Search

The subject of the research refers to the aspect of digital forensics and computer crime and the latter is one of the reasons for the evolution of crime in general. Based on the growing trend of technology development and the increase in the number of digital crimes, a special emphasis is given to the statistical aspect of computer crime as well as measures to reduce the impact of computer crime, including the ethical and legal aspects in the Republic of North Macedonia (RNM). To conduct this research, statistical data on computer crime in RNM from 2011 to 2020 were used, based on historical data of analysis, as well as comparison, correlation, and the ANOVA-test. The highest number of crimes were registered in 2020 and a special feature is that a positive linear trend can be observed during the last decade. "Damage and unauthorized access to a computer system" took the first place in computer crimes according to the Criminal Procedure Law. [ABSTRACT FROM AUTHOR]

Modern society, in its fundamental principles of state existence as the primary subject of international relations, aims to protect individuals and their property from all forms of endangerment, whether it be natural, technological, or any other disaster of smaller or larger scale, regardless of whether it concerns security threats within or beyond the state borders. In this endeavor, the state must, on the one hand, take all necessary measures to undertake activities for the protection of the lives and property of its citizens. On the other hand, it has an obligation to safeguard every personal datum of those citizens, whether they are victims or perpetrators. A specific aspect is the observation of internal security with all the entities whose primary task is the protection of the state's internal order, including: police authorities, intelligence agencies, inspection bodies, judiciary, customs, and other authorities responsible for maintaining internal security. Special attention in this article is given to the police authorities in the Federation of Bosnia and Herzegovina, which, in accordance with their legal competencies, take measures and actions to detect and document perpetrators of offenses and criminal acts, as well as their accomplices. The greatest security risks facing police forces worldwide, including in the Federation of Bosnia and Herzegovina, are currently organized crime and computer crime, their mutual connection and dependence, and the widespread nature of their activities aimed at obtaining unlawful financial gain, as well as destabilizing the state. Organized crime, utilizing technological advancements, adversely affects the economic and social prosperity of the country. [ABSTRACT FROM AUTHOR]

The process of prosecuting and sentencing individuals who have violated the law takes into account different factors, among which are the sentencing guidelines, which provide a guide for judges to orientate their decisions during the prosecution process. However, the variety of crimes and the evolution of cybercrime require that these criteria be applied differently, especially when new technologies are involved, in the case of cybercrimes involving child sexual abuse material (CSAM) those criteria may differ in the guidelines that apply to the other forms of cybercrime. For this reason, the present study analysed 14 documented cases in order to characterise the differences in the applications of the sentences and investigate the forms of supervision for cybercriminals under probation. Finally, this study invites us to reflect on the challenges posed by technological advances in crime control and the need for proactive measures to improve the response of institutions in the containment and investigation of cybercrimes involving CSAM [ABSTRACT FROM AUTHOR]

Cybercriminals use domain generation algorithms (DGAs) to prevent their servers from being potentially blacklisted or shut down. Existing reverse engineering techniques for DGA detection is labor intensive, extremely time-consuming, prone to human errors, and have significant limitations. Hence, an automated real-time technique with a high detection rate is warranted in such applications. In this article, we present a novel technique to detect randomly generated domain names and domain name system (DNS) homograph attacks without the need for any reverse engineering or using nonexistent domain (NXDomain) inspection using deep learning. We provide an extensive evaluation of our model over four large, real-world, publicly available datasets. We further investigate the robustness of our model against three different adversarial attacks: DeepDGA, CharBot, and MaskDGA. Our evaluation demonstrates that our method is effectively able to identify DNS homograph attacks and DGAs and also is resilient to common evading cyberattacks. Promising results show that our approach provides a more effective detection rate with an accuracy of 0.99. Additionally, the performance of our model is compared against the most popular deep learning architectures. Our findings highlight the essential need for more robust detection models to counter adversarial learning. [ABSTRACT FROM AUTHOR]

Cyber risk affects all organizations. Cyber risk management has generally been based on the heuristics and the availability of protective tools, such as firewalls and passwords. Only recently have there been quantitative analyses of these tools’ costs and benefits. This article presents a probabilistic method based on the existing data in an organization and on their extension to assess the probabilities of new attack scenarios. The objective is to set priorities among risk management measures and to optimize the allocation of limited resources. The model is illustrated first by a statistical analysis of 60 000 incidents, such as lost or stolen laptops, over six years in a specific organization. This analysis is then expanded to the probabilistic domain to cover threats that have not occurred yet. This requires a systematic construction of new attack scenarios and an assessment both of their probability of success and of subsequent losses. The conjunction of statistics and probabilities of more extreme scenarios yields full risk curves. These curves represent the overall cyber risk for the organization and its insurers and unable assessment of the benefits of a spectrum of protective options. [ABSTRACT FROM AUTHOR]

The Gulf Cooperation Council (GCC) is a political and economic union of the Arab states, comprising some of the fastest growing economies in the world due to the prevalence of oil and gas industry and more recently due to significant investments in the digital economy. However, in recent years, rates of cybercrime and cyber-threats have risen significantly, posing challenges to the security and economic performance of the region. This article deals with the necessity to engage in transnational cooperation to counter the complex challenges posed by cybercrime across the GCC. Interviews were held with members of the GCC political elite who hold expertise in cybersecurity affairs. An analysis is presented of cybersecurity threats in the region, problems of strategic cooperation and lack of dialogue to tackle common challenges in the areas of cybercrime and cybersecurity. Finally, specific aspects of GCC cybersecurity policy are discussed: preventive and mitigation actions; potential intraregional and international cooperation avenues; and the formulation of effective strategy to enhance cybersecurity capabilities and resilience. Although grounded in the GCC as a regional bloc, the findings also carry implications for other contexts, especially other Middle East and North Africa countries and, thus, represent a promising avenue for future research. [ABSTRACT FROM AUTHOR]

This article reports on a grounded theory investigation of subject response anomalies that were encountered in the course of a neurocognitive laboratory study of computer user cybersecurity behaviors. Subsequent qualitative data collection led to theoretical development in specification of three broad constructs of computer user security complacency. Theoretical insights indicate that states of security complacency can arise in the form of a naïve lack of concern about the likelihood of facing security threats (inherent complacency), from ill-advised dependence upon specific computing platforms and protective workplace technology implementations for protection (platform complacency), as well as the reliance on the guidance on advice from trusted social others in personal and workplace networks (social complacency). Elements of an emergent theory of cybersecurity complacency arising from our interpretive insights are discussed. [ABSTRACT FROM AUTHOR]

The rising number of cyberattacks and cybercriminals around the world has put major threats on the cybersecurity and even the national security of many countries. In response, governments started to introduce policies and regulations to improve cybersecurity. It is increasingly realized that effective cybersecurity policy making largely depends upon optimized policy attention and the effective use of public resources. This article draws on the “attention-driven policy choice model” and the punctuated equilibrium theory to analyze the relationship between policy attention allocation, policy agenda setting, and the choice of policy tools in different periods of cybersecurity development. Using Chinese cybersecurity development as the main context, content analysis of policy texts was conducted to examine the pathway of cybersecurity policy development in China between 1994 and 2019. The findings suggest that there is evidence for punctuated equilibrium with policy stagnation and incrementality being broken up by major events which shift policy attention and subsequently affects agenda setting and the choice of policy tools. The findings of this article will provide important implications for the development of strategic foresight of cybersecurity and the effective use of public resources to improve cybersecurity. [ABSTRACT FROM AUTHOR]

Many small and medium enterprises (SMEs) engage in dyadic information integration partnerships or partial integration with their direct suppliers and customers. They often utilize e-commerce or cloud computing technology platforms hosted by third-party providers to leverage such partnerships. However, information security breaches and disruptions caused by cyberattacks are commonplace in the information technology industry. The effects of said disruptions and breaches on e-commerce businesses under varied disruption conditions are still uncertain. Furthermore, the effect of security breaches on nonparticipating members of the supply chain is poorly understood, especially under various disruption profiles. Using discrete event modeling, in this article, we explore the impact of disruption caused by information security breaches on supply chain performance and the externality effect of partial integration on nonparticipants. We also examine the impact of breach disruption frequency and remediation length on supply chain performance with varying levels of information sharing. These impacts were studied under two typical inventory replenishment policies for SMEs. It was determined that remediation length should be a prioritized factor in impact management and that flexibility in the inventory replenishment policy can help mitigate the impact of information disruption on the inventory performance of businesses, especially that of nonparticipants, in information-sharing partnerships. [ABSTRACT FROM AUTHOR]

In recent years, cyber-racketeering has become a prevalent means of cyberattack, severely jeopardizing nations, organizations, and individual users. However, because previous research has been focused on individual crimes, insider security threats, and compliance, the serious consequences of organized cybercrimes have received little attention. To investigate organized cyber-racketeering, we explore how organized cybercriminals apply organizational techniques to systematically commit cyberattack on individuals and businesses. Based on 80 court cases of successfully prosecuted cybercrimes, this article is one of the first to scientifically examine organized crime syndicates that are engaged in cyber-racketeering. We use the grounded theory approach to investigate organized cyber-racketeering. To ensure the scientific rigor and realism of this study, we examine these court cases to develop a process theory based on the results of interpretive and iterative analyses conducted from multiple perspectives on organized cyber-racketeering. We establish a framework for organized cyber-racketeering to shed light on its characteristics and the crucial role of Internet technology (IT) in the implementation and operation of cyber-racketeering activities. The proposed framework consists of motive, organization, learning and development, and execution. This article contributes both to enhancing the understanding of how organized cybercriminals operate and profit from cyber-racketeering using information and communications technology (ICT) and to improving countermeasures that may be taken by practitioners. [ABSTRACT FROM AUTHOR]

The cybersecurity of organizations is a subject of perennial concern as they are subject to mounting threats in an increasingly digitalized world. While commercial and charitable organizations have been the objects of cybersecurity research, social enterprises (SEs) have remained unexplored. As SEs have become increasingly important features of social and economic development, so their prominence as potential targets of cybercrime also increases. In order to address this knowledge gap, this article examines the factors that influence the cyber-preparedness of SEs in the U.K. Through the use of semistructured interviews with SE owner-managers, these factors are found to comprise the characteristics of the enterprise, the characteristics of the enterprise management, resource constraints, experience of cyberattacks, usage of IT, and awareness of cybersecurity schemes and resources. These insights provide valuable guidance for SE owner-managers, SE support agencies, and policy-makers when considering the cybersecurity of SEs. These findings are of immediate concern to SEs but also to other organizations that are engaged in partnerships with them as SEs may afford “gateway” opportunities to those with malicious intent. [ABSTRACT FROM AUTHOR]

Concerns about the cybersecurity and resilience of power systems have heightened in electric utilities and regulatory agencies over the past decade mainly because of the unpredictable target, location and scale of cyberattacks and the potential severity of consequences. The cybersecurity of pilot protection is paramount in bulk power systems considering their prevalence and the crucial role they play in protecting critical assets and preventing large system disturbances and major blackouts. This paper investigates the resilience of pilot protection using a co-simulation platform based on OPAL-RT simulator and Riverbed Modeler. It is demonstrated that software-defined networking for operational technology (OT SDN) significantly improves the resilience of pilot protection to false data injection (FDI) attacks compared to traditional networks. Moreover, the resilience of OT SDN based pilot protection to denial of service (DoS) attack against the SDN controller is investigated both in the proactive and reactive modes of operation. The simulation results verified the resilience of OT SDN controller in OT SDN based pilot protection to DoS attacks in the proactive mode of operation. [ABSTRACT FROM AUTHOR]

This article develops a unique model of organizational resilience architecture with an emphasis on the ways in which organizations respond to cyberattacks. The model elucidates the dynamics and approaches through which organizations mobilize and utilize expertise and resources to combat the effects of cyberattacks on normal business operations. Drawing on recent cases of cyberattacks against organizations, the article identifies a host of strategic and tactical responses victims used to aid recovery and return to daily activities. The responses are grouped into three stages to demonstrate the steps that organizations can take to enhance their resilience: Stage 1 focuses on proactive environmental scanning and locating potential threats and attacks, Stage 2 emphasizes neutralizing threats and attacks, and Stage 3 focuses on redesigning, upgrading, and updating human, technological, and financial resources. On this basis, the article sheds light on levels of organizational resilience and strategies for organizational design in withstanding cyberattacks and security breaches. The theoretical and practical implications of these findings are discussed. [ABSTRACT FROM AUTHOR]

The security and economy of multienergy systems (MESs) are directly threatened by the potential cyberattacks. It is of great importance to investigate the effects of cyberattacks, e.g., denial of service (DoS) attacks, on distributed energy management algorithms. To this end, this article focuses on exploring how the frequency and the time of duration of DoS attacks influence the behavior of Newton–Raphson-based distributed energy management (NRBDEM) algorithm for MES and in which condition the optimal operations can still be obtained. First, a switched NRBDEM algorithm is presented, which is composed of the normal operation mode and the attack mode. In the attack mode, the attackers are able to change the communication structure at will and make it unconnected to destroy the convergence of the switched NRBDEM algorithm. Then, by making use of automatons to generate the hybrid time domain, the switched NRBDEM algorithm is further modeled and formulated as a hybrid dynamical system, which provides a mathematical model for the subsequent convergence analysis. Therein, the generated hybrid time domain satisfies the average dwell-time constraint and time-ratio constraint to limit the persistent attacks. Furthermore, we analyze the restrained conditions for persistent attacks, under which the optimality and convergence of the switched NRBDEM algorithm can be guaranteed still. Finally, simulation results demonstrate the effectiveness of the proposed method. Note to Practitioners—The multienergy system (MES) is viewed as a typical cyber-physical system. Since it works in a networked environment, the convergence and optimality of the corresponding distributed energy management algorithms are easily destroyed by various cyberattacks, such as the DoS attack. Few noticeable studies have been documented to investigate the distributed energy management problem for MES under persistent DoS attacks. To address this issue, this article proposes a switched NRBDEM algorithm subject to persistent DoS attacks, which is made up of normal operation mode and attack mode. Moreover, sufficient conditions are derived for the tolerable frequency of attack and the time of duration. It is helpful for the practitioners to know in which conditions the global convergence and optimality can be maintained still. Several simulations are provided to verify the correctness of the proposed theoretical analysis results. Our future work will aim at analyzing the performance of different energy management algorithms under different cyberattacks. [ABSTRACT FROM AUTHOR]

The use of mechanisms such as the transmission of data by ultrasonic waves can allow malicious personnel to obtain personal data from a computer system, which could constitute a computer crime. The objective of this article is to demonstrate how it is possible to filter information through ultrasound, using workstation peripheral systems, with which personal data could be obtained, which generates a confidentiality problem. For this, the method used was to perform a characterization of the computer components, a support software was built for sending and receiving ultrasound data (at a frequency greater than 18000 Hz), using the speakers of a computer equipment and the reception of data was from another laptop, the tests were performed in a controlled environment with low noise level. As a result, it was possible to transfer information through basic computational elements, although with some packet loss, but functional for the fulfillment of the proposed objective, with which it is concluded that it is possible that part of this leaked information could generate a computer crime through the light of Law 1273 in Colombia. [ABSTRACT FROM AUTHOR]

Finding top- $k$ k frequent items has been a hot issue in databases. Finding top- $k$ k persistent items is a new issue, and has attracted increasing attention in recent years. In practice, users often want to know which items are significant, i.e., not only frequent but also persistent. No prior art can address both of the above two issues at the same time. Also, for high-speed data streams, prior art cannot achieve high accuracy when the memory is tight. In this paper, we define a new issue, named finding significant items, and propose a novel algorithm namely LTC to address this issue. It includes two key techniques, Long-tail Restoring and CLOCK, as well as three optimizations. In addition, LTC is extended to support finding significant items with thresholds. We theoretically derive the correct rate and error bound, and conduct extensive experiments on three real datasets to test the performance of LTC. Our experimental results show that LTC can achieve $10^5$ 10 5 times higher accuracy in terms of average relative error than other related algorithms. Lastly, LTC is applied to a DDoS detection task and it shows that finding significant items is more powerful than finding frequent items. [ABSTRACT FROM AUTHOR]

Table-based scalar multiplication provides practical security for ECDSA signature generation. However, a novel key recovery attack against this form of ECDSA signature generation that exploits the collisions between entries was recently proposed at CHES 2021. This attack is possible even if table entries are unknown, such as with random permutated entry ordering. In this paper, we enhance the efficiency of the key recovery attack against secure ECDSA signature generation based on fixed-base comb scalar multiplication. We significantly reduce the required number of traces by compressing collision information using the mathematical relationship between table entry collisions. We verify this is a practical threat by performing an experiment on fixed-base comb method with window width $w=4$ w = 4 . Using our method, up to 27 traces are needed, much fewer than 1,019 traces required in the CHES publication. We cluster real traces measured using 32-bit STM32F4 microcontroller. In the experiment, we provide a selection method of points of interest using variance traces and unsupervised clustering-based leakage detection. With the selection method, we succeed in clustering leakages into 16 classes with a 100% success rate with 32-bit MCU. This represents the first experiment to cluster the more leakage classes with a 32-bit MCU than in literature. [ABSTRACT FROM AUTHOR]

Large-scale power systems are composed of regional utilities with assets that stream sensor readings in real time. In order to detect cyberattacks, the globally acquired, real-time sensor data needs to be analyzed in a centralized fashion. However, owing to operational constraints, such a centralized sharing mechanism turns out to be a major obstacle. In this article, we propose a blockchain-based decentralized framework for detecting coordinated replay attacks with full privacy of sensor data. We develop a Bayesian inference mechanism employing locally reported attack probabilities that is tailor made for a blockchain framework. We compare our framework to a traditional decentralized algorithm based on the broadcast gossip framework both theoretically as well as empirically. With the help of experiments on a private Ethereum blockchain, we show that our approach achieves good detection quality and significantly outperforms gossip-driven approaches in terms of accuracy, timeliness, and scalability. [ABSTRACT FROM AUTHOR]

This article explores the role of artist collectives in the original innovation of distributed-denial-of-service attacks. While current scholarship references the artist collectives Strano Network and Electronic Disturbance Theater as separate case studies, this article explores these groups' overlapping ambitions, passion, and community and the Anonymous Digital Coalition's role in linking the two. The continuity of innovation by these collectives presents a distinct historical origin story from traditional early hacking culture. This article surveys two well-documented incidents: the targeting of French government websites by the Strano Network to protest French nuclear testing and the targeting of the Pentagon by EDT in solidarity with the Zapatista movement in Chiapas, Mexico. These artist collectives and the online activist spaces they occupied deserve both recognition and potential criticism for their creative and ultimately costly innovations. [ABSTRACT FROM AUTHOR]

We propose a game attack–defense graph (GADG) approach that integrates the attack–defense graph and the game theory to model and analyze cyberattacks and defenses in the local metering system (LMS). Different from previous studies concentrating on static analyses of cybervulnerabilities, the GADG method considers correlations among these vulnerabilities. Besides, to avoid the uncertainty brought by unilateral analysis, we introduce the game theory for the interaction analysis between the attacker and the defender. The mixed-strategy Nash equilibrium that they finally reach can serve as the input for the inference of system states. We also propose two eliminating algorithms to reduce the complexity of solving mixed-strategy Nash equilibrium on large-scale LMS. In the case study, our GADG model has been conducted on a real LMS, and the results prove its efficiency. This research aims to assist the power company in optimizing the allocation of limited defensive resources, especially specific in attacking steps. Note to Practitioners—This article is motivated by the practical demand of protecting the cybersecurity of the local metering system (LMS), which is a critical subsystem of the smart grid and has been widely deployed to collect and transmit time-stamped information. Different from typical research works on local metering cybersecurity, which focuses on the analysis and identification of cybervulnerabilities, in this study, real experiments considering the interactive scenarios between the attacker and the defender are conducted on the LMS. Based on this, we developed the attack graph to clearly illustrate various cyberattack paths and their corresponding effects. We then applied the game theory model on the attack graph to obtain the optimal attack and defense strategy under each attack scenario. Based on this, the defender, i.e., power company, can optimally allocate limited defense resources among various attacking steps according to our model. The proposed model and method are demonstrated on one exemplar LMS used by our industrial partner China Southern Grid (CSG). Given the generalizability of the proposed model and method, they can be applied to other similar cyber–physical systems. [ABSTRACT FROM AUTHOR]

Cyber-physical systems (CPSs) integrate computing and communication capabilities to monitor and control physical processes. In order to do so, communication networks are commonly used to connect sensors, actuators, and controllers in the feedback system. The use of communication networks increases the vulnerability of CPSs to cyberattacks that can drive the system to unsafe states. One of the most powerful cyberattacks is the so-called man-in-the-middle attack, where the intruder can observe, hide, create, or change information in the attacked network channels. In this article, we propose a defense strategy that can thwart man-in-the-middle attacks in the sensor and/or control communication channels of CPSs modeled as discrete-event systems. We also introduce the definition of network attack security (NA-Security), which is related to the possibility of preventing the system from reaching unsafe states by using a security supervisor, whose online implementation has polynomial computational complexity, and we propose an algorithm to verify this property. Note to Practitioners—CPSs form the basis for the fourth industrial revolution, called Industry 4.0. In these kinds of systems, communication networks are used to connect sensors, actuators, and controllers in the closed-loop system. The increase in the use of communication networks also increases the vulnerability of CPSs to cyberattacks. The use of conventional defenses, such as firewalls, is not recommended in industrial systems due to the introduction of communication delays. In this article, we propose a new defense strategy that prevents damages in the system caused by man-in-the-middle attacks. A security supervisor is proposed to disable controllable events when there is a risk to reach states of the system that may represent damages to the system or its operators. [ABSTRACT FROM AUTHOR]

This article proposes a novel approach to uncover deficiencies of the existing cyber-attack detection schemes and thereby to serve as a foundation for establishing more reliable cybersecure solutions, with particular application in dc microgrids. For this purpose, a multiagent deep reinforcement learning (RL)-based algorithm is proposed to automatically discover the vulnerable spots in the conventional index-based cyberattack detection schemes and automatically generate coordinated stealthy destabilizing false data injection (FDI) attacks on cyber-protected islanded dc microgrids. To enable a continuous action space for the trained RL agents and enhance the algorithm’s precision and convergence rate, deep deterministic policy gradient is incorporated. Using this approach, susceptibility of a state-of-the-art detection scheme to several different coordinated FDI attacks on the distributed communication links is identified. The proposed algorithm is also enhanced with a sniffing feature to enable maintaining the stealthy attacks even under the sudden disconnection of any of the compromised links. To address the discovered deficiencies within the index-based detection scheme, a complementary multiagent RL detection algorithm using deep $Q$ -network algorithm is integrated, which provides a more reliable overall identification performance. Taking into account the communication delays and load changes, the effectiveness of the proposed algorithm is verified by the experimental tests. [ABSTRACT FROM AUTHOR]

The increase in the use of information systems, of communications through the Internet in recent decades and the possibility of sharing data instantly have brought with them terms such as cybersecurity, since, from the beginning, there have been unscrupulous people who want to obtain confidential information, that is why new attack vectors are invented every year and with it new methods to persuade them, there is currently a growing boom on technologies based on microservices and cloud computing, this due to its high scalability, maintainability and facility to create infrastructure safely. Amazon web services offers various services that allow you to convert simple platforms into robust applications with different connections, using different technologies and databases, as well as allowing you to add security to both the applications and the data, this last concept is the main source of any system. This is why in this article an exploration of the encryption on databases and documents is made, using AWS services such as Key management server, Relational database service and S3, at the end it will be found that the encrypted files and databases will not be readable by malicious people, in case an attack materializes. [ABSTRACT FROM AUTHOR]

In this article, a cyber-resilient consensus-based distributed control scheme is proposed for islanded ac microgrids. Considering the impacts of false data injection (FDI) attacks on the conventional consensus algorithms, a hybrid solution is presented based on the combination of multiobjective sliding-mode control and communication link quality observer to provide a reliable performance against different types of FDIs. Unlike the commonly developed distributed observer-based cyber-resilient algorithms, this approach aims to form a complete localized solution without the requirements for transmission of extra distributed signals in the secondary layer. Using the proposed method, the system reliability will not be impacted by the cyber intrusions on the distributed observer terms, and the system's dynamic performance is not deteriorated by the counteracting operation resulted from adaptive distributed observers under other system-transient conditions such as load dynamics, which can be even worsened under communication delays. Using cyber-resilient offset compensation terms, performance of the proposed sliding-mode control scheme is enhanced for multiobjective regulation. Integrating the sliding-mode control with communication link observer also ensures effective isolation of the unbounded and extreme cyberattacks. Unlike the former indirect local observers, the proposed scheme operates directly based on monitoring the affected distributed signals rather than only power terms, which enhances its reliability on detection. The effectiveness of the proposed scheme is validated through a real-time model developed in Typhoon HIL-402 real-time simulator as well as the experimental tests. [ABSTRACT FROM AUTHOR]

The security of data propagation is a critical challengefor the widespread use of networked control systems (NCSs), while the conventional strategies based on estimation techniques cannot solve this issue well. Furthermore, the contradiction between the security and the real-time nature of the control method has not been settled yet. The aim of this article is to propose a novel real-time control method empowered by blockchain technologies to resolve the security problems of NCSs under potential cyberattacks. To facilitate the analysis of blockchain-assisted NCSs, a cyber-authentic-physical system (CAPS) framework is proposed. One of the significant features of the CAPS is that the defense of NCSs against attacks is built by introducing a blockchain protocol. Theoretical analysis reveals the relationship among the scale of the peer-to-peer network, the security of the CAPS, and the latency of NCSs, as well as clarifies the impact of the introduction of the blockchain mechanism on the performance of NCSs. With the networked secure control mechanism designed in this article, the security and stability of NCSs can be achieved simultaneously, and their sufficient conditions are also given. Finally, simulations and practical experiments are presented to show the efficacy of the suggested secure control strategy. [ABSTRACT FROM AUTHOR]

Distributed denial of service (DDoS) attacks remain a persistent nuisance on the Internet. They exploit the fact that the Internet lacks centralized access control. Since this vulnerability was a core design decision of the early Internet, DDoS attacks have persisted. This article presents the technologies and tools that are used in DDoS, followed by a timeline of the major DDoS incidents. This is followed by a discussion of the primary classes of DDoS incidents and how the computing ecosystem enables DDoS. Early attacks were related to hacker culture, but their focus quickly changed to commercial exploitation. There have also been a number of political uses of DDoS, including cyberwar, hacktivism, and terrorism. [ABSTRACT FROM AUTHOR]

This article designs a fully distributed resilient control method for networked multigroup systems in the face of unknown unbounded false data injection (FDI) attacks. The considered multigroup systems contain cooperative agents and adversarial attackers. FDI attacks on the multigroup systems include unknown unbounded injections on the local feedback state and communication channels among the network topology. A fully distributed resilient control method is proposed to guarantee the uniformly ultimately bounded containment convergence. In particular, the proposed method consists of the original cyber-physical layer and a virtual resilient layer. The method is further refined to deal with the case when both cyber-physical and virtual layers are subjected to unknown unbounded attacks. The efficacy of the proposed results is first validated on two simulation examples for both linear and nonlinear multigroup systems, and then evaluated on a modified IEEE 34-bus feeder system, emulated in a controller/hardware-in-the-loop experimental platform, to regulate frequency and voltage for islanded microgrid against malicious attacks. [ABSTRACT FROM AUTHOR]

The fields of health care, education, culture, and shopping can all be integrated into the core of a smart city to create an infrastructure that allows people to live more conveniently. We must think ahead about cybersecurity, as cyberattacks can threaten the lives of citizens. [ABSTRACT FROM AUTHOR]

Phasor measurement units (PMUs) are widely used to monitor the operating conditions of a smart grid. The PMU communication network is, generally, a public wide area network, hence it is vulnerable to cyberattacks. At present, IEEE C37.118.2 is widely used as the communication standard for PMU communication. However, the IEEE C37.118.2 standard does not specify any security mechanism to protect the PMU data from cyberattacks. Deviation in the transmitted data of PMUs may lead to devastating consequences, such as blackouts in the grid. To mitigate cyberattacks on a PMU, this article proposes a security mechanism based on key distribution scheme that ensures integrity along with confidentiality. This mechanism involves addition of new security fields to IEEE C37.118.2 message structure. The introduction of security mechanism imposes additional computational complexity on resource constraint PMU devices and addition of new security fields in PMU message structure increases overall message size which in turn increases communication delays. In order to assess the additional computational complexity and increased communication delays, an experimental set up consisting of PMU simulators and network emulator is developed in this article. The developed PMU simulator generates IEEE C37.118.2 messages with proposed security mechanisms. Results validate the applicability of the proposed security mechanism in PMU networks without any repercussions. [ABSTRACT FROM AUTHOR]

In recent years, technologies of indoor crowd positioning and movement data analysis have received widespread attention in the fields of reliability management, indoor navigation, and crowd behavior monitoring. However, only a few indoor crowd movement trajectory datasets are available to the public, thus restricting the development of related research and application. This article contributes a new benchmark dataset of indoor crowd movement trajectories. This dataset records the movements of over 5000 participants at a three-day large academic conference in a two-story indoor venue. The conference comprises varied activities, such as academic seminars, business exhibitions, a hacking contest, interviews, tea breaks, and a banquet. The participants are divided into seven types according to participation permission to the activities. Some of them are involved in anomalous events, such as loss of items, unauthorized accesses, and equipment failures, forming a variety of spatial–temporal movement patterns. In this article, we first introduce the scenario design, entity and behavior modeling, and data generator of the dataset. Then, a detailed ground truth of the dataset is presented. Finally, we describe the process and experience of applying the dataset to the contest of ChinaVis Data Challenge 2019. Evaluation results of the 75 contest entries and the feedback from 359 contestants demonstrate that the dataset has satisfactory completeness, and usability, and can effectively identify the performance of methods, technologies, and systems for indoor trajectory analysis. [ABSTRACT FROM AUTHOR]

E-commerce transactions have been rapidly increasing (over 20% from 2016 to 2017), and thus the number of data thefts has been increasing. Data thefts cause a loss of trust by the customer, but previous research has failed to identify how such events change customer perceptions and also influence future shopping behavior. Our survey of 390 individuals provides insight into how the individuality of the crime victims (targeting of a few named individuals or a large customer database) has strong effects. Specifically, respondents were more likely to blame the breached customers and less likely to blame the business if only a few individuals were targeted. Responses such as blaming the business and possessing a cynical perspective about the thieves and affected customers, along with the individuality of the crime, did have a significant effect on whether customers would choose to revisit the business. However, increased blame on affected customers did not necessarily lead to diminished revisits. We recommend that businesses respond to large database breaches with apologies and blame acceptance, and to small, targeted breaches with an agile mix of apology, blame acceptance, diminishment, and protest. [ABSTRACT FROM AUTHOR]

Supervisory control and data acquisition (SCADA) systems are widely used for industrial control of critical infrastructures, such as power plants and manufacturing systems. There is abundant evidence of SCADA systems being subject to cyberattacks. With increasing interest in industrial digitization, the cybersecurity of SCADA systems is poised to be even more important. Equipment faults and cyberattacks can manifest themselves in a similar fashion, i.e., they can exhibit similar signatures. This article focuses on methods that are capable of distinguishing equipment faults from bona fide cyberattacks. Especially, we consider a relatively sophisticated form of cyberattack known as the “replay attack” (RA). We derive mathematical formalisms that distinguish the RA from several classes of equipment faults and verify our methodology through an extensive numerical study. Note to Practitioners—This article is motivated by the problem of detecting replay cyberattacks in industrial control systems and differentiating it from equipment faults. Existing approaches mainly focus on the detection aspect but usually ignore the importance of differentiation. We an ensembled statistical process monitoring approach based on five statistical metrics. The statistical metrics are derived based on a theoretical analysis that shows the data characteristics under each system anomaly, including replay attack (RA), controller fault, and plant fault. We mathematically prove that the signatures generated by the derived metrics can be used to differentiate an RA from the equipment faults. We conduct a sensitivity analysis of the detection delay of our method regarding the magnitude of the cyberattack. Physical experiments on a rotating machinery setup show that the proposed approach applies to some simple real-world settings. In future research, we will address the scalability issue of our method as well as more generalized nonlinear system settings. [ABSTRACT FROM AUTHOR]

The low-rate denial of service (LDoS) attack mainly exploits security vulnerabilities of adaptive mechanisms in network protocols and application services. The high-rate attack pulses within a short time interval are sent periodically, which will result in the degradation of service quality. The attack traffic is similar to normal traffic from legitimate users in the network, consequently, it is easy to escape the traditional detection methods because of its intermittence. Research works have demonstrated that there are fractal characteristics (self-similarity) of the network traffic over the large scale of time. Although the fractal characteristics of the network traffic will be changed under the LDoS attack, the variations of the fractal characteristics in some network states are not apparent in real-time detection. Based on the fractal characteristics, the fractal residual of the network traffic is analyzed through the Hurst parameters calculating process by R/S algorithm in this article. It can be found that the fractal residual of the network traffic can better reflect the different states of the LDoS attack. Combining the idea behind the sliding window, a novel fractal residual based real-time detection (FR-RED) method of the LDoS attack is proposed. The effectiveness of the method in this article is verified by performing some experiments on two platforms, the NS2 and test-bed. The results manifest the beginning and end of the LDoS attack can be estimated in real-time with high detection accuracy. [ABSTRACT FROM AUTHOR]

Connected and Automated Vehicles (CAVs) rely on the correctness of position and other vehicle kinematics information to fulfill various driving tasks such as vehicle following, lane change, and collision avoidance. However, a malicious vehicle may send false sensor information to the other vehicles intentionally or unintentionally, which may cause traffic inconvenience or loss of human lives. Here, we take the advantage of vehicular cloud and increase the resilience of CAVs to malicious vehicles by assuming each vehicle shares its local sensor information with other vehicles to create information redundancy on the cloud side. We exploit this redundancy and propose a sensor fusion algorithm for the vehicular cloud, capable of providing robust state estimation of all vehicles under the condition that the number of malicious information is sufficiently small. Using the proposed estimator, we provide an algorithm for isolating malicious vehicles. We use numerical examples to illustrate the effectiveness of our methods. [ABSTRACT FROM AUTHOR]

This article considers integral sliding-mode control (ISMC) for multiagent systems with matched disturbances through adaptive dynamic programming (ADP) method. A distributed disturbance observer (DDO) is designed for each agent to generate the disturbance estimation. Using the disturbance estimation, an ISMC scheme is proposed to reject the input disturbance and obtain the equivalent local neighbor consensus sliding-mode dynamics. Then, a discount performance function is designed for each agent, and ADP technique is utilized to address the optimal consensus control for the equivalent sliding-mode dynamics online. Based on the gradient descent algorithm, we propose the adaptive weight tuning laws for the critic-actor neural networks (NNs) to carry out the ADP method. Furthermore, the local neighbor consensus errors and the weight estimation errors for the critic-actor NNs are proved to be uniformly ultimately bounded (UUB). Finally, the practical example is applied to validate the effectiveness of our results. [ABSTRACT FROM AUTHOR]

Hackathons have been around for decades. This article is a primer on what constitutes a hackathon, how hackathons have evolved, and why it can be advantageous to participate in and sponsor hackathons. [ABSTRACT FROM AUTHOR]

This letter assesses the impact of cyber-attacks on the control system of the modular multilevel converter (MMC)-based high-voltage dc (MMC-HVdc) transmission technology. Specifically, the small-signal model of the MMC-HVdc is characterized by a closed-loop matrix and the distance to the small-signal instability is then quantified by structured pseudospectrum. Furthermore, a vertical search method is proposed to quantify the boundary of the structured pseudospectrum. The proposed quantification model with the vertical search method can be extended to the control of other power electronics-based systems. Case studies on a two-terminal MMC-HVdc system verify the effectiveness of the qualification method. [ABSTRACT FROM AUTHOR]

A recent proactive defense mechanism, named as moving-target-defense (MTD), has been proposed as a prevailing topic that is capable of actively changing transmission line reactance to preclude cyberattacks. However, the MTD strategy has seldom been studied for the unbalanced AC distribution system in the existing literature. Towards the end, this paper proposes a deeply-hidden MTD (DH-MTD) to elaborately hide both the self and mutual reactance of each phase at the transmission line installed with D-FACTS devices. Both the branch and injection power phasor measurement functions are integrated into DH-MTD in the cyberattack scenario and under the normal operating condition, while the system voltage stability is ensured. The proposed DH-MTD model is solved using a nonlinear least square (NLS) method based on the trust-region algorithm due to the non-Gaussian noise assumption. Also, we cope with the MTD allocation (MTDA) problem using a data-driven normalized PDF peak residual (NPPR) index. The effectiveness of the proposed DH-MTD method is demonstrated in the unbalanced IEEE 123-bus distribution system against both branch and node cyberattacks. [ABSTRACT FROM AUTHOR]

Multimicrogrid (MMG) systems play an increasingly important role in the smart grid. They come with various potential cyberattacks, which may cause power supply interruption or even human casualties. Therefore, decision-making for timely mitigation of cyberattack risks is highly desirable in the security protection of power systems. However, there is a lack of effective decentralized decision-making strategies that are able to deal with MMG scenarios through distributed consensus. To address this issue, a decentralized consensus decision-making (DCDM) approach is proposed in this article for the security of MMG systems. It achieves decentralized consensus without the need of a trusted authority or central server, making it distinct from existing consensus methods. Meanwhile, it guarantees the consistency and nonrepudiability of consensus results, which are stored on the blockchain in sequence. In each of the distributed agents, the approach consists of a fuzzy static Bayesian game model (FSB-GM) to determine the optimal security strategy and a hybrid consensus algorithm to achieve consensus. The FSB-GM considers the fuzzy preferences of different types of attackers and defenders. The hybrid consensus algorithm is implemented by the fusion improvement of two consensus mechanisms in the blockchain. The effectiveness of the presented approach is demonstrated through a case study on an MMG system. [ABSTRACT FROM AUTHOR]

While the threats may appear to be vastly different, further investigation reveals that the cybersecurity community can learn much from the COVID-19 messaging response. [ABSTRACT FROM AUTHOR]

Cybersecurity has become an emerging issue for the secure operation of power systems. Besides hardening the power system to improve its cybersecurity, cyber insurance is emerging as a promising tool in cyber risk management. In this paper, an actuarial framework is established to capture and reduce the riskiness raised by interdependence among cyber risks, with the aim to enhance cyber insurance market for power systems. Absorbing semi-Markov process (SMP) is proposed to model the cyberattacks on the power grid. Also a stochastic model is developed to reflect the correlation of cyber risks across the power system. A sequential Monte Carlo simulations (MCS) framework is developed to evaluate the interruptions of the power system considering both the physical failures of the components and malicious cyberattacks. Then, the detailed insurance schemes are designed to manage the risks of the power system considering the financial consequences of cybersecurity threats. Case studies are conducted on a test system based on the IEEE Reliability Test System (RTS-79) to illustrate the application of the proposed insurance pricing schemes. [ABSTRACT FROM AUTHOR]

Cyber-physical systems (CPSs) empower the integration of physical processes and cyber infrastructure with the aid of ubiquitous computation resources and communication capabilities. CPSs have permeated modern society and found extensive applications in a wide variety of areas, including energy, transportation, advanced manufacturing, and medical health. The security of CPSs against cyberattacks has been regarded as a long-standing concern. However, CPSs suffer from extendable vulnerabilities that are beyond classical networked systems due to the tight integration of cyber and physical components. Sophisticated and malicious cyberattacks continue to emerge to adversely impact CPS operation, resulting in performance degradation, service interruption, and system failure. Secure state estimation and control technologies play a vital role in warranting reliable monitoring and operation of safety-critical CPSs. This article provides a review of the state-of-the-art results for secure state estimation and control of CPSs. Specifically, the latest development of secure state estimation is summarized in light of different performance indicators and defense strategies. Then, the recent results on secure control are discussed and classified into three categories: 1) centralized secure control; 2) distributed secure control; and 3) resource-aware secure control. Furthermore, two specific application examples of water supply distribution systems and wide-area power systems are presented to demonstrate the applicability of secure state estimation and control approaches. Finally, several challenging issues are discussed to direct future research. [ABSTRACT FROM AUTHOR]

IoT devices provide a significant medium for distributed denial-of-service (DDoS) attacks. In 2016, a large-scale DDoS attack, named Dyn, caused massive damage to several well-known companies. One effective countermeasure is observing previous network traffic information or abnormal behavior determined by the host machines and determining the latest DDoS-attack IP addresses. Because of the lack of a fair exchange mechanism, most security operation centers (SOCs) are unwilling to share their real-time DDoS data. In this article, we propose a decentralized DDoS data exchange platform, namely SOChain, using blockchain technology to overcome the trust and fairness issues. The platform incentivizes SOCs through the DDoS_coin token. The more DDoS information an SOC contributes, the more coins it earns. To confirm the validity of uploaded information, we enlist a content verifier to examine uploaded abnormal IP addresses. Moreover, the verifier is incentivized by the DDoS_coin. To decrease the management effort, the entire flow is automatically executed in smart contract deployed onto the blockchain system. To address the issue of privacy in smart contracts, we devise a novel dual-level Bloom filter to enable efficient searches with privacy protection. Herein, a verifiable method is designed without revealing the information to public. [ABSTRACT FROM AUTHOR]

Cyber security has become crucial to any nation's security, economy, and overall well-being. While much has been written about India's rise as a global computing power, not much is known about its cyber security history. I seek to fill this gap through a comprehensive analysis of India's cyber security history and cyber security consciousness. To do this, I take a very wide view of cyber security––as the totality of security infrastructure that includes all technologies used for information collection, storage, and dissemination. My study also covers a very long period, starting from India's colonial times to the present. The long period of examination helps gain perspective on how India's security stances and security consciousness have evolved with time. Earlier colonial policies kept information and communications technologies (ICTs) strictly under government authority, to be wielded as tools of project power and control. These policies continued even after independence, with successive Indian governments retaining absolute monopoly over ICTs. I divide cyber security into internally-focused (i.e. censorship, surveillance, control of citizens) and externally-focused (i.e. defensive and offensive actions directed at malicious external and internal entities perceived as threats to the nation, its enterprises, and citizens) cyber security. My analysis shows that postindependent India granted its citizens freedom of expression and the freedom to elect and govern, but did not do away with the colonial vestiges of internally-focused control policies using ICTs. Nor has it been entirely successful in stitching together a comprehensive externally-focused cyber security policy, despite increasing threats from the outside. These are increasingly at odds with Indian citizens whose cyber security consciousness has grown and evolved over time. It is clear that the state and the citizens need to continuously and democratically negotiate cyber security, to balancing national security with the citizens' constitutionally protected rights. [ABSTRACT FROM AUTHOR]

Cyberattacks have significant economic, political, and privacy-related impacts in Brazil. Regulatory and enforcement measures have been insufficient to prevent these attacks. The authors analyze these trends and assess some recent measures to address these issues. [ABSTRACT FROM AUTHOR]

We are falling behind in the war against distributed denial-of-service attacks. Unless we act now, the future of the Internet could be at stake. [ABSTRACT FROM AUTHOR]

The Internet's features and capacity have evolved, but is the nature of its security noticeably better? We examine the fundamental nature of distributed denial-of-service (DDoS) and the state of the union of our defenses in today's DDoS wars. [ABSTRACT FROM AUTHOR]

We determine the 2-adic complexity of the Ding-Helleseth-Martinsen (DHM) binary sequences by using cyclotomic numbers of order four, “Gauss periods” and “quadratic Gauss sums” on finite field $\mathbb {F}_{{q}}$ and valued in $\mathbb {Z}_{2^{{N}}-1}$ , where ${q} \equiv 5\pmod 8$ is a prime number and ${N}=2{q}$ is the period of the DHM sequences. [ABSTRACT FROM AUTHOR]