We present a novel anomaly-based detection approach capable of detecting botnet Command and Control traffic in an enterprise network by estimating the trustworthiness of the traffic destinations. A traffic flow is classified as anomalous if its destination identifier does not origin from: human input, prior traffic from a trusted destination, or a defined set of legitimate applications. This allows for real-time detection of diverse types of Command and Control traffic. The detection approach and its accuracy are evaluated by experiments in a controlled environment.
DOCUMENT
Adversarial thinking is essential when dealing with cyber incidents and for finding security vulnerabilities. Capture the Flag (CTF) competitions are used all around the world to stimulate adversarial thinking. Jeopardy-style CTFs, given their challenge-and-answer based nature, are used more and more in cybersecurity education as a fun and engaging way to inspire students. Just like traditional written exams, Jeopardy-style CTFs can be used as summative assessment. Did a student provide the correct answer, yes or no. Did the participant in the CTF competition solve the challenge, yes or no. This research project provides a framework for measuring the learning outcomes of a Jeopardy-style CTF and applies this framework to two CTF events as case studies. During these case studies, participants were tested on their knowledge and skills in the field of cybersecurity and queried on their attitude towards CTF education. Results show that the main difference between traditional written exam and a Jeopardy-style CTF is the way in which questions a re formulated. CTF education is stated to be challenging and fun because questions are formulated as puzzles that need to be solved in a gamified and competitive environment. Just like traditional written exams, no additional insight into why the participant thinks the correct answer is the correct answer has been observed or if the participant really did learn anything new by participating. Given that the main difference between a traditional written exam and a Jeopardy-style CTF is the way in which questions are formulated, learning outcomes can be measured in the same way. We can ask ourselves how many participants solved which challenge and to which measurable statements about “knowledge, skill and attitude” in the field of cybersecurity each challenge is related. However, when mapping the descriptions of the quiz-questions and challenges from the two CTF events as case studies to the NICE framework on Knowledge, Skills and Abilities in cybersecurity, the NICE framework did not provide us with detailed measurable statements that could be used in education. Where the descriptions of the quiz-questions and challenges were specific, the learning outcomes of the NICE framework are only formulated in a quite general matter. Finally, some evidence for Csíkszentmihályi’s theory of Flow has been observed. Following the theory of Flow, a person can become fully immersed in performing a task, also known as “being in the zone” if the “challenge level” of the task is in line with the person’s “skill level”. The persons mental state towards a task will be different depending on the challenge level of the task and required skill level for completing it. Results show that participants state that some challenges were difficult and fun, where other challenges were easy and boring. As a result of this9 project, a guide / checklist is provided for those intending to use CTF in education.
DOCUMENT
Cybercrime is een relatief nieuw onderwerp dat tal van vragen oproept. Welke delicten vallen onder de verzamelnaam 'cybercrime'? Wie zijn de nieuwe daders? Wie zijn de slachtoffers? Voor welke uitdagingen staan politie, private partners en lokale overheden bij de aanpak van dit fenomeen? In dit nummer van Cahiers Politiestudies gaan we op zoek naar resultaten van recent (internationaal) onderzoek om antwoord te vinden op deze vragen. Er wordt aandacht besteed aan de wijze waarop de politie kennis ontwikkelt over nieuwe vormen van cybercrime en aan de bewijsvergaring in een digitale omgeving, er wordt ingezoomd op de slachtoffers van cybercrime , op hun aangiftegedrag en hun behoefte aan steun. Ook wordt ingegaan op werkwijzen van cyberdaders, cybercriminele bedrijfsprocessen, het internationale karakter van cybercrime en het criminele verdienmodel. Daarnaast wordt ingegaan op specifieke fenomenen, zoals sexting en hacking, op veelvoorkomende delicten zoals oplichting en helpdeskfraude, en op technisch geavanceerde en lastig te bestrijden misdrijven, zoals complexe phishing en malware verspreiding, DDos-aanvallen en gebruikmaking van botnets. In dit nummer wordt aandacht besteed aan de daders van deze vormen van criminaliteit, aan de slachtoffers, en aan de mogelijkheden om hiertegen op te treden. Daarbij wordt ingezoomd op de rol en de bevoegdheden van de politie, op de mogelijkheden van privaat-publieke samenwerking en op de rol van de burgemeester en van lokale risicocommunicatie bij de aanpak van complexe digitale veiligheidsvraagstukken. Zo biedt dit nummer van Cahiers Politiestudies een waaier aan interessante kennis rond dit fenomeen.
DOCUMENT
