National and local governments must continuously adapt counter-terrorism strategies to new and evolving threats. With limited budgets, security architects and planners across the world face the same recurrent challenge: specifying a portfolio of effective measures and detailing where and when to deploy those. To perform this difficult task, methods have been proposed that apply a risk-based approach to solve this class of optimisation problems. However, many of those methods either ignore important aspects of the attacker-defender interaction or are too complicated to appeal to practitioners.Aimed at security specialists, this article uses simulation experiments to examine current responses to an unsophisticated but increasingly frequent manifestation of terrorism: vehicle and knife attacks. In particular, it shows that the optimal configuration of Armed Response Vehicles (ARVs) and measures of Crime Prevention through Environmental Design (CPTED) depends on whether offenders conduct hostile reconnaissance, the way they react to 2 the presence of security measures, and what attributes of the opportunity structure influence their actions most.Through this study, we demonstrate how information about offender displacement can be used to improve security strategies. We found that security architects and planners should not necessarily prioritise the most crowded and high-profile targets but could also consider deploying CPTED measures to protect nearby secondary targets. As we review the information underpinning our decision-making model, practical challenges in modelling displacement are then highlighted. Finally, a more general observation is made that, despite strong conceptual differences, ARVs and CPTED measures are, in fact, interdependent.

In this paper, we propose JABBIC lookups, a telemetrybased system for malware triage at the interface between proprietary reputation score systems and malware analysts. JABBIC uses file download telemetry collected from client protection solutions installed on endhosts to determine the threat level of an unknown file based on telemetry data associated with files already known to be malign. We apply word embeddings, and semantic and relational similarities to triage potentially malign files following the intuition that, while single elements in a malware download might change over time, their context, defined as the semantic and relational properties between the different elements in a malware delivery system (e.g., servers, autonomous systems, files) does not change as fast. To this end, we show that JABBIC can leverage file download telemetry to allow security vendors to manage the collection and analysis of unknown files from remote end-hosts for timely processing by more sophisticated malware analysis systems. We test and evaluate JABBIC lookups with 33M download events collected during October 2015. We show that 85.83% of the files triaged with JABBIC lookups are part of the same malware family as their past counterpart files. We also show that, if used with proprietary reputation score systems, JAB-BIC can triage as malicious 55.1% of files before they are detected by VirusTotal, preceding this detection by over 20 days.