Model-driven Simulation and Training Environments for Cybersecurity : Second International Workshop, MSTEC 2020, Guildford, UK, September 14{u2013}18, 2020, Revised Selected Papers

This book constitutes the refereed post-conference proceedings of the Second International Workshop on Model-Driven Simulation and Training Environments for Cybersecurity, MSTEC 2020, held in Guildford, UK, in September 2020 in conjunction with the 24th European Symposium on Research in Computer Security, ESORICS 2020. The conference was held virtually due to the COVID-19 pandemic. The MSTEC Workshop received 20 submissions from which 10 full papers were selected for presentation. The papers are grouped in thematically on: cyber security training modelling; serious games; emulation & simulation studies; attacks; security policies. Preface 6 Organization 7 Contents 8 Cyber Security Training Modelling 10 Cyber Taxi: A Taxonomy of Interactive Cyber Training and Education Systems 11 1 Introduction 11 2 Definition of Terms and Requirements 12 3 Related Work 13 4 Taxonomy 14 4.1 Technical Setup 14 4.2 Audience 17 4.3 Training Environment 18 4.4 Training Setup 19 5 Examples and Case Studies of Cyber Training and Education Systems 22 5.1 Application of the Taxonomy 23 5.2 Phase 1: Organization and Development 23 5.3 Phase 2: Testing and Dry Run 24 5.4 Phase 3: Accomplishment 24 5.5 Phase 4: Cleanup and Maintenance 25 6 Conclusion and Future Work 26 References 27 Cyber Range Training Programme Specification Through Cyber Threat and Training Preparation Models 30 1 Introduction 30 2 Background and Related Work 32 3 Cyber Threat and Training Preparation Models 32 4 CTTP Programme Scenario Definition 35 4.1 Smart Home/IoT - Threat Response & Mitigation Training Programme 36 4.2 Smart Shipping - Navigation Combo Attack (Phishing Email and GPS Spoofing) 38 5 CTTP Programme Model Specification 40 5.1 Core Assurance Model 41 5.2 Emulation Sub-model 41 5.3 Simulation Sub-model 41 5.4 Gamification Sub-model 42 5.5 Training Model Generation and Delivery Parameters 42 6 Conclusions and Future Work 44 References 44 Serious Games 46 A Pond Full of Phishing Games - Analysis of Learning Games for Anti-Phishing Education 47 1 Introduction 47 2 Related Work 49 3 Research Objectives and Hypotheses 50 4 Methodology of Literature and Product Search 51 5 Analysis of Target Groups and Educational Contexts 52 6 Analysis of Learning Goals and Taxonomy Levels 53 7 Analysis of Learning Content 56 8 Discussion 59 9 Conclusion 61 References 63 Conceptualization of a CyberSecurity Awareness Quiz 67 1 Introduction 67 2 Background and Related Work 68 2.1 Relation to Existing Games 68 2.2 Embedding into a CyberSecurity Training Platform 69 3 Concept 70 3.1 Game Concept 70 3.2 Process for Information Procurement and Question Generation 72 4 Architecture and Components 77 4.1 Content Collector 77 4.2 Quiz Manager 78 4.3 Provision Manager 79 4.4 Start Screen 79 4.5 Quiz Game 80 5 Conclusion 80 References 81 Emulation and Simulation Studies 83 Towards the Monitoring and Evaluation of Trainees' Activities in Cyber Ranges 84 1 Introduction 84 2 Related Work 86 3 Background: The THREAT-ARREST Platform 87 4 An Enhanced Platform with Trainee Activity Monitoring and Evaluation 88 4.1 Actions Taxonomy 89 4.2 Evaluation Server 90 4.3 A Distributed and Agent-Based Plugin Architecture 93 5 Conclusion and Future Works 95 References 96 Automatically Protecting Network Communities by Malware Epidemiology 97 1 Introduction and Motivation 97 2 Identify the Network Communities 100 2.1 The Network Structure 100 2.2 Detect and Group Nodes into Communities 101 3 Simulate Epidemic Final Sizes Using Malware Propagation Models 101 4 Smooth the Final Size Probabilities as a Signal 102 4.1 Calculate the Probability of Each Final Size 102 4.2 Apply a Smoothing Function 104 5 Group the Final Sizes into Ranges 105 5.1 Find All the Boundary Values Marked by Local Minima in the Smoothed Probability 105 5.2 Merge the Original Ranges Using Thresholds/Rules 105 6 Identify Granular Community Information/Characteristics Through Relationship Analysis Between Final Size Range and Community Contributions 107 6.1 Epidemic Starting Community and Final Size 108 7 Protect Network Communities Automatically 109 7.1 Set up Rules and Thresholds 109 7.2 Real World Use 110 8 Discussion 110 References 111 Attacks 113 Chasing Botnets: A Real Security Incident Investigation 114 1 Introduction 114 2 Related Works 116 2.1 Botnet Infrastructure 116 2.2 Attacks 116 2.3 Countermeasures 117 3 The Storyline of the Security Incident 119 4 The Investigation – Incident Report 120 5 The Economic Implications 122 6 Silver Bulletin for Setting a Server in the Cloud 123 7 Conclusions 125 References 125 Software System Exploration Using Library Call Analysis 128 1 Introduction 128 2 Background and Related Work 129 3 Design 132 4 Implementation 133 5 Training Scenarios 137 5.1 Software Exploration 137 5.2 Run-Time Analysis and Modification 139 6 Conclusion 140 References 140 Security Policies 143 A Pattern–Driven Adaptation in IoT Orchestrations to Guarantee SPDI Properties 144 1 Introduction 144 2 Related Work 145 3 Background 146 3.1 Pattern Language 146 3.2 Pattern Definition 147 3.3 Pattern Rule 148 4 Architecture and Core Building Blocks 149 4.1 Node–RED 149 4.2 Pattern Orchestrator 150 4.3 Pattern Engine 150 5 Implementation Details 150 6 Comparison with Alternative Approaches 154 7 Conclusion 155 References 156 Password Management: How Secure Is Your Login Process? 158 1 Introduction 158 2 Empirical Study 159 3 Entropy 160 4 Storage and Password Hashing 162 4.1 Stored Information 162 4.2 Login Process 164 5 Mobile Applications and BYOD Policy 166 6 OAuth 2.0 167 7 Benchmark 169 8 Conclusions 171 Appendix I – Question Sets for Users and Administrators 172 References 176 Author Index 179