Search

Keywords Panoramic roaming; Digital museum; Audio-visual channel; Cognitive load; Eye-tracking Highlights * Eye-tracking, WP scale, Personal Meaning Map, and knowledge tests were jointly used to investigate the impact of the inclusion of the audio channel on user cognition in the panoramic digital museums. * The adoption of dual-channel audio-visual interaction increases the overall cognitive load on users. * Adding an audio channel has no positive effect on learning outcomes. * Suggestions are proposed to museum practitioners and platform developers. Abstract Multi-channel human-computer interaction offers a new perspective for optimization research in the digital museum, though there is no empirical evidence on how these factors affect cognition. This paper conducted a controlled experiment using the audio guide as a breakthrough point, aiming to determine the cognitive changes before and after the audio-visual dual-channel interaction. The results demonstrate that adding the auditory channel brought more cognitive load but not better cognitive outcomes. This paper evaluated the reasons behind it and noted that designing channels based solely on technical feasibility is undesirable, with suggestions proposed for museum practitioners and platform developers. Author Affiliation: (a) School of Information Management, Wuhan University, Luojia Hill, 430072, Wuhan, China * Corresponding author. Article History: Received 18 October 2021; Revised 5 April 2023; Accepted 9 April 2023 Byline: Xiaoyang He, Dan Wu [woodan@whu.edu.cn] (*)

Keywords Classical side-channel analysis framework; Access-driven cache attacks; Difference of means-based analysis; Vector distance-based analysis; Mutual information-based analysis; Guessing entropy Abstract Cryptographic devices are vulnerable to side-channel attacks, which have attracted broad attention in the hardware security field. The side-channel analysis framework proposed at Eurocrypt 2009 has been widely adopted in academia, containing key elements such as points of interest, leakage models, distinguishers, and security metrics. This classical framework, however, is not intuitively compatible with recent micro-architectural attacks such as cache attacks, therefore, few attempts have been made to link them. In this paper, we extend the classical side-channel analysis framework and migrate its ideas to access-driven cache attacks. We find that cache attacks can be effectively incorporated into this framework. Specifically, we propose a leakage model called cache access pattern vector according to the cache timing leakage characteristics. Furthermore, we propose data preprocessing schemes such as noise reduction, dimensionality reduction, and vector expansion to implement efficient attacks. Subsequently, we proposed seven distinguishers in three categories: difference of means-based analysis, vector distance-based analysis, and mutual information-based analysis. Moreover, we attacked the last round of the AES fast software implementation algorithm based on the Chipyard platform. According to the experimental results, all proposed methods can successfully extract the key, and five of them are comparable to mainstream cache analysis in attack efficiency. Finally, we evaluate the five efficient distinguishers under three different cache micro-architectures using guessing entropy. Based on the experimental environment of this paper, vector distance-based distinguishers have the best attack efficiency, and the difference of mean-based analysis has the worst. Surprisingly, the most general mutual information-based attacks can achieve excellent medium results in a few attack rounds without the help of static analysis tools. Meanwhile, the experimental results demonstrate that cache micro-architecture directly impacts the attack effect, in which the smaller cache line size benefits the attacks, while the random replacement policy increases the noise and difficulty of the attacks. Author Affiliation: (a) College of Cryptography Engineering, Information Engineering University, Zhengzhou 450001, China (b) College of Information Science and Electronic Engineering, Zhejiang University, Hangzhou 310027, China (c) College of Cyber Science and Technology, Zhejiang University, Hangzhou 310027, China * Corresponding author at: College of Cryptography Engineering, Information Engineering University, No. 62, Science Avenue, High-Tech Zone, Zhengzhou 450001, China. Article History: Received 8 October 2022; Revised 17 March 2023; Accepted 7 April 2023 Byline: Pengfei Guo [pfguo_hit@126.com] (a,b,*), Yingjian Yan (a), Fan Zhang (c), Chunsheng Zhu (a), Lichao Zhang (a), Zibin Dai (a)

Keywords Computer security; Secure hardware; Trusted execution environments; Hardware attacks; Software attacks; Side-channel attacks Abstract As the number of security and privacy attacks continue to grow around the world, there is an ever increasing need to protect our personal devices. As a matter of fact, more and more manufactures are relying on Trusted Execution Environments (TEEs) to shield their devices. In particular, ARM TrustZone (TZ) is being widely used in numerous embedded devices, especially smartphones, and this technology is the basis for secure solutions both in industry and academia. However, as shown in this paper, TEE is not bullet-proof and it has been successfully attacked numerous times and in very different ways. To raise awareness among potential stakeholders interested in this technology, this paper provides an extensive analysis and categorization of existing vulnerabilities in TEEs and highlights the design flaws that led to them. The presented vulnerabilities, which are not only extracted from existing literature but also from publicly available exploits and databases, are accompanied by some effective countermeasures to reduce the likelihood of new attacks. The paper ends with some appealing challenges and open issues. Author Affiliation: Network, Information and Computer Security (NICS) Lab, University of Malaga, Spain * Corresponding author. Article History: Received 16 November 2022; Revised 4 February 2023; Accepted 9 March 2023 Byline: Antonio Muñoz [amunoz@lcc.uma.es] (*), Ruben Ríos [ruben@lcc.uma.es], Rodrigo Román [roman@lcc.uma.es], Javier López [jlm@lcc.uma.es]

Keywords Cloud-native security; Container security; Vulnerability; Docker; Kubernetes; Istio; CNI Abstract Cloud-native systems have recently emerged as one of the most popular platforms for application development, providing lightweight virtualization, simplified DevOps procedures, scaling, resource efficiency, monitoring, and more. The typical cloud-native system may include containers, container orchestrators, and service meshes. However, a number of attacks exploit vulnerabilities in different components, leading the attacker to gain control over the cloud-native system. In this paper, we collect, classify, exploit, and mitigate vulnerabilities of different components. Firstly, we choose Docker, Kubernetes, and Istio as the most popular cloud technologies and give each an overview. Secondly, we give an in-depth analysis of the vulnerabilities. We collect cloud-native vulnerabilities over the past five years and propose two classifications of those vulnerabilities. One is based on the architecture of the component, and the other is based on the attack enabled. We exploit vulnerabilities that enable us to discover some insightful findings and provide mitigation solutions. Third, we analyze 15 open-source security tools provided for the cloud-native environment. We argue that among all these security tools, none of them covers all features which we will discuss in this paper. We believe that our analysis of cloud security vulnerabilities and open-source security tools can benefit the security of the cloud-native ecosystem. Author Affiliation: (a) Zhejiang University, China (b) Northwestern University, USA * Corresponding author. Article History: Received 23 May 2022; Revised 22 February 2023; Accepted 2 March 2023 Byline: Qingyang Zeng [qyzeng@zju.edu.cn] (a), Mohammad Kavousi [kavousi@u.northwestern.edu] (b), Yinhong Luo [22021181@zju.edu.cn] (a), Ling Jin [ljin1995@zju.edu.cn] (a), Yan Chen [ychen@northwestern.edu] (*,b)

Keywords User authentication; Roberta; Keystroke dynamics; Continuous authentication; Attention network Abstract With the rapid development of digitalization, information security becomes more and more important. User authentication is a significant line of defense. During the past few years, many research works concentrating on user authentication have been published. Traditional authentication techniques (password, ID card-based authentication, or other biometrics like fingerprint or iris) basically fall into the category of one-time authentication. The disadvantage of these methods is that once an unknown user completes an authentication through forgery, the system would continue to operate without any resistance, thus putting the entire system at risk. Recently, due to the prevalence of deep learning techniques, some researchers have applied learning-based models to user authentication. However, almost all existing methods only focus on keystroke dynamics while ignoring the 'text' entered by users during keystrokes. In this paper, we propose contents and keystroke dual attention networks with pre-trained models for continuous authentication. To the best of our knowledge, our paper is the first to address user-inputted 'text' during keystrokes as an important asset beyond traditional characteristic keystroke dynamics. Specifically, we use the well-known pre-trained RoBERTa model to capture textual features. Then, we pass textual features and conventional features through our proposed dual attention networks. Our networks fuse these features and acquire final representations. Experiments show that the CKDAN model achieves state-of-the-art performance on two datasets, Clarkson II keystroke dataset and Buffalo dataset, outperforming all baseline methods. Author Affiliation: (a) Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China (b) School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China (c) York University, Ontario, Canada (d) Jiangnan University, Wuxi, China * Corresponding author. Article History: Received 22 July 2022; Revised 18 February 2023; Accepted 21 February 2023 Byline: Haitian Yang [yanghaitian@iie.ac.cn] (a,b), Xiang Meng [mengxiang@iie.ac.cn] (b,*), Xuan Zhao [xuanzhao@eecs.yorku.ca] (c), Yan Wang [wangyan@iie.ac.cn] (a), Yuejun Liu [liuyuejun@jndxrwxy.wecom.work] (d), Xiaoyu Kang [kangxiaoyu@iie.ac.cn] (a), Jiahui Shen [shenjiahui@iie.ac.cn] (a), Weiqing Huang [huangweiqing@iie.ac.cn] (a,b)

Keywords Cyber ship; Cyber physical systems (CPS); STPA; Cyber risk assessment; STRIDE; CORAS Abstract The widespread use of software-intensive cyber systems in critical infrastructures such as ships (CyberShips) has brought huge benefits, yet it has also opened new avenues for cyber attacks to potentially disrupt operations. Cyber risk assessment plays a vital role in identifying cyber threats and vulnerabilities that can be exploited to compromise cyber systems. Understanding the nature of cyber threats and their potential risks and impact is essential to improve the security and resilience of cyber systems, and to build systems that are secure by design and better prepared to detect and mitigate cyber attacks. A number of methodologies have been proposed to carry out these analyses. This paper evaluates and compares the application of three risk assessment methodologies: system theoretic process analysis (STPA-Sec), STRIDE and CORAS for identifying threats and vulnerabilities in a CyberShip system. We specifically selected these three methodologies because they identify threats not only at the component level, but also threats or hazards caused due to the interaction between components, resulting in sets of threats identified with each methodology and relevant differences. Moreover, STPA-Sec, which is a variant of the STPA, is widely used for safety and security analysis of cyber physical systems (CPS); CORAS offers a framework to perform cyber risk assessment in a top-down approach that aligns with STPA-Sec; and STRIDE (Spoofing, Tampering, Repudiation,Information disclosure, Denial of Service, Elevation of Privilege) considers threat at the component level as well as during the interaction that is similar to STPA-Sec. As a result of this analysis, this paper highlights the pros and cons of these methodologies, illustrates areas of special applicability, and suggests that their complementary use as threats identified through STRIDE can be used as an input to CORAS and STPA-Sec to make these methods more structured. Author Affiliation: (a) Business Management Department, Oregon Institute of Technology, Klamath Falls, OR 97601, United states (b) Digitalization Group, Rigshospitalet, Denmark (c) Department of Applied Mathematics & Computer Science, Technical University of Denmark, Kgs. Lyngby, DK-2800, Denmark (d) DTU Management Engineering, Technical University of Denmark, DK-2800, Kgs. Lyngby, Denmark * Corresponding author. Article History: Received 15 December 2022; Revised 13 February 2023; Accepted 8 March 2023 Byline: Rishikesh Sahay [rishikesh.sahay@oit.edu] (a), D.A. Sepulveda Estay [daniel.alberto.sepulveda.estay@regionh.dk] (b), Weizhi Meng [weme@dtu.dk] (*,c), Christian D. Jensen [cdje@dtu.dk] (c), Michael Bruhn Barfod [mbba@dtu.dk] (d)

Keywords Reinforcement learning; Android malware detection; Feature selection; RNN; Sequence processing Highlights * This paper applied reinforcement learning algorithms to the feature selection phase of Android malware detection, reducing the burden of feature selection tasks. * This paper adopts Natural Language Processing methods to tackle the feature selection methods. * This paper presented a modifiable framework that can be easily ported to other feature selection tasks for malware detection. Abstract Due to the completely open-source nature of Android, the exploitable vulnerability of malware attacks is increasing. Machine learning, leading to a great evolution in Android malware detection in recent years, is typically applied in the classification phase. Since the correlation between features is ignored in some traditional ranking-based feature selection algorithms, applying wrapper-based feature selection models is a topic worth investigating. Though considering the correlation between features, wrapper-based approaches are time-consuming for exploring all possible valid feature subsets when processing a large number of Android features. To reduce the computational expense of wrapper-based feature selection, a framework named DroidRL is proposed. The framework deploys DDQN algorithm to obtain a subset of features which can be used for effective malware classification. To select a valid subset of features over a larger range, the exploration-exploitation policy is applied in the model training phase. The recurrent neural network (RNN) is used as the decision network of DDQN to give the framework the ability to sequentially select features. Word embedding is applied for feature representation to enhance the framework's ability to find the semantic relevance of features. The framework's feature selection exhibits high performance without any human intervention and can be ported to other feature selection tasks with minor changes. The experiment results show a significant effect when using the Random Forest as DroidRL's classifier, which reaches 95.6% accuracy with only 24 features selected. Author Affiliation: (a) College of Software Engineering, Sichuan University, Chengdu, China (b) School of Cyber Science and Engineering, Sichuan University, Chengdu, China (c) College of Computer Science, Sichuan University, Chengdu, China (d) School of Business, Sichuan University, Chengdu, China * Corresponding author. Article History: Received 21 September 2022; Revised 21 December 2022; Accepted 26 January 2023 Byline: Yinwei Wu (a), Meijin Li (a), Qi Zeng (c), Tao Yang (c), Junfeng Wang (c), Zhiyang Fang [fangzhiyang@scu.edu.cn] (*,b), Luyu Cheng (d)

Keywords Cyberspace security; Intrusion detection; Adversarial training; Machine learning; Generative adversarial networks Abstract Network Intrusion Detection Systems (IDS) have achieved high accuracy by widely applying Machine Learning (ML) models. However, most current ML-based IDSs can not cope with targeted attacks from adversaries because they are commonly trained and tested using fixed data sets. In this paper, we propose an Adversarial Intrusion Detection Training Framework (AIDTF) to improve the robustness of IDSs, which consists of an attacker model a-model, a defender model d-model, and a black-box trainer t-module. Both the a-model and d-model are multilayer perceptrons, and the t-module is the module used to train IDSs. AIDTF improves the accuracy of IDS by using an adversarial training method, which is different from traditional training methods. Taking the distribution of normal samples in the dataset as the distribution that the a-model and d-model need to learn, the goal of the a-model is to generate samples that deceive the d-model, while the goal of the d-model is to determine whether the input samples are real samples, so there is an adversarial relationship between a-model and d-model. Different types of IDSs can be trained by the t-module using the samples generated from the confrontation between the a-model and the d-model, and we call this kind of IDS the Adversarial Training Intrusion Detection System (ATIDS). The main contribution of this paper is to propose a training method that is used to obtain an IDS with high accuracy not only for known test sets but also to identify unknown disguised attack samples. We tested different types of ATIDSs using the current mainstream attack methods, which include the Fast Gradient Method, Fast Gradient Sign Method, Projected Gradient Descent, and Jacobs Saliency Map Algorithm. The experimental results prove that AIDTF outperforms other adversarial training methods with not only higher accuracy for the test set but also up to a 99% recognition rate for the attack samples. Author Affiliation: (a) School of Computer Science and Technology, Dongguan University Of Technology, GuangDong, China (b) School of Cyberspace Security, Dongguan University Of Technology, GuangDong, China * Corresponding author. Article History: Received 11 October 2022; Revised 2 February 2023; Accepted 13 February 2023 Byline: Wen Ding Xiong [xiongwending@hotmail.com] (a), Kai Lun Luo [luokl@dgut.edu.cn] (b), Rui Li [ruili@dgut.edu.cn] (*,b)

Keywords Portable executable; Malware detection; Machine learning; Adversarial machine learning; Deep learning; Adversarial attack Abstract Malware has been one of the most damaging threats to computers that span across multiple operating systems and various file formats. To defend against ever-increasing and ever-evolving malware, tremendous efforts have been made to propose a variety of malware detection that attempt to effectively and efficiently detect malware so as to mitigate possible damages as early as possible. Recent studies have shown that, on the one hand, existing machine learning (ML) and deep learning (DL) techniques enable superior solutions in detecting newly emerging and previously unseen malware. However, on the other hand, ML and DL models are inherently vulnerable to adversarial attacks in the form of adversarial examples, which are maliciously generated by slightly and carefully perturbing the legitimate inputs to misbehave. Adversarial attacks are initially studied in the domain of computer vision like image classification, and then quickly extended to other domains, including natural language processing, audio recognition, and even malware detection. In this paper, we focus on malware with the file format of portable executable (PE) in the family of Windows operating systems, namely Windows PE malware, as a representative case to study the adversarial attack methods in such adversarial settings. To be specific, we start by first outlining the general learning framework of Windows PE malware detection based on ML/DL and subsequently highlighting three unique challenges of performing adversarial attacks in the context of Windows PE malware. Then, we conduct a comprehensive and systematic review to categorize the state-of-the-art adversarial attacks against PE malware detection, as well as corresponding defenses to increase the robustness of Windows PE malware detection. Finally, we conclude the paper by first presenting other related attacks against Windows PE malware detection beyond the adversarial attacks and then shedding light on future research directions and opportunities. Author Affiliation: (a) Institute of Software, Chinese Academy of Sciences, Beijing, 100190, Beijing, China (b) Pinterest,New York, 10018, NY, USA (c) Zhejiang University of Science and Technology, Hangzhou, 310023, Zhejiang, China (d) Zhejiang University, Hangzhou, 310027, Zhejiang, China * Corresponding authors. Article History: Received 9 October 2022; Revised 19 December 2022; Accepted 4 February 2023 Byline: Xiang Ling [lingxiang@iscas.ac.cn] (a), Lingfei Wu [lwu@email.wm.edu] (b), Jiangyu Zhang [zhangjiangyu@zju.edu.cn] (d), Zhenqing Qu [quzhenqing@zju.edu.cn] (d), Wei Deng [dengwei@zju.edu.cn] (d), Xiang Chen [wasdnsxchen@gmail.com] (d), Yaguan Qian [qianyaguan@zust.edu.cn] (c), Chunming Wu [wuchunming@zju.edu.cn] (d), Shouling Ji [sji@zju.edu.cn] (d), Tianyue Luo [tianyue@iscas.ac.cn] (a), Jingzheng Wu [jingzheng08@iscas.ac.cn] (*,a), Yanjun Wu [yanjun@iscas.ac.cn] (*,a)

Keywords Survey; Microservices; Containers; Security; Cloud Abstract The adoption of microservice architecture is rapidly growing, involving industries of every size. Their ability to scale and reconstitute complex functionalities into small, cohesive, and interconnected components (the microservices), and their limited use of isolation contribute to this success. Unfortunately but unsurprisingly, these very factors enlarge the attack surface and increase the security risks of today's deployments. In this study, we performed a systematization of knowledge about the run-time security of microservices. Starting from a keyword search, we initially reviewed 807 papers available in digital libraries (e.g., Google Scholar and Scopus), which we filtered down to 48 by applying a number of selection criteria (e.g., the presence of a proof-of-concept implementation). We also considered over 30 industry tools that offer various security services for microservices. We categorized both papers and tools and highlighted areas where research is abundant, where it is lacking, and where it is misleading. We conclude that the run-time security of microservices is still in its infancy and we supplement our analyses with insights into addressing the key challenges. Author Affiliation: (a) Vrije Universiteit Amsterdam, Netherlands (b) University of Trento, Italy * Corresponding author. Article History: Received 11 September 2022; Revised 19 December 2022; Accepted 22 January 2023 (footnote)[white star] This work has received funding from the European Union under the H2020 grant 952647 (AssureMOSS). Byline: Francesco Minna [f.minna@vu.nl] (*,a), Fabio Massacci [fabio.massacci@ieee.org] (a,b)

Keywords Internet of things; DDoS attack; Botnet; Machine learning; Software defined network Abstract IoT offers capabilities to gather information from digital devices, infer from their results, and maintain and optimize these devices in different domains. IoT is heterogeneous in nature, which makes it prone to various security threats like confidentiality and integrity breaches, lack of availability of resources, trust issues, etc. The security concerns lead to different attacks over the system, and the Distributed Denial of Services (DDoS) bout is growing generously. DDoS is an assault that targets the availability of resources and servers of a network by flooding the communication medium from distinct locations by utilizing various IoT devices, which makes it harder to detect. Thus, analyzing and defending DDoS is a protruding field of research these days. The paper gives a thorough knowledge of DDoS over IoT. In this, we have critically analysed the existing DDoS variants, IoT Security issues, the execution of DDoS attempts, along with the exploitation of IoT devices and creation of them in Botnets or zombies. Moreover, the paper will also cover prevailing DDoS defense methodologies as well as their comparative analysis for ease of understanding. Author Affiliation: Computer Engineering Department, National Institute of Technology, Kurukshetra, India * Corresponding author. Article History: Received 4 January 2022; Revised 4 January 2023; Accepted 8 January 2023 Byline: Pooja Kumari [poojakumari.cse7@gmail.com] (*), Ankit Kumar Jain

Keywords Distributed query execution; Controlled data sharing; Authorization model; Relation profile; Cloud computing Abstract The availability of a multitude of data sources has naturally increased the need for subjects to collaborate for supporting distributed computations that combine different data collections for their elaboration and analysis. Due to the quick pace at which datasets grow, often the authorities collecting and owning such datasets resort to external third parties (e.g., cloud providers) for their storage and management. Data under the control of different authorities are autonomously encrypted (using different encryption schemes and keys) for their external storage. This makes distributed computations combining these sources difficult to support. In this paper, we propose an approach enabling collaborative computations over data encrypted in storage, selectively involving also subjects that might not be authorized for accessing the data in plaintext when their collaboration is considered economically convenient. We also consider the possible adoption of trusted hardware components, to enable the evaluation of operations over plaintext data at non-fully trusted computational providers. The experimental results confirm the economic benefits that can be enabled by our proposal. Author Affiliation: (a) Università degli Studi di Milano Via Celoria 18, Milano 20133 MI, Italy (b) George Mason University, 10401 York River Road, Fairfax, VA, 22030-4422, USA (c) Università degli Studi di Bergamo, Viale Marconi 5, Dalmine 24044 BG, Italy * Corresponding author. Article History: Received 13 April 2022; Revised 4 August 2022; Accepted 6 December 2022 (footnote)[white star] A preliminary version of this paper appeared under the title 'Distributed query evaluation over encrypted data,' in Proc. of the 35th Annual IFIP WG 11.3 Conference on Data and Applications Security and Privacy (DBSec 2021), Calgary, Canada, July 19-20, 2021 (). Byline: Sabrina De Capitani di Vimercati [sabrina.decapitani@unimi.it] (*,a), Sara Foresti [sara.foresti@unimi.it] (a), Sushil Jajodia [jajodia@gmu.edu] (b), Giovanni Livraga [giovanni.livraga@unimi.it] (a), Stefano Paraboschi [parabosc@unibg.it] (c), Pierangela Samarati [pierangela.samarati@unimi.it] (*,a)

Keywords Telecommunications; Consumer engagement; Retention offers; Behavior-based price discrimination Highlights * Telecommunications operators use behavior-base price discrimination strategies. * We analyze the effects of consumer engagement on prices in the Spanish telecommunications market. * Engaged consumers pay 9.4% less than unengaged consumers for their services. * The excess price paid by unengaged consumers increases as they contract premium television content. * The elderly are the more likely to be unengaged. Abstract This paper analyzes how customers' heterogeneous search and switching habits affect the prices paid for telecommunication services in a context in which operators use price discrimination strategies to retain their customers and attract those of their rivals. Drawing on a representative sample of Spanish households (N=3,113), we show that engaged consumers pay 9.4% less than completely unengaged consumers for their telecommunication services, after controlling for the characteristics of the bundle of services contracted. We also find that highly engaged consumers (i.e. those that have called their operator to obtain a better deal and who have switched to a different operator at least once) pay 13.6% less for their services than unengaged consumers, that consumers who have switched operator at least once pay 8.4% less, and that consumers who call their operator to request better conditions for their contracts pay 5.8% less. Finally, we show that the excess price paid by unengaged consumers increases as they contract more sophisticated services, such as premium television content and additional mobile lines. Author Affiliation: (a) Departament d'Economia and BEAT, Universitat de Barcelona, Spain (b) Department of Statistics and Knowledge Management, Comisión Nacional de los Mercados y la Competencia, Spain * Corresponding author. Article History: Received 25 March 2022; Revised 25 December 2022; Accepted 5 January 2023 (footnote) The opinions and analysis that appear in this paper are responsibility of the authors only and do not necessarily represent those of the CNMC. Joan Calzada acknowledges financial support from the Spanish Ministry of Science, Innovation and Universities (grant PID2021-128237OB-I00). Byline: Joan Calzada [calzada@ub.edu] (a,*), Begoña García-Mariñoso (b), David Suárez (b)

Keywords Situation awareness; Security operations center; Cyber security; Human performance System performance Abstract Situation awareness is shown through human factors research to be a valuable construct to understand and improve how humans perform while operating complex systems in critical environments. Within cyber security one such environment is the Security Operations Center (SOC). With the increasing threat of hybrid warfare, knowledge about situation awareness within SOC environments, where human error or low performance may be detrimental, must be developed. This paper reports on the results of a Systematic Descriptive Literature Review of the current research on situation awareness within SOCs. The goal of the paper is to analyze how situation awareness is understood in the current research. To achieve this goal three aspects of understanding were addressed: Theoretical foundations; levels of conceptualization; and measurement of situation awareness. Theoretical foundations in the literature were assessed by how situation awareness was defined and the presence of references to theoretical models of SA. The results show a clear trend of basing the research on Endsley's three level situation awareness model; this model has been developed into a domain specific formulation called 'Cyber Situation Awareness'. Some parts of the literature, particularly in research aimed at developing tools for improving situation awareness, lack a theoretical foundation; some refer to alternative theoretical foundations of situation awareness like Stanton et al.'s Distributed Situation Awareness. Further, a balance between conceptualizations on the individual, group and system level has been identified. Within research aimed at developing tools for improving situation awareness there are some examples of specialized and precise measurements of situation awareness, but in general the research seems too reliant on indirect measures of situation awareness. The paper concludes with the proposition of connecting the systems-based theoretical perspective of distributed situation awareness into the research, utilizing a systems level conceptualization of situation awareness. This might prove to be a useful bridge between the human cognitive perspective of situation awareness and the development of the complex technical environment of critical importance that SOCs represent. Abbreviations HFR, Human Factors Research; SA, Situation Awareness; ISA, Individual Situation Awareness; DSA, Distributed Situation Awareness; SSA, Shared Situation Awareness; CSA, Cyber Situation Awareness Author Affiliation: Department of Information Security and Communication Technology, Norwegian University of Science and Technology, Gjøvik 2802, Norway * Corresponding author. Article History: Received 17 October 2022; Revised 12 December 2022; Accepted 15 December 2022 (footnote) This work was supported by the Research Council of Norway under Project nr 333900 'Situation awareness in virtual security operations centers' and Project nr 310105 'Norwegian Centre for Cyber Security in Critical Sectors (NORCICS)'. Byline: Håvard Jakobsen Ofte [havard.ofte@ntnu.no] (*), Sokratis Katsikas [sokratis.katsikas@ntnu.no]