations that embrace observability report significant improvements in incident response times, system reliability, and overall operational efficiency. The article guides successfully transitioning to an observability-focused approach by embracing automation, fostering a culture of observability, implementing the right tools, and leveraging AI and machine learning for advanced analytics and insights.

Modeling Cybersecurity Risk: The Integration of Decision Theory and Pivot Pairwise Relative Criteria Importance Assessment with Scale for Cybersecurity Threat Evaluation

This paper presents a comprehensive model for cyber security risk assessment using the PIPRECIA-S method within decision theory, which enables organizations to systematically identify, assess and prioritize key cyber threats. The study focuses on the evaluation of malware, ransomware, phishing and DDoS attacks, using criteria such as severity of impact, financial losses, ease of detection and prevention, impact on reputation and system recovery. This approach facilitates decision making, as it enables the flexible adaptation of the risk assessment to the specific needs of an organization. The PIPRECIA-S model has proven to be useful for identifying the most critical threats, with a special emphasis on ransomware and DDoS attacks, which represent the most significant risks to businesses. This model provides a framework for making informed and strategic decisions to reduce risk and strengthen cyber security, which are critical in a digital environment where threats become more and more sophisticated.

A Study On Present Status of E Banking Services in Tamil Nadu

E-banking has rapidly transformed the banking landscape in Tamil Nadu, driven by technological advancements and increasing internet penetration. This paper examines the current status of e-banking services in the state, highlighting key features such as mobile banking, online transactions, and digital wallets. The rise of fintech companies has introduced innovative solutions, enhancing customer experience and accessibility. Despite the growth, challenges remain, including cybersecurity threats and digital literacy gaps among certain demographics. The government's initiatives, such as the Digital India campaign, aim to promote e-banking and financial inclusion. Overall, Tamil Nadu is witnessing a robust adoption of e-banking, making it a crucial player in India's digital financial ecosystem.

The Impact and Challenges of Digital Transformation on Supply Chain Resilience in Physical Enterprises

Abstract: In the digital era, supply chain resilience (SCR) has become a key pillar of the real economy. Enterprises face various challenges, including cybersecurity threats, market volatility, technological change and changing global conditions. A strong SCR not only ensures continued business operations but also maintains market stability and consumer well-being. Digital transformation helps businesses anticipate market changes, optimize inventory management, improve operational efficiency, and assist in management decisions when necessary by providing unprecedented data transparency and real-time insights. The purpose of this paper is to examine the extent of digital transformation in the supply chains of physical firms globally through a literature review, to identify the factors influencing the resilience of digital transformation in the supply chains of physical firms, and to discover the barriers to digital transformation in the supply chains of physical firms. The study finds that the digital transformation of physical firms' supply chains is still in its infancy, and there are barriers at both managerial and physical levels. Solutions to address these barriers include enhancing employee training, correctly introducing appropriate digital technologies, and improving information security.

Mitigating Maritime Cybersecurity Risks Using AI-Based Intrusion Detection Systems and Network Automation During Extreme Environmental Conditions

The maritime industry is increasingly confronted with a myriad of cybersecurity challenges exacerbated by extreme environmental conditions, technological advancements, and heightened reliance on automation. This review paper discusses the intersection of these factors, focusing on the adoption of artificial intelligence (AI)-based intrusion detection systems (IDS) and network automation as vital strategies for mitigating cybersecurity risks. The paper begins by outlining the unique cybersecurity threats faced by the maritime sector, which include data breaches, phishing attacks, and malware threats, all amplified by adverse weather and geographical isolation. In light of these challenges, the rationale for integrating AI-driven solutions into maritime operations is discussed. AI-based IDS can enhance threat detection capabilities through advanced machine learning algorithms that adapt to evolving cyber threats while minimizing false positives. Additionally, network automation can improve connectivity and data security, facilitating real-time monitoring and response to incidents. The review also addresses the critical need for collaboration between maritime and technology industries, emphasizing how partnerships can foster innovation and provide tailored solutions to the sector’s specific needs. Furthermore, the paper examines current implementations and case studies that illustrate successful applications of AI and automation in adverse maritime conditions. While recognizing the potential benefits, the review highlights the technical and operational challenges inherent in these implementations, including data integration, regulatory compliance, and cultural differences between sectors. Ultimately, this paper aims to provide a comprehensive overview of the state of maritime cybersecurity and the pivotal role of AI and automation in shaping a resilient, secure maritime future. The findings underscore the importance of ongoing research and development, collaborative efforts, and the necessity of adaptable strategies to safeguard maritime operations against the evolving landscape of cyber threats.

Transnational Cyber Governance for Risk Management in the Gas Sector: Exploring the Potential of G7 Cooperation

At the Group of Seven (G7) summit held on 13–15 June in 2024, the Group’s leaders committed to establishing a collective cyber security framework and reinforcing the work of the cyber security working group to manage the risks targeting energy systems. Likewise, oil and electricity, and natural gas rely on complex and interdependent technologies and communication networks from production to consumption. The preparedness to handle cyber security threats in the energy infrastructures among decision makers, planners, and the industry in a concerted manner signifies that cyber security is becoming more appreciated. Therefore, considering the ambition and achievement of the G7 countries towards energy and cyber sovereignty, this paper’s focus and research question aims to explore the potential existence of the cyber governance alliance in the gas subsector within the G7. The objective of this paper is twofold. First, it explores the potential of the G7, the world’s seven largest advanced economies, to lead on a nascent cyber governance for risk management in the gas sector. The qualitative analysis conducted through the institutional analysis and design method examines up-to-date data involving mainly state actors. Second, by drawing on LNG, one of the world’s fastest growing energy types in the coming decades, the paper points out the need for further research on the transnational governance operating through public–private engagement to address the cyber risks to gas systems. While the paper makes an empirical contribution to the field of security governance and a practical contribution to security consulting, its limitations rely on the necessity to also conduct a quantitative enquiry, which would necessitate, among others, a review of the literature in the G7 countries, and a group of researchers from academia and practitioners to obtain a sense of the cyberspace in the energy reality.

Enhancing Network Threat Detection with Random Forest-Based NIDS and Permutation Feature Importance

Network Intrusion Detection Systems (NIDS) are critical for protecting computer networks from unauthorized activities. Traditional NIDS rely on rule-based signatures, which can be limiting in detecting emerging threats. This study investigates the effectiveness of the random forest classifier in advancing NIDS capabilities through machine learning. Using the CICIDS-2017 dataset, the data are preprocessed to enhance their quality by removing redundancies. feature selection and permutation importance were employed to identify the most relevant features. The methodology involves rigorous testing and analysis of the random forest classifier’s performance, focusing on f1-score rates compared to other machine learning models. Results demonstrate that by optimizing class weights, applying a custom prediction function and leveraging 26 key features, the random forest classifier achieves an outstanding 99.8% in the weighted f1-score and 93.31% in the macro f1-score in various attack types. This research highlights the potential of machine learning to significantly enhance NIDS effectiveness, offering a robust defense mechanism against evolving cybersecurity threats in modern networks.

Machine Learning Model for Content Protection from Cyber security Threats

Cyber security is the shield that protects our digital world from unauthorized access, data breaches, and evolving threats. The former views human involvement as an extra dimension and a possible target, while the second considers it as part of the security process. However, because it centers on the ethical aspect of society as a whole, this kind of cyber security conversation has significant implications. Numerous frameworks and strategies have been proposed to handle the cyber security challenge. The ideas of cyber security are also introduced, along with information on individuals, frameworks, and protecting personal data on computers. This paper aims to emphasize the effective approach for Machine Learning Model for content from Cyber Security threats. The results show that, in this scenario, the Support Vector Machine (SVM) classifier performs better than other algorithms.

Cyber Security Threat Detection Using Machine Learning

The present review delves into the development and effectiveness of machine learning (ML) methods in the context of cybersecurity threat identification. More sophisticated and adaptable solutions are required as cyber threats increase in number and complexity beyond what can be achieved with standard security techniques. This study provides a thorough assessment of the several machine learning (ML) techniques that have been used to identify and categorize cyber risks. These algorithms include supervised, unsupervised, and deep learning approaches. We assess these methods' efficacy in identifying malware, phishing, and network intrusions while emphasizing their advantages and disadvantages. While ML offers considerable gains over traditional approaches, comparative study shows that issues like algorithmic bias, data quality, and adaptation to changing threats still exist. In an effort to improve predictive capabilities and real-time threat response, the evaluation also highlights trends and future directions in the integration of machine learning with cybersecurity. In order to implement ML-driven security systems, academics and practitioners may use this paper as a thorough guide. Keywords—Cybersecurity, Machine Learning, Algorithms, Threats, Security.

Cyber-Securing Medical Devices Using Machine Learning: A Case Study of Pacemaker

This study aims to enhance the cybersecurity framework of pacemaker devices by identifying vulnerabilities and recommending effective strategies. The objectives are to pinpoint cybersecurity weaknesses, utilize machine learning to predict security breaches, and propose countermeasures based on analytical trends. The literature review highlights the transformation of pacemaker technology from basic, fixed-rate devices to sophisticated systems with wireless capabilities, which, while improving patient care, also introduce significant cybersecurity risks. These risks include unauthorized entry, data breaches, and life-threatening device malfunctions. The methodology in this study utilizes a quantitative research approach using the WUSTL-EHMS-2020 dataset, which includes network traffic features, patients' biometric features, and attack label. The step-by-step method of machine learning prediction includes data collection, data preprocessing, feature engineering, and models’ training using Support Vector Machines (SVM) and Gradient Boosting Machines (GBM). The implementation results used evaluation metrics like accuracy, precision, recall, and F1 score to show that GBM model outperformed the SVM model. The GBM model achieved higher accuracy of 95.1% compared to 92.5% for SVM, greater precision of 99.6% compared to 96.7% for SVM, better recall of 94.9% compared to 42.7% for SVM, and a higher F1 score of 76.3% compared to 59.0% for SVM, making GBM model more effective in predicting cybersecurity threats. This study concludes that GBM is an effective machine learning model for enhancing pacemaker cybersecurity by analyzing network traffic and biometric data patterns. Future recommendations for improving the pacemaker cybersecurity include implementing GBM model for threat predictions, integration with existing security measures, and regular model updates and retraining.

Handling imbalanced data in intrusion detection using time weighted Adaboost support vector machine classifier and crossover boosted Dwarf Mongoose Optimization algorithm

Cybersecurity threats pose a serious challenge in the present day and age, and Intrusion Detection Systems (IDS) have emerged as an effective solution to counter these threats. In this paper, a novel IDS is proposed that captures data from the NSL-KDD dataset and are preprocessed. The Kernel Principal Component Analysis (KPCA) model extracts features presented in the data, and the Crossover Boosted Dwarf Mongoose Optimization (CDMO) algorithm selects the relevant features for classification. The CDMO algorithm offers the advantages of improving exploitation, providing optimal solutions, and balancing global exploitation and local search capabilities. The selected features are classified into five classes using the Time Weighted Adaboost Support Vector Machine (TWASVM) classifier. The TWASVM classifier effectively handles imbalanced data and delivers high-performance results. Experiments conducted on MATLAB R2019a and the proposed model achieved an higher accuracy of 98.6 % and less time complexity of 13 seconds. Comparative analysis demonstrated that the proposed IDS outperforms other state-of-the-art methods. The advantages of CDMO algorithm include improved exploitation, optimal solutions, and a balanced crossover strategy for global exploitation and local search capabilities. The advantages of the TWASVM classifier include the ability to handle imbalanced data and deliver high-performance results. Overall, the proposed IDS offer a novel solution to the challenges of intrusion detection in a rapidly evolving cybersecurity landscape.

Cybersecurity risks of automated (and autonomous) offshore oil and gas units—the IMO cybersecurity rules framework

Abstract Automated and/or autonomous offshore platforms or units are becoming more important in the energy sector, whether they are being used for oil and gas extraction or for carbon storage purposes. Automation means that harsh working conditions and risks of personal injury to crew could be cut to virtually zero. Automation also provides significant cost savings and helps make less attractive oil and gas fields more economically viable to exploit. However, automation does come with its own set of challenges—the notable one being the cybersecurity threat. Any regulation or international standard dealing with the cybersecurity risk which is relevant to automated offshore units is usually framed within those rules that apply to ships. This article examines to what extent that regulatory approach, especially that of the International Maritime Organisation’s (IMO) regime, could and should apply to automated or autonomous offshore platforms. It argues that whilst, for now, the IMO cybersecurity guidelines are relevant, a more targeted regulatory approach is needed.

Current Status and Challenges and Future Trends of Deep Learning-Based Intrusion Detection Models.

With the advancement of deep learning (DL) technology, DL-based intrusion detection models have emerged as a focal point of research within the domain of cybersecurity. This paper provides an overview of the datasets frequently utilized in the research. This article presents an overview of the widely utilized datasets in the research, establishing a basis for future investigation and analysis. The text subsequently summarizes the prevalent data preprocessing methods and feature engineering techniques utilized in intrusion detection. Following this, it provides a review of seven deep learning-based intrusion detection models, namely, deep autoencoders, deep belief networks, deep neural networks, convolutional neural networks, recurrent neural networks, generative adversarial networks, and transformers. Each model is examined from various dimensions, highlighting their unique architectures and applications within the context of cybersecurity. Furthermore, this paper broadens its scope to include intrusion detection techniques facilitated by the following two large-scale predictive models: the BERT series and the GPT series. These models, leveraging the power of transformers and attention mechanisms, have demonstrated remarkable capabilities in understanding and processing sequential data. In light of these findings, this paper concludes with a prospective outlook on future research directions. Four key areas have been identified for further research. By addressing these issues and advancing research in the aforementioned areas, this paper envisions a future in which DL-based intrusion detection systems are not only more accurate and efficient but also better aligned with the dynamic and evolving landscape of cybersecurity threats.

Towards Securing Smart Homes: A Systematic Literature Review of Malware Detection Techniques and Recommended Prevention Approach

The exponential growth of the Internet of Things (IoT) sector has resulted in a surge of interconnected gadgets in smart households, thus exposing them to new cyber-attack susceptibilities. This systematic literature review investigates machine learning methodologies for detecting malware in smart homes, with a specific emphasis on identifying common threats such as denial-of-service attacks, phishing efforts, and zero-day vulnerabilities. By examining 56 publications published from 2019 to 2023, this analysis uncovers that users are the weakest link and that there is a possibility of attackers disrupting home automation systems, stealing confidential information, or causing physical harm. Machine learning approaches, namely, deep learning and ensemble approaches, are emerging as effective tools for detecting malware. In addition, this analysis highlights prevention techniques, such as early threat detection systems, intrusion detection systems, and robust authentication procedures, as crucial measures for improving smart home security. This study offers significant insights for academics and practitioners aiming to protect smart home settings from growing cybersecurity threats by summarizing the existing knowledge.

Enhancing the security of image communication with a new hyper-chaotic system

The rapid expansion of multimedia communication necessitates the development of advanced and resilient cryptographic systems. As computational power grows, traditional encryption methods become susceptible to brute-force attacks. Cybersecurity threats are in a constant state of flux, requiring the creation of innovative cryptographic systems to outpace these developments. Chaotic systems offer a very good promise in cryptography as they are sensitive to initial conditions and parameters. In this study, the authors propose a novel hypercryptographic system (referred as NHCS) for color images that integrates a new hyperchaotic system with the RSA algorithm. This approach combines the unpredictable behavior of the hyper-chaotic system with the robust encryption capabilities of the RSA algorithm. This combination provides an additional layer of security. The hyper-chaotic systems offer a broader range of parameter values leading to chaos. Moreover, due to their four-dimensional nature, they can be employed to encrypt four-color channels. The NHCS algorithm has a large key space (of size 2704), 1024-bit RSA encrypted for higher security. The key sensitivity of this algorithm is of the order 10−16. The effectiveness of NHCS is validated through numerous test images from the USC-SIPI database and is bolstered by statistical analysis. The two indicators NPCR (∽100% ) and UACI (>33%) ensure that the system is robust against differential attacks. We perform a correlation analysis of the images and observe that correlation coefficients between adjacent pixels of the encrypted images are close to zero. Further, the information entropy values of the encrypted images are close to the ideal value 8. PSNR, MSE, and other statistical measures are found near their respective ideal values. A comparison with the other methods shows that NHCS is very promising.