Cyber situational awareness – A systematic review of the literature

Franke, Ulrik; Brynielsson, Joel

doi:10.1016/j.cose.2014.06.008

Cited by 259 publications

(165 citation statements)

References 22 publications

Supporting

Mentioning

161

Contrasting

Unclassified

Order By: Relevance

“…This statement has been reinforced in a recent systematic literature review performed in [5], where a set of application areas for SA have been identified. These areas include ICS, command and control systems, and operations management.…”

Section: Related Workmentioning

confidence: 99%

“…Cyber SA can be defined as the part of SA that is concerned with cyber environments [5]. Following, we elaborate on cyber SA in utility networks, and further continue with the introduction of threat awareness (TA) architecture in the context of cyber SA.…”

Section: B Situational Awarenessmentioning

confidence: 99%

“…Cyber SA is crucial to apply in networks in order to safeguard sensitive data, sustain fundamental operations, and protect infrastructures. Furthermore, cyber SA was identified as an attractive approach by the FOI Swedish Defence Research Agency, which is capable of copying with the complexity provided by ICS [5]. Cyber SA can be applied as a three-phase process [18,19].…”

Section: Cyber Situational Awarenessmentioning

confidence: 99%

“…In addition to these research approaches there are several other towards achieving SA [5], which mostly make use of anomaly detection algorithms, intrusion detection, identification of networks traffic regularity, etc. Nevertheless, none of them cope with issues stemming from a non-technical point of view, and are based on the fusion of data gathered from various sensors or agents [6].…”

Section: Related Workmentioning

confidence: 99%

See 3 more Smart Citations

Threat awareness for critical infrastructures resilience

Gouglidis

Green

Busby

et al. 2016

2016 8th International Workshop on Resilient Networks Design and Modeling (RNDM)

View full text Add to dashboard Cite

Abstract-Utility networks are part of every nation's critical infrastructure, and their protection is now seen as a high priority objective. In this paper, we propose a threat awareness architecture for critical infrastructures, which we believe will raise security awareness and increase resilience in utility networks. We first describe an investigation of trends and threats that may impose security risks in utility networks. This was performed on the basis of a viewpoint approach that is capable of identifying technical and non-technical issues (e.g., behaviour of humans). The result of our analysis indicated that utility networks are affected strongly by technological trends, but that humans comprise an important threat to them. This provided evidence and confirmed that the protection of utility networks is a multi-variable problem, and thus, requires the examination of information stemming from various viewpoints of a network. In order to accomplish our objective, we propose a systematic threat awareness architecture in the context of a resilience strategy, which ultimately aims at providing and maintaining an acceptable level of security and safety in critical infrastructures. As a proof of concept, we demonstrate partially via a case study the application of the proposed threat awareness architecture, where we examine the potential impact of attacks in the context of social engineering in a European utility company.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: B Situational Awarenessmentioning

confidence: 99%

Section: Cyber Situational Awarenessmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

Threat awareness for critical infrastructures resilience

Gouglidis

Green

Busby

et al. 2016

2016 8th International Workshop on Resilient Networks Design and Modeling (RNDM)

View full text Add to dashboard Cite

show abstract

“…The current approach for device and service identification focus on very specific networks, e.g., industrial control systems, or selected subset of services [1,2] which reduces their value in modern networks described above. Manual evaluation by security expert is still prevalent in the field of dependency detection and importance estimation.…”

Section: Introductionmentioning

confidence: 99%

Situational Awareness: Detecting Critical Dependencies and Devices in a Network

Laštovička

Čeleda

2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Large-scale networks consisting of thousands of connected devices are like a living organism, constantly changing and evolving. It is very difficult for a human administrator to orient in such environment and to react to emerging security threats. With such motivation, this PhD proposal aims to find new methods for automatic identification of devices, the services they provide, their dependencies and importance. The main focus of the proposal is to find novel approaches to building cyber situational awareness in an unknown network for the purpose of computer security incident response. Our research is at the initial phase and will contribute to a PhD thesis in four years.

show abstract

GraphBAD: A general technique for anomaly detection in security information and event management

Parkinson

Vallati

Crampton

et al. 2018

Concurrency and Computation

View full text Add to dashboard Cite

The reliance on expert knowledge-required for analysing security logs and performing security audits-has created an unhealthy balance, where many computer users are not able to correctly audit their security configurations and react to potential security threats. The decreasing cost of IT and the increasing use of technology in domestic life are exacerbating this problem, where small companies and home IT users are not able to afford the price of experts for auditing their system configuration. In this paper, we present GraphBAD, a graph-based analysis tool that is able to analyse security configurations in order to identify anomalies that could lead to potential security risks. GraphBAD, which does not require any prior domain knowledge, generates graph-based models from security configuration data and, by analysing such models, is able to propose mitigation plans that can help computer users in increasing the security of their systems. A large experimental analysis, conducted on both publicly available (the well-known KDD dataset) and synthetically generated testing sets (file system permissions), demonstrates the ability of GraphBAD in correctly identifying security configuration anomalies and suggesting appropriate mitigation plans. KEYWORDSanomaly detection, graph structure, log files, security auditing, SIEM INTRODUCTIONAuditing security configurations is the process of searching for anomalies that potentially expose a vulnerability of a considered system. The term Security Information and Event Management (SIEM) is often used to describe the process of monitoring audit logs and security configurations to identify vulnerabilities. Given the complexity of the task, there is a heavy reliance on expert knowledge, which is required for understanding the different security configurations. This reliance has two main drawbacks: first, expert knowledge can be incomplete or erroneous; second, the high cost of security experts makes it infeasible for many users to correctly configure the security of their Information Technology (IT) systems. Therefore, in many cases, unseen weaknesses, which can be exploited, will remain in the configuration. Clearly, auditing security configurations is a critical problem for organisations that significantly rely on their IT infrastructure for undertaking business. For this reason, many companies frequently employ a third party security auditing company to examine their IT infrastructure to identify weaknesses and suggest suitable mitigation plans (named as penetration testing 1,2 ). Although businesses are prepared to pay a premium for maintaining their security, the average home IT user or small companies are left to maintain their own IT security. Furthermore, the decreasing cost of IT and the increasing use of technology in domestic life are exacerbating this problem.These limitations are heightened by the following factors. (i) The complexity of computational infrastructure-the cyber-physical platform on which security is attained-is increasing, and the technological landscape i...

show abstract

Cyber situational awareness – A systematic review of the literature

Cited by 259 publications

References 22 publications

Threat awareness for critical infrastructures resilience

Threat awareness for critical infrastructures resilience

Situational Awareness: Detecting Critical Dependencies and Devices in a Network

GraphBAD: A general technique for anomaly detection in security information and event management

Contact Info

Product

Resources

About