Incorporating Cyber Threat Intelligence into Complex Cyber-Physical Systems: A STIX Model for Active Buildings

Abstract

Active buildings can be briefly described as smart buildings with distributed and renewable energy resources able to energise other premises in their neighbourhood. As their energy capacity is significant, they can provide ancillary services to the traditional power grid. As such, they can be a worthy target of cyber-attacks potentially more devastating than if targeting traditional smart buildings. Furthermore, to handshake energy transfers, they need additional communications that add up to their attack surface. In such a context, security analysis would benefit from collection of cyber threat intelligence (CTI). To facilitate the analysis, we provide a base active building model in STIX in the tool cyberaCTIve that handles complex models. Active buildings are expected to implement standard network security measures, such as intrusion-detection systems. However, to timely respond to incidents, real-time detection should promptly update CTI, as it would significantly speed up the understanding of the nature of incidents and, as such, allow for a more effective response. To fill this gap, we propose an extension to the tool cyberaCTIve with a web service able to accept (incursion) feeds in real-time and apply the necessary modifications to a STIX model of interest.

Model Design of Intrusion Detection System on Web Server Using Machine Learning Based

“…Cybercriminals consistently explore vulnerabilities in systems, applications, and even human behaviour. The threat spectrum spans from relatively harmless spam emails to highly destructive ransomware attacks, data breaches, and advanced persistent threats [10], [11] The rapid digitalization in Indonesia, characterized by a booming e-commerce market, growing tech startups, and increasing governmental digital services, makes the nation a notable target for cyber threats. Indonesia's cyber landscape has witnessed rising incidents of phishing, web defacements, and ransomware attacks.…”

“…Indonesia's cyber landscape has witnessed rising incidents of phishing, web defacements, and ransomware attacks. Additionally, as local businesses migrate to cloud-based platforms and offer digital services, their web servers become potential targets, underscoring the need for robust intrusion detection mechanisms [12].…”