Journal of Cybersecurity and Privacy最新文献

Humans and Automation: Augmenting Security Operation Centers 人类与自动化：增强安全运营中心

Journal of Cybersecurity and Privacy Pub Date : 2024-07-01 DOI: 10.3390/jcp4030020

Jack Tilbury, Stephen Flowerday

{"title":"Humans and Automation: Augmenting Security Operation Centers","authors":"Jack Tilbury, Stephen Flowerday","doi":"10.3390/jcp4030020","DOIUrl":"https://doi.org/10.3390/jcp4030020","url":null,"abstract":"The continuous integration of automated tools into security operation centers (SOCs) increases the volume of alerts for security analysts. This amplifies the risk of automation bias and complacency to the point that security analysts have reported missing, ignoring, and not acting upon critical alerts. Enhancing the SOC environment has predominantly been researched from a technical standpoint, failing to consider the socio-technical elements adequately. However, our research fills this gap and provides practical insights for optimizing processes in SOCs. The synergy between security analysts and automation can potentially augment threat detection and response capabilities, ensuring a more robust defense if effective human-automation collaboration is established. A scoping review of 599 articles from four databases led to a final selection of 49 articles. Thematic analysis resulted in 609 coding references generated across four main themes: SOC automation challenges, automation application areas, implications on analysts, and human factor sentiment. Our findings emphasize the extent to which automation can be implemented across the incident response lifecycle. The SOC Automation Matrix represents our primary contribution to achieving a mutually beneficial relationship between analyst and machine. This matrix describes the properties of four distinct human-automation combinations. This is of practical value to SOCs striving to optimize their processes, as our matrix mentions socio-technical system characteristics for automated tools.","PeriodicalId":316237,"journal":{"name":"Journal of Cybersecurity and Privacy","volume":"265 29‐32","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141692320","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

ScriptBlock Smuggling: Uncovering Stealthy Evasion Techniques in PowerShell and .NET Environments 脚本块走私：揭秘 PowerShell 和 .NET 环境中的隐蔽规避技术

Journal of Cybersecurity and Privacy Pub Date : 2024-03-25 DOI: 10.3390/jcp4020008

Anthony J. Rose, Scott R. Graham, Christine M. Schubert Kabban, Jacob J. Krasnov, Wayne C. Henry

{"title":"ScriptBlock Smuggling: Uncovering Stealthy Evasion Techniques in PowerShell and .NET Environments","authors":"Anthony J. Rose, Scott R. Graham, Christine M. Schubert Kabban, Jacob J. Krasnov, Wayne C. Henry","doi":"10.3390/jcp4020008","DOIUrl":"https://doi.org/10.3390/jcp4020008","url":null,"abstract":"The Antimalware Scan Interface (AMSI) plays a crucial role in detecting malware within Windows operating systems. This paper presents ScriptBlock Smuggling, a novel evasion and log spoofing technique exploiting PowerShell and .NET environments to circumvent the AMSI. By focusing on the manipulation of ScriptBlocks within the Abstract Syntax Tree (AST), this method creates dual AST representations, one for compiler execution and another for antivirus and log analysis, enabling the evasion of AMSI detection and challenging traditional memory patching bypass methods. This research provides a detailed analysis of PowerShell’s ScriptBlock creation and its inherent security features and pinpoints critical limitations in the AMSI’s capabilities to scrutinize ScriptBlocks and the implications of log spoofing as part of this evasion method. The findings highlight potential avenues for attackers to exploit these vulnerabilities, suggesting the possibility of a new class of AMSI bypasses and their use for log spoofing. In response, this paper proposes a synchronization strategy for ASTs, intended to unify the compilation and malware scanning processes to reduce the threat surfaces in PowerShell and .NET environments.","PeriodicalId":316237,"journal":{"name":"Journal of Cybersecurity and Privacy","volume":" 3","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-03-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"140384414","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Image Encryption Algorithms: A Survey of Design and Evaluation Metrics 图像加密算法：设计与评估指标调查

Journal of Cybersecurity and Privacy Pub Date : 2024-02-23 DOI: 10.3390/jcp4010007

Yousef Alghamdi, Arslan Munir

{"title":"Image Encryption Algorithms: A Survey of Design and Evaluation Metrics","authors":"Yousef Alghamdi, Arslan Munir","doi":"10.3390/jcp4010007","DOIUrl":"https://doi.org/10.3390/jcp4010007","url":null,"abstract":"Ensuring confidentiality and privacy is critical when it comes to sharing images over unsecured networks such as the internet. Since widely used and secure encryption methods, such as AES, Twofish, and RSA, are not suitable for real-time image encryption due to their slow encryption speeds and high computational requirements, researchers have proposed specialized algorithms for image encryption. This paper provides an introduction and overview of the image encryption algorithms and metrics used, aiming to evaluate them and help researchers and practitioners starting in this field obtain adequate information to understand the current state of image encryption algorithms. This paper classifies image encryption into seven different approaches based on the techniques used and analyzes the strengths and weaknesses of each approach. Furthermore, this paper provides a detailed review of a comprehensive set of security, quality, and efficiency evaluation metrics for image encryption algorithms, and provides upper and lower bounds for these evaluation metrics. Finally, this paper discusses the pros and cons of different image encryption approaches as well as the suitability of different image encryption approaches for different applications.","PeriodicalId":316237,"journal":{"name":"Journal of Cybersecurity and Privacy","volume":"4 5","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-02-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"140436209","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Incidental Data: A Survey towards Awareness on Privacy-Compromising Data Incidentally Shared on Social Media 偶然数据：社交媒体上偶然分享的隐私受损数据认知调查

Journal of Cybersecurity and Privacy Pub Date : 2024-02-23 DOI: 10.3390/jcp4010006

S. Kutschera, Wolfgang Slany, Patrick Ratschiller, Sarina Gursch, Patrick Deininger, Håvard Dagenborg

引用次数: 0

Experiential Transformation in Privacy Behavior: A New Framework for Privacy Behavior Enhancement 隐私行为的经验转变：隐私行为改进的新框架

Journal of Cybersecurity and Privacy Pub Date : 2024-02-07 DOI: 10.3390/jcp4010005

I. Paspatis, A. Tsohou

{"title":"Experiential Transformation in Privacy Behavior: A New Framework for Privacy Behavior Enhancement","authors":"I. Paspatis, A. Tsohou","doi":"10.3390/jcp4010005","DOIUrl":"https://doi.org/10.3390/jcp4010005","url":null,"abstract":"Multiple studies have demonstrated that the conventional method of learning is suboptimal when our goal is to enhance individuals’ genuine privacy behavior. This study introduces a framework for transforming privacy behavior, with the objective of enhancing individuals’ privacy practices to a higher level of confidentiality. We performed an experiment on a limited number of people to validate the efficacy of our suggested transformation framework. This framework combined determining aspects of privacy behavior with experiential behavior modification methodologies such as neutral stimuli (e.g., cognitive behavioral transformation—CBTx), practical assessments and motivational interviews from other disciplines. While these methods have proven effective in fields like psychology and sociology, they have not yet been applied to the realm of Information Computer and Technology (ICT). In this study, we have effectively demonstrated the efficacy of the proposed framework through a five-phase experiment. The suggested framework has the potential to be advantageous for educational institutions, including both public and private schools as well as universities, to construct new frameworks or develop new methodologies regarding individuals’ privacy behavior transformation to a more protective one. Furthermore, our framework offers a conducive environment for further investigation into privacy behavior transformation methodologies.","PeriodicalId":316237,"journal":{"name":"Journal of Cybersecurity and Privacy","volume":"17 10","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-02-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"139856886","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Experiential Transformation in Privacy Behavior: A New Framework for Privacy Behavior Enhancement 隐私行为的经验转变：隐私行为改进的新框架

Journal of Cybersecurity and Privacy Pub Date : 2024-02-07 DOI: 10.3390/jcp4010005

I. Paspatis, A. Tsohou

{"title":"Experiential Transformation in Privacy Behavior: A New Framework for Privacy Behavior Enhancement","authors":"I. Paspatis, A. Tsohou","doi":"10.3390/jcp4010005","DOIUrl":"https://doi.org/10.3390/jcp4010005","url":null,"abstract":"Multiple studies have demonstrated that the conventional method of learning is suboptimal when our goal is to enhance individuals’ genuine privacy behavior. This study introduces a framework for transforming privacy behavior, with the objective of enhancing individuals’ privacy practices to a higher level of confidentiality. We performed an experiment on a limited number of people to validate the efficacy of our suggested transformation framework. This framework combined determining aspects of privacy behavior with experiential behavior modification methodologies such as neutral stimuli (e.g., cognitive behavioral transformation—CBTx), practical assessments and motivational interviews from other disciplines. While these methods have proven effective in fields like psychology and sociology, they have not yet been applied to the realm of Information Computer and Technology (ICT). In this study, we have effectively demonstrated the efficacy of the proposed framework through a five-phase experiment. The suggested framework has the potential to be advantageous for educational institutions, including both public and private schools as well as universities, to construct new frameworks or develop new methodologies regarding individuals’ privacy behavior transformation to a more protective one. Furthermore, our framework offers a conducive environment for further investigation into privacy behavior transformation methodologies.","PeriodicalId":316237,"journal":{"name":"Journal of Cybersecurity and Privacy","volume":"39 8","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-02-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"139797286","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Continued Fractions Applied to the One Line Factoring Algorithm for Breaking RSA 将连续分数应用于破解 RSA 的单线因式分解算法

Journal of Cybersecurity and Privacy Pub Date : 2024-01-10 DOI: 10.3390/jcp4010003

A. Overmars, S. Venkatraman

{"title":"Continued Fractions Applied to the One Line Factoring Algorithm for Breaking RSA","authors":"A. Overmars, S. Venkatraman","doi":"10.3390/jcp4010003","DOIUrl":"https://doi.org/10.3390/jcp4010003","url":null,"abstract":"The RSA (Rivest–Shamir–Adleman) cryptosystem is an asymmetric public key cryptosystem popular for its use in encryptions and digital signatures. However, the Wiener’s attack on the RSA cryptosystem utilizes continued fractions, which has generated much interest in developing competitive factoring algorithms. A general-purpose integer factorization method first proposed by Lehmer and Powers formed the basis of the well-known Continued Fraction Factorization (CFRAC) method. Recent work on the one line factoring algorithm by Hart and its connection with Lehman’s factoring method have motivated this paper. The emphasis of this paper is to explore the representations of PQ as continued fractions and the suitability of lower ordered convergences as representations of ab. These simpler convergences are then prescribed to Hart’s one line factoring algorithm. As an illustration, we demonstrate the working of our approach with two numbers: one smaller number and another larger number occupying 95 bits. Using our method, the fourth convergence finds the factors as the solution for the smaller number, while the eleventh convergence finds the factors for the larger number. The security of the RSA public key cryptosystem relies on the computational difficulty of factoring large integers. Among the challenges in breaking RSA semi-primes, RSA250, which is an 829-bit semi-prime, continues to hold a research record. In this paper, we apply our method to factorize RSA250 and present the practical implementation of our algorithm. Our approach’s theoretical and experimental findings demonstrate the reduction of the search space and a faster solution to the semi-prime factorization problem, resulting in key contributions and practical implications. We identify further research to extend our approach by exploring limitations and additional considerations such as the difference of squares method, paving the way for further research in this direction.","PeriodicalId":316237,"journal":{"name":"Journal of Cybersecurity and Privacy","volume":"39 10","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-01-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"139441313","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Security Attack Behavioural Pattern Analysis for Critical Service Providers 关键服务提供商的安全攻击行为模式分析

Journal of Cybersecurity and Privacy Pub Date : 2024-01-10 DOI: 10.3390/jcp4010004

Elias Seid, Oliver Popov, Fredrik Blix

{"title":"Security Attack Behavioural Pattern Analysis for Critical Service Providers","authors":"Elias Seid, Oliver Popov, Fredrik Blix","doi":"10.3390/jcp4010004","DOIUrl":"https://doi.org/10.3390/jcp4010004","url":null,"abstract":"Identifying potential system attacks that define security requirements is crucial to building secure cyber systems. Moreover, the attack frequency makes their subsequent analysis challenging and arduous in cyber–physical systems (CPS). Since CPS include people, organisations, software, and infrastructure, a thorough security attack analysis must consider both strategic (social and organisational) aspects and technical (software and physical infrastructure) aspects. Studying cyberattacks and their potential impact on internal and external assets in cyberspace is essential for maintaining cyber security. The importance is reflected in the work of the Swedish Civil Contingencies Agency (MSB), which receives IT incident reports from essential service providers mandated by the NIS directive of the European Union and Swedish government agencies. To tackle this problem, a multi-realm security attack event monitoring framework was proposed to monitor, model, and analyse security events in social(business process), cyber, and physical infrastructure components of cyber–physical systems. This paper scrutinises security attack patterns and the corresponding security solutions for Swedish government agencies and organisations within the EU’s NIS directive. A pattern analysis was conducted on 254 security incident reports submitted by critical service providers. A total of five critical security attacks, seven vulnerabilities (commonly known as threats), ten attack patterns, and ten parallel attack patterns were identified. Moreover, we employed standard mitigation techniques obtained from recognised repositories of cyberattack knowledge, namely, CAPEC and Mitre, in order to conduct an analysis of the behavioural patterns","PeriodicalId":316237,"journal":{"name":"Journal of Cybersecurity and Privacy","volume":"44 4","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-01-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"139441021","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Evaluating Cluster-Based Synthetic Data Generation for Blood-Transfusion Analysis 评估用于输血分析的基于聚类的合成数据生成

Journal of Cybersecurity and Privacy Pub Date : 2023-12-01 DOI: 10.3390/jcp3040040

S. Kroes, Matthijs van Leeuwen, Rolf H H Groenwold, M. Janssen

{"title":"Evaluating Cluster-Based Synthetic Data Generation for Blood-Transfusion Analysis","authors":"S. Kroes, Matthijs van Leeuwen, Rolf H H Groenwold, M. Janssen","doi":"10.3390/jcp3040040","DOIUrl":"https://doi.org/10.3390/jcp3040040","url":null,"abstract":"Synthetic data generation is becoming an increasingly popular approach to making privacy-sensitive data available for analysis. Recently, cluster-based synthetic data generation (CBSDG) has been proposed, which uses explainable and tractable techniques for privacy preservation. Although the algorithm demonstrated promising performance on simulated data, CBSDG has not yet been applied to real, personal data. In this work, a published blood-transfusion analysis is replicated with synthetic data to assess whether CBSDG can reproduce more complex and intricate variable relations than previously evaluated. Data from the Dutch national blood bank, consisting of 250,729 donation records, were used to predict donor hemoglobin (Hb) levels by means of support vector machines (SVMs). Precision scores were equal to the original data results for both male (0.997) and female (0.987) donors, recall was 0.007 higher for male and 0.003 lower for female donors (original estimates 0.739 and 0.637, respectively). The impact of the variables on Hb predictions was similar, as quantified and visualized with Shapley additive explanation values. Opportunities for attribute disclosure were decreased for all but two variables; only the binary variables Deferral Status and Sex could still be inferred. Such inference was also possible for donors who were not used as input for the generator and may result from correlations in the data as opposed to overfitting in the synthetic-data-generation process. The high predictive performance obtained with the synthetic data shows potential of CBSDG for practical implementation.","PeriodicalId":316237,"journal":{"name":"Journal of Cybersecurity and Privacy","volume":" 11","pages":""},"PeriodicalIF":0.0,"publicationDate":"2023-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"138615183","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Anomaly Detection for Modbus over TCP in Control Systems Using Entropy and Classification-Based Analysis 利用熵和基于分类的分析方法对控制系统中的 Modbus over TCP 进行异常检测

Journal of Cybersecurity and Privacy Pub Date : 2023-12-01 DOI: 10.3390/jcp3040041

Tirthankar Ghosh, S. Bagui, S. Bagui, Martin Kadzis, Jackson Bare

{"title":"Anomaly Detection for Modbus over TCP in Control Systems Using Entropy and Classification-Based Analysis","authors":"Tirthankar Ghosh, S. Bagui, S. Bagui, Martin Kadzis, Jackson Bare","doi":"10.3390/jcp3040041","DOIUrl":"https://doi.org/10.3390/jcp3040041","url":null,"abstract":"This article presents a statistical approach using entropy and classification-based analysis to detect anomalies in industrial control systems traffic. Several statistical techniques have been proposed to create baselines and measure deviation to detect intrusion in enterprise networks with a centralized intrusion detection approach in mind. Looking at traffic volume alone to find anomalous deviation may not be enough—it may result in increased false positives. The near real-time communication requirements, coupled with the lack of centralized infrastructure in operations technology and limited resources of the sensor motes, require an efficient anomaly detection system characterized by these limitations. This paper presents extended results from our previous work by presenting a detailed cluster-based entropy analysis on selected network traffic features. It further extends the analysis using a classification-based approach. Our detailed entropy analysis corroborates with our earlier findings that, although some degree of anomaly may be detected using univariate and bivariate entropy analysis for Denial of Service (DOS) and Man-in-the-Middle (MITM) attacks, not much information may be obtained for the initial reconnaissance, thus preventing early stages of attack detection in the Cyber Kill Chain. Our classification-based analysis shows that, overall, the classification results of the DOS attacks were much higher than the MITM attacks using two Modbus features in addition to the three TCP/IP features. In terms of classifiers, J48 and random forest had the best classification results and can be considered comparable. For the DOS attack, no resampling with the 60–40 (training/testing split) had the best results (average accuracy of 97.87%), but for the MITM attack, the 80–20 non-attack vs. attack data with the 75–25 split (average accuracy of 82.81%) had the best results.","PeriodicalId":316237,"journal":{"name":"Journal of Cybersecurity and Privacy","volume":" 4","pages":""},"PeriodicalIF":0.0,"publicationDate":"2023-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"138617195","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0