This paper reports on a trade study we performed to support the development of a Cyber ontology from an initial malware ontology. The goals of the Cyber ontology effort are first described, followed by a discussion of the ontology development methodology used. The main body of the paper then follows, which is a description of the potential ontologies and standards that could be utilized to extend the Cyber ontology from its initially constrained malware focus. These resources include, in particular, Cyber and malware standards, schemas, and terminologies that directly contributed to the initial malware ontology effort. Other resources are upper (sometimes called 'foundational') ontologies. Core concepts that any Cyber ontology will extend have already been identified and rigorously defined in these foundational ontologies. However, for lack of space, this section is profoundly reduced. In addition, utility ontologies that are focused on time, geospatial, person, events, and network operations are briefly described. These utility ontologies can be viewed as specialized super-domain or even mid-level ontologies, since they span many, if not most, ontologies -including any Cyber ontology. An overall view of the ontological architecture used by the trade study is also given. The report on the trade study concludes with some proposed next steps in the iterative evolution of the

/pdf/developing-an-ontology-of-the-cyber-security-domain-do0g05yco6.pdf

Developing an Ontology of the Cyber Security Domain.

The trustworthiness of an industrial Internet of Things (IIoT) network is an important stakeholder expectation. Maintaining the trustworthiness of such a network is crucial to void the loss of lives. A trustworthy IIoT system combines the security characteristics of IT trustworthiness—safety, security, privacy, reliability, and resilience. Conventional security tools and techniques are not enough to safeguard the IIoT platform due to the difference in protocols, limited upgrade opportunities, mismatch in protocols, and older versions of the operating system used in the industrial system. In this article, we propose to improve the trustworthiness of an IIoT network [i.e., supervisory control and data acquisition (SCADA) network] through a reliable and salable cyberattack detection model. In particular, an ensemble-learning model based on the combination of a random subspace (RS) learning method with random tree (RT) is proposed for detecting cyberattacks of SCADA by using the network traffics from the SCADA-based IIoT platform. The novelty of the proposed model is that it uses the industrial protocol-based network traffic and the RS to solve the sensitivity of irrelevant features and ensemble RT to reduce the overfitting problem, thereby constructs a detection engine based on industrial protocols and achieves high detection rates. The proposed model has been tested over 15 datasets of the SCADA network. Experimental results reveal that the proposed model outperforms conventional detection techniques and, thus, improves the security and related measure of the trustworthiness of the IIoT platform.

Increasing the Trustworthiness in the Industrial IoT Networks Through a Reliable Cyberattack Detection Model

An executable file is loaded into memory. The executable file is analyzed to determine whether one or more dynamically linked libraries are referenced in an import table of the file. It can then be determined whether one or more dynamically linked libraries is adapted to contact a network

Segregating executable files exhibiting network activity

In the 4 decades since offender profiling (OP) was established, hundreds of journal articles, books, book chapters, reports, and magazine articles have been published on the topic, and the technique has been used by countless law enforcement agencies around the globe. However, despite the popularity and extensive literature published on OP, very little is known about its evolution, current state, or findings of the field to date. Therefore, this study presents a systematic review and meta-analysis of 426 publications on OP from 1976 through 2016. Results of this systematic review suggest that there have been considerable improvements in the scientific rigor and self-assessment being conducted in the discipline, although in total, few studies have used a strong empirical approach to develop new profiles. Even fewer evaluations of the effectiveness of OP have been conducted. The first summary of offender profiles proposed for major crimes in OP literature is also presented, with results indicating some recurrent themes in profiles, but wide variations in the number, name, and description of the profiles often found. A meta-analysis of case linkage analysis research indicates that this area is statistically sophisticated, and has yielded moderate to strong accuracy rates for linking crimes to a single offender. Finally, the first analysis of the most prolific authors, researchers, departments, and outlets for OP research, and the methods, approach, and most cited publications in OP are identified. Suggestions for future research on OP and the potential impact that this may have on policy and practice are also discussed. (PsycINFO Database Record (c) 2018 APA, all rights reserved).

What have we learned from offender profiling? A systematic review and meta-analysis of 40 years of research.

Smart grids are a type of complex cyber–physical system (CPS) that integrates the communication capabilities of smart devices into the grid to facilitate remote operation and control of power systems. However, this integration exposes many existing vulnerabilities of conventional supervisory control and data acquisition (SCADA) systems, resulting in severe cyber threats to the smart grid and potential violation of security objectives. Stealing sensitive information, modifying firmware, or injecting function codes through compromised devices are examples of possible attacks on the smart grid. Therefore, early detection of cyberattacks on the grid is crucial to protect it from sabotage. Machine learning (ML) methods are conventional approaches for detecting cyberattacks that use features of smart grid networks. However, developing an effective, highly accurate detection method with reduced computational overload, is still a challenging research problem. In this work, an efficient and effective security control approach is proposed to detect cyberattacks on the smart grid. The proposed approach combines both feature reduction and detection techniques to reduce the extremely large number of features and achieve an improved detection rate. A correlation-based feature selection (CFS) method is used to remove irrelevant features, improving detection efficiency. An instance-based learning (IBL) algorithm classifies normal and cyberattack events using the selected optimal features. This study describes a set of experiments conducted on public datasets from a SCADA power system based on a 10-fold cross-validation technique. Experimental results show that the proposed approach achieves a high detection rate based on a small number of features drawn from SCADA power system measurements.

A robust cyberattack detection approach using optimal features of SCADA power systems in smart grids

To ameliorate the quality of protection provided by intrusion detection systems (IDS) we strongly need more effective evaluation and testing procedures. Evaluating an IDS against all known and unknown attacks is probably impossible. Nevertheless, a sensible selection of representative attacks is necessary to obtain an unbiased evaluation of such systems. To overcome the problem of an unmanageably large set of possible inputs, software testers usually divide the data input domain into categories (or equivalence classes), and select representative instances from each category as test cases. We believe that the same principle could be applied to IDS testing if we have a reasonable classification. In this paper we make a thorough analysis of existing attack classifications in order to determine whether they could be helpful in selecting attack test cases. Then, we construct a new scheme to classify attacks relying on those attributes that appear to be the best classification criteria.

/pdf/defining-categories-to-select-representative-attack-test-104dfdgq0t.pdf

Defining categories to select representative attack test-cases

In this paper, we describe a detailed approach to develop a botnet detection system using machine learning (ML) techniques. Detecting botnet member hosts, or identifying botnet traffic has been the main subject of many research efforts. This research aims to overcome two serious limitations of current botnet detection systems: First, the need for Deep Packet Inspection-DPI and the need to collect traffic from several infected hosts. To achieve that, we have analyzed several botware samples of known botnets. Based on this analysis, we have identified a set of statistical features that may help to distinguish between benign and botnet malicious traffic. Then, we have carried several machine learning experiments in order to test the suitability of ML techniques and also to pick a minimal subset of the identified features that provide best detection. We have implemented our approach in a tool called BotCap whose test results showed its proven ability to detect individually infected hosts in a local network.

https://ijcnis.org/index.php/ijcnis/article/download/3624/323

BotCap: Machine Learning Approach for Botnet Detection Based on Statistical Features

With the massive surges of new malware, the intuitive detection techniques currently used in most security tools deem ineffective. Consequently, we urgently need better solutions that are established on solid theoretical basis. It becomes, thus, necessary to search for more efficient techniques and algorithms as well as taxonomies and models for attacks and malware. We present, in this paper, the analysis we made on both automatic malware and human-centric attacks, which allowed us to construct a model for attack process. The main objective of this work is to construct a model that can aide in the generation of real attack scenarios and use it in the evaluation of Intrusion Detection Systems. However, the model described here could have many other potential uses. For example, it can be used for writing "execution- based" signatures, event correlation, penetration testing, security simulations as well as security educations.

Execution Patterns in Automatic Malware and Human-Centric Attacks

The calibration of resistances was being performed manually at National Institute of Standards (NIS), Egypt till now. In this paper, a fully automated system for the remote calibrations of resistances is described. This sytem is mainly used for routine calibrations for low precision calibrations. The calibration of many resistors can be performed in this system automatically through the Resistors Automatic Changer which is controlled by a LabVIEW program developed and described in the present research work. Not only these calibrations of resistances are performed automatically but are also controlled remotely via an internet connection. Some simple remote and automated resistance measurements are carried out just to confirm our new measuring system.

Mohammed S. Gadelrab

Papers

Defining categories to select representative attack test-cases

BotCap: Machine Learning Approach for Botnet Detection Based on Statistical Features

Execution Patterns in Automatic Malware and Human-Centric Attacks

Construction and remote calibration of an automated resistance measuring system

Towards a new generation of digital calibration certificate: Analysis and survey