Attack and Defense Strategies in Cyber War Involving Production and Stockpiling of Zero-Day Cyber Exploits

2021 | Information Systems Frontiers | Citations: 0

Authors: Hausken, Kjell; Welburn, Jonathan W.

Abstract: Two players strike balances between allocating resources for defense and product ... Expand

Abstract: Two players strike balances between allocating resources for defense and production of zero-day exploits. Production is further allocated into cyberattack or stockpiling. Applying the Cobb Douglas expected utility function for equivalent players, an analytical solution is determined where each player’s expected utility is inverse U shaped in each player’s unit defense cost. More generally, simulations illustrate the impact of varying nine parameter values relative to a benchmark. Increasing a player’s unit costs of defense or development of zero-days benefits the opposing player. Increasing the contest intensities over the two players’ assets causes the players to increase their efforts until their resources are fully exploited and they receive zero expected utility. Decreasing the Cobb Douglas output elasticity for a player’s stockpiling of zero-days causes its attack to increase and its expected utility to eventually reach a maximum, while the opposing player’s expected utility reaches a minimum. Altering the Cobb Douglas output elasticities for a player’s attack or defense contests towards their maxima or minima causes maximum expected utility for both players. Collapse

Topics: zero-day vulnerability accounting anonymity

Methods: simulation

An Architecture for Federated Learning Enabled Collaborative Intrusion Detection System

2021 | Americas Conference on Information Systems | Citations: 0

Authors: McOsker, Caitlin; Handlin, Michael; Li, Lei; Shahriar, Hossain; Zhao, Liang

Abstract: Intrusion Detection Systems (IDSs) are essential part of a security solution to ... Expand

Abstract: Intrusion Detection Systems (IDSs) are essential part of a security solution to monitor the network traffics and detect malicious attacks. In a collaborative IDS, multiple IDSs work together to effectively detect large scaled and across platforms or operating systems attacks. However, the participating nodes in a CIDS may hesitate to share their network traffic data due to privacy concerns. In this paper, we propose a federated learning enabled CIDS architecture leveraging its privacy-reserving feature. An unsupervised machine learning algorithm, Self-Organizing Maps (SOM), is adopted as the intrusion detection method. Based on our knowledge, this research is the first attempt incorporating SOM and federated learning into CIDS. We believe that the proposed framework can greatly improve both precision and recall of the intrusion detection. This paper is research in progress. We are in the process of developing a preliminary research prototype and designing experiments for validations. KeywordsCollaborative intrusion detection system, unsupervised learning, federated learning, anomaly detection. Collapse

Topics: privacy intrusion detection system zero-day vulnerability open source open source software project

Methods: machine learning federated learning experiment design artifact computational algorithm

Examining Exploitability Risk of Vulnerabilities: A Hazard Model

2020 | Communications of the Association for Information Systems | Citations: 1

Authors: Roumani, Yaman; Nwankpa, Joseph

Abstract: With the increasing number and severity of security incidents and exploits, info ... Expand

Abstract: With the increasing number and severity of security incidents and exploits, information technology (IT) vendors, security managers, and consumers have begun to place more emphasis on security. Yet, fixing the sheer volume of vulnerabilities remains a challenge as IT vendors race against attackers to evaluate system vulnerabilities, prioritize them, and issue security patches before cybercriminals can exploit them. In this study, we posit that IT vendors can prioritize which vulnerabilities they should patch first by assessing their exploitability risk. Accordingly, we identified the vulnerabilities that cybercriminals will most likely exploit using vulnerability-related attributes and vulnerability types. To do so, we employed survival analysis and tested our models using historical data of vulnerabilities and exploits between 2007 and 2016. Our results indicate that IT vendors benefit the most from fixing remotely exploitable vulnerabilities; non-complex vulnerabilities; vulnerabilities that require no authentication; and vulnerabilities that affect confidentiality, integrity, and availability components. Furthermore, our findings suggest that IT vendors can mitigate the risk of exploit-related attacks by remedying code-injection vulnerabilities, buffer-overflow vulnerabilities, and numeric-error vulnerabilities. Collapse

Topics: electronic authentication research and development database system privacy SQL injection

Methods: regression analysis method survival analysis proportional hazards model game theoretical model Compustat

Theories: game theory theory of bounded rationality

Detection of online phishing email using dynamic evolving neural network based on reinforcement learning

2018 | Decision Support Systems | Citations: 11

Authors: Smadi, Sami; Aslam, Nauman; Zhang, Li

Abstract: Despite state-of-the-art solutions to detect phishing attacks, there is still a ... Expand

Abstract: Despite state-of-the-art solutions to detect phishing attacks, there is still a lack of accuracy for the detection systems in the online mode which is leading to loopholes in web-based transactions. In this research, a novel framework is proposed which combines a neural network with reinforcement learning to detect phishing attacks in the online mode for the first time. The proposed model has the ability to adapt itself to produce a new phishing email detection system that reflects changes in newly explored behaviours, which is accomplished by adopting the idea of reinforcement learning to enhance the system dynamically over time. The proposed model solves the problem of limited dataset by automatically adding more emails to the offline dataset in the online mode. A novel algorithm is proposed to explore any new phishing behaviours in the new dataset. Through rigorous testing using the well-known data sets, we demonstrate that the proposed technique can handle zero-day phishing attacks with high performance levels achieving high accuracy, TPR, and TNR at 98.63%, 99.07%, and 98.19% respectively. In addition, it shows low FPR and FNR, at 1.81% and 0.93% respectively. Comparison with other similar techniques on the same dataset shows that the proposed model outperforms the existing methods. Collapse

Topics: electronic mail phishing email phishing email spam systems development

Methods: computational algorithm experiment machine learning decision tree classification reinforcement learning

Information Disclosure and the Diffusion of Information Security Attacks

2015 | Information Systems Research | Citations: 32

Authors: Mitra, Sabyasachi; Ransbotham, Sam

Abstract: With the nearly instantaneous dissemination of information in the modern era, po ... Expand

Abstract: With the nearly instantaneous dissemination of information in the modern era, policies regarding the disclosure of sensitive information have become the focus of significant discussion in several contexts. The fundamental debate centers on trade-offs inherent in disclosing information that society needs, but that can also be used for nefarious purposes. Using information security as a research context, our empirical study examines the adoption of software vulnerabilities by a population of attackers. We compare attacks based on software vulnerabilities disclosed through full-disclosure and limited-disclosure mechanisms. We find that full disclosure accelerates the diffusion of attacks, increases the penetration of attacks within the target population, and increases the risk of first attack after the vulnerability is reported. Interestingly, the effect of full disclosure is greater during periods when there are more overall vulnerabilities reported, indicating that attackers may strategically focus on busy periods when the effort of security professionals is spread across many vulnerabilities. Although the aggregate volume of attacks remains unaffected by full disclosure, attacks occur earlier in the life cycle of the vulnerability. Building off our theoretical insights, we discuss the implications of our findings in more general contexts. Collapse

Topics: innovation management intrusion detection system database system data security diffusion of innovation

Methods: longitudinal research mathematical model proportional hazards model regression analysis method Poisson regression

Using time-driven activity-based costing to manage digital forensic readiness in large organisations

2012 | Information Systems Frontiers | Citations: 0

Authors: Reddy, K.; Venter, H. S.; Olivier, M. S.

Abstract: A digital forensic readiness (DFR) programme consists of a number of activities ... Expand

Abstract: A digital forensic readiness (DFR) programme consists of a number of activities that should be chosen and managed with respect to cost constraints and risk. Traditional cost systems, however, can not provide the cost of individual activities. This makes it difficult or impossible for organisations to consider cost when making decisions about specific activities. In this paper we show that the relatively new cost system, time-driven activity-based costing (TDABC), can be used to determine the cost of implementing and managing activities required for DFR. We show through analysis and simulation that the cost information from a TDABC model can be used for such decisions. We also discuss some of the factors that ought to be considered when implementing or managing the use of TDABC in a large organisation. Collapse

Topics: firewall data security decision making privacy Java

Methods: simulation literature study survey stochastic simulation computational algorithm