Seeking Foundations for the Science of Cyber Security

Introduction

Cyber security (or cybersecurity) has become a fundamental issue which deeply affects citizen’s lives (including their privacy), the public’s economic prosperity, and national security. The high frequency of media reports on high-profile cyber attacks, which cause substantial and, at times, catastrophic damages, highlights that cyberspace is a very fragile and vulnerable ecosystem, and that our understanding of cybersecurity and our capability of defending cyberspace are far from adequate. This is true despite the numerous advancements and breakthroughs in some fields of cybersecurity. One outstanding example is cryptography, which has been built on a firm foundation in Computational Complexity Theory, starting with a number of breakthroughs, e.g. Diffie and Hellman (1976), Rivest et al. (1978), Goldwasser and Micali (1982), and Yao (1982). However, there are many cyber attacks that go beyond the standard cryptographic threats models, such as attacks which can compromise cryptographic private keys by directly stealing memory pages (e.g., Harrison and Xu (2007)), or indirectly exploiting side-channel attacks (e.g., Kocher (1996)). The state-of-the-art is that we are far from being capable of adequately dealing with such attacks in practice, as discussed in Xu and Yung (2009). Indeed, it would be fair to say, cybersecurity as a whole is still an art, partially because its many aspects (e.g., defense operations) are largely heuristics without scientific rigor.

It is interesting to note that the importance of putting cybersecurity on firm foundations were not widely recognized until perhaps the 2008 Science of Security Workshop (https://cps-vo.org/group/SoS/). This event has triggered a number of explorations, including: Schneider (2011), Kott (2014), Xu (2014a), Xu (2014b), Xu (2019), Xu (2020), Roque et al. (2016), Herley and van Oorschot (2017), and Spring et al. (2017). These endeavors suggest that it is far from clear in terms of what would be the foundations for the Science of Cyber Security. This is not surprising because cyber security turns out to be an extremely difficult problem, owing to many factors, such as: (i) the scale of cyberspace, where billions of devices are interconnected and must be considered holistically; (ii) the complexity of cyberspace in terms of the interdependence and interactions among its cyber-physical-human components; (iii) the adversarial intelligence that attackers possess as skilled human beings which is on par with defenders; (iv) the asymmetry between attackers who only need to identify and exploit a single vulnerability, and defenders who must seek to prevent or block each and every vulnerability; (v) the difficulty in quantifying cybersecurity from a whole-system (rather than building-blocks) perspective; and (vi) the multidisciplinary nature of cybersecurity, technologically speaking, and especially the involvement of human beings as users, attackers, and defenders.

The above discussion suggests that it must take an extensive community wide effort to investigate the foundations for the Science of Cyber Security. This motivated the creation of the new series of International Conference on Science of Cyber Security (SciSec) in 2018. The mission of SciSec is to catalyze and foster such a research community. SciSec focuses on a unique set of topics. As shown in the Call For Papers of SciSec (cf. https://scisec.org), the topics of interest include, but are not limited to, the following: “(1) cybersecurity dynamics; (2) cybersecurity metrics and measurements; (3) first-principle cybersecurity modeling and analysis; (4) cybersecurity data analytics; (5) quantitative risk management for cybersecurity; (6) big data for cybersecurity; (7) artificial intelligence and machine learning to cybersecurity; (8) economics approaches to cybersecurity; (9) social sciences approaches to cybersecurity; (10) statistical physics approaches to cybersecurity; (11) complexity sciences approaches to cybersecurity; (12) experimental cybersecurity; (13) macroscopic cybersecurity; (14) statistics approaches to cybersecurity; (15) human factors for cybersecurity; (16) compositional security; (17) biology-inspired approaches to cybersecurity; (18) synergetics approaches to cybersecurity.”

The Special Issue

The present special issue consists of four invited papers whose earlier versions were presented at The Second International Conference on Science of Cyber Security (SciSec’2019). All these papers contain significant extensions based on the feedback received at the conference, and went through two rounds of independent reviews per the criteria of the Information Systems Frontier journal. These papers fall into three topics of SciSec, namely experimental cybersecurity or more specifically deceptive cyber defense, cybersecurity data analytics, and human factors in cybersecurity or more specifically game-theoretic modeling of human behavior.

Deceptive cyber defense is an important approach to cyber security which is little understood. The paper by Huang et al. (2021), entitled ``HoneyGadget: A Deception Based Approach for Detecting Code Reuse Attacks,” advances the state-of-the-art in deceptive cyber defense, by proposing and evaluating a new deception mechanism that aims at actively detecting ongoing code reuse attacks.

Cybersecurity data analytics aims at leveraging real-world data to deepen our understanding of attacks, and helping achieve more effective cyber defense. The paper by Xia et al. (2021), entitled ``LogGAN: a Log-level Generative Adversarial Network for Anomaly Detection using Permutation Event Modeling,” proposes a cutting-edge Generative Adversarial Network (GAN) method in systems anomaly detection. The paper by Roy and Chen (2021), entitled ``DeepRan: Attention-based BiLSTM and CRF for Ransomware Early Detection and Classification,” pushes the frontier in ransomware detection, by leveraging deep learning techniques.

Game-theoretic modeling of cyber security, including human behavior, is an active research topic. The paper by Xue et al. (2021), entitled ``Incentive Mechanism for Rational Miners in Bitcoin Mining Pool,” presents a novel game-theoretic model of user behaviors in the Bitcoin network, more specifically it covers designing incentive mechanism design for Bitcoin miners and analyzing their properties.

Future Research

There are many open problems that are yet to be tackled. We next highlight a few of them.

First, corresponding to the aforementioned scale of cyberspace, we immediately encounter the scalability barrier, which is fundamentally related to the state-space explosion problem as discussed in Xu (2014a), Xu (2019), and Xu (2020). While there have been some significant progress in this regard (e.g., Xu et al. (2015b), Zheng et al. (2015), Zheng et al. (2018), Lin et al. (2019), and Han et al. (2020)), there are many problems that are yet to be addressed (cf. Xu (2020)).

Second, corresponding to the aforementioned complexity of cyberspace in terms of the interdependence and interactions among its cyber-physical-human components, we encounter the challenges of high nonlinearity, as shown in Xu et al. (2012), Xu et al. (2014), Zheng et al. (2018), and Lin et al. (2019), and dependence between random variables and stochastic processes (or time series), as shown in Xu and Xu (2012), Da et al. (2014), Xu et al. (2015a), and Fang et al. (2021). One outstanding research problem is to model and characterize coordinated defense against coordinated attacks (cf. Xu (2008)). Another outstanding research problem is to model and characterize large-scale adaptive and proactive defenses against adaptive attacks. Yet another outstanding open problem is to understand and manage the transient behavior in the evolution of cybersecurity state of (say) enterprise networks. This is important because, often, mathematical tools can only characterize asymptotic (e.g., equilibrium) behaviors. While important for sure, it is imperative to understand the transient behaviors, which often have to be dealt with using data-driven approaches, highlighting the importance of cybersecurity data analytics (e.g., Zhan et al. (2013), Zhan et al. (2015), Chen et al. (2015), Xu et al. (2017), Peng et al. (2017), Xu et al. (2018), Fang et al. (2019), and Fang et al. (2021)).

Third, corresponding to the aforementioned adversarial intelligence that attackers are as skilled human beings as defenders, we encounter a range of challenges, including adversarial evasion attacks against malware detectors, uncertainty of models and parameters, the absence of data label ground truth (when applicable), the availability of partial (rather than full) information, and the treatment of cyber attacker/defender human factors (including their cognitive capabilities). There are some initial efforts towards ultimately tackling these problems (e.g., Li et al. (2020), Li et al. (2021a), Du et al. (2018), and Rodriguez et al. (2020)).

Fourth, corresponding to the aforementioned asymmetry that inherently benefits the attacker, researchers have been studying how to detect software vulnerabilities so as to hopefully patch them before they are discovered by attackers (e.g., Li et al. (2018), Li et al. (2021c), Zou et al. (2019), and Li et al. (2021d)). However, many problems remain open, including the explainability and robustness of such detectors against adversarial attackers (cf. Zou et al. (2021) and Li et al. (2021b)).

Fifth, corresponding to the aforementioned difficulty in quantifying cyber security from a whole-system perspective, the research community must tackle the barriers of cyber security trustworthiness metrics, broadly defined to include security metrics, resilience metrics, and agility metrics (cf. Pendleton et al. (2016) and Cho et al. (2019)) and their measurements. There are a sequence of ongoing research activities in this regard (e.g., Li et al. (2011), Xu and Xu (2012), Han et al. (2014), Wang et al. (2015), Chen et al. (2018a), Chen et al. (2018b), Mireles et al. (2019), and Liu et al. (2021)).

Sixth, corresponding to the aforementioned multidisciplinary nature of cyber security, we observe that Science of Cyber Security would demand the research community to understand not only the security properties and behavior of information technologies, but also their ripple effects on individuals, organizations, and the society (e.g., Wang et al. (2019)). This multidisciplinary nature, naturally calls for international collaborations, which motivated the creation of the new conference series of SciSec. One problem of particular interest is: Which discipline can contribute to solve what kinds of concrete cyber security problems that may not be solved by other disciplines? Answering this question will likely lead to holistic and end-to-end cyber defense solutions.

With this special issue, we hope that more researchers will find, both, the emerging field of Science of Cyber Security and the SciSec Conference interesting, and more importantly, raise their passion and engagement in elevating the art of cybersecurity to a science, which cannot be achieved without a concert community effort. We look forward to seeing a community working together.