Cyber Security, Networking and Applications Research Group (CNA)

Andrew Moore, Muhammad Ali

Objectives

• Expand the body of knowledge on cybercrime and malware, studying their mechanisms, impacts, and trends.
• Investigate advanced tools and methodologies for detecting, analysing, and neutralising malware and the forensic investigation of cybercrimes.
• Enhance Cyber Resilience: Working towards strengthening the cybersecurity posture of organisations and individuals by providing insights into threat mitigation and prevention strategies.

Research and activities

• Malware Analysis: Dissecting malware to understand its behaviour, origin, and impact. This involves reverse engineering malware samples, identifying their attack vectors, and understanding their communication protocols.
• Cybercrime Investigation: Examining cybercrime incidents to trace back to the perpetrators, understanding their motives, methods, and the vulnerabilities they exploit.
• Digital Forensics: Developing and applying techniques to recover and analyse digital evidence from various devices and networks, ensuring evidence is admissible in legal proceedings.
• Threat Intelligence: Gathering and analysing data on current and emerging threats, enabling proactive defence strategies and informing stakeholders about potential risks.
• Collaboration with Law Enforcement: Assisting law enforcement agencies with investigations and sharing expertise and tools to pursue and prosecute cybercriminals effectively.

Bernardi Pranggono, Hossein Abroshan, Charles Marrow, Nouman Nafees

Objectives

• Assess Threat Landscape: Investigate the evolving threat landscape facing critical infrastructure and operational technology (OT) systems, including cyber-physical attacks, nation-state threats, and vulnerabilities arising from interconnectedness.
• Analyse Vulnerabilities: Identify and analyse vulnerabilities in critical infrastructure and OT systems, including legacy systems, supply chain dependencies, and human factors, to understand potential entry points for malicious actors.
• Develop Resilience Frameworks: Design resilience frameworks tailored to critical infrastructure and OT environments, incorporating redundancy, diversity, and adaptive capabilities to withstand and recover from cyber-attacks.
• Enhance Threat Detection and Response: Investigate advanced threat detection and response mechanisms, leveraging technologies such as anomaly detection, behavioural analytics, and AI-driven security orchestration to rapidly detect and mitigate cyber threats targeting critical infrastructure and OT systems.
• Secure Industrial Control Systems (ICS): Explore strategies for securing industrial control systems (ICS), including supervisory control and data acquisition (SCADA) systems, programmable logic controllers (PLCs), and distributed control systems (DCS), against cyber attacks and insider threats.
• Implement Secure Communication Protocols: Develop and evaluate secure communication protocols and standards for critical infrastructure and OT systems, ensuring confidentiality, integrity, and data availability between devices and control centres.
• Indicators of Compromise (IoCs) in OT: Develop comprehensive methodologies for identifying IoCs specific to OT environments. This includes understanding unique attack vectors, such as communication anomalies in SCADA systems, unexpected changes in PLC behaviour, and irregularities in network traffic patterns.

Erika Sanchez, Ronak Al-Haddad, James Kadirire

Objectives

• Identify emerging threats: Analyse current cyber threats and anticipate future challenges to network security, including advanced persistent threats (APTs), zero-day exploits and insider threats.
• Assess existing security mechanisms: Evaluate the effectiveness of traditional network security approaches, such as firewalls, intrusion detection/prevention systems (IDS/IPS) and encryption protocols, in mitigating modern cyber risks.
• Explore cutting-edge technologies: Investigate the potential of emerging technologies, such as artificial intelligence (AI), machine learning (ML), blockchain and quantum cryptography, in enhancing network security resilience and QoS.
• Investigate Threat Intelligence: Explore using threat intelligence platforms and threat-hunting techniques to proactively identify and mitigate network security threats before they escalate.
• Study human factors: Examine the role of human behaviour, including user awareness, training and insider threat detection, in shaping network security posture and vulnerabilities.
• Evaluate security in IoT and Edge Computing: Assess the unique security challenges posed by the proliferation of Internet of Things (IoT) devices and edge computing environments and propose novel solutions to mitigate associated risks.
• Explore the potential of using AI (ML/DL) in SDN Networks: Conventional SDN-based DDoS /slow DDoS mitigation often struggle with the detection and mitigation of sophisticated attacks due to their limited ability to analyse complex traffic patterns. Explore/evaluate the potential of using AI (machine learning (ML) and deep learning (DL)) using convolutional neural network (CNN), logistic regression (LR), random forest (RF), support vector machine (SVM) and k-nearest neighbour (KNN) models, amongst others.

Segun Popoola, Hossein Abroshan, Nouman Nafees

Objectives

• Deep learning for intelligent cyber security solutions: Developing novel algorithms to autonomously and efficiently detect cyber threats and attacks in Internet of Things (IoT)-enabled smart critical infrastructure.
• Federated learning for privacy-preservation: Developing innovative methods to create intelligent systems that preserve user privacy by enabling decentralised data processing in distributed environments.
• Adversarial machine learning: Developing novel techniques to understand and mitigate vulnerabilities in AI models by focusing on the generation and defence against malicious inputs designed to deceive AI systems.
• AI security and safety: Developing the frameworks and strategies required to ensure that AI systems are secure and safe by addressing potential risks, bias, and ethical concerns.

Charles Marrow, Andrew Moore

Objectives

• Vulnerability Analysis: Conduct comprehensive vulnerability analysis of modern applications to identify common security weaknesses such as injection flaws, broken authentication, sensitive data exposure, and inadequate access controls.
• Automated Security Testing: Develop and evaluate automated security testing tools and techniques, including static analysis, dynamic analysis, and interactive application security testing (IAST), to detect and remediate security vulnerabilities in software applications efficiently.
• Secure Software Development Lifecycle (SDLC): Investigate methodologies and best practices for integrating security into the software development lifecycle, including secure coding standards, threat modelling, code review processes, and security-focused testing methodologies.
• Container and Serverless Security: Explore security challenges and solutions specific to containerised and serverless application architectures, including container isolation, image security, runtime protection, and serverless function security.
• Web Application Firewall (WAF) Efficacy: Evaluate the effectiveness of web application firewalls (WAFs) in mitigating common web application attacks, such as SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF), and propose enhancements to WAF technology.
• API Security: Investigate security risks associated with application programming interfaces (APIs), including API authentication, authorization, encryption, and protection against API abuse, and propose strategies for securing APIs in distributed systems.
• Threat Intelligence Integration: Explore approaches for integrating threat intelligence feeds and security information from external sources into application security workflows to enhance threat detection and response capabilities.
• Compliance and Regulatory Alignment: Assess the alignment of application security practices with industry-specific regulations (e.g., GDPR, PCI DSS) and compliance frameworks (e.g., ISO 27001, OWASP ASVS) and propose methodologies for achieving and maintaining regulatory compliance.

• Close collaboration with the ISC2 East Chapter
• ISC2 Academic Peer-to-Peer Network Group
• Professional Development Content Review subgroup
• Forward looking Cybersecurity Education-Training subgroup
• Open Web Application Security Project (OWASP) – Cambridge chapter
• British Computing Society – Cybercrime Forensics
• Cybercrime Forensics and BCS DevSecOps
• Close working relationships with industry, professional bodies, law enforcement, government agencies and academia

Dr Erika Sanchez V (Interim Director, Cisco Academy Lead, contact for the group): [email protected]

Dr Shareeful Islam (Contact for external income generation): [email protected]

Dr Hossein Abroshan (Contact for industry links): [email protected]

Dr Cristina Luca (Contact for postgraduate research student enquiries): [email protected]