Global Trends in Cyber Security

I. INTRODUCTION

Cyber infrastructure has become one of the critical infrastructures for any economy to prosper. This is due to reliance on ICTs by all sectors of the economy.

Critical infrastructure is a collection of systems and assets both tangible and non-tangible that provide critical services to the nation $[1]$. Cyber infrastructure refers to computational systems, data and information management, advanced instruments, visualization environments, and people, all linked together by software and advanced networks to improve scholarly productivity and enable knowledge breakthroughs and discoveries not otherwise possible $[2]$.

Other definitions of cyber infrastructure include: the constellation of ICT that support communication, coordination, collaboration, and collection, storage, analysis and dissemination of data for distributed groups of researchers [3]; The comprehensive hardware for computing, data and networks, digitally-enabled sensors, observatories and experimental facilities, and an interoperable suite of software and middle-ware services and tools needed to capitalize on dramatic advances in information technology[4].

From these definitions, cyber infrastructure can be defined as a collection of electronic and computing systems, configured to provide specific services via computer networks.

Due to the value derived from cyber infrastructure and the level of investments in them, cyber infrastructures have become a target from malicious persons out to vent their anger on regimes or persons utilizing the cyber infrastructures.

This has necessitated the development of measures to protect cyber infrastructures, called cyber security. Cyber security is the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance and technologies that can be used to protect the cyber environment, organization and user's assets [5].

The measures that have been put in place to mitigate against or deter the occurrence of cyber crimes are collectively referred to as cyber security.

Cyber crimes refers to computer-mediated activities which are either illegal or considered illicit by certain parties and which can be conducted through global electronic networks [6].

Other definitions of cyber crime include: crimes in which computer networks are the target or a substantial tool $[7]$; acts against the confidentiality, integrity and availability of computer data or systems represent the core of cybercrime $[8]$.

Investigation of cyber crime requires acquisition of evidence from digital devices through Computer Forensics. Computer Forensics is the use of specialized techniques for the preservation, identification, extraction, authentication, examination, analysis, interpretation and documentation of digital information, while Forensics is the application of investigative and analytical techniques that conform to evidentiary standards used in or appropriate for a court of law or other legal context [9].

Computer forensics could also be referred to as: the science that is concerned with the identification, collection, examination and analysis of data during an investigation $[10]$; The application of computer science and investigative procedures for a legal purpose involving the analysis of digital evidence (information of probative value that is stored or transmitted in binary form) after proper search authority, chain of custody, validation with mathematics (hash function), use of validated tools, repeatability and possible expert presentation $[11]$.

II. FORMS OF CYBER CRIME

Cyber crime takes three mains forms depending on the target, namely: cyber crime against persons/entity; cyber crime against institution; and cyber crime against computers and its associated infrastructures [11].

Cyber crimes could also be classified into four classes as: offences against the confidentiality, integrity and availability of computer data and systems; Computer-related offences; Content-related offences; and Copyright-related offences [12].

2.1 Cyber crime against persons

2.2 Cyber crime against institutions

These are criminal activities targeted at certain institution e.g. financial institutions, academic institution or government bodies. They include compromising the Confidentiality, Integrity and Accessibility of the information held by those institutions e.g. systems hacking, intellectual property (software piracy, copyright infringement, trademark violations, theft of computer code) and Distributed Denial of Service (sabotage).

2.3 Cyber crime against Computers and associated Infrastructure

These are criminal activities targeted at computer infrastructures in general without targeting any specific person, entity or computing systems. They include computer virus creation, cyber vandalism.

III. MOTIVATIONS FOR CYBER CRIME

The motivation for cyber crime can be understood through analysis of the groups of persons engaged in the cyber crime.

The persons involved in cyber crime could be categorized as: the idealist, the greed motivated (criminals) and the cyber terrorist [11].

The idealists are normally teenagers, seeking social recognition and pleasure by deriving satisfaction in successfully challenging existing cyber security measures in place.

The greed motivated, the typical cyber criminals, are money motivated persons, ready to sabotage cyber security measures for monetary gains.

The cyber terrorists are usually a group of individuals out to sabotage cyber security measures for purposes of supporting a given cause they defend or due to disgruntlement with government policies. It is also called cyber warfare.

VI. TRENDS IN CYBER CRIME

Computer crimes date back in the 1960s [13]. Computer crimes in this era involved physical damage to computer systems and subversion of the long-distance telephone networks crimes.

The crimes later evolved to sabotage of computer systems in the 1970s. This took the forms of intentional power systems shutdown and cable cuts. The Late 1970s saw the emergence of impersonation after credentials stealing from social engineering tactics like dumpster diving amongst other tactics. This later transformed to credit card frauds in the 1990s.

Technological advancements in the 1990s led to the emergence of hacking as a computer crime. The main target of this crime was banks where client money could be transferred without their consent and knowledge. This evolved to Salami Attacks, where money in small negligible and not easily detectable was moved from bank accounts.

The 1990s and early 2000s saw the prevalent of malwares from viruses, logic bombs, Trojan horses and worms. This could be used for various vices including confidential information gathering, alteration, destruction, spamming and denial of service.

The mid 2000s saw the emergence of malicious botnets. A bot is a script or sets of scripts designed to perform a predefined function in an automated fashion [14]. The same author defines a botnet as networks of infected end-hosts, called bots that are under the control of a human operator commonly known as a bot master/ bot herder.

The botnets are used for various cyber crimes namely launching Distributed Denial of Service (DDoS) attacks, spamming, sending Trojan and phishing emails, illegally distributing pirated media and software, force distribution, stealing information and computing resource, e-business extortion, performing click fraud, and identity theft for financial gain [15,16].

By 2013, Cyber crime had taken the form of ransomware. Ransomware is a type of malware that stops or limits users from accessing their system, either by securing the system's screen or by locking the users' files unless a ransom is paid [17].

Examples of common Ransomwares include Cryptolocker, Cryptotwall, Locky and TeslaCrypt. The ransom is normally paid in form of bitcoin [17].

The latest cyber crime model is cybercrime as a service (CaaS). This refers to provision of services to others to facilitate their commission of cyber-crimes $[18]$.

The various services available on CaaS platforms include: Research as a Service (Legal or illegal collection of information on victims); Infrastructure-as-a-service (Hosting of malware on secure networks, Rental of established botnets for Distributed Denial-of-Services, Cloud-based computing power for operations; Crimeware-as-a-service (Design and delivery of customized crime solutions); Hacking-as-a-service (Outsourcing of a complete cyber-enabled attack and Technical support for cybercrime activities) [19].

These development of a "as-a-service" innovations have accelerated the evolution of the cybercrime ecosystem and the growth of the cybercrime business, reconstructing into a specialization, commercialize, and cooperation system $[20]$.

A summary of the trends in cyber crime is as shown in figure 1.

V. MEASURES IN PLACE TO COUNTER CYBER CRIME

The advancements in cyber crime have evolved hand in hand with measures of fighting cyber crime. These measures can be categorised as: physical measures, technological measures and collaborative frameworks.

The physical measures aim to address access to cyber infrastructure by implanting access control features ranging from physical barriers to unauthorised access, biometrics and human guards.

Technological measures include rapid development of Anti virus, Firewalls, Intrusion detection systems and Intrusion Prevention systems.

Collaborative frameworks in fighting cyber crimes involve setting up of computer emergency response teams that liaise with other teams globally in alerting and educating each other on latest attack vectors.

Whereas these measures have helped mitigate cyber crimes, they have limitations which impact on their effectiveness in combating cyber rime.

5.1 Limitations of Anti Virus and Intrusion Detection/Prevention Systems

Antivirus and Intrusion detection/Prevention systems, if not designed with care can turn from defense mechanisms to instruments of attacks $[21]$. Further, since most anti virus operate based on known virus signatures, unknown threats for which no signatures exist can easily bypass the detection.

Several vulnerabilities have been sported in various anti virus softwares e.g. Kaspersky [22], AVG [23], FireEye [24] and EST [25].

Anti viruses use byte patterns, hash sums and heuristics during virus signature mapping [21].

Anti virus assisted attacks are launched using malicious markers, which do not rely on exploiting vulnerabilities but is based on the weak design of pattern-based signatures $[21]$.

The main vulnerabilities identifiable in anti virus software are Local privilege escalation, Active –X related, Engine based and management interface related $[26]$.

Intrusion Prevention and Detections systems can be classified based on detection methods, namely Anomaly Detection Systems, signature based detection and Decision Making Techniques $[27]$.

These system have limitations in terms of gathering a set of static criteria of normal behaviors, how to identify new attacks with no signatures in the database and how or who makes the decisions, respectively $[27]$.

Firewalls suffer from various limitations too, including inability to protect systems against malicious insiders and inability to protect against completely new threats $[28]$.

5.2 Limitations of collaborative frameworks

Collaborative frameworks suffer from lack of secure channels to exchange cyber crime information. This raises the possibility of risk of the exchanged information falling into the wrong hands.

Cyber crimes spread at alarmingly fast rates hence delays in sharing cyber crime information renders the shared information less effective especially if the information is received after the attack has occurred.

Legal constraints that prevent sharing of experiences on going legal proceedings against cyber crime mean that law enforcement authorities are not at liberty to divulge all the facts and elements of an on going case [29].

Other major limitations include: issues surrounding trust and control of incident response; questions about obligations regarding disclosure and exposure; the evolving liability and regulatory landscape; challenges faced in the cross-border investigation of cybercrime; and cross-border data transfer restrictions that impede the ability of companies to respond nimbly to cyber threats and incidents $[30]$.

VI. TOOLS USED IN DIGITAL FORENSICS

Some of the tools used in digital evidence gathering include: Encase developed by Guidance Software of USA; Forensic Toolkit (FTK) by AccessData of USA; SANS SIFT Workstation of USA; Helix3 Pro of the USA; Automated Image and Restore (AIR) developed by Steve Gibson, founder of Gibson Research Corporation [31].

Additional forensics tools include: X-Ways Forensics developed by X-ways of Germany; Virtual Forensics Computing (VFC) developed by the MD5 of the UK [33].

Others include ProDiscover by Technology Pathways of the USA; and SMART by ASR Data of the USA [34]; Belkasoft Evidence Centre by Belkasoft of the USA; Computer Aided Investigative Environment (CAINE) created by the digital forensics project of Italy; Foremost created by Special Agents Kris Kendall and Jesse Kornblum of the United States Air Force Office of Special Investigations; MemGator created by the

E5h Forensic Solutions of the UK; and OSForensics from PassMark of the US [35].

Whereas several tools have been developed to aid in digital forensics they suffer from various limitations, namely: limitations in terms of the operating systems on which they can operate, limitation on the file formats they can read, limitation of the area of focus for the tool (e.g. hard disk, browser, operating systems files etc.), their effectiveness on ability to process encrypted files and ability to recover overwritten files.

Further, most tools were designed for usage on traditional computing platforms, namely desktop or laptop. In cases where the forensics are to be carried on other computing platforms, like cloud computing, edge computing, Fog Computing, mist computing, etc, then the tools will be limited if not rendered unusable.

The proliferation of big data poses a challenge to current tools since they are not optimized to analyze big data, which is varied, and moving at high velocity. The overall efficiency of current forensics tools is limited to employment of simple hashing and indexing algorithms $[36]$.

Digital investigations are also hindered by the limited processing capabilities of human analysts, since the tools as currently designed present data to the analysts who have to evaluate it and present in report form. With big data, this becomes a challenge in terms of man hours required to evaluate and analyze the large data sets.

This limitation can be overcome by integration of artificial intelligence techniques in the tools used for digital forensics.

VII. ARTIFICIAL INTELLIGENCE IN CYBER SECURITY

Due to the proliferation of devices connected on the internet, combined with an uptake of Internet of Things (IoT) technologies, the number of devices vulnerable to attacks or used in cyber crimes will surge, posing a challenge to existing means of fighting cyber crimes.

The rate at which new threats are being created now far exceeds the financial resource or human capability required to manually analyze or create rules for each and every new piece of malware code $[37]$.

To cope with the high rate at which new malwares are spawned, Artificial Intelligence will come in handy. Artificial Intelligence (AI) is a field of study concerned with development of computers that are able to engage in human-like thought processes such as learning, reasoning, and self-correction $[38]$.

Other definitions of AI are: A discipline devoted to developing and applying computational approaches to intelligent behavior $[39]$; machines that are capable of performing tasks that, if performed by a human, would be said to require intelligence $[40]$; is a subfield of computer science aimed at the development of computers capable of doing things that are normally done by people — in particular, things associated with people acting intelligently $[41]$

AI therefore is a paradigm for studying, development and application of computational systems capable of perceiving and learning from their usage context, and independently applying the gained knowledge in a way a human being would apply.

7.1 AI Techniques

The various AI techniques include Intelligent Agents, Neural Networks and Expert Systems [42].

1) Intelligent Agents

These are software components with features of intelligent behavior such as (at a minimum) pro-activeness, the ability to communicate, and reactivity (in other words the ability to make some decisions and to act) [43].

They have also been defined, as a piece of software that is situated within a given environment, where it acts autonomously, responds to changes in its environment including self recovery from failure, as it pursues its goals by assessing multiple ways of achieving the goals as it interacts with other agents [44].

Other definitions include: pieces of software that act based on information which is gathered from dynamic environment and achieve the goals successfully [44]; software entities that carry out some set of operations on behalf of a user or another program with some degree of independence or autonomy, and in so doing, employ some knowledge or representation of the user's goals or desires [45].

Intelligent agents which are able to detect unusual and malicious activities could be incorporated in Intrusion Prevention and Detection systems, in Operating systems, in Anti virus. Based on their heuristics knowledge, the agents will be able to decide on whether to terminate or allow the activity.

A typical conceptual architecture for the integration of an intelligent agent in a host environment is as shown if figure 1.

A zoomed view of the figure 1 is as shown in figure 2.

From the diagram, the agent learns the state of the environment and updates its knowledge base. A new requested state is compared with the learned states in the knowledge base and the Beliefs (known Information about the environment), Desires (objectives to be accomplished by the agent) and Intentions (current chosen course of action) (BDIs), of the agent.

Depending on the chosen course of action, the knowledge base and the BDIs are updated accordingly. The learning process is continuous and the decisions are dynamic depending on the requested state and the BDIs

2) Artificial Neural Networks (ANN)

ANN is a system simulating the work of the neurons in the human brain [46].

It consists of a collection of iterations to transform a set of inputs to a set of desired outputs, through a set of simple processing units, or nodes and connections between them. Subsets of the units in the iteration are input nodes, output nodes, and nodes between input and output form hidden layers; the connection between two units assigned some weight, used to determine how much one unit will affect the other. [47].

Due to the generalization feature of ANN, they are able to work with imprecise and incomplete data, meaning that they can recognize patterns not presented during a learning phase $[46]$. This feature is very vital in signature based detection systems.

Based on this relationship, an ANN can be used in pattern recognition and thus identify anomalies in the various computing platforms. This capability can be implemented in Intrusion Detection /Prevention Systems.

A high level architectural representation of the concept of an ANN in an IDS is shown in figure 3.

From figure 3, all traffic is detected by the IDS sensor, and passed to the IDS engine, which analyses it based on the rules in the Knowledge base.

After analysis, the result is passed to the ANN, which uses that information for learning purposes. With time, the ANN will have learnt the patterns presented to it from the IDS engine, which it uses for future decision-making.

This lowers the chances of false alarms and zero days attacks from intrusions not yet configured in the knowledge base since the ANN can detect them.

Neural networks can also be extended to data encryption and used to construct an efficient encryption system by using a permanently changing key.

3) Expert Systems

This is a computer system that mimics the decision making of a human being [48]. They are composed of the Knowledge base which represents illustrations and assertions about the real world and the Inference Engine, which is the reasoning system.

Expert systems can take the form of Associate skilled system, which is software system for locating answers to queries in some application domain bestowed either by a user or by another software system [49].

The knowledge base could be composed of items like malicious IP addresses, known malwares, expected end system state and allowed applications.

The inference engine on the other hand could contain information on application usage patterns, geographical location of certain IP addresses.

The Inference Engine reads the current state (Knowledge) of the knowledge base, applies the rules relevant to that and asserts new knowledge in to it.

Incase a new state is required which is not contained in the Knowledge Base, the inference engine executes a set of algorithms (rules) which predict the desired state. A decision is made depending on the predicted state.

A high level architectural depiction of the expert system concept is as in figure 4.

From figure 4, the requested process is passed through an expert system to determine whether it is a know process. If the process is known it is analyzed against the knowledge base to determine whether it is whitelisted or blacklisted.

If the requested process or state is not known, the inference engine analyzes it to determine its potential state or outcome. Depending on the outcome and system objectives, the Knowledge base is updated and the process loops back through the knowledge base for either termination or execution.

VIII. CONCLUSION

Whereas the use of Artificial Intelligence techniques in cyber security is currently on an upward trend, there is a possibility of cyber criminals using similar Artificial Intelligence tactics to counter the fight against cyber crime.

To prevent this, this paper recommends direct integration of Artificial Intelligence techniques directly into user applications, system software as well as embedded systems. The integration will also eliminate the need for third party tools downloaded by users to fight cyber crime, which could turn out to be malicious.

Further, from the analyzed literature, AI techniques have only been used in preventing or detecting cyber crimes. AI techniques have not been used in post cyber crime activities like investigations. This paper therefore recommends explorations of ways in which AI can be applied in cyber crime investigations to reduce the reliance on human intervention in view of the proliferation of IoT devices.