Improving Cyber Security Awareness and Training Programs with Data Analytics

ABSTRACT

This article it is a modest attempt to explore the issues facing cyber security awareness and training programs and potential benefits of using learning analytics, an emerging field in data analytics, for combining existing data sources to provide additional value to these programs. This article was written under the assumption that awareness and training are valid preventive controls and therefore the pros and cons of implementing such programs are not being discussed.     

The Cyber Threat to National Critical Infrastructures: Beyond Theory

ABSTRACT

Adversary threats to critical infrastructures have always existed during times of conflict, but threat scenarios now include peacetime attacks from anonymous computer hackers. Current events, including examples from Israel and Estonia, prove that a certain level of real-world disorder can be achieved from hostile data packets alone. The astonishing achievements of cyber crime and cyber espionage – to which law enforcement and counterintelligence have found little answer – hint that more serious cyber attacks on critical infrastructures are only a matter of time. Still, national security planners should address all threats with method and objectivity. As dependence on IT and the Internet grow, governments should make proportional investments in network security, incident response, technical training, and international collaboration.     

配电网用户侧异构电力物联设备网络风险量化评估

随着配电网用户侧异构电力物联设备(以下简称“配电网用户侧物联设备”)接入电力系统的规模逐步扩大,针对它的网络攻击将会对电力系统安全造成严重的破坏,配电网用户侧物联设备的网络风险评估由此成为了目前电力系统亟需解决的关键问题。首先,计及设备终端、移动应用、云端等各组件网络安全防护和终端运行特性,识别配电网用户侧物联设备网络风险评估指标,并结合改进的层次分析法和变异系数法对评估指标进行组合赋权。进而,依据设备网络风险概率以及设备被恶意攻击后对电力系统造成的物理后果,提出一种信息物理融合的配电网用户侧物联设备网络风险评估模型。最后,针对高风险的配电网用户侧物联设备,通过指标对标分析目前终端、移动应用、云端等各组件网络安全防护的薄弱环节,指明设备各组件网络安全防护亟待改进的方向。研究成果以期对用户侧电力物联网的建设以及安全防护提供一种有效的科学判据,从而降低用户侧电力物联网网络风险,确保电力系统运行安全。     

基于深度强化学习的多阶段信息物理协同拓扑攻击方法

随着智能电网的发展及通信设备不断引入到信息物理系统(cyber physical system,CPS)中,CPS正面临一种破坏性更强的新型攻击方式——信息物理协同攻击(coordinated cyber physical attack,CCPA),其隐蔽性与威胁性易导致系统出现级联故障。首先,基于攻击者的视角,提出一种多阶段信息物理协同拓扑攻击模型,单阶段的物理攻击使线路中断,双阶段的网络攻击分别用来掩盖物理攻击的断开线路和制造一条新的虚假断开线路。其次,结合深度强化学习(deep reinforcement learning,DRL)理论,提出一种基于深度Q网络(deep Q-network,DQN)的最小攻击资源确定方法。然后,给出攻击者考虑上层最大化物理攻击效果和下层最小化攻击代价的具体模型及求解方法。最后,以IEEE 30节点系统为例,验证了所提多阶段攻击模型的有效性。仿真结果表明,多阶段信息物理协同拓扑攻击较单一攻击更加隐蔽且有效,对电网的破坏程度更大,为防御此类攻击提供了参考。     

基于区间鲁棒控制的配电信息物理双层设备协调配置方法

为提高配电网消纳高比例分布式电源的经济性,充分利用一次侧储能和二次侧主动调控的灵活性,该文提出一种基于区间鲁棒控制的配电信息物理双层设备协调配置方法。首先,建立分布式电源控制选点与储能配置的协调优化综合经济性模型,而后,考虑源荷不确定性,以电压越限风险水平为约束,建立配电网区间鲁棒优化运行模型,形成双层优化模型;最后,给出基于差分进化算法的求解流程,并以IEEE-33节点配电系统为例验证模型的有效性,同时仿真分析不同可接受风险水平和设备价格对配置的影响,为高渗透配电网的经济消纳方案提供有益的参考。     

动态自组织P2P僵尸网络的构建及其防御

僵尸网络作为大规模攻击活动的基础平台,严重威胁网络空间安全,从预测的角度对其开展研究具有重要的现实意义。针对现有研究在终端感知、身份识别和动态对抗中存在的不足,本文概括僵尸网络生命周期,总结P2P结构僵尸网络的脆弱点,建立P2P僵尸网络动态对抗模型,分析节点真实性判断和网络拓扑优化重构的重要性。在此基础上,从攻击者视角提出一种新颖的动态自组织P2P僵尸网络模型DSBot。该模型在架构设计上可扩展至各类目标设备,通过基于可信度矩阵和真实性验证的节点安全性评估机制增强终端对抗性,并提出分阶段感染策略。借鉴无线自组网和多智能体的思路和方法,刻画节点属性多维表示和基于状态标识的动态网络框架,以此为基础设计O(N_i)更新算法、均匀连接算法和节点主动移除算法,并结合相应的初始化和调整机制提出网络自组织重构策略,从而进一步提升网络的健壮性。其中,O(N_i)更新算法确保节点的可信度,均匀连接算法降低网络暴露风险,节点主动移除算法实时移除可疑节点。从平均等待时间、命令可达率、网络连接度和重构稳定时间等方面对DSBot模型进行评估。实验结果表明,DSBot模型在效率和韧性上可满足僵尸网络命令控制机制的基本需求。最后,从终端清除、命令控制服务器打击和命令控制过程等方面讨论了可能的防御策略。本文旨在通过预测新型僵尸网络模型来完善防御解决方案。     

A Stochastic Programming Strategy in Microgrid Cyber Physical Energy System for Energy Optimal Operation

This paper focuses on the energy optimal operation problem of microgrids (MGs) under stochastic environment. The deterministic method of MGs operation is often uneconomical because it fails to consider the high randomness of unconventional energy resources. Therefore, it is necessary to develop a novel operation approach combining the uncertainty in the physical world with modeling strategy in the cyber system. This paper proposes an energy scheduling optimization strategy based on stochastic programming model by considering the uncertainty in MGs. The goal is to minimize the expected operation cost of MGs. The uncertainties are modeled based on autoregressive moving average (ARMA) model to expose the effects of physical world on cyber world. Through the comparison of the simulation results with deterministic method, it is shown that the effectiveness and robustness of proposed stochastic energy scheduling optimization strategy for MGs are valid.      

刑法学视野下的“维基争密”事件

“维基解密”事件较典型的反映了当前网络犯罪的特征和类型。对网络犯罪的处理,既要传承传统的刑法规则和刑法理论,又要适当根据新情况进行立法调整。网络犯罪包括两种类型,一种是以网络信息系统为对象的犯罪,这类犯罪符合全新的犯罪构成要件,应由刑事立法单独规定为新类型犯罪;另一种是以网络信息系统为工具的犯罪,这类犯罪侵害的是传统法益,只是行为方式、社会危害稍有不同。国内当前刑事立法也正是反映了这一分类思想。     

信息物理系统在变压器稳压调节控制中的应用研究

考虑到现有变压器电压调节方法受调压档位限制,且电压调整判断依据为调度部门确定的电压曲线,难以实现灵活、高效、高精度的变压器输出电压稳定调节,提出一种基于信息物理融合系统的稳压动态调节方法以更好地解决变压器运行过程中出现的电压偏移问题。建立变压器的物理模型与信息模型,通过物理参数与信息属性的相互映射,利用动态链接对物理模型与信息模型在统一仿真平台上进行整合,建立变压器的信息物理融合系统模型,通过信息量对物理量的实时反馈作用机制,控制变压器原副线圈匝数比的自动调节,实现变压器输出稳压。仿真实验结果表明信息物理融合方法在变压器输出电压稳定调节应用中具有一定的有效性。     

On the design of online synchronous assessments in a synchronous cyber classroom

Online learning has been rapidly developing in the last decade. However, there is very little literature available about the actual adoption of online synchronous assessment approaches and any guidelines for effective assessment design and implementation. This paper aims at designing and evaluating the possibility of applying online synchronous assessments in a formal credit course. Relying on the four dimensions of knowledge taxonomy, this paper describes four different online synchronous assessments for conducting a formal mid‐term exam, including synchronous quiz, synchronous practicum, synchronous essay and synchronous oral assessments. The designs were implemented and evaluated in a synchronous cyber classroom for an online credit course. This study identified the challenges and potential issues while conducting the online synchronous assessments, including (1) the extent of monitoring and cheating; (2) the lack of suitable software tools specifically for supporting online synchronous assessments; and (3) the need for a variety of online synchronous assessment methods for different subject matter. This paper concludes with some possible solutions, such as a short time limit for answering questions and a well analysed need of a software tool, to address all the issues.