Study finds companies react negatively to material cybersecurity incident disclosures.
problem Understanding market reactions to cybersecurity incidents.
method Examined daily stock price movements of companies disclosing material cybersecurity incidents.
result Companies tend to experience negative price reactions after disclosing material cybersecurity incidents.
Study evaluates early-stage cybersecurity firms' performance using Crunchbase data.
problem Assessing performance of early-stage cybersecurity startups.
method Empirical analysis of 19 cybersecurity sectors using Crunchbase data.
result Significant variations in capital raised and post-money valuations across cybersecurity sectors.
Model for optimal cybersecurity investment considering clustered cyberattacks.
problem Optimal investment in cybersecurity to reduce system vulnerability under clustered cyberattacks.
method Developed a continuous-time stochastic model using a Hawkes process, extended Gordon-Loeb model, solved as a Markovian stochastic optimal control problem.
result Investment policies that account for attack clustering lead to more effective and responsive strategies, improving upon static and Poisson-based approaches.
Paper introduces a framework for managing cyber risk with insurance and cybersecurity models.
problem Pervasive challenges in managing cyber risk, especially for capital allocation.
method Combines insurance frequency-severity models with cybersecurity cascade models for comprehensive cyber risk assessment. Facilitates informed capital allocation through a two-pillar framework.
result Demonstrates the necessity of comprehensive cost-benefit analysis for budget-constrained companies.
Paper uses ensemble learning for IoT cybersecurity anomaly detection.
problem Anomaly detection in IoT data is challenging due to heterogeneous device types.
method Bayesian hyperparameter optimisation for ensemble learning.
result Ensemble learning with Bayesian optimisation improves anomaly detection accuracy.
Introduces an artificial cyber lab to test and identify cyber resilience measures.
problem Systemic cyber risks and their control methods.
method Classical contagion models and artificial cyber lab simulations.
result Identified two classes of measures: security- and topology-based interventions.
Machine learning techniques are currently used extensively for automating various cybersecurity tasks. Most of these techniques utilize supervised learning algorithms that rely on training the algorithm to classify incoming data into different categories, using data encountered in the relevant domain. A critical vulner…
Develops a Bonus-Malus model for cyber risk insurance to incentivize cybersecurity.
problem Lack of effective insurance strategies to incentivize cybersecurity.
method Proposes a Bonus-Malus model and a mathematical model with a numerical algorithm.
result Demonstrates how a Bonus-Malus system resolves moral hazard and benefits the insurer.
This work develops agents to learn generalizable policies for dynamic network environments.
problem Real-world network topologies change due to attackers, defenders, or system failures, leading to failures in adaptive ACD systems.
method Developing agents to learn generalizable policies across dynamic network environments.
result Agents can learn robust policies for dynamic network topologies and diverse attackers.
TinyML models detect RF and cyber threats in spacecraft with low latency.
problem Detecting cyber-RF threats in autonomous spacecraft with low latency.
method Analysis of classical models (RF, LR, SVM, MLP) for latency-accuracy trade-offs.
result Logistic Regression achieves microsecond-level inference with minimal accuracy loss.
This paper optimizes cybersecurity resource allocation in networks with heterogeneous attacker and defender valuations.
problem Optimizing cybersecurity resource allocation in networks with heterogeneous attacker and defender valuations.
method Combining strategic behavior of players with contagion dynamics, a method is extended to determine optimal resource allocation based on simple network metrics weighted by risk profiles.
result The asymmetry between attacker and defender valuations drives optimal attack and defense strategies, shaping system resilience.
Paper tackles cybersecurity attack detection with an ensemble approach.
problem Challenges in multi-class classification for cyber security breaches.
method Designing a multi-node multi-class classification ensemble approach.
result Proposed approach outperforms full-data approach in multi-node data-censoring cases.
The paper shows supply chain features improve cyber risk prediction.
problem Predicting cyber risk from supply chain attributes.
method Machine learning, external supply chain features, AUC improvement.
result Supply chain network features improve AUC by 2.3%.
Online-iForest detects anomalies in streaming data efficiently.
problem Offline anomaly detection methods are impractical for streaming contexts.
method Online-iForest tracks evolving data processes in real-time without periodic retraining.
result Online-iForest outperforms all competitors in efficiency.
Anti-phishing aims to detect phishing content/documents in a pool of textual data. This is an important problem in cybersecurity that can help to guard users from fraudulent information. Natural language processing (NLP) offers a natural solution for this problem as it is capable of analyzing the textual content to per…
Model quantifies cyber-attacks' impact on firms and insurers.
problem Impact of cyber-attacks on firms' revenues and insurers' portfolios.
method Stochastic SIR model coupled with granular firm growth model.
result Predicts insurer needs to compensate up to two days of revenue in a 100-day incident.
To be prepared against cyberattacks, most organizations resort to security information and event management systems to monitor their infrastructures. These systems depend on the timeliness and relevance of the latest updates, patches and threats provided by cyberthreat intelligence feeds. Open source intelligence platf…
Survey of machine learning methods for Windows malware classification.
problem Difficulties in malware classification through data collection, labeling, feature creation, and selection.
method Review of current methods and challenges in malware classification.
result Discussion of constraints and unaddressed problems for machine learning in cybersecurity.
UN-AVOIDS visualizes and detects anomalies without needing labeled data.
problem The need for a unified framework to visualize and detect anomalies.
method UN-AVOIDS is an unsupervised, nonparametric approach that transforms data into a new space (NCDF) for both visualization and detection.
result UN-AVOIDS assigns invariant anomalous scores and achieves high AUC in detecting anomalies.
AutoYara generates effective Yara rules faster than humans.
problem Developing high-quality Yara rules for malware families is labor-intensive.
method Leverages biclustering on large n-grams to automate Yara rule generation.
result AutoYara reduces analyst workload by 44-86% and matches human performance.
The ever-growing big data and emerging artificial intelligence (AI) demand the use of machine learning (ML) and deep learning (DL) methods. Cybersecurity also benefits from ML and DL methods for various types of applications. These methods however are susceptible to security attacks. The adversaries can exploit the tra…
New framework uses conformal predictions for robust, scalable machine learning classification.
problem Developing robust and reliable machine learning models for classification.
method Introducing scalable classifiers linked to statistical order theory and probabilistic learning theory, defining a score function and conformal safety set.
result Demonstrated practical implications in cybersecurity for identifying DNS tunneling attacks.
This paper surveys ML applications in SG for cyberattacks.
problem Cyberattacks in smart grid due to advanced technologies.
method Comprehensive review of existing research in cyberattacks detection and mitigation.
result Machine learning is effective in detecting and mitigating cyberattacks.
Noise analysis detects backdoors in DNNs quickly.
problem Detecting backdoors in DNNs trained on compromised data.
method Noise-infused image titration curves to quantify robustness and detect backdoors.
result DNNs with backdoors are more sensitive to noise and reveal their targets.
Machine learning-based IDSs in ICS are vulnerable to adversarial attacks that can bypass them.
problem Adversarial attacks on machine learning-based IDSs in ICS can lead to undetected cyber attacks.
method Used Jacobian-based Saliency Map attack to generate adversarial samples and explored adversarial training to improve model robustness.
result Classification performance of supervised models decreased by 16-20 percentage points with adversarial samples, but improved with adversarial training.
Stream deinterleaving is an important problem with various applications in the cybersecurity domain. In this paper, we consider the specific problem of deinterleaving DNS data streams using machine-learning techniques, with the objective of automating the extraction of malware domain sequences. We first develop a gener…
A federated graph learning approach improves EV charging demand forecasting while protecting against cyberattacks.
problem Cybersecurity risk and data heterogeneity in EV charging demand forecasting.
method Federated Graph Neural Network (GNN) model with global attention mechanism and credit-based function.
result Enhanced robustness and prediction accuracy in EV charging demand forecasting.
DL models for MTS regression are vulnerable to adversarial attacks, posing risks in safety-critical applications.
problem Vulnerability of DL models to adversarial examples in MTS regression.
method Adversarial attack generation techniques from image classification were adapted for MTS.
result All state-of-the-art DL regression models (CNN, LSTM, GRU) are vulnerable to adversarial attacks.
Adversarial attacks can manipulate deep trading policies, compromising their performance.
problem Adversarial attacks can compromise deep reinforcement learning trading policies.
method Developed a threat model and proposed two attack techniques.
result Demonstrated the effectiveness of adversarial attacks against DQN trading agents.
New unsupervised methods for anomaly detection and clustering in structured and streaming data.
problem Anomaly detection and clustering in structured and streaming data.
method Preference Isolation Forest (PIF), Sliding-PIF, MultiLink, Online-iForest, MaxLogit.
result Methods outperform existing techniques on synthetic and real datasets.
Study shows data breaches cause significant financial losses for firms, especially in health sector.
problem Understanding the economic impact of cyber incidents on listed firms.
method Event study using abnormal returns over 2012-2022, adjusting for event-induced variance and residual cross-correlation.
result Data breaches cause significant financial losses for firms, especially in health sector.
GMM-HMMs improve malware classification compared to discrete HMMs.
problem Improving malware classification accuracy using GMM-HMM models.
method Used GMM-HMM models for opcode and entropy-based features comparison with discrete HMMs.
result GMM-HMMs generally improve significantly on entropy-based features classification results.
TechRank ranks companies and technologies based on investor preferences.
problem Estimating influence and ranking companies and technologies.
method Recursive algorithm based on a bi-partite graph with weighted nodes, incorporating investor preferences.
result Provides investors with a quantitative ranking of technologies for optimal portfolio design.
This paper shows diffusion models improve intrusion detection by purifying adversarial examples.
problem Adversarial examples mislead ML intrusion detection systems, leading to false alerts or evasion.
method Used diffusion models to purify adversarial examples in intrusion detection.
result Diffusion models enhance adversarial robustness in intrusion detection without significantly impacting normal performance.
Automates feature extraction from JSON data for machine learning.
problem Manual feature engineering for JSON data is laborious, lossy, and prone to bias.
method Automates feature extraction using Mill.jl and JsonGrinder.jl.
result Creates a differentiable machine learning model from raw JSON samples.
While the last few decades have witnessed a huge body of work devoted to inference and learning in distributed and decentralized setups, much of this work assumes a non-adversarial setting in which individual nodes---apart from occasional statistical failures---operate as intended within the algorithmic framework. In r…
Analysis of an organization's computer network activity is a key component of early detection and mitigation of insider threat, a growing concern for many organizations. Raw system logs are a prototypical example of streaming data that can quickly scale beyond the cognitive power of a human analyst. As a prospective fi…
Since the inception of Deep Reinforcement Learning (DRL) algorithms, there has been a growing interest in both research and industrial communities in the promising potentials of this paradigm. The list of current and envisioned applications of deep RL ranges from autonomous navigation and robotics to control applicatio…
Cybersecurity attacks are growing both in frequency and sophistication over the years. This increasing sophistication and complexity call for more advancement and continuous innovation in defensive strategies. Traditional methods of intrusion detection and deep packet inspection, while still largely used and recommende…
Deep Neural Network (DNN) workloads are quickly moving from datacenters onto edge devices, for latency, privacy, or energy reasons. While datacenter networks can be protected using conventional cybersecurity measures, edge neural networks bring a host of new security challenges. Unlike classic IoT applications, edge ne…
In this paper, we introduce a new gait segmentation method based on accelerometer data and develop a new distance function between two time series, showing novel and effectiveness in simultaneously identifying user and adversary. Comparing with the normally used Neural Network methods, our approaches use geometric feat…
Ever increasing number of Android malware, has always been a concern for cybersecurity professionals. Even though plenty of anti-malware solutions exist, a rational and pragmatic approach for the same is rare and has to be inspected further. In this paper, we propose a novel two-set feature selection approach based on …
C-PP-COAD detects anomalies with limited real data, reducing dependency on real calibration data.
problem Limited real calibration data for online anomaly detection.
method Context-aware prediction-powered conformal online anomaly detection (C-PP-COAD).
result Significantly reduces dependency on real calibration data without compromising FDR control.
A framework solves parametric families of MFGs efficiently.
problem Efficiently solving MFG systems with varying initial distributions and terminal costs.
method Operator learning framework for parametric families of MFGs.
result Accurate approximation for cybersecurity and quadratic MFGs.
Machine learning models, especially neural network (NN) classifiers, are widely used in many applications including natural language processing, computer vision and cybersecurity. They provide high accuracy under the assumption of attack-free scenarios. However, this assumption has been defied by the introduction of ad…
A framework combines unsupervised and semi-supervised AD using synthetic anomalies.
problem Improving anomaly detection in both unsupervised and semi-supervised settings.
method Proposes a new framework that uses both known and synthetic anomalies for training.
result Synthetic anomalies improve anomaly modeling in low-density regions and provide optimal convergence guarantees.
Paper proposes SDS for 5G security using machine learning.
problem Cybersecurity threats and expanding IoT in 5G networks.
method SDS uses machine learning, specifically a CNN with NAS, to detect anomalies.
result CNN achieved 100% accuracy in identifying benign traffic and 96.4% in detecting anomalies.
Paper analyzes cyber risk classifications for forecasting performance.
problem Lack of effective out-of-sample forecasting performance in current cyber risk classifications.
method Rolling window analysis using threshold weighted scoring functions.
result Dynamic and impact-based cyber risk classifiers outperform others in forecasting future cyber risk losses.