Ahmad Nasayreh , Haris M. Khalid , Hamza K. Alkhateeb , Jalal Al-Manaseer , Abdulla Ismail , Hasan Gharaibeh
{"title":"Automated detection of cyber attacks in healthcare systems: A novel scheme with advanced feature extraction and classification","authors":"Ahmad Nasayreh , Haris M. Khalid , Hamza K. Alkhateeb , Jalal Al-Manaseer , Abdulla Ismail , Hasan Gharaibeh","doi":"10.1016/j.cose.2024.104288","DOIUrl":"10.1016/j.cose.2024.104288","url":null,"abstract":"<div><div>The growing incorporation of interconnected healthcare equipment, software, networks, and operating systems into the Internet of Medical Things (IoMT) poses a risk of security breaches. This is because the IoMT devices lack adequate safeguards against cyberattacks. To address this issue, this article presents a proposed framework for detecting anomalies and cyberattacks. The proposed integrated model employs the 1) K-nearest neighbors (KNN) algorithm for classification, while 2) utilizing long-short term memory (LSTM) for feature extraction, and 3) applying Principal component analysis (PCA) to modify and reduce the features. PCA subsequently enhances the important temporal characteristics identified by the LSTM network. The parameters of the KNN classifier were confirmed by using fivefold cross-validation after making hyperparameter adjustments. The evaluation of the proposed model involved the use of four datasets: 1) telemetry operating system network internet-of-things (TON-IoT), 2) Edith Cowan University-Internet of Health Things (ECU-IoHT) dataset, 3) intensive care unit (ICU) dataset, and 4) Washington University in St. Louis Enhanced Healthcare Surveillance System (WUSTL-EHMS) dataset. The proposed model achieved 99.9% accuracy, recall, F1 score, and precision on the WUSTL-EHMS dataset. The proposed technique efficiently mitigates cyber threats in healthcare environments.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"150 ","pages":"Article 104288"},"PeriodicalIF":4.8,"publicationDate":"2024-12-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143142811","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Nourhan Halawi Ghoson , Vincent Meyrueis , Khaled Benfriha , Thomas Guiltat , Stéphane Loubère
{"title":"A review on the static and dynamic risk assessment methods for OT cybersecurity in industry 4.0","authors":"Nourhan Halawi Ghoson , Vincent Meyrueis , Khaled Benfriha , Thomas Guiltat , Stéphane Loubère","doi":"10.1016/j.cose.2024.104295","DOIUrl":"10.1016/j.cose.2024.104295","url":null,"abstract":"<div><div>The inherent vulnerabilities of Operational Technology (OT) systems to cyberattacks have historically been mitigated through the practice of air-gapping, effectively isolating them from broader industrial networks and thereby maintaining a level of security. However, the beginning of the fourth industrial revolution (Industry 4.0) signs a concept shift towards increased interconnectivity, enhanced visibility, and digital continuity. The transition towards Industry 4.0 has been characterized by a marked increase in security breaches within industrial settings, leading to a variety of hazardous outcomes. These incidents underscore the importance of cybersecurity within OT environments, necessitating the development and implementation of strict cybersecurity measures to safeguard against potential threats. In response to this emerging threat landscape, there has been a notable shift from static risk assessment methodologies towards more dynamic approaches, particularly with the incorporation of Artificial Intelligence (AI) technologies. This paper presents a comprehensive literature review that explores various risk assessment approaches within the context of Industry 4.0, focusing on industrial systems. It outlines the transition from traditional, static risk assessment methods to innovative, dynamic risk assessment strategies facilitated by the integration of AI.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"150 ","pages":"Article 104295"},"PeriodicalIF":4.8,"publicationDate":"2024-12-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143142418","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Edge Implicit Weighting with graph transformers for robust intrusion detection in Internet of Things network","authors":"C. Karpagavalli, M. Kaliappan","doi":"10.1016/j.cose.2024.104299","DOIUrl":"10.1016/j.cose.2024.104299","url":null,"abstract":"<div><div>In recent years, the Internet of Things devices have progressively deployed in various applications including smart cities, intelligent transportation, healthcare, and agriculture. However, this widespread adaptation of the Internet of Things networks has been vulnerable to several attacks. Lack of security protocols, unauthorized access, and improper device updates lead the Internet of Things environment to several attacks, which impact network security and confidentiality of users. This paper develops an innovative approach that integrates Edge Implicit Weighting and Aggregated Graph Transformer architecture for accurate and timely intrusion detection. The proposed technique aggregates information from both one-hop and two-hop neighbors to derive immediate and extended relational context thereby improving the detection of complex attacks. This approach designs an Edge Implicit Weighting mechanism that allows the model to prioritize structurally significant relationships and enhance the accuracy of attack detection. The multi-head attention mechanism is introduced to enhance the detection of relevant patterns even in highly variable traffic scenarios. Further, the proposed framework incorporates the Synthetic Minority Over-sampling Technique to generate synthetic samples of minority classes to reduce class imbalance problems and attain balanced detection performance across all classes. The performance of the proposed detection technique is analyzed using multiple datasets with standard evaluation parameters. The proposed technique achieves outstanding performance results including an accuracy of 98.87% and a recall of 98.36%. From this experimental validation, it's clear that the proposed framework provides robust performance under diverse network conditions and handles imbalanced data effectively.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"150 ","pages":"Article 104299"},"PeriodicalIF":4.8,"publicationDate":"2024-12-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143142804","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"CyberShapley: Explanation, prioritization, and triage of cybersecurity alerts using informative graph representation","authors":"Alon Malach , Prasanna N. Wudali , Satoru Momiyama , Jun Furukawa , Toshinori Araki , Yuval Elovici , Asaf Shabtai","doi":"10.1016/j.cose.2024.104270","DOIUrl":"10.1016/j.cose.2024.104270","url":null,"abstract":"<div><div>In recent years, the field of cybersecurity has seen significant advancements in the ability to detect anomalies and cyberattacks. This progress can be attributed to the use of deep learning (DL) models. Despite their superior performance, such models are imperfect, and their complex architecture makes them opaque and uninterpretable. Therefore, security analysts cannot effectively analyze the alerts generated by these models. Recently proposed methods that provide an explanation for the predictions of DL-based anomaly detectors tend to focus on the models’ low-level input features which necessitate further analysis to understand the alerts. As a result, when triaging alerts, security analysts spend a great deal of time analyzing the alerts before making a decision whether and how to act. To address this issue and ensure that the explanations produced for DL models’ output are beneficial to security analysts, we propose CyberShapley, an XAI approach that aims to enhance the interpretability of alerts generated by anomaly detectors by providing user-friendly explanations for the decisions made by these models. We evaluated our method on an LSTM-based anomaly detection model that raises alerts on the anomalous event sequences in the DARPA Engagement #3 and PublicArena datasets. Our method explains the anomalous event sequences associated with alerts by visualizing them as human-interpretable subgraphs (i.e., connected components) and highlighting (prioritizing) the most important components. Consequently, analysts can easily triage the event sequences by focusing on the components with high importance while disregarding the components with low importance.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"150 ","pages":"Article 104270"},"PeriodicalIF":4.8,"publicationDate":"2024-12-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143142437","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Albert Calvo , Santiago Escuder , Nil Ortiz , Josep Escrig , Maxime Compastié
{"title":"RBD24 : A labelled dataset with risk activities using log application data","authors":"Albert Calvo , Santiago Escuder , Nil Ortiz , Josep Escrig , Maxime Compastié","doi":"10.1016/j.cose.2024.104290","DOIUrl":"10.1016/j.cose.2024.104290","url":null,"abstract":"<div><div>This paper introduces the Risk Activities Dataset 2024 (RBD24), an open-source dataset designed to facilitate the identification and analysis of risk activities within the cybersecurity domain. The RBD24 Dataset is derived from multimodal application logs collected over a two-week period at a Spanish state university, identifying activities aligned with the early stages of the attack scenario. This dataset paves the way for novel User and Entity behaviour Analytics (UEBA) and risk assessment frameworks within the cybersecurity domain. In detail, the dataset offers a fully user-centric approach by providing ground-truth data for various risk behaviours, including cryptocurrency activities, outdated software usage, P2P file sharing, and phishing incidents. These ground-truth data, identified through intrusion detection systems (IDS) and experimental campaigns, are represented as a set of indicators extracted from DNS, HTTP, SSL, and SMTP protocol logs. This dataset is expected to be a valuable resource for developing and benchmarking cybersecurity models, particularly in the realm of risk behaviour assessment.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"150 ","pages":"Article 104290"},"PeriodicalIF":4.8,"publicationDate":"2024-12-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143142809","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A trajectory privacy protection method based on the replacement of points of interest in hotspot regions","authors":"Ruowei Gui , Xiaolin Gui , Xingjun Zhang","doi":"10.1016/j.cose.2024.104279","DOIUrl":"10.1016/j.cose.2024.104279","url":null,"abstract":"<div><div>Location-Based Services (LBS) already provides technical support for advertising, bus scheduling, and personnel tracking. However, the trajectory data published in LBS contains some sensitive semantic information related users in some locations. Through mining these data, sensitive personal information can be disclosed, such as user’s living habits, interests, daily activities, social relations, and health condition. It is a challenge to provide users with high-quality LBS while protecting user privacy. In order to address the disadvantages of current trajectory privacy protection methods, we propose a method of trajectory privacy protection with the replacement of points of interest (<span><math><mrow><mi>P</mi><mi>O</mi><mi>I</mi><mi>s</mi></mrow></math></span>) based on hotspot clustering. Firstly, user stay points are extracted based on the speed threshold using a sliding time window, user stay areas are merged by the distance threshold based on user stay points, and user hotspot regions are extracted from all user stay areas using <span><math><mrow><mi>D</mi><mi>B</mi><mi>S</mi><mi>C</mi><mi>A</mi><mi>N</mi></mrow></math></span>. Then, according to the semantic and distance features of the <span><math><mrow><mi>P</mi><mi>O</mi><mi>I</mi><mi>s</mi></mrow></math></span> in the hotspot regions, the sensitive regions meeting the user’s privacy needs are constructed, and the <span><math><mrow><mi>P</mi><mi>O</mi><mi>I</mi><mi>s</mi></mrow></math></span> are replaced in the sensitive regions according to the privacy budgets. Finally, some locations in the sensitive regions are reconstructed to minimize the trajectory change. The experimental results show that our method can improve the usability of protected trajectories about 13.8% to 16.5% compared to the differential privacy method under the same level of privacy protection.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"150 ","pages":"Article 104279"},"PeriodicalIF":4.8,"publicationDate":"2024-12-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143142808","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"How do mental models affect cybersecurity awareness? The roles of questioning styles, need for cognition, and graphical representations","authors":"Yuntian Xie, Ting Lei, Zimo Li, Yujing Yang, Chunyin Chen, Yuanyuan Long","doi":"10.1016/j.cose.2024.104292","DOIUrl":"10.1016/j.cose.2024.104292","url":null,"abstract":"<div><div>This study, grounded in psychological model theory, investigated the influence of psychological models on cybersecurity awareness. To achieve this, two online experiments were conducted with college students. Experiment 1 examined the impact of various questioning methods on cybersecurity awareness within different problem situations among 479 college students. Experiment 2 explored the interplay of cognitive needs and graphic representations in shaping cybersecurity awareness among 468 college students. Our findings revealed that both problem situations and questioning methods significantly affect cybersecurity awareness. Notably, in criminal scenarios, a four-step questioning approach demonstrated the most pronounced positive impact on cybersecurity awareness. Additionally, an interaction effect was observed between cognitive needs and graphic representations on cybersecurity awareness. Specifically, graphic representations were more effective in promoting cybersecurity awareness among individuals with high cognitive needs. These results underscore the importance of questioning methods and cognitive needs in mediating the impact of psychological models on cybersecurity awareness, while also highlighting the conditional influence of graphic representations.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"150 ","pages":"Article 104292"},"PeriodicalIF":4.8,"publicationDate":"2024-12-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143142806","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A classifications framework for continuous biometric authentication (2018–2024)","authors":"Dutliff Boshoff, Gerhard P. Hancke","doi":"10.1016/j.cose.2024.104285","DOIUrl":"10.1016/j.cose.2024.104285","url":null,"abstract":"<div><div>The increase in personal devices, the amount of private and sensitive information these devices store/process, and the importance of this information have introduced vital security requirements for user authentication to facilitate data access and collection. Continuous Biometric Authentication is a set of techniques developed to monitor a person's biometrics continuously and ensures transparent/implicit authentication. These protocols could mitigate the security and usability limitations of one-time authentication mechanisms in personal computers and mobile devices. As a result, the popularity of continuous authentication technologies in research has drastically increased, leading to a multitude of different biometric data sampling techniques. These techniques include physiological versus behavioural systems or unimodal versus multimodal authenticators. This paper compares the various data sampling approaches by examining 80 recent state-of-the-art papers and outlining their respective advantages and disadvantages. Firstly, the paper introduces the proposed Continuous Biometric framework, including a diagram detailing its specifics and the rationale for focusing on biometric data sampling. It then explains the system architecture and how our framework integrates with it. Following which, the framework compares the surveyed papers across several popular authentication metrics. Lastly, the paper discusses the challenges that need to be addressed for the widespread adoption of this technology in everyday commercial use.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"150 ","pages":"Article 104285"},"PeriodicalIF":4.8,"publicationDate":"2024-12-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143142803","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Shi-Jie Xu , Kai-Chuan Kong , Xiao-Bo Jin , Guang-Gang Geng
{"title":"Unveiling traffic paths: Explainable path signature feature-based encrypted traffic classification","authors":"Shi-Jie Xu , Kai-Chuan Kong , Xiao-Bo Jin , Guang-Gang Geng","doi":"10.1016/j.cose.2024.104283","DOIUrl":"10.1016/j.cose.2024.104283","url":null,"abstract":"<div><div>Encryption technology ensures secure transmission for internet communications but poses significant challenges for effective encrypted traffic classification, which categorizes traffic into distinct groups, facilitating the process of monitoring network activities to uncover patterns and extract valuable information applicable in areas such as network management and anomaly detection. To this end, machine learning has emerged as a powerful technology for conducting encrypted traffic classification without compromising user data privacy. Machine learning-based classification demonstrates remarkable capabilities in processing vast amounts of data through sophisticated handcrafted features, with traffic path signature features representing the cutting edge of this field. This method shows stable performance improvements for common encrypted traffic types using only packet length information. However, it also yields a high dimensionality of path signature features, complicating the training of lightweight models and hindering further innovation due to a lack of model explainability. In this paper, we first propose leveraging feature selection to conduct feature dimensionality reduction, and then try to focus on the explanation of the model from both global and local perspectives. Performance comparisons indicate that our proposed method significantly reduces the number of path signature features while preserving classification performance, which enhances computational efficiency and meets the demand for lightweight models in various application scenarios. Furthermore, this significant reduction in the feature dimensionality allows for the interpretability of the model, which gives the user a clear understanding of the modeling decision-making process.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"150 ","pages":"Article 104283"},"PeriodicalIF":4.8,"publicationDate":"2024-12-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143142801","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Andrea Cimmino, Juan Cano-Benito, Raúl García-Castro
{"title":"Open Digital Rights Enforcement framework (ODRE): From descriptive to enforceable policies","authors":"Andrea Cimmino, Juan Cano-Benito, Raúl García-Castro","doi":"10.1016/j.cose.2024.104282","DOIUrl":"10.1016/j.cose.2024.104282","url":null,"abstract":"<div><div>From centralised platforms to decentralised ecosystems, like Data Spaces, sharing data has become a paramount challenge. For this reason, the definition of data usage policies has become crucial in these domains, highlighting the necessity of effective policy enforcement mechanisms. The Open Digital Rights Language (ODRL) is a W3C standard ontology designed to describe data usage policies, however, it lacks built-in enforcement capabilities, limiting its practical application. This paper introduces the Open Digital Rights Enforcement (ODRE) framework, whose goal is to provide ODRL with enforcement capabilities. The ODRE framework proposes a novel approach to express ODRL policies that integrates the descriptive ontology terms of ODRL with other languages that allow behaviour specification, such as dynamic data handling or function evaluation. The framework includes an enforcement algorithm for ODRL policies and two open-source implementations in Python and Java. The ODRE framework is also designed to support future extensions of ODRL to specific domain scenarios. In addition, current limitations of ODRE, ODRL, and current challenges are reported. Finally, to demonstrate the enforcement capabilities of the implementations, their performance, and their extensibility features, several experiments have been carried out with positive results.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"150 ","pages":"Article 104282"},"PeriodicalIF":4.8,"publicationDate":"2024-12-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143142802","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}