Organizations strive to secure their valuable data and minimise potential damages, recognising that critical operations are susceptible to attacks. This research paper seeks to elucidate the concept of proactive cyber threat hunting. The proposed framework is to help organisations check their preparedness against upcoming threats and their probable mitigation plan. While traditional threat detection methods have been implemented, they often need to address the evolving landscape of advanced cyber threats. Organisations must adopt proactive threat-hunting strategies to safeguard business operations and identify and mitigate unknown or undetected network threats. This research proposes a conceptual model based on a review of the literature. The proposed framework will help the organisation recover from the attack. As the recovery time is less, the financial loss for the company will also be reduced. Also, the attacker might need more time to gather data, so there will be less stealing of confidential information. Cybersecurity companies use proactive cyber defence strategies to reduce an attacker s time on the network. The different frameworks used are SANS, MITRE, Hunting ELK, Logstash, Digital Kill Chain, Model in Diamonds, and NIST Framework for Cybersecurity, which proposes a proactive approach. It is beneficial for the defensive security team to assess their capabilities to defend against Advanced Threats Persistent (ATP) and a wide range of attack vectors.

Advanced persistent threat (APT) attack is one of the most serious threats to power system cyber security. ATT\&CK framework integrates the known historical and practical APT attack tactics and techniques to form a general language for describing hacker behavior and an abstract knowledge base framework for hacker attacks. Combined with the ATT\&CK for ICS framework, this paper combed the known attack techniques used by viruses or hacker groups aimed at cyberattacks on infrastructure, especially power systems. Then found the corresponding mitigations for each attack technique, and merged them. Next, we listed the high frequency and important mitigations for reference. At last, we proposed a cyber security defense model suitable for ICS to provide a reference for security teams on how to apply ATT\&ck; other similar cyberattack frameworks.

The rapid growth of communication networks, coupled with the increasing complexity of cyber threats, necessitates the implementation of proactive measures to protect networks and systems. In this study, we introduce a federated learning-based approach for cyber threat hunting at the endpoint level. The proposed method utilizes the collective intelligence of multiple devices to effectively and confidentially detect attacks on individual machines. A security assessment tool is also developed to emulate the behavior of adversary groups and Advanced Persistent Threat (APT) actors in the network. This tool provides network security experts with the ability to assess their network environment s resilience and aids in generating authentic data derived from diverse threats for use in subsequent stages of the federated learning (FL) model. The results of the experiments demonstrate that the proposed model effectively detects cyber threats on the devices while safeguarding privacy.

Advanced Persistent Threats (APTs) have been a major challenge in securing both Information Technology (IT) and Operational Technology (OT) systems. APT is a sophisticated attack that masquerade their actions to navigates around defenses, breach networks, often, over multiple network hosts and evades detection. It also uses “low-and-slow” approach over a long period of time. Resource availability, integrity, and confidentiality of the operational cyber-physical systems (CPS) state and control is highly impacted by the safety and security measures in place. A framework multi-stage detection approach termed “APT$_\textrmDASAC$” to detect different tactics, techniques, and procedures (TTPs) used during various APT steps is proposed. Implementation was carried out in three stages: (i) Data input and probing layer - this involves data gathering and pre-processing, (ii) Data analysis layer; applies the core process of “APT$_\textrmDASAC$” to learn the behaviour of attack steps from the sequence data, correlate and link the related output and, (iii) Decision layer; the ensemble probability approach is utilized to integrate the output and make attack prediction. The framework was validated with three different datasets and three case studies. The proposed approach achieved a significant attacks detection capability of 86.36\% with loss as 0.32\%, demonstrating that attack detection techniques applied that performed well in one domain may not yield the same good result in another domain. This suggests that robustness and resilience of operational systems state to withstand attack and maintain system performance are regulated by the safety and security measures in place, which is specific to the system in question.

Advanced persistent threats (APTs) have novel features such as multi-stage penetration, highly-tailored intention, and evasive tactics. APTs defense requires fusing multi-dimensional Cyber threat intelligence data to identify attack intentions and conducts efficient knowledge discovery strategies by data-driven machine learning to recognize entity relationships. However, data-driven machine learning lacks generalization ability on fresh or unknown samples, reducing the accuracy and practicality of the defense model. Besides, the private deployment of these APT defense models on heterogeneous environments and various network devices requires significant investment in context awareness (such as known attack entities, continuous network states, and current security strategies). In this paper, we propose a few-shot multi-domain knowledge rearming (FMKR) scheme for context-aware defense against APTs. By completing multiple small tasks that are generated from different network domains with meta-learning, the FMKR firstly trains a model with good discrimination and generalization ability for fresh and unknown APT attacks. In each FMKR task, both threat intelligence and local entities are fused into the support/query sets in meta-learning to identify possible attack stages. Secondly, to rearm current security strategies, an finetuning-based deployment mechanism is proposed to transfer learned knowledge into the student model, while minimizing the defense cost. Compared to multiple model replacement strategies, the FMKR provides a faster response to attack behaviors while consuming less scheduling cost. Based on the feedback from multiple real users of the Industrial Internet of Things (IIoT) over 2 months, we demonstrate that the proposed scheme can improve the defense satisfaction rate.

As a recent breakthrough in generative artificial intelligence, ChatGPT is capable of creating new data, images, audio, or text content based on user context. In the field of cybersecurity, it provides generative automated AI services such as network detection, malware protection, and privacy compliance monitoring. However, it also faces significant security risks during its design, training, and operation phases, including privacy breaches, content abuse, prompt word attacks, model stealing attacks, abnormal structure attacks, data poisoning attacks, model hijacking attacks, and sponge attacks. This paper starts from the risks and events that ChatGPT has recently faced, proposes a framework for analyzing cybersecurity in cyberspace, and envisions adversarial models and systems. It puts forward a new evolutionary relationship between attackers and defenders using ChatGPT to enhance their own capabilities in a changing environment and predicts the future development of ChatGPT from a security perspective.

The adoption of IoT in a multitude of critical infrastructures revolutionizes several sectors, ranging from smart healthcare systems to financial organizations and thermal and nuclear power plants. Yet, the progressive growth of IoT devices in critical infrastructure without considering security risks can damage the user’s privacy, confidentiality, and integrity of both individuals and organizations. To overcome the aforementioned security threats, we proposed an AI and onion routing-based secure architecture for IoT-enabled critical infrastructure. Here, we first employ AI classifiers that classify the attack and non-attack IoT data, where attack data is discarded from further communication. In addition, the AI classifiers are secure from data poisoning attacks by incorporating an isolation forest algorithm that efficiently detects the poisoned data and eradicates it from the dataset’s feature space. Only non-attack data is forwarded to the onion routing network, which offers triple encryption to encrypt IoT data. As the onion routing only processes non-attack data, it is less computationally expensive than other baseline works. Moreover, each onion router is associated with blockchain nodes that store the verifying tokens of IoT data. The proposed architecture is evaluated using performance parameters, such as accuracy, precision, recall, training time, and compromisation rate. In this proposed work, SVM outperforms by achieving 97.7\% accuracy.

Wireless Sensor Networks (WSN s) have gained prominence in technology for diverse applications, such as environmental monitoring, health care, smart agriculture, and industrial automation. Comprising small, low-power sensor nodes that sense and collect data from the environment, process it locally, and communicate wirelessly with a central sink or gateway, WSN s face challenges related to limited energy resources, communication constraints, and data processing requirements. This paper presents a comprehensive review of the current state of research in WSN s, focusing on aspects such as network architecture, communication protocols, energy management techniques, data processing and fusion, security and privacy, and applications. Existing solutions are critically analysed regarding their strengths, weaknesses, research gaps, and future directions for WSNs.

The notion that ships, marine vessels and off-shore structures are digitally isolated is quickly disappearing. Affordable and accessible wireless communication technologies (e.g., short-range radio, long-range satellite) are quickly removing any air-gaps these entities have. Commercial, defence, and personal ships have a wide range of communication systems to choose from, yet some can weaken the overall ship security. One of the most significant information technologies (IT) being used today is satellite-based communications. While the backbone of this technology is often secure, third-party devices may introduce vulnerabilities. Within maritime industries, the market for satellite communication devices has also grown significantly, with a wide range of products available. With these devices and services, marine cyber-physical systems are now more interconnected than ever. However, some of these off-the-shelf products can be more insecure than others and, as shown here, can decrease the security of the overall maritime network and other connected devices. This paper examines the vulnerability of an existing, off-the-shelf product, how a novel attack-chain can compromise the device, how that introduces vulnerabilities to the wider network, and then proposes solutions to the found vulnerabilities.

In wireless security, cognitive adversaries are known to inject jamming energy on the victim’s frequency band and monitor the same band for countermeasures thereby trapping the victim. Under the class of cognitive adversaries, we propose a new threat model wherein the adversary, upon executing the jamming attack, measures the long-term statistic of Kullback-Leibler Divergence (KLD) between its observations over each of the network frequencies before and after the jamming attack. To mitigate this adversary, we propose a new cooperative strategy wherein the victim takes the assistance for a helper node in the network to reliably communicate its message to the destination. The underlying idea is to appropriately split their energy and time resources such that their messages are reliably communicated without disturbing the statistical distribution of the samples in the network. We present rigorous analyses on the reliability and the covertness metrics at the destination and the adversary, respectively, and then synthesize tractable algorithms to obtain near-optimal division of resources between the victim and the helper. Finally, we show that the obtained near-optimal division of energy facilitates in deceiving the adversary with a KLD estimator.

Current threat modeling methods focus on understanding the protected network from the perspective of the owners of those networks rather than on comprehensively understanding and integrating the methodology and intent of the threat. We argue that layering the human factors of the adversary over the existing threat models increases the ability of cybersecurity practitioners to truly understand possible threats. Therefore, we need to expand existing adversary and threat modeling approaches in cyberspace to include the representation of human factors of threats, specifically motivations, biases, and perceptions. This additional layer of modeling should be informed by an analysis of cyber threat intelligence reporting. By creating and adopting this expanded modeling, cybersecurity practitioners would have an understanding of how an adversary views their network, which would expand their ability to understand how their network is most likely to be attacked.

The rapid growth of communication networks, coupled with the increasing complexity of cyber threats, necessitates the implementation of proactive measures to protect networks and systems. In this study, we introduce a federated learning-based approach for cyber threat hunting at the endpoint level. The proposed method utilizes the collective intelligence of multiple devices to effectively and confidentially detect attacks on individual machines. A security assessment tool is also developed to emulate the behavior of adversary groups and Advanced Persistent Threat (APT) actors in the network. This tool provides network security experts with the ability to assess their network environment s resilience and aids in generating authentic data derived from diverse threats for use in subsequent stages of the federated learning (FL) model. The results of the experiments demonstrate that the proposed model effectively detects cyber threats on the devices while safeguarding privacy.

Intelligent security system is an important part of intelligent site construction, which directly affects the life safety of operators and the level of engineering supervision. Traditional security communication systems for construction, mineral mining and other fields have problems such as small network coverage, low capacity, short terminal life and relatively simple function. According to the application scenarios and business requirements of intelligent security system, this paper uses LoRa AD-hoc networking technology to carry out the network architecture research and key technology design of intelligent security AD-hoc networking system. Further, the detailed design of the embedded software of the system terminal and gateway is completed, and the functions of physical sign monitoring, danger warning and terminal positioning are realized.

Low probability of detection (LPD) has recently emerged as a means to enhance the privacy and security of wireless networks. Unlike existing wireless security techniques, LPD measures aim to conceal the entire existence of wireless communication instead of safeguarding the information transmitted from users. Motivated by LPD communication, in this paper, we study a privacy-preserving and distributed framework based on graph neural networks to minimise the detectability of a wireless ad-hoc network as a whole and predict an optimal communication region for each node in the wireless network, allowing them to communicate while remaining undetected from external actors. We also demonstrate the effectiveness of the proposed method in terms of two performance measures, i.e., mean absolute error and median absolute error.

Vehicular Ad Hoc Networks (VANETs) have the capability of swapping every node of every individual while driving and traveling on the roadside. The VANET-connected vehicle can send and receive data such as requests for emergency assistance, current traffic conditions, etc. VANET assistance with a vehicle for communication purposes is desperately needed. The routing method has the characteristics of safe routing to repair the trust-based features on a specific node.When malicious activity is uncovered, intrusion detection systems (IDS) are crucial tools for mitigating the damage. Collaborations between vehicles in a VANET enhance detection precision by spreading information about interactions across their nodes. This makes the machine learning distribution system feasible, scalable, and usable for creating VANET-based cooperative detection techniques. Privacy considerations are a major impediment to collaborative learning due to the data flow between nodes. A malicious node can get private details about other nodes by observing them. This study proposes a cooperative IDS for VANETs that safeguards the data generated by machine learning. In the intrusion detection phase, the selected optimal characteristics is used to detect network intrusion via a hybrid Deep Neural Network and Bidirectional Long Short-Term Memory approach. The Trust-based routing protocol then performs the intrusion prevention process, stopping the hostile node by having it select the most efficient routing path possible.

Named Data Networking (NDN) has been considered a promising network architecture for Vehicular Ad Hoc Networks (VANETs), what became known as Vehicular Named-Data Networking (VNDN). This new paradigm brings the potential to improve Vehicle-to-Vehicle (V2V) and Vehicle-to-Infrastructure (V2I) that are inefficient in urban intelligent transport scenarios. Despite the advantages, VNDN brings inherent problems, such as the routing interest packages on NDN, which causes serious problem in the vehicular environment. The broadcast storm attack results in a huge amount of packet loss, provoking transmission overload. In addition, the link disconnection caused by the highly dynamic topology leads to a low package delivery rate. In this article, we propose a strategy for forwarding packages of interest in VNDN networks, using fuzzy logic to mitigate the broadcast storm. The proposal also aims to avoid packet collision and efficient data recovery, which the approach is based on metrics such as the nodes distance, the link stability and the signal quality. The results show a reduction in the number of Interest and Data packets without disrupting network performance maintaining adequate Interest delays.

One of the popular networks highly used for creating various Adhoc network applications is Mobile Ad hoc Networks, which are vulnerable to various security attacks, one of which is the blackhole attack. One of the networks that come under MANET is the Vehicular Adhoc network. It uses multi-hop data transmission, which provides various pathways to malicious attacks. One of the attacks, non-identifiable easily, is a blackhole attack, a category of DoS attack. Earlier research methods provided different algorithms for identifying and detecting individual attacks or standard security methods. At the same time, the accuracy of malicious activity detection and elimination is not up to the mark. In which a malevolent node misleadingly publicizes itself as having the shortest path to a destination, causing other nodes to send their data to it, which the attacker discards. This paper proposes a genetic algorithm-based approach for detecting blackhole attacks in VANETs. Our approach uses a combination of network metrics, such as network throughput and end-to-end delay, and genetic algorithms to identify malicious nodes. The genetic algorithm is used to optimize the selection of network metrics and determine the weights given to each metric in the detection process. Simulation results show that our approach effectively detects blackhole attacks with high accuracy and low false positive rates.

At present, the application of wireless Ad hoc network in the field of mobile security inspection is in its infancy, and the network security protection means for the power industry are still insufficient, which is highlighted by the lack of efficient security authentication means for Ad hoc network, and it is difficult to completely eliminate security risks such as illegal terminal intrusion, data counterfeiting and tampering. A decentralized security authentication scheme suitable for Ad hoc network is designed, which can solve the security trust transfer problem on the variable network topology. Under any network route, the security trust is transferred to the proxy node step by step through multiple peer authentication, and the authentication chain is eUEblished between the digital intelligence edge proxy device, the proxy node and the node to be accessed. On the one hand, it can effectively solve the counterfeit problem of A-nodes and proxy nodes; on the other hand, it can greatly reduce the problem of reduced security authentication efficiency caused by deepening network hierarchy.

The new power system puts forward higher requirements for the communication interconnection of power equipment, especially in power areas that are difficult to cover by public networks and private power networks. As an efficient means, although building power communication ad hoc network has the advantages of low cost and flexibility, it puts forward higher requirements for the security of power ad hoc networks. This paper proposes a lightweight and secure access method for power WIFI to better meet the real-time requirements of power ad hoc networks. Based on the analysis of STA and AP flexible networking switching modes of WIFI ad hoc network system, this paper focuses on the security challenges of power WIFI ad hoc network system. Meanwhile, according to the environmental characteristics of the power ad hoc network, we simplify and improve the classic WIFI secure communication in three stages: Scanning, link authentication, and association, to improve lightweight and secure access to power WIFI. The secure access example of power ad hoc network of multiple nodes proves the effectiveness of the proposed method.

Information-Centric Networking (ICN) has emerged as a perfect match to support data-driven applications. Typically, ICN ensures data integrity and authenticity, by provisioning signed and verifiable data packets. Nonetheless, the ICN cryptography-based security scheme entails increased computational and communication cost, while also necessitates continuous connectivity to the infrastructure. We claim that this security approach requires supportive mechanisms to perform adequately in scenarios involving disruptive connectivity and short-term communication. In this paper, we investigate the applicability of two security approaches, namely the in-force cryptographybased approach and a ‘lighter’ reputation-based one, in ad hoc information-centric networks, and aim to identify the pros and cons of each solution. Our experiments rely on a scenario deemed appropriate for the particular research objective: we selected an ICN-based Flying Ad hoc Network (FANET). We assess the impact of intermittent connectivity, as well as, the associated computational and communication cost, and the dynamics of mobility. Our results demonstrate that the reputation-based approach allows for building trust relations in a fast and lightweight manner, but without requiring permanent connectivity to trusted third parties. Therefore, we argue that the standard ICN security system can be consolidated by integrating reputation-based trust as an essential complementary mechanism.

Unmanned aerial vehicles (UAVs) can be deployed and managed in a variety of applications with the help of flying ad hoc networks, or FANETs. However, the dynamically changing topology in FANET has raised significant challenges, mainly related to the insurance of security as a required service for the optimal performance of FANET networks. Blockchain technology has recently been used as an innovative solution to improve FANET security, due to its main characteristics such as transparency, decentralization, and tamper-proof nature. In this poster, we detail some current applications of Blockchain to secure FANET including military, surveillance, and Industry 4.0 services. Finally, we discuss some of the common issues associated with the application of Blockchain on FANET networks.

Flying Ad-hoc Networks (FANET) is an evolving phenomenon in the types of ad-hoc networks, which connects Multiple UAVs (Unmanned Aerial Vehicles) or drones. It is a rapidly deployable, infrastructure-less, self-configurable, and flexible communication environment for data transmission among the multi-UAVs and the Base Station (BS). As a result of technological advancement, the deployment of Multi-UAV networks or FANET has increased. Particularly in life-threatening applications like disaster management and military operations, this kind of ad-hoc network will be highly beneficial. Due to its characteristics of infrastructure-less and non-hierarchical behavior, FANETs faces several security issues in their flexible data communication. Since these kinds of networks are significantly emerging, there is a vital need to establish a threat model capable of identifying vulnerabilities, quantifying risks, and addressing them. In Existing observations, these FANET environment are highly vulnerable to any kind of security threats which in turn degrades the overall performance of the network. Securing the data packets in FANET communication is a crucial task because the nodes involved in this network are movable. Malicious nodes can compromise the confidentiality, availability, and integrity of the network by intruding and modifying data or discarding network packets. In this article, the classification of attacks and several security issues for the FANETs are highlighted. Then the experimental analysis of Packet-loss based detection and Content-Modification detection in the FANETs are implemented and discussed using Omnet++ simulation tool.

This paper investigates the output feedback security control problem of switched nonlinear systems (SNSs) against denial-of-service (DoS) attacks. A novel switched observer-based neural network (NN) adaptive control algorithm is established, which guarantees that all the signals in the closed-loop system remain bounded. Note that when a DoS attacker is active in the Sensor-Controller channel, the controller cannot acquire accurate information, which leads to the standard backstepping technique not being workable. A set of NN adaptive switching-like observers is designed to tackle the obstacle for each subsystem. Further, by combining the proposed observer with the backstepping technique, an NN adaptive controller is constructed and the dynamic surface control method is borrowed to surmount the complexity explosion phenomenon. Finally, an illustrative example is provided to demonstrate the effectiveness of the proposed control algorithm.

Adaptive security is considered as an approach in cybersecurity that analyzes events and against events and behaviors to protect a network. This study will provide details about the different algorithms being used to secure networks. These approaches are driven by a small quantity of labeled data and a massive amount of unlabeled data. In this context, contemporary semi-supervised learning strategies base their operations on the assumption that the distributions of labeled and unlabeled data are comparable. This assumption has a substantial influence on how well these strategies perform overall. If unlabeled data contain information that does not belong to a particular category, the efficiency of the system will deteriorate.

The term "Internet of things (IoT) security" refers to the software industry concerned with protecting the IoT and connected devices. Internet of Things (IoT) is a network of devices connected with computers, sensors, actuators, or users. In IoT, each device has a distinct identity and is required to automatically transmit data over the network. Allowing computers to connect to the Internet exposes them to a number of major vulnerabilities if they are not properly secured. IoT security concerns must be monitored and analyzed to ensure the proper working of IoT models. Protecting personal safety while ensuring accessibility is the main objective of IoT security. This article has surveyed some of the methods and techniques used to secure data. Accuracy, precision, recall, f1 score, and area under the Receiver Operating Characteristic Curve are the assessment metrics utilized to compare the performance of the existing techniques. Further the utilization of machine learning algorithms like Decision Tree, Random Forest, and ANN tests have resulted in an accuracy of 99.4\%. Despite the results, Random Forest (RF) performs significantly better. This study will help to gain more knowledge on the smart home automation and its security challenges.