Security defense against long-term and stealthy cyberattacks

2023 | Decision Support Systems | Citations: 0

Authors: Han, Kookyoung; Choi, Jin Hyuk; Choi, Yunsik; Lee, Gene Moo; Whinston, Andrew B.

Abstract: Modern cyberattacks such as advanced persistent threats have become sophisticate ... Expand

Abstract: Modern cyberattacks such as advanced persistent threats have become sophisticated. Hackers can stay unde­ tected for an extended time and defenders do not have sufficient countermeasures to prevent advanced cyber­ attacks. Reflecting on this phenomenon, we propose a game-theoretic model to analyze strategic decisions made by a hacker and a defender in equilibrium. In our game model, the hacker launches stealthy cyberattacks for a long time and the defender decides when to disable a suspicious user based on noisy observations of the user’s activities. Damages caused by the hacker can be enormous if the defender does not immediately ban a suspicious user under certain circumstances, which can explain the emerging sophisticated cyberattacks with detrimental consequences. Our model also predicts that the hacker may opt to be behavioral to avoid worst cases. This is because behavioral cyberattacks are less threatening and the defender decides not to immediately block a sus­ picious user to reduce cost of false detection. Collapse

Topics: IT security data breach electronic mail IT security threat intrusion detection system

Methods: first-hitting-time model optimization model

Theories: game theory lemon market theory

SIREN: Designing Business Processes for Comprehensive Industrial IoT Security Management

2023 | DESRIST | Citations: 0

Authors: Hornsteiner, Markus; Schönig, Stefan

Abstract: The Industrial Internet of Things (IIoT) paradigm means that “things” in an indu ... Expand

Abstract: The Industrial Internet of Things (IIoT) paradigm means that “things” in an industrial context are equipped with connectivity. The convergence of formerly isolated Operational Technology with IT provides disruptive opportunities for organizations but is also vulnerable to cyberattacks. To mitigate these risks, the IEC62443 standard was developed, which will be mandatory for critical infrastructure organizations due to the EU Cybersecurity Act. This standard demands various requirements for the technology and organizational aspects of organizations. To implement the standard’s technical requirements and demonstrate compliance, applications can be used. This paper utilizes Design Science Research (DSR) to design, develop, and demonstrate Security Iiot pRocEss Notation (SIREN), an approach based on Business Process Model and Notation (BPMN) to model and monitor processes and compliance. Previous research have yet to cover the IIoT explicitly and lack the monitoring of the modeled attributes. Therefore, a novel specialized approach is presented, enhancing the model with monitorable attributes based on the standard. Thus, this paper presents a BPMN-based approach to model and monitor security-aware processes in IIoT. Collapse

Topics: Python evaluation criteria extensible markup language IT security requirements analysis

Methods: modeling language business process model and notation business process modeling personal interview design artifact

What are the trend and core knowledge of information security? A citation and co-citation analysis

2023 | Information & Management | Citations: 0

Authors: Shiau, Wen-Lung; Wang, Xiaoqun; Zheng, Fei

Abstract: Information technology brings business success opportunities, but also causes po ... Expand

Abstract: Information technology brings business success opportunities, but also causes potential safety hazards to orga­ nizations. In response to the increasing academia and industry concerns regarding information security (ISec), this study systematically explored extant ISec research and identified eight core knowledge groups, including (1) intrusion detection, (2) privacy protection, (3) secure machine learning, (4) cryptosystem, (5) data service se­ curity, (6) malware analysis, (7) security decision-making, and (8) security management. The detection of research hotspots shows that data service security and risk management garner the most current research attention. Furthermore, we establish a comprehensive ISec framework to help systematically understand and achieve ISec. Collapse

Topics: privacy decision making intrusion detection system malware database system

Methods: co-citation analysis cluster analysis literature sample hierarchical clustering multidimensional scaling

Bayesian Networks for Interpretable Cyberattack Detection

2023 | HICSS | Citations: 0

Authors: Yang, B.; Hoffman, M.; Brown, N.

Abstract: The challenge of cyberattack detection can be illustrated by the complexity of ... Expand

Abstract: The challenge of cyberattack detection can be illustrated by the complexity of the MITRE ATT&CK TM matrix, which catalogues >200 attack techniques (most with multiple sub-techniques). To reliably detect cyberattacks, we propose an evidence-based approach which fuses multiple cyber events over varying time periods to help differentiate normal from malicious behavior. We use Bayesian Networks (BNs)probabilistic graphical models consisting of a set of variables and their conditional dependencies -for fusion/classification due to their interpretable nature, ability to tolerate sparse or imbalanced data, and resistance to overfitting. Our technique utilizes a small collection of expert-informed cyber intrusion indicators to create a hybrid detection system that combines data-driven training with expert knowledge to form a host-based intrusion detection system (HIDS). We demonstrate a software pipeline for efficiently generating and evaluating various BN classifier architectures for specific datasets and discuss explainability benefits thereof. Collapse

Topics: shapley additive explanation application programming interface Python Microsoft Windows intrusion detection system

Methods: random forest classification naïve bayes machine learning cluster analysis experiment

Deep Reinforcement Learning in the Advanced Cybersecurity Threat Detection and Protection

2023 | Information Systems Frontiers | Citations: 1

Authors: Sewak, Mohit; Sahay, Sanjay K.; Rathore, Hemant

Abstract: The cybersecurity threat landscape has lately become overly complex. Threat acto ... Expand

Abstract: The cybersecurity threat landscape has lately become overly complex. Threat actors leverage weaknesses in the network and endpoint security in a very coordinated manner to perpetuate sophisticated attacks that could bring down the entire network and many critical hosts in the network. To defend against such attacks, cybersecurity solutions are upgrading from the traditional to advanced deep and machine learning defense mechanisms for threat detection and protection. The application of these techniques has been reviewed well in the scientific literature. Deep Reinforcement Learning has shown great promise in developing AI solutions for areas that had earlier required advanced human cognizance. Different techniques and algorithms under deep reinforcement learning have shown great promise in applications ranging from games to industrial processes, where it is claimed to augment systems with general AI capabilities. These algorithms have recently also been used in cybersecurity, especially in threat detection and protection, where these are showing state-of-the-art results. Unlike supervised machine learning and deep learning, deep reinforcement learning is used in more diverse ways and is empowering many innovative applications in the threat defense landscape. However, there does not exist any comprehensive review of deep reinforcement learning applications in advanced cybersecurity threat detection and protection. Therefore, in this paper, we intend to fill this gap and provide a comprehensive review of the different applications of deep reinforcement learning in this field. Collapse

Topics: mobile system denial of service attack internet of things IT security malware

Methods: machine learning computational algorithm deep learning reinforcement learning supervised learning

Anomaly Detection in Cybersecurity Datasets via Cooperative Co-evolution-based Feature Selection

2022 | ACM Transactions on Management Information Systems | Citations: 0

Authors: Rashid, A. N. M. Bazlur; Ahmed, Mohiuddin; Sikos, Leslie F.; Haskell-Dowland, Paul

Abstract: Anomaly detection from Big Cybersecurity Datasets is very important; however, th ... Expand

Abstract: Anomaly detection from Big Cybersecurity Datasets is very important; however, this is a very challenging and computationally expensive task. Feature selection (FS) is an approach to remove irrelevant and redundant features and select a subset of features, which can improve the machine learning algorithms’ performance. In fact, FS is an effective preprocessing step of anomaly detection techniques. This article’s main objective is to improve and quantify the accuracy and scalability of both supervised and unsupervised anomaly detection techniques. In this effort, a novel anomaly detection approach using FS, called Anomaly Detection Using Feature Selection (ADUFS), has been introduced. Experimental analysis was performed on five different benchmark cybersecurity datasets with and without feature selection and the performance of both supervised and unsupervised anomaly detection techniques were investigated. The experimental results indicate that instead of using the original dataset, a dataset with a reduced number of features yields better performance in terms of true positive rate (TPR) and false positive rate (FPR) than the existing techniques for anomaly detection. For example, with FS, a supervised anomaly detection technique, multilayer perception increased the TPR by over 200% and decreased the FPR by about 97% for the KDD99 dataset. Similarly, with FS, an unsupervised anomaly detection technique, local outlier factor increased the TPR by more than 40% and decreased the FPR by 15% and 36% for Windows 7 and NSL-KDD datasets, respectively. In addition, all anomaly detection techniques require less computational time when using datasets with a suitable subset of features rather than entire datasets. Furthermore, the performance results have been compared with six other state-of-the-art techniques based on a decision tree (J48). Collapse

Topics: Microsoft Windows IT security intrusion detection system spreadsheet missing data

Methods: anomaly detection machine learning computational algorithm experiment simulation

Theories: co-evolution theory

Antecedents and consequences of data breaches: A systematic review

2022 | Information & Management | Citations: 11

Authors: Schlackl, Frederic; Link, Nico; Hoehle, Hartmut

Abstract: Research on data breaches is scattered across disciplines and methodologies. To ... Expand

Abstract: Research on data breaches is scattered across disciplines and methodologies. To help consolidate it, we review 43 articles on data breaches’ antecedents and 83 on their consequences. We find eight different categories each for antecedents and consequences. Most research is empirical-quantitative and employs an organizational unit of analysis. Theoretical lenses discovered range from a data breach as organizational crisis to criminological and privacy-specific theories. Our review provides researchers and practitioners with a synthesis of extant research and elaborates on future implications for data breach literature. Collapse

Topics: data breach database system data security ergonomics usability

Methods: literature sample econometric modeling literature study structured literature research event study

Theories: organizational behavior theory

Artificial Intelligence and Machine Learning in Cybersecurity: Applications, Challenges, and Opportunities for MIS Academics

2022 | Communications of the Association for Information Systems | Citations: 0

Authors: Sen, Ravi; Heim, Gregory; Zhu, Qilong

Abstract: The availability of massive amounts of data, fast computers, and superior machi ... Expand

Abstract: The availability of massive amounts of data, fast computers, and superior machine learning (ML) algorithms has spurred interest in artificial intelligence (AI). It is no surprise, then, that we observe an increase in the application of AI in cybersecurity. Our survey of AI applications in cybersecurity shows most of the present applications are in the areas of malware identification and classification, intrusion detection, and cybercrime prevention. We should, however, be aware that AI-enabled cybersecurity is not without its drawbacks. Challenges to AI solutions include a shortage of good quality data to train machine learning models, the potential for exploits via adversarial AI/ML, and limited human expertise in AI. However, the rewards in terms of increased accuracy of cyberattack predictions, faster response to cyberattacks, and improved cybersecurity make it worthwhile to overcome these challenges. We present a summary of the current research on the application of AI and ML to improve cybersecurity, challenges that need to be overcome, and research opportunities for academics in management information systems. Collapse

Topics: IT security artificial intelligence malware fake news accounting

Methods: decision tree classification machine learning computational algorithm supervised learning survey

Using Word Embeddings to Deter Intellectual Property Theft through Automated Generation of Fake Documents

2021 | ACM Transactions on Management Information Systems | Citations: 0

Authors: Abdibayev, Almas; Chen, Dongkai; Chen, Haipeng; Poluru, Deepti; Subrahmanian, V. S.

Abstract: Theft of intellectual property is a growing problem—one that is exacerbated by t ... Expand

Abstract: Theft of intellectual property is a growing problem—one that is exacerbated by the fact that a successful compromise of an enterprise might only become known months after the hack. A recent solution called FORGE addresses this problem by automatically generating N “fake” versions of any real document so that the attacker has to determine which of the N + 1 documents that they have exfiltrated from a compromised network is real. In this article, we remove two major drawbacks in FORGE: (i) FORGE requires ontologies in order to generate fake documents—however, in the real world, ontologies, especially good ontologies, are infrequently available. The WE-FORGE system proposed in this article completely eliminates the need for ontologies by using distance metrics on word embeddings instead. (ii) FORGE generates fake documents by first identifying “target” concepts in the original document and then substituting “replacement” concepts for them. However, we will show that this can lead to sub-optimal results (e.g., as target concepts are selected without knowing the availability and/or quality of the replacement concepts, they can sometimes lead to poor results). Our WE-FORGE system addresses this problem in two possible ways by performing a joint optimization to select concepts and replacements simultaneously. We conduct a human study involving both computer science and chemistry documents and show that WE-FORGE successfully deceives adversaries. Collapse

Topics: information retrieval knowledge representation IT security Google+ innovation management

Methods: optimization model word embedding term frequency–inverse document frequency experiment ontological modelling

Decepticon: a Theoretical Framework to Counter Advanced Persistent Threats

2021 | Information Systems Frontiers | Citations: 0

Authors: Baksi, Rudra P.; Upadhyaya, Shambhu J.

Abstract: Deception has been proposed in the literature as an effective defense mechanism ... Expand

Abstract: Deception has been proposed in the literature as an effective defense mechanism to address Advanced Persistent Threats (APT). However, administering deception in a cost-effective manner requires a good understanding of the attack landscape. The attacks mounted by APT groups are highly diverse and sophisticated in nature and can render traditional signature based intrusion detection systems useless. This necessitates the development of behavior oriented defense mechanisms. In this paper, we develop Decepticon (Deception-based countermeasure), a Hidden Markov Model based framework where the indicators of compromise (IoC) are used as the observable features to aid in detection. This theoretical framework also includes several models to represent the spread of APTs in a computer system. The presented framework can be used to select an appropriate deception script when faced with APTs or other similar malware and trigger an appropriate defensive response. The effectiveness of the models in a networked system is illustrated by considering a real APT type ransomware. Collapse

Topics: ransomware malware computer hardware intrusion detection system pandemic

Methods: computational algorithm hidden Markov model literature study experiment