Advanced Cybersecurity Services Design

1. Introduction

Cybersecurity technologies have been researched extensively in the last few years in order to face the current threat landscape, which has shown a continuous growth in the quality and quantity of attacks that are oriented toward any potentially vulnerable items (people, software, firmware, hardware, etc.). Thus, there is a need for more sophisticated cybersecurity services that are able to combine different technologies to cover all the different aspects that such attacks may utilize.

These advanced cybersecurity services must enrich the different areas of cybersecurity, including cyberattacks prevention, detection and response, as well as advanced supporting infrastructures for these services. Nowadays, most of the prevention initiatives rely on increasing users’ awareness, in order to prevent social engineering attacks, but there are also some technological areas that can complement a security architecture for the prevention of cyberattacks. In the area of attacks detection, machine learning-based algorithms are one of the most promising techniques for anomaly detection, as well as the use of Cyber Threats Intelligence in order to share knowledge about the attacks. In the area of supporting infrastructure, there is an increasing interest in leveraging traditional cryptographic algorithms with new approaches, such as homomorphic encryption when privacy is concerned, quantum and post-quantum cryptography, and the use of blockchain technologies for different advanced cybersecurity services.

2. The Present Issue

This Special Issue includes 14 contributions that cover these areas. It includes two review contributions: [1] provides a survey with an overview of the state of the art in detecting and projecting cyberattack scenarios, i.e., approaches that automate the analysis of alerts to detect large-scale attacks and predict the attacker’s next steps, with a focus on evaluation and the corresponding metrics. On the other hand, Ref. [2] reviews a specific application area, namely the identification and discussion of the relation between the safety of Autonomous Haulage Systems in the mining environment and both cybersecurity and communication; furthermore, the article highlights their challenges and open issues.

The Special Issue also includes 12 research contributions. It includes several contributions related to advanced services for Intrusion Detection Systems. In [3], the use of different machine learning models depending on the specific scenarios and datasets is addressed, as well as the design of an automatic dynamic model selector for anomalies detections scenarios. The article in [4] focuses on the use of deep learning techniques for the detection of zero-day attacks, with an autoencoder implementation that is able to monitor the rate of false-negative detection rates. In [5], an integrated scalable framework is proposed that aims at efficiently detecting anomalous events on large amounts of unlabelled data logs. Detection is supported by clustering and classification methods that take advantage of parallel computing environments using two models: one based on K-Means and the other based on a XGBoost system implementing a gradient tree boosting algorithm. In [6] a spatiotemporal characterization of cyberattacks for detecting cyberattacks is proposed using a stochastic graph model to represent these cyberattacks in time and space. In [7], the area of industrial control networks is addressed with a two-stage intrusion detection system, including a traffic prediction model and an anomaly detection model. A chatbot is proposed in [8] for detecting online sex offenders, based on an Artificial Conversational Entity (ACE) that connects to different online chat services to start a conversation. The ACE was designed using generative and rule-based models in charge of generating the posts and replies that constitute the conversation from the chatbot side. The proposed solution also includes a module to analyse the conversations performed by the chatbot and calculate a set of 25 features that describes the suspect’s behaviour. Finally, Ref. [9] introduces Insight2, an open-source platform for manipulating both streaming and archived network flow data in real time in order to understand normal activity and identify abnormal activity.

This Special Issue also contains two protection-related research contributions: [10] proposes a countermeasure for on-off web defacement attacks with a random monitoring strategy, designing and validating two specific strategies for such a purpose. On the other hand, Ref. [11] addressed the evaluation of multi-path routing as a protection feature against network attacks and failures, with the study of the following two different models: first-hop multi-path and multi-hop multi-path routing.

The Special Issue also includes several contributions about related technologies for providing support to the design of advanced cybersecurity services: [12] provides an analysis of a partially homomorphic encryption algorithm for the design of services needing privacy-preserving functionalities. In [13] a system for using blockchain technologies for the accountability of cybersecurity audit results is proposed in order to boost the automation of both digital evidence gathering, auditing, and controlled information exchange. The study in [14] focuses on the area of Cyber-Threat Intelligence Sources, and Formats and Languages, while investigating the landscape of the available formats and languages, along with the publicly available sources of threat feeds, how these are implemented and their suitability for providing rich cyber-threat intelligence.

3. Future Directions

Cybersecurity is nowadays a race between the attackers and the different digital technologies actors (users, manufacturers, IT companies, etc.). A new technology, or a new protection system is usually followed by a new attacker method, so there is a need for new services based on new technologies that might make possible the establishment of a gap with attackers, increasing the confidence on the usage of business and personal services by users. Therefore, there is a need to extend the research on these areas with the adequate support of public and private entities in order to generate new research proposals that might be able to find the different steps to establish a gap with the attackers. The proposals in this Special Issue might provide small steps in pursuit of this aim, but there is a need for many more initiatives to be designed, tested and validated in order to make secure technologies available for everybody.