2017 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (Cyber SA)最新文献

Automated computer network defence using ARMOUR: Mission-oriented decision support and vulnerability mitigation 使用armor的自动计算机网络防御:面向任务的决策支持和漏洞缓解

2017 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (Cyber SA) Pub Date : 2017-06-19 DOI: 10.1109/CyberSA.2017.8073389

N. Nakhla, K. Perrett, Christopher McKenzie

{"title":"Automated computer network defence using ARMOUR: Mission-oriented decision support and vulnerability mitigation","authors":"N. Nakhla, K. Perrett, Christopher McKenzie","doi":"10.1109/CyberSA.2017.8073389","DOIUrl":"https://doi.org/10.1109/CyberSA.2017.8073389","url":null,"abstract":"Mission assurance requires effective, near-real time defensive cyber operations to appropriately respond to cyber attacks, without having a significant impact on operations. The ability to rapidly compute, prioritize and execute network-based courses of action (CoAs) relies on accurate situational awareness and mission-context information. Although diverse solutions exist for automatically collecting and analysing infrastructure data, few deliver automated analysis and implementation of network-based CoAs in the context of the ongoing mission. In addition, such processes can be operatorintensive and available tools tend to be specific to a set of common data sources and network responses. To address these issues, Defence Research and Development Canada (DRDC) is leading the development of the Automated Computer Network Defence (ARMOUR) technology demonstrator and cyber defence science and technology (S&T) platform. ARMOUR integrates new and existing off-the-shelf capabilities to provide enhanced decision support and to automate many of the tasks currently executed manually by network operators. This paper describes the cyber defence integration framework, situational awareness, and automated mission-oriented decision support that ARMOUR provides.","PeriodicalId":365296,"journal":{"name":"2017 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (Cyber SA)","volume":"46 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-06-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129022185","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 4

RicherPicture: Semi-automated cyber defence using context-aware data analytics 图片:使用上下文感知数据分析的半自动网络防御

2017 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (Cyber SA) Pub Date : 2017-06-19 DOI: 10.1109/CyberSA.2017.8073399

Arnau Erola, Ioannis Agrafiotis, J. Happa, M. Goldsmith, S. Creese, P. Legg

{"title":"RicherPicture: Semi-automated cyber defence using context-aware data analytics","authors":"Arnau Erola, Ioannis Agrafiotis, J. Happa, M. Goldsmith, S. Creese, P. Legg","doi":"10.1109/CyberSA.2017.8073399","DOIUrl":"https://doi.org/10.1109/CyberSA.2017.8073399","url":null,"abstract":"In a continually evolving cyber-threat landscape, the detection and prevention of cyber attacks has become a complex task. Technological developments have led organisations to digitise the majority of their operations. This practice, however, has its perils, since cybespace offers a new attack-surface. Institutions which are tasked to protect organisations from these threats utilise mainly network data and their incident response strategy remains oblivious to the needs of the organisation when it comes to protecting operational aspects. This paper presents a system able to combine threat intelligence data, attack-trend data and organisational data (along with other data sources available) in order to achieve automated network-defence actions. Our approach combines machine learning, visual analytics and information from business processes to guide through a decision-making process for a Security Operation Centre environment. We test our system on two synthetic scenarios and show that correlating network data with non-network data for automated network defences is possible and worth investigating further.","PeriodicalId":365296,"journal":{"name":"2017 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (Cyber SA)","volume":"27 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-06-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125996888","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 7

Stock market reaction to data breaches: The moderating role of corporate social responsibility 股市对数据泄露的反应:企业社会责任的调节作用

2017 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (Cyber SA) Pub Date : 2017-06-19 DOI: 10.1109/CyberSA.2017.8073393

Shuili Du, Jing Wang, Kholekile L. Gwebu

引用次数: 0

A preliminary radicalisation framework based on social engineering techniques 基于社会工程技术的初步激进化框架

2017 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (Cyber SA) Pub Date : 2017-06-19 DOI: 10.1109/CyberSA.2017.8073406

S. Sabouni, A. Cullen, Lorna Armitage

引用次数: 7

A methodology for testing virtualisation security 一种测试虚拟化安全性的方法

2017 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (Cyber SA) Pub Date : 2017-06-19 DOI: 10.1109/CyberSA.2017.8073397

S. Donaldson, Natalie J. Coull, David McLuskie

{"title":"A methodology for testing virtualisation security","authors":"S. Donaldson, Natalie J. Coull, David McLuskie","doi":"10.1109/CyberSA.2017.8073397","DOIUrl":"https://doi.org/10.1109/CyberSA.2017.8073397","url":null,"abstract":"There is a growing interest in virtualisation due to its central role in cloud computing, virtual desktop environments and Green IT. Data centres and cloud computing utilise this technology to run multiple operating systems on one physical server, thus reducing hardware costs. However, vulnerabilities in the hypervisor layer have an impact on any virtual machines running on top, making security an important part of virtualisation. In this paper, we evaluate the security of virtualisation, including detection and escaping the environment. We present a methodology to investigate if a virtual machine can be detected and further compromised, based upon previous research. Finally, this methodology is used to evaluate the security of virtual machines. The methods used to evaluate the security include analysis of known vulnerabilities and fuzzing to test the virtual device drivers on three different platforms: VirtualBox, Hyper-V and VMware ESXI. Our results demonstrate that the attack surface of virtualisation is more prone to vulnerabilities than the hypervisor. Comparing our results with previous studies, each platform withstood IOCTL and random fuzzing, demonstrating that the platforms are more robust and secure than previously found. By building on existing research, the results show that security in the hypervisor has been improved. However, using the proposed methodology in this paper it has been shown that an attacker can easily determine that the machine is a virtual machine, which could be used for further exploitation. Finally, our proposed methodology can be utilised to effectively test the security of a virtualised environment.","PeriodicalId":365296,"journal":{"name":"2017 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (Cyber SA)","volume":"6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-06-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116156484","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 5

Cybersecurity situational awareness taxonomy 网络安全态势感知分类法

2017 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (Cyber SA) Pub Date : 2017-06-19 DOI: 10.1109/CyberSA.2017.8073386

Antti Evesti, T. Kanstrén, T. Frantti

引用次数: 25

Security awareness and affective feedback: Categorical behaviour vs. reported behaviour 安全意识和情感反馈:绝对行为vs.报告行为

2017 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (Cyber SA) Pub Date : 2017-06-19 DOI: 10.1109/CyberSA.2017.8073387

Lynsay A. Shepherd, J. Archibald

引用次数: 4

Visualisation of device datasets to assist digital forensic investigation 设备数据集的可视化，以协助数字法医调查

2017 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (Cyber SA) Pub Date : 2017-06-19 DOI: 10.1109/CyberSA.2017.8073402

Gavin Hales

引用次数: 4

A temporal assessment of cyber intrusion chains using multidisciplinary frameworks and methodologies 使用多学科框架和方法的网络入侵链的时间评估

2017 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (Cyber SA) Pub Date : 2017-06-19 DOI: 10.1109/CyberSA.2017.8073398

Aunshul Rege, Z. Obradovic, N. Asadi, B. Singer, Nicholas Masceri

引用次数: 11

Random forest explorations for URL classification URL分类的随机森林探索

2017 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (Cyber SA) Pub Date : 2017-06-19 DOI: 10.1109/CyberSA.2017.8073403

Martyn Weedon, D. Tsaptsinos, J. Denholm-Price

引用次数: 16