Search

The "Glossary" from the Adelphi Series provides definitions of key terms related to cybersecurity and cyber operations. It covers concepts such as botnets, cyber espionage, malware, and denial-of-service attacks, offering insights into the terminology used in the field. The document also explains terms like dark web, phishing, and Stuxnet, shedding light on complex cyber issues for readers conducting research on cybersecurity and digital technology. [Extracted from the article]

The article offers information on the rapid progress in developing generalist AI systems and the potential risks associated with their autonomy. Topics include the race among companies to create AI systems that surpass human abilities; the increasing investment in AI capabilities and efficiency; and the potential for AI to amplify social harms and pose control challenges.

The article highlights Professor Gene Spafford's tribute to William H. Murray, a pioneering figure in cybersecurity, emphasizing Murray's influential role and impact on the field. Topics discussed include Murray's advocacy for policy over technology, his management of consulting company IBM's security programs, and his significant contributions to professional ethics and education in cybersecurity.

Computer worms perform harmful tasks in network systems due to their rapid spread, which leads to harmful consequences on system security. However, existing worm detection algorithms are still suffered a lot to achieve good performance. The reasons for that are: First, a large number of irrelevant data impacts classification accuracy (irrelevant feature gives estimator new ways to go wrong without any expected benefit also can cause overfitting, which will generally lead to decreased accuracy). Second, the individual classifiers used extensively in the systems do not effectively detect all types of worms. Third, many systems are built based on old datasets, making them less suitable for new types of worms. The research aims to detect computer worms in the network based on data mining algorithms for their high ability to automatically and accurately detect new types of computer worms. The proposal uses misuse and anomaly detection techniques based on the UNSW_NB15 dataset to train and test the ensemble Ada Boosting algorithm using SVM and DT classifiers. To select the most important features, we propose to conduct the similar features selected by Correlation and Chi-Square feature selection (since correlation finds the relations between features and classes whereas Chi finds whether features and classes are independent or not). The contribution suggests using SVM in the boosting ensemble algorithm as base estimators instead of DT to efficiently detect various types of worms. The system achieved accuracy, reaching 100% with CFS+Chi2fs and 99.38, 99.89 with correlation and chi-square separately.

In order to prevent the propagation of computer worms effectively, based on the latent character of worms, the exposed compartments of computer and USB device are introduced respectively, and a series of computer worm propagation models with saturation incidence rate are proposed. The qualitative behavior of the proposed model is studied. Firstly, the threshold R0 of the model is derived by using the next-generation matrix method, which completely characterized the stability of disease free equilibrium and endemic equilibrium. If R0 < 1, the disease free equilibrium is asymptotically stable, implying that the worm dies out eventually and its attack remains under control; if R0 > 1, the asymptotic stability of endemic equilibrium under certain conditions is proved, which means that the worm is always persistent and uncontrollable under such conditions. Secondly, the theoretical results are verified by numerical study, in which the relative importance of each parameter in worm prevalence is evaluated by sensitivity analysis. Finally, so as to minimize the number of computer and USB device carrying computer worms in short span of time, the worm propagation model is extended to incorporate three control strategies. The Pontryagin’s maximum principle is used to characterize the controls’ optimal levels. According to the control effect diagram, the combined strategy is effective in minimizing the transmission dynamics of worm virus in computer and USB devices populations respectively.

Recently, diffusion processes in social networks have attracted increasing attention within computer science, marketing science, social sciences, and political science. Although the majority of existing works focus on maximizing the reach of desirable diffusion processes, we are interested in deploying a group of monitors to detect malicious diffusion processes such as the spread of computer worms. In this work, we introduce and study the (α , β) -Monitoring Game} on networks. Our game is composed of two parties an attacker and a defender. The attacker can launch an attack by distributing a limited number of seeds (i.e., virus) to the network. Under our (α , β) -Monitoring Game, we say an attack is successful if and only if the following two conditions are satisfied: (1) the outbreak/propagation reaches at least α individuals without intervention, and (2) it has not been detected before reaching β individuals. Typically, we require that β is no larger than α in order to compensate the reaction delays after the outbreak has been detected. On the other end, the defender's ultimate goal is to deploy a set of monitors in the network that can minimize attacker's success ratio in the worst-case. (We also extend the basic model by considering a noisy diffusion model, where the propagation probabilities on each edge could vary within an interval.) Our work is built upon recent work in security games, our adversarial setting provides robust solutions in practice. Summary of Contribution: Although the diffusion processes in social networks have been extensively studied, most existing works aim at maximizing the reach of desirable diffusion processes. We are interested in deploying a group of monitors to detect malicious diffusion processes, such as the spread of computer worms. To capture the impact of model uncertainty, we consider a noisy diffusion model in which the propagation probabilities on each edge could vary within an interval. Our work is built upon recent work in security games; our adversarial setting leads to robust solutions in practice. [ABSTRACT FROM AUTHOR]

Computer worms are serious threats to Internet security and have caused billions of dollars of economic losses during the past decades. In this study, we implemented a susceptible–infected–recovered–dead (SIRD) model of computer worms and analyzed the characteristics and mechanisms of worm transmission. We applied the ordinary differential equation model to simulate the transmission process of computer worms and estimated the unknown parameters of the SIRD model through the methods of least squares, Markov chain Monte Carlo, and ensemble Kalman filtering (ENKF). The results reveal that the proposed SIRD model is more accurate than the susceptible–exposed–infected–recovered–susceptible model with respect to parameter estimation. [ABSTRACT FROM AUTHOR]

It is possible to produce mobile phone worms, which are computer viruses with the ability to command the running of cell phones by taking advantage of their flaws, to be transmitted from one device to the other with increasing numbers. In our day, one of the services to gain currency for circulating these malignant worms is SMS. The distinctions of computers from mobile devices render the existing propagation models of computer worms unable to start operating instantaneously in the mobile network, and this is particularly valid for the SMS framework. The susceptible--affected--infectious--suspended--recovered model with a classical derivative (abbreviated as SAIDR) was coined by Xiao et al., (2017) in order to correctly estimate the spread of worms by means of SMS. This study is the first to implement an Atangana--Baleanu (AB) derivative in association with the fractional SAIDR model, depending upon the SAIDR model. The existence and uniqueness of the drinking model solutions together with the stability analysis are shown through the Banach fixed point theorem. The special solution of the model is investigated using the Laplace transformation and then we present a set of numeric graphics by varying the fractional-order q with the intention of showing the effectiveness of the fractional derivative. [ABSTRACT FROM AUTHOR]

The problem of attack detection for Stuxnet in the industrial control system is discussed in this article. Different operating modes (normal and hazard modes) may occur in the nominal process. In this article, we consider that the transition between different modes follows a Markov chain model with a certain transition probability. However, when the Stuxnet attack is launched, the attack signals with random multitude and frequency will be injected to trigger more hazard modes, and finally, hasten fatigue of control devices. Under this unpredictable attack, the transition between operating modes will not follow the regular transition probabilities. Therefore, a hidden Markov model with time-varying transition probabilities is utilized to describe the Stuxnet attack. The transition probabilities are estimated based on the measurements. By recognizing operating modes and predicting the number of the occurrence of hazard modes, the Stuxnet attack can be detected earlier if the predicted value exceeds the threshold. In the operating mode recognition, the expectation maximization algorithm is used to estimate the parameters considering random packet dropouts caused by the unreliable network. A simulation is conducted to verify the effectiveness of the proposed method. [ABSTRACT FROM AUTHOR]

Advanced persistent threat campaigns employ sophisticated strategies and tactics to achieve their attack goal. [ABSTRACT FROM AUTHOR]

This paper studies the dynamic behaviour of a computer worm system under a discontinuous control strategy. Some conditions for globally asymptotically stable solutions of the discontinuous system are obtained by using the Bendixson-Dulac theorem, Green's formula, and the Lyapunov function. It is found that the solutions of the controlled computer worm system can converge to either of two local equilibrium points or the sliding equilibrium point on the discontinuous surface. It is shown that a threshold control strategy can effectively control the spread of computer viruses. The research results may be applicable to control other types of virus systems. [ABSTRACT FROM AUTHOR]

This paper discusses computer worm detection using machine learning. More specifically, the generalization capability of autoencoders is investigated and improved using regularization and deep autoencoders. Models are constructed first without autoencoders and thereafter with autoencoders. The models with autoencoders are further improved using regularization and deep autoencoders. Results show an improved in the capability of models to generalize well to new examples. [ABSTRACT FROM AUTHOR]

With the advent of Industry 4.0 (I4.0), traditional operational-technology and IT systems converge, entailing novel attack vectors. However, I4.0 technologies might also contribute to industrial security. Digital Twins are virtual entities of physical industrial systems that offer opportunities for security, such as simulation and replication of system behavior. [ABSTRACT FROM AUTHOR]

Considering the important issue of computer infections by worms spread via networks, the theme of source identification has been a prominent research field that aims at investigating infection propagation including acquiring knowledge about the infection and the node removal times when a worm infection happens. This information helps in identifying the patient zero in the worm attack and may be used by computer forensic investigators and network administrators to spot the culprits and to identify related network vulnerabilities. In this paper, we tackle this problem by developing new probabilistic models based on Bayesian networks. We learn a probability distribution to calculate, at every time step, the probability that each node is infected by a scanning worm, using historical data and features extracted from the network and application layers. With the mentioned probability distribution, the node infection status can be inferred using feature values at each time step. We propose a four‐step method to investigate the time of infection and removal of each node probabilistically. First, features are extracted and derived from network traffic data. There are no suitable training and test datasets publicly available for our tests; therefore, we developed the training and test datasets using simulations of the Code Red II worm. Second, a prior model is built using training data. Third, the probabilistic model is built by the estimation of distribution algorithm. Fourth, the infection probability of nodes is inferred given the probability distribution and feature values at each time step. It has already been shown that the number of infectious nodes can be probabilistically approximated backward in time through the stochastic Back‐to‐Origin Markov model. We combine our first model with the prior stochastic Back‐to‐Origin Markov model to develop our second model. To evaluate our first and second models, we conducted experiments that show that these models can pinpoint the source node and the infection time of nodes with acceptable accuracy. It should be noted that our method could be employed with other propagating worm types including ransomware worms. [ABSTRACT FROM AUTHOR]

Recent cybersecurity incidents such as Stuxnet and Irongate alert us to the threats faced by critical cyber-physical systems. These attacks compromise the control signals to push the system to unsafe regions and meanwhile, inject fake sensor measurements to cover the ongoing attack. Detecting these Stuxnet-like (SL) attacks still remains an open research issue. This paper analyzes the taxonomy, construction, and implication of SL attacks in CPS control loops. We propose to apply the moving target defense (MTD) approach that actively changes the system configuration to detect SL attacks, since these attacks are generally constructed based on the knowledge about the system’s configuration. We analyze the basic conditions for MTD to be successful. Finally, as a case study, we apply MTD for the secondary voltage control of power grids and present simulation results based on the IEEE 39-bus test system under realistic settings. [ABSTRACT FROM AUTHOR]

Systems of wormlike particles are studied by molecular dynamics computer simulations in the isotropic phase. The particles are modeled as a chain of nine soft repulsive, partially overlapping, spherical sites. These particles are characterized by a varying degree of internal flexibility: from very stiff and rodlike to very deformable and stringlike. Their self-diffusion coefficients have been evaluated at many thermodynamic conditions. Maintaining the temperature constant and sufficiently low, from the stiff rod case and letting the worms become more flexible, the self-diffusion coefficients first steeply increase, then reach a plateau. This behavior is rationalized in terms of local nematic domains. The presence of the latter significantly affects the equation of state of the wormlike particles as well, with the density of the stiffest rods being, respectively, the highest at lower temperatures and the lowest at higher temperatures. This fact might have significant implications for the theory of liquid-crystalline phase behavior in systems of flexible particles. If the density of all systems is fixed at the equilibrium value of the stiffest case, which is a way to single out the effects of flexibility, self-diffusion coefficients may exhibit a moderately nonmonotonic behavior: subsequently to the above-mentioned steep increase, they may reveal a shallow maximum for intermediate degrees of internal flexibility degrees, then gently decrease. This behavior is tentatively associated with the different effects that internal flexibility has on the average length and width of a wormlike particle. [ABSTRACT FROM AUTHOR]

In this paper, we have formulated an e-epidemic energy efficient susceptible-infected--terminally infected-recovered (SITR) model to analyse the attacking behaviour of worms in wireless sensor network (WSN) using cyrtoid type functional response. In this model, once a sensor node has been attacked by the worms, the terminally infected node spreads the worms to its neighbouring nodes using normal communications, which further spread it to their neighbouring nodes and the process continues. To tackle this issue, we proposed an SITR model by considering the sleep mode concept of WSN in which the operational capabilities and power consumption of the motes decreases. Boundedness, existence of equilibrium points, stability and bifurcation analysis are analysed for the proposed model system. Stability and direction of Hopf-bifurcation are also obtained for endemic equilibrium point using center manifold theorem. Finally, numerical simulations are carried out that supports the analytical findings. The impact of the control parameters like transmission rate (β), inter-nodes interference coefficient (θ1) and intrinsic growth rate (r1) on the dynamics of the model system are investigated. [ABSTRACT FROM AUTHOR]

The article discusses the threat of cyber terrorism and presents suggestions on dealing with it. It refers to some of the many difficulties faced by the international legal community in formulating a response to cyber terrorism including the lack of an agreed definition on acts or conduct to be included in the term cyber terrorism and disagreement across the international community on actions against acts that would amount to terrorism. It mentions instances such as the TV5Monde attack that constitute interference in the domestic affairs of another state and are clearly governed by international law.

Predators, a class of programs that can travel over Internet, and replicate and multiply themselves, are specifically designed to eliminate the computer viruses. To better understand the effects of predators on virus propagation, a model described the coevolution between viruses and predators is proposed. This model has one virus-free equilibrium and two potential viral equilibria. The existence and global stability of these equilibria are fully studied. Furthermore, the optimal solution to control virus propagation is obtained by using Pontryagin's minimum principle. And some numerical experiments are carried out to verify the theoretical results. From the obtained results it can be deduced that predators are quite effective in preventing the widely propagation of viruses with extremely high infection rate. [ABSTRACT FROM AUTHOR]

In the field of computer virus, a growing number of mathematical models have been published during the last decade. In this paper, we consider several estimation methods under two parametric models, the random constant scanning model and the nonhomogeneous random scanning model, to propose a comparison of the estimators’ performances based on the simulation of random populations. We conclude our work with an application of the different estimation methods to a real data set of worm propagation. [ABSTRACT FROM AUTHOR]

P2P file-sharing networks allow peers (computers) to download files and make them available to other users on the network. The fear of downloading worm file is a reasonable reason to discourage users to utilize P2P file-sharing networks. So, peers may hesitate to open the downloaded files due to the concern of receiving poisoned files or being compromised by malwares. In this article, we present a model of spread of passive worm in P2P file-sharing networks, where susceptible peers which were already infected before, are reluctant to open new downloaded files. Here, we address this issue by introducing a modified SEIS model, where λe (average rate at which exposed peer opens a downloaded file) decreases with the number of reinfections n for a maximum of ℓ times (λe(n+1) = 휖λe(n)where 0<휖<1represents the hesitation value). Hence, for a susceptible peer which was already infected by the worm, the hesitation to open a new downloaded file is quantified by the two parameters (휖,ℓ). We studied numerically the effects of various system parameters on the time evolution of the peer states. At steady state and for every value of ℓ, there exists a critical value 휖c below which the system is infection-free. A phase diagram in the plane (휖,ℓ) is constructed that shows which phases are present according to the state variables. In addition, we introduced and evaluated the effect of different patch-based immunization strategies to show how they could block the spread of the worm in the system. The immunization patch is launched in the network at a time tl and will be out of order at a time tf (i.e. outdated patch). We found that the parameters (tl,tf, 휖) are very important to be defined when developing the immunization patch. [ABSTRACT FROM AUTHOR]

In a cybersecurity operations center (CSOC), under normal operating conditions in a day, sufficient numbers of analysts are available to analyze the amount of alert workload generated by intrusion detection systems (IDSs). For the purpose of this paper, this means that the cybersecurity analysts can fully investigate each and every alert that is generated by the IDSs in a reasonable amount of time. However, there are a number of disruptive factors that can adversely impact the normal operating conditions such as (1) higher alert generation rates from a few IDSs, (2) new alert patterns that decreases the throughput of the alert analysis process, and (3) analyst absenteeism. The impact of all the above factors is that the alerts wait for a long duration before being analyzed, which impacts the readiness of the CSOC. It is imperative that the readiness of the CSOC be quantified, which in this paper is defined as the level of operational effectiveness (LOE) of a CSOC. LOE can be quantified and monitored by knowing the exact deviation of the CSOC conditions from normal and how long it takes for the condition to return to normal. In this paper, we quantify LOE by defining a new metric called total time for alert investigation (TTA), which is the sum of the waiting time in the queue and the analyst investigation time of an alert after its arrival in the CSOC database. A dynamic TTA monitoring framework is developed in which a nominal average TTA per hour (avgTTA/hr) is established as the baseline for normal operating condition using individual TTA of alerts that were investigated in that hour. At the baseline value of avgTTA/hr, LOE is considered to be ideal. Also, an upper-bound (threshold) value for avgTTA/hr is established, below which the LOE is considered to be optimal. Several case studies illustrate the impact of the above disruptive factors on the dynamic behavior of avgTTA/hr, which provide useful insights about the current LOE of the system. Also, the effect of actions taken to return the CSOC to its normal operating condition is studied by varying both the amount and the time of action, which in turn impacts the dynamic behavior of avgTTA/hr. Results indicate that by using the insights learnt from measuring, monitoring, and controlling the dynamic behavior of avgTTA/hr, a manager can quantify and color-code the LOE of the CSOC. Furthermore, the above insights allow for a deeper understanding of acceptable downtime for the IDS, acceptable levels for absenteeism, and the recovery time and effort needed to return the CSOC to its ideal LOE. [ABSTRACT FROM AUTHOR]

With rapid development of Internet, network security issues become increasingly serious. Temporary patches have been put on the infectious hosts, which may lose efficacy on occasions. This leads to a time delay when vaccinated hosts change to susceptible hosts. On the other hand, the worm infection is usually a nonlinear process. Considering the actual situation, a variable infection rate is introduced to describe the spread process of worms. According to above aspects, we propose a time-delayed worm propagation model with variable infection rate. Then the existence condition and the stability of the positive equilibrium are derived. Due to the existence of time delay, the worm propagation system may be unstable and out of control. Moreover, the threshold τ0 of Hopf bifurcation is obtained. The worm propagation system is stable if time delay is less than τ0. When time delay is over τ0, the system will be unstable. In addition, numerical experiments have been performed, which can match the conclusions we deduce. The numerical experiments also show that there exists a threshold in the parameter a, which implies that we should choose appropriate infection rate β(t) to constrain worm prevalence. Finally, simulation experiments are carried out to prove the validity of our conclusions. [ABSTRACT FROM AUTHOR]

In this article, an in-depth analysis is provided for seven of the most advanced malware evasion behaviors that are both pervasive in the wild and continue to pose a serious challenge to detection tools. The analysis is a summary of the information gained in our malware research labs where we have continually observed new evasion techniques being implemented. The results of the analysis show that in the race between malware, the most dynamic opponent will win. [ABSTRACT FROM AUTHOR]

A delayed SEIQRS worm propagation model with different infection rates for the exposed computers and the infectious computers is investigated in this paper. The results are given in terms of the local stability and Hopf bifurcation. Sufficient conditions for the local stability and the existence of Hopf bifurcation are obtained by using eigenvalue method and choosing the delay as the bifurcation parameter. In particular, the direction and the stability of the Hopf bifurcation are investigated by means of the normal form theory and center manifold theorem. Finally, a numerical example is also presented to support the obtained theoretical results. [ABSTRACT FROM AUTHOR]

A computer worm is a self-replicating malicious code that does not alter files but resides in active memory where it duplicates itself. Worms use parts of the operating system that are automatic and usually invisible to the user. Worms commonly exhibit abnormal behaviors, which become noticeable only when their uncontrolled replication consumes system resources and consequently decelerates or halts other tasks completely. This paper proposes an effective approach for detecting the presence of TCP network worms. This approach consists of two phases: Statistical Cross-relation for Network Scanning (SCANS) phase and the Worm Correlation phase. The SCANS phase is used to detect the presence of the network scanning behavior of a network worm, while the worm correlation phase is used to detect the Destination Source Correlation (DSC) behavior of the network worm. The proposed approach has been tested with a simulated dataset obtained from the GTNetS simulator. The numerical results showed that the proposed approach is efficient and outperforms the well-known DSC approach in terms of detecting the presence of TCP network worm. [ABSTRACT FROM AUTHOR]

Nowadays, malware is the most important threat to information security. In this sense, several mathematical models to simulate malware spreading have appeared. They are compartmental models where the population of devices is classified into different compartments: susceptible, exposed, infectious, recovered, etc. The main goal of this work is to propose an improved SEIRS (Susceptible–Exposed–Infectious–Recovered–Susceptible) mathematical model to simulate computer worm propagation. It is a continuous model whose dynamic is ruled by means of a system of ordinary differential equations. It considers more realistic parameters related to the propagation; in fact, a modified incidence rate has been used. Moreover, the equilibrium points are computed and their local and global stability analyses are studied. From the explicit expression of the basic reproductive number, efficient control measures are also obtained. [ABSTRACT FROM AUTHOR]

Intrusion is the primary step to conduct various kinds of network attacks. Most of the intrusion detection and intrusion prevention systems (IDPS) that make use of signature can detect only known attacks, but cannot save resources from new form of attacks like internet worms. Thus, it is necessary to collect information about unknown intrusion dynamically. Honeypots are useful security mechanism that deliberately lure intruders to probe, attack or compromise the systems. This paper presents an agent based honeymesh for protecting the network resources like servers from intrusion related attacks. In our strategy, agent programs make use of decoyports to lure intruders and redirects to honeymesh to understand attackers' activities. Also, the agents remove malicious processes and executable files on compromised server as soon as honeypots alerts those intrusions. This novel defense mechanism detects and removes new kinds of internet worms without using signatures. [ABSTRACT FROM AUTHOR]

Fraudulent behaviors in Google Play, the most popular Android app market, fuel search rank abuse and malware proliferation. To identify malware, previous work has focused on app executable and permission analysis. In this paper, we introduce FairPlay, a novel system that discovers and leverages traces left behind by fraudsters, to detect both malware and apps subjected to search rank fraud. FairPlay correlates review activities and uniquely combines detected review relations with linguistic and behavioral signals gleaned from Google Play app data (87 K apps, 2.9 M reviews, and 2.4M reviewers, collected over half a year), in order to identify suspicious apps. FairPlay achieves over 95 percent accuracy in classifying gold standard datasets of malware, fraudulent and legitimate apps. We show that 75 percent of the identified malware apps engage in search rank fraud. FairPlay discovers hundreds of fraudulent apps that currently evade Google Bouncer's detection technology. FairPlay also helped the discovery of more than 1,000 reviews, reported for 193 apps, that reveal a new type of “coercive” review campaign: users are harassed into writing positive reviews, and install and review other apps. [ABSTRACT FROM PUBLISHER]

Internet worm infection continues to be one of top security threats and has been widely used by botnets to recruit newbots. In order to defend against future worms, it is important to understand how worms propagate and how different scanning strategies affect worm propagation dynamics. In our study, we present a (stochastic) continuous-time Markov chain model for characterizing the propagation of Internet worms. The model is developed for uniform scanning worms, and further for local preference scanning worms and flash worms. Specifically, for uniform and local preference scanning worms, we are able to (1) provide a precise condition that determines whether the worm spread would eventually stop and (2) obtain the distribution of the total number of infected hosts. By using the same modeling approach, we reveal the underlying similarity and relationship between uniform scanning and local preference scanning worms. Finally, we validate the model by simulating the propagation of worms. [ABSTRACT FROM AUTHOR]

In this paper, we propose a client-server based framework that alle-viates the dissemination of XSS worms from the OSN. The framework initially creates the views corresponding to retrieved request on the server-side. Such views indicate that which part of the generated web page on the server can be accessed by user depending on the generated Access Control List (ACL). Secondly, JavaScript attack vectors are retrieved from the HTTP response by referring the blacklist repository of attack vectors. Finally, injection of sanitization primitives will be done on the client-side in place of extracted JavaScript attack vectors. The frame-work will perform the sanitization on such attack vectors strictly in a context-aware manner. The experimental testing of our framework has performed on the two plat-forms of open source OSN-based web applications. The observed detection rate of JavaScript attack vectors was effective and acceptable as compared to other existing XSS defensive methodologies. The proposed framework has optimized the method of auto-context-aware sanitization in contrast to other existing approaches and hence incurs a low and acceptable performance overhead. [ABSTRACT FROM AUTHOR]

A series of high-performance polyethersulfone, which had pendent carbazole moieties (Cz-PES 1–3), have been designed and successfully synthesized for an application in a write-once read-many type memory device as the active polymer layer. The memory performance can be tuned by changing the substituent in the Cz derivatives units. Cz-PES 3 with excellent thermal properties (Tg = 185°C and Td = 378°C) exhibits the best memory performance. For Cz-PES 3-based device indium tin oxide/Cz-PES 3/aluminum, the turn-on voltage is 2.5 V and the ON/OFF current ratio is higher than 106. Moreover, the data can be maintained for longer than 3 × 105 s once written and can be read for more than 450 cycles under a reading voltage of 1.0 V at ambient conditions. Thus Cz-PES 3 can serve as an excellent memory material in the data storage field of next generation. [ABSTRACT FROM AUTHOR]