El detectar eventos disruptivos usando sensores COTS como los utilizados en smartphones representa un gran desafío pero también una oportunidad interesante. En este artículo se presenta una arquitectura de sistema de tiempo real crítico, jerárquica y distribuida, que hace uso de smartphones que actúan como sensores a través de una aplicación de bajo consumo de energía que convierte a sus acelerómetros en acelerógrafos. Los smartphones desplegados forman una red de sensores que detecta, analiza y notifica un pico sísmico. El sistema optimiza cálculos distribuidos y capacidades de comunicación en smartphones para proveer tiempo extra para alertas tempranas en escenarios de desastre de tipo sísmico, aunque puede ser empleada como solución a otros desastres naturales. Se propone una solución innovadora de bajo coste que realiza análisis tanto espaciales como temporales, no presentes en otros trabajos, lo cual lo hace más preciso y personalizable permitiendo adaptarse a las características geográficas de la zona, de red, y recursos tanto humanos como monetarios. La arquitectura ha sido validada mediante una extensa evaluación, consiguiendo como resultado notificaciones tempranas que adelantan en decenas de segundos el pico máximo del sismo en la zona del epicentro y aún más para zonas más alejadas; y la considerable reducción de falsas alarmas. Adicionalmente la arquitectura propuesta incluye una administración post-evento que mejora la capacidad operativa, logística y de telecomunicaciones desde un solo nivel central, y al mismo tiempo, mantiene al usuario informado de centros de refugios cercanos, mejores rutas, rutas seguras para una mejor decisión.

This paper presents a different and innovative proposal to detect seismic events, a solution that uses smartphones as opportunistic sensor nodes to obtain real-time knowledge of the community environment through a hierarchical architecture, taking advantage of this growing trend. A distributed low-cost network formed of smartphones capable of detect a seismic-peak with a high accuracy by means of converting accelerometers in accelerographs optimizing distributed calculations in these. A server which considers time and spatial analyses not present in another works, making it more precise and customizable, coupling it to the features of the geographical zone, network and resources. Validated by extensive evaluation, the most relevant results have been the improvement in notifications delivery about a seismic-peak 12 seconds earlier in the epicenter zone, the reduced consumption of mobile battery and the reduction in the number of false positives. In addition, this challenge becomes an great opportunity giving people as much as tens of seconds warning before an earthquake occurs in places far from the epicenter.

The number and the diversity in nature of daily cyber-attacks have increased in the last few years, and trends show that both will grow exponentially in the near future. Critical Infrastructures (CI) operators are not excluded from these issues; therefore, CIs’ Security Departments must have their own group of IT specialists to prevent and respond to cyber-attacks. To introduce more challenges in the existing cyber security landscape, many attacks are unknown until they spawn, even a long time after their initial actions, posing increasing difficulties on their detection and remediation. To be reactive against those cyber-attacks, usually defined as zero-day attacks, organizations must have Threat Hunters at their security departments that must be aware of unusual behaviors and Modus Operandi. Threat Hunters must face vast amounts of data (mainly benign and repetitive, and following predictable patterns) in short periods to detect any anomaly, with the associated cognitive overwhelming. The application of Artificial Intelligence, specifically Machine Learning (ML) techniques, can remarkably impact the real-time analysis of those data. Not only that, but providing the specialists with useful visualizations can significantly increase the Threat Hunters’ understanding of the issues that they are facing. Both of these can help to discriminate between harmless data and malicious data, alleviating analysts from the above-mentioned overload and providing means to enhance their Cyber Situational Awareness (CSA). This work aims to design a system architecture that helps Threat Hunters, using a Machine Learning approach and applying state-of-the-art visualization techniques in order to protect Critical Infrastructures based on a distributed, scalable and online configurable framework of interconnected modular components.

No abstract

Cyberattacks are increasing in number and diversity in nature daily, and the tendency for them is to escalate dramatically in the forseeable future, with critical infrastructures (CI) assets and networks not being an exception to this trend. As time goes by, cyberattacks are more complex than before and unknown until they spawn, being very difficult to detect and remediate. To be reactive against those cyberattacks, usually defined as zero-day attacks, cyber-security specialists known as threat hunters must be in organizations’ security departments. All the data generated by the organization’s users must be processed by those threat hunters (which are mainly benign and repetitive and follow predictable patterns) in short periods to detect unusual behaviors. The application of artificial intelligence, specifically machine learning (ML) techniques (for instance NLP, C-RNN-GAN, or GNN), can remarkably impact the real-time analysis of those data and help to discriminate between harmless data and malicious data, but not every technique is helpful in every circumstance; as a consequence, those specialists must know which techniques fit the best at every specific moment. The main goal of the present work is to design a distributed and scalable system for threat hunting based on ML, and with a special focus on critical infrastructure needs and characteristics.