In order to gain an overview of the state of research using machine learning for applications in cybersecurity, we have carried out a quantitative analysis of published works using the Scopus database. In total, 81,082 articles in this area were scraped from Scopus, from which we created an article-citation graph with articles as nodes and 547,998 citations among them as edges. We used the Louvain method for community-finding to organize the articles into research areas based on citation patterns, resulting in 12 identified research areas: intrusion detection: classical machine learning, intrusion detection: deep learning, privacy-preserving machine learning, malware detection, biometrics, adversarial machine learning, steganalysis, neural cryptography, phishing, traffic classification, software vulnerabilities, and smart grid. The state of the whole field and of each research area is discussed in detail, including highly cited and seminal works in each area and the relative size of each area compared to each other. Compared to previous literature surveys on this topic this review is not limited to specific subtopics and organizes the field by grouping works based on research topics, giving a more comprehensive overview of the field and the areas it encompasses.

We present and evaluate Vejde; a framework which combines data abstraction, graphneural networks and reinforcement learning to produce inductive policy functions for decisionproblems with richly structured states, such as object classes and relations. MDP statesare represented as data bases of facts about entities, and Vejde converts each state to abipartite graph, which is mapped to latent states through neural message passing. Thefactored representation of both states and actions allows Vejde agents to handle problemsof varying size and structure. We tested Vejde agents on eight problem domains defined inRDDL, with ten problem instances each, where policies were trained using both supervisedand reinforcement learning. To test policy generalization, we separate problem instances intwo sets, one for training and the other solely for testing. Test results on unseen instancesfor the Vejde agents were compared to MLP agents trained on each problem instance,as well as the online planning algorithm Prost. Our results show that Vejde policies inaverage generalize to the test instances without a significant loss in score. Additionally, theinductive agents received scores on unseen test instances that on average were close to theinstance-specific MLP agents.

As cyberattacks are becoming more sophisticated, automated activity logging and anomaly detection are becoming important tools for defending computer systems. Recent deep learning-based approaches have demonstrated promising results in cybersecurity contexts, typically using supervised learning combined with large amounts of labeled data. Self-supervised learning has seen growing interest as a method of training models because it does not require labeled training data, which can be difficult and expensive to collect. However, existing self-supervised approaches to anomaly detection in user authentication logs either suffer from low precision or rely on large pre-trained natural language models. This makes them slow and expensive both during training and inference. Building on previous works, we therefore propose an end-to-end trained self-supervised transformer-based sequence model for anomaly detection in user authentication events. Thanks in part to an adapted masked-language modeling (MLM) learning task and domain knowledge-based improvements to the anomaly detection method, our proposed model outperforms previous long short-term memory (LSTM)-based approaches at detecting red-team activity in the "Comprehensive, Multi-Source Cyber-Security Events"authentication event dataset, improving the area under the receiver operating characteristic curve (AUC) from 0.9760 to 0.9989 and achieving an average precision of 0.0410. Our work presents the first application of end-to-end trained self-supervised transformer models to user authentication data in a cybersecurity context, and demonstrates the potential of transformer-based approaches for anomaly detection.

We believe that agents for automated incident response based on machine learning need to handle changes in network structure. Computer networks are dynamic, and can naturally change in structure over time. Retraining agents for small network changes costs time and energy. We attempt to address this issue with an existing method of relational agent learning, where the relations between objects are assumed to remain consistent across problem instances. The state of the computer network is represented as a relational graph and encoded through a message passing neural network. The message passing neural network and an agent policy using the encoding are optimized end-to-end using reinforcement learning. We evaluate the approach on the second instance of the Cyber Autonomy Gym for Experimentation (CAGE 2), a cyber incident simulator that simulates attacks on an enterprise network. We create variants of the original network with different numbers of hosts and agents are tested without additional training on them. Our results show that agents using relational information are able to find solutions despite changes to the network, and can perform optimally in some instances. Agents using the default vector state representation perform better, but need to be specially trained on each network variant, demonstrating a trade-off between specialization and generalization.

Nowadays, IT infrastructures are involved in making innumerable aspects of our lives convenient, starting with water or energy distribution systems, and ending with e-commerce solutions and online banking services. In the worst case, cyberattacks on such infrastructures can paralyze whole states and lead to losses in terms of both human lives and money.One of the approaches to increase security of IT infrastructures relies on modeling possible ways of compromising them by potential attackers. To facilitate creation and reusability of such models, domain specific languages (DSLs) can be created. Ideally, a user will employ a DSL for modeling their infrastruc-ture of interest, with the domain-specific threats and attack logic being already encoded in the DSL by the domain experts.The Meta Attack Language (MAL) has been introduced previously as a meta-DSL for development of security-oriented DSLs. In this work, we define formally the syntax and a semantics of MAL to ease a common understanding of MAL's functionalities and enable reference implementations on different tech-nical platforms. It's applicability for modeling and analysis of security of IT infrastructures is illustrated with an example.

Migrating enterprises and business capabilities to cloud platforms like Amazon Web Services (AWS) has become increasingly common. However, securing cloud operations, especially at large scales, can quickly become intractable. Customer-side issues such as service misconfigurations, data breaches, and insecure changes are prevalent. Furthermore, cloud-specific tactics and techniques paired with application vulnerabilities create a large and complex search space. Various solutions and modeling languages for cloud security assessments exist. However, no single one appeared sufficiently cloud-centered and holistic. Many also did not account for tactical security dimensions. This article, therefore, presents a domain-specific modeling language for AWS environments. When used to model AWS environments, manually or automatically, the language automatically constructs and traverses attack graphs to assess security. Assessments, therefore, require minimal security expertise from the user. The modeling language was primarily tested on four third-party AWS environments through securiCAD Vanguard, a commercial tool built around the AWS modeling language. The language was validated further by measuring performance on models provided by anonymous end users and a comparison with a similar open source assessment tool. As of March 2020, the modeling language could represent essential AWS structures, cloud tactics, and threats. However, the tests highlighted certain shortcomings. Data collection steps, such as planted credentials, and some missing tactics were obvious. Nevertheless, the issues covered by the DSL were already reminiscent of common issues with real-world precedents. Future additions to attacker tactics and addressing data collection should yield considerable improvements.

In this ongoing project we employ reinforcement learning in a simulation environment to learn policies for cyber defense. The environment is based on attack graphs produced using the Meta Attack Language, a modeling language used to assess the security of systems. Two RL algorithms are utilized to prevent a simulated attacker agent to reach a series of targets within attack graphs. The defensive agent has to make decisions based on the value of keeping assets enabled, or suffering the consequence of the attacker reaching its goal. The initial results are promising, and show that both algorithms are able to find distinct strategies for defense. However, further analysis is needed to evaluate policy quality, including the implementation of sensible baseline policies for comparison.

Cyber-attacks on IT infrastructures can have disastrous consequences for individuals, regions, as well as whole nations. In order to respond to these threats, the cyber security assessment of IT infrastructures can foster a higher degree of security and resilience against cyber-attacks. Therefore, the use of attack simulations based on system architecture models is proposed. To reduce the effort of creating new attack graphs for each system under assessment, domain-specific languages (DSLs) can be employed. DSLs codify the common attack logics of the considered domain. Previously, MAL (the Meta Attack Language) was proposed, which serves as a framework to develop DSLs and generate attack graphs for modeled infrastructures. In this article, we propose coreLang as a MAL-based DSL for modeling IT infrastructures and analyzing weaknesses related to known attacks. To model domain-specific attributes, we studied existing cyber-attacks to develop a comprehensive language, which was iteratively verified through a series of brainstorming sessions with domain modelers. Finally, this first version of the language was validated against known cyber-attack scenarios.

Plagiarism in hands-on ethical hacking education is challeng-ing due to student work being delivered almost exclusively virtually viaactions on a cyber range. We are developing the Cheat Detection Sys-tem, a solution that uses system administration and two approaches oflog analysis to infer about the cheating behavior of students; one basedon canary detection and another based on traces of student actions whichwe have termed the intrusion deficit approach.