Artificial intelligence in the cyber domain: Offense and defense

Artificial intelligence techniques have grown rapidly in recent years, and their applications in practice can be seen in many fields, ranging from facial recognition to image analysis. In the cybersecurity domain, AI-based techniques can provide better cyber defense tools and help adversaries improve methods of attack. However, malicious actors are aware of the new prospects too and will probably attempt to use them for nefarious purposes. This survey paper aims at providing an overview of how artificial intelligence can be used in the context of cybersecurity in both offense and defense.Web of Science123art. no. 41

Scalable architecture for online prioritization of cyber threats

This paper proposes an innovative framework for the early detection of several cyber attacks, where the main component is an analytics core that gathers streams of raw data generated by network probes, builds several layer models representing different activities of internal hosts, analyzes intra-layer and inter-layer information. The online analysis of internal network activities at different levels distinguishes our approach with respect to most detection tools and algorithms focusing on separate network levels or interactions between internal and external hosts. Moreover, the integrated multi-layer analysis carried out through parallel processing reduces false positives and guarantees scalability with respect to the size of the network and the number of layers. As a further contribution, the proposed framework executes autonomous triage by assigning a risk score to each internal host. This key feature allows security experts to focus their attention on the few hosts with higher scores rather than wasting time on thousands of daily alerts and false alarms

Expanding Australia\u27s defence capabilities for technological asymmetric advantage in information, cyber and space in the context of accelerating regional military modernisation: A systemic design approach

Introduction. The aim of the project was to conduct a systemic design study to evaluate Australia\u27sopportunities and barriers for achieving a technological advantage in light of regional military technological advancement. It focussed on the three domains of (1) cybersecurity technology, (2) information technology, and (3) space technology. Research process. Employing a systemic design approach, the study first leveraged scientometric analysis, utilising informetric mapping software (VOSviewer) to evaluate emerging trends and their implications on defence capabilities. This approach facilitated a broader understanding of the interdisciplinary nature of defence technologies, identifying key areas for further exploration. The subsequent survey study, engaging 828 professionals across STEM, space, aerospace, defence/ law enforcement, and ICT, aimed to assess the impact, deployment likelihood, and developmental timelines of the identified technologies. Finally, five experts were interviewed to help elaborate on the findings in the survey and translate them into implications for the ADF. Findings. Key findings revealed significant overlaps in technology clusters, highlighting ten specific technologies or trends as potential force multipliers for the ADF. Among these, cybersecurity of critical infrastructure and optimisation and other algorithmic technologies were recognised for their immediate potential and urgency, suggesting a prioritisation for development investment. The analysis presented a clear imperative for urgent and prioritised technological investments, specifically in cybersecurity and information technologies, followed by space technologies. The research also suggested partnerships that Australia should develop to keep ahead in terms of regional military modernisation. Implications. To maintain a competitive edge, there is an urgent need for investment in the development and application of these technologies, as nearly all disruptive technologies identified for their potential impact, deployment/utilization likelihood, extensive use, and novelty for defence purposes are needed in the near-term (less than 5 years – cybersecurity and information technologies) or medium-term (less than 10 years – space technologies). In line with this, technology investments should be prioritized as follows: Priority 1 includes Cyber Security of critical infrastructure and optimization algorithms; Priority 2 encompasses Unmanned and autonomous systems and weapons, Deep/Machine Learning, and Space-based command and communications systems; and Priority 3 involves Industry 4.0 technologies, Quantum technology, Electromagnetic and navigation warfare systems, Hypersonic weapons, and Directed energy weapons. At the policy level, underfunding, bureaucratic inertia and outdated procurement models needed to be addressed to enhance agility of innovation. More critically, Australia needed to come up with creative ways to recruit, train and retain human capital to develop, manage and use these sophisticated technologies. Finally, in order to maintain a lead over competitors (China, Russia, Iran, North Korea) in the regional military technology competition, the survey and interviews indicate that Australia should continue its military technology alliances with long-standing partners (US, Europe, Israel), broaden its collaborations with more recent partners (Japan, Singapore, South Korea), and establish partnerships with new ones (India, Malaysia, Vietnam, Pacific Island nations). Conclusion. This study sheds light on the future direction for the ADF and Defence in general, underscoring the importance of strategic investments in up-and-coming technologies. By pinpointing strategic voids, potential partnerships, and sovereign technologies with high potential, this report acts as a roadmap for bolstering Australia’s defence capabilities and safeguarding its strategic interests amidst regional technological changes

THE ANALYTICS QUOTIENT: RETOOLING CIVIL AFFAIRS FOR THE FUTURE OPERATING ENVIRONMENT

Historically, military intelligence analysts and U.S. forces, frozen in their preferred strategy of attrition warfare, have undervalued civil information in conflicts against irregular threats. As operating environments grow more complex, uncertain, and population-centric, the roles of Civil Affairs Forces and civil information will become increasingly relevant. Unfortunately, the current analytical methods prescribed in Civil Affairs doctrine are inadequate for evaluating complex environments. They fail to provide supported commanders with the information required to make informed decisions. The purpose of this research is to determine how Civil Affairs Forces must retool their analytical capabilities to meet the demands of future operating environments. The answer lies in developing an organic Civil Affairs analytic capability suitable for employing data-driven approaches to gain actionable insights into uncertain operational environments, and subsequently, integrating those insights into sophisticated operational targeting frameworks and strategies designed to disrupt irregular threats. This research uses case studies of organizations, across a range of industries, that leveraged innovative data-driven approaches into disruptive competitive advantages. These organizations highlight the broad utility of the prescribed approaches and potential pathways for Civil Affairs Forces to pursue in creating an analytic capability that supports effective civil knowledge integration.http://archive.org/details/theanalyticsquot1094564891Major, United States ArmyApproved for public release; distribution is unlimited

Countering Terrorism on Tomorrow’s Battlefield: Critical Infrastructure Security and Resiliency (NATO COE-DAT Handbook 2)

Every day, malicious actors target emerging technologies and medical resilience or seek to wreak havoc in the wake of disasters brought on by climate change, energy insecurity, and supply-chain disruptions. Countering Terrorism on Tomorrow’s Battlefield is a handbook on how to strengthen critical infrastructure resilience in an era of emerging threats. The counterterrorism research produced for this volume is in alignment with NATO’s Warfighting Capstone Concept, which details how NATO Allies can transform and maintain their advantage despite new threats for the next two decades. The topics are rooted in NATO’s Seven Baseline requirements, which set the standard for enhancing resilience in every aspect of critical infrastructure and civil society. As terrorists hone their skills to operate lethal drones, use biometric data to target innocents, and take advantage of the chaos left by pandemics and natural disasters for nefarious purposes, NATO forces must be prepared to respond and prevent terrorist events before they happen. Big-data analytics provides potential for NATO states to receive early warning to prevent pandemics, cyberattacks, and kinetic attacks. NATO is perfecting drone operations through interoperability exercises, and space is being exploited by adversaries. Hypersonic weapons are actively being used on the battlefield, and satellites have been targeted to take down wind farms and control navigation. This handbook is a guide for the future, providing actionable information and recommendations to keep our democracies safe today and in the years to come.https://press.armywarcollege.edu/monographs/1953/thumbnail.jp

Scale Inside-Out: Rapid Mitigation of Cloud DDoS Attacks

The distributed denial of service (DDoS) attacks in cloud computing requires quick absorption of attack data. DDoS attack mitigation is usually achieved by dynamically scaling the cloud resources so as to quickly identify the onslaught features to combat the attack. The resource scaling comes with an additional cost which may prove to be a huge disruptive cost in the cases of longer, sophisticated, and repetitive attacks. In this work, we address an important problem, whether the resource scaling during attack, always result in rapid DDoS mitigation? For this purpose, we conduct real-time DDoS attack experiments to study the attack absorption and attack mitigation for various target services in the presence of dynamic cloud resource scaling. We found that the activities such as attack absorption which provide timely attack data input to attack analytics, are adversely compromised by the heavy resource usage generated by the attack. We show that the operating system level local resource contention, if reduced during attacks, can expedite the overall attack mitigation. The attack mitigation would otherwise not be completed by the dynamic scaling of resources alone. We conceived a novel relation which terms “Resource Utilization Factor” for each incoming request as the major component in forming the resource contention. To overcome these issues, we propose a new “Scale Inside-out” approach which during attacks, reduces the “Resource Utilization Factor” to a minimal value for quick absorption of the attack. The proposed approach sacrifices victim service resources and provides those resources to mitigation service in addition to other co-located services to ensure resource availability during the attack. Experimental evaluation shows up to 95 percent reduction in total attack downtime of the victim service in addition to considerable improvement in attack detection time, service reporting time, and downtime of co-located services

The Future Role of Strategic Landpower

Recent Russian aggression in Ukraine has reenergized military strategists and senior leaders to evaluate the role of strategic Landpower. American leadership in the European theater has mobilized allies and partners to reconsider force postures for responding to possible aggression against NATO members. Although Russian revisionist activity remains a threat in Europe, the challenges in the Pacific for strategic Landpower must also be considered. At the same time, the homeland, the Arctic, climate change, and the results of new and emerging technology also challenge the application of strategic Landpower. This publication serves as part of an enduring effort to evaluate strategic Landpower’s role, authorities, and resources for accomplishing the national strategic goals the Joint Force may face in the next conflict. This study considers multinational partners, allies, and senior leaders that can contribute to overcoming these enduring challenges. The insights derived from this study, which can be applied to both the European and Indo-Pacific theaters, should help leaders to consider these challenges, which may last a generation. Deterrence demands credible strategic response options integrated across warfighting functions. This valuable edition will continue the dialogue about addressing these issues as well as other emerging ones.https://press.armywarcollege.edu/monographs/1959/thumbnail.jp

Decision Support Elements and Enabling Techniques to Achieve a Cyber Defence Situational Awareness Capability

[ES] La presente tesis doctoral realiza un análisis en detalle de los elementos de decisión necesarios para mejorar la comprensión de la situación en ciberdefensa con especial énfasis en la percepción y comprensión del analista de un centro de operaciones de ciberseguridad (SOC). Se proponen dos arquitecturas diferentes basadas en el análisis forense de flujos de datos (NF3). La primera arquitectura emplea técnicas de Ensemble Machine Learning mientras que la segunda es una variante de Machine Learning de mayor complejidad algorítmica (lambda-NF3) que ofrece un marco de defensa de mayor robustez frente a ataques adversarios. Ambas propuestas buscan automatizar de forma efectiva la detección de malware y su posterior gestión de incidentes mostrando unos resultados satisfactorios en aproximar lo que se ha denominado un SOC de próxima generación y de computación cognitiva (NGC2SOC). La supervisión y monitorización de eventos para la protección de las redes informáticas de una organización debe ir acompañada de técnicas de visualización. En este caso, la tesis aborda la generación de representaciones tridimensionales basadas en métricas orientadas a la misión y procedimientos que usan un sistema experto basado en lógica difusa. Precisamente, el estado del arte muestra serias deficiencias a la hora de implementar soluciones de ciberdefensa que reflejen la relevancia de la misión, los recursos y cometidos de una organización para una decisión mejor informada. El trabajo de investigación proporciona finalmente dos áreas claves para mejorar la toma de decisiones en ciberdefensa: un marco sólido y completo de verificación y validación para evaluar parámetros de soluciones y la elaboración de un conjunto de datos sintéticos que referencian unívocamente las fases de un ciberataque con los estándares Cyber Kill Chain y MITRE ATT & CK.[CA] La present tesi doctoral realitza una anàlisi detalladament dels elements de decisió necessaris per a millorar la comprensió de la situació en ciberdefensa amb especial èmfasi en la percepció i comprensió de l'analista d'un centre d'operacions de ciberseguretat (SOC). Es proposen dues arquitectures diferents basades en l'anàlisi forense de fluxos de dades (NF3). La primera arquitectura empra tècniques de Ensemble Machine Learning mentre que la segona és una variant de Machine Learning de major complexitat algorítmica (lambda-NF3) que ofereix un marc de defensa de major robustesa enfront d'atacs adversaris. Totes dues propostes busquen automatitzar de manera efectiva la detecció de malware i la seua posterior gestió d'incidents mostrant uns resultats satisfactoris a aproximar el que s'ha denominat un SOC de pròxima generació i de computació cognitiva (NGC2SOC). La supervisió i monitoratge d'esdeveniments per a la protecció de les xarxes informàtiques d'una organització ha d'anar acompanyada de tècniques de visualització. En aquest cas, la tesi aborda la generació de representacions tridimensionals basades en mètriques orientades a la missió i procediments que usen un sistema expert basat en lògica difusa. Precisament, l'estat de l'art mostra serioses deficiències a l'hora d'implementar solucions de ciberdefensa que reflectisquen la rellevància de la missió, els recursos i comeses d'una organització per a una decisió més ben informada. El treball de recerca proporciona finalment dues àrees claus per a millorar la presa de decisions en ciberdefensa: un marc sòlid i complet de verificació i validació per a avaluar paràmetres de solucions i l'elaboració d'un conjunt de dades sintètiques que referencien unívocament les fases d'un ciberatac amb els estàndards Cyber Kill Chain i MITRE ATT & CK.[EN] This doctoral thesis performs a detailed analysis of the decision elements necessary to improve the cyber defence situation awareness with a special emphasis on the perception and understanding of the analyst of a cybersecurity operations center (SOC). Two different architectures based on the network flow forensics of data streams (NF3) are proposed. The first architecture uses Ensemble Machine Learning techniques while the second is a variant of Machine Learning with greater algorithmic complexity (lambda-NF3) that offers a more robust defense framework against adversarial attacks. Both proposals seek to effectively automate the detection of malware and its subsequent incident management, showing satisfactory results in approximating what has been called a next generation cognitive computing SOC (NGC2SOC). The supervision and monitoring of events for the protection of an organisation's computer networks must be accompanied by visualisation techniques. In this case, the thesis addresses the representation of three-dimensional pictures based on mission oriented metrics and procedures that use an expert system based on fuzzy logic. Precisely, the state-of-the-art evidences serious deficiencies when it comes to implementing cyber defence solutions that consider the relevance of the mission, resources and tasks of an organisation for a better-informed decision. The research work finally provides two key areas to improve decision-making in cyber defence: a solid and complete verification and validation framework to evaluate solution parameters and the development of a synthetic dataset that univocally references the phases of a cyber-attack with the Cyber Kill Chain and MITRE ATT & CK standards.Llopis Sánchez, S. (2023). Decision Support Elements and Enabling Techniques to Achieve a Cyber Defence Situational Awareness Capability [Tesis doctoral]. Universitat Politècnica de València. https://doi.org/10.4995/Thesis/10251/19424