Model-driven Simulation and Training Environments for Cybersecurity Second International Workshop, MSTEC 2020.pdf

Preface
Organization
Contents
Cyber Security Training Modelling
Cyber Taxi: A Taxonomy of Interactive Cyber Training and Education Systems
	1 Introduction
	2 Definition of Terms and Requirements
	3 Related Work
	4 Taxonomy
		4.1 Technical Setup
		4.2 Audience
		4.3 Training Environment
		4.4 Training Setup
	5 Examples and Case Studies of Cyber Training and Education Systems
		5.1 Application of the Taxonomy
		5.2 Phase 1: Organization and Development
		5.3 Phase 2: Testing and Dry Run
		5.4 Phase 3: Accomplishment
		5.5 Phase 4: Cleanup and Maintenance
	6 Conclusion and Future Work
	References
Cyber Range Training Programme Specification Through Cyber Threat and Training Preparation Models
	1 Introduction
	2 Background and Related Work
	3 Cyber Threat and Training Preparation Models
	4 CTTP Programme Scenario Definition
		4.1 Smart Home/IoT - Threat Response & Mitigation Training Programme
		4.2 Smart Shipping - Navigation Combo Attack (Phishing Email and GPS Spoofing)
	5 CTTP Programme Model Specification
		5.1 Core Assurance Model
		5.2 Emulation Sub-model
		5.3 Simulation Sub-model
		5.4 Gamification Sub-model
		5.5 Training Model Generation and Delivery Parameters
	6 Conclusions and Future Work
	References
Serious Games
A Pond Full of Phishing Games - Analysis of Learning Games for Anti-Phishing Education
	1 Introduction
	2 Related Work
	3 Research Objectives and Hypotheses
	4 Methodology of Literature and Product Search
	5 Analysis of Target Groups and Educational Contexts
	6 Analysis of Learning Goals and Taxonomy Levels
	7 Analysis of Learning Content
	8 Discussion
	9 Conclusion
	References
Conceptualization of a CyberSecurity Awareness Quiz
	1 Introduction
	2 Background and Related Work
		2.1 Relation to Existing Games
		2.2 Embedding into a CyberSecurity Training Platform
	3 Concept
		3.1 Game Concept
		3.2 Process for Information Procurement and Question Generation
	4 Architecture and Components
		4.1 Content Collector
		4.2 Quiz Manager
		4.3 Provision Manager
		4.4 Start Screen
		4.5 Quiz Game
	5 Conclusion
	References
Emulation and Simulation Studies
Towards the Monitoring and Evaluation of Trainees' Activities in Cyber Ranges
	1 Introduction
	2 Related Work
	3 Background: The THREAT-ARREST Platform
	4 An Enhanced Platform with Trainee Activity Monitoring and Evaluation
		4.1 Actions Taxonomy
		4.2 Evaluation Server
		4.3 A Distributed and Agent-Based Plugin Architecture
	5 Conclusion and Future Works
	References
Automatically Protecting Network Communities by Malware Epidemiology
	1 Introduction and Motivation
	2 Identify the Network Communities
		2.1 The Network Structure
		2.2 Detect and Group Nodes into Communities
	3 Simulate Epidemic Final Sizes Using Malware Propagation Models
	4 Smooth the Final Size Probabilities as a Signal
		4.1 Calculate the Probability of Each Final Size
		4.2 Apply a Smoothing Function
	5 Group the Final Sizes into Ranges
		5.1 Find All the Boundary Values Marked by Local Minima in the Smoothed Probability
		5.2 Merge the Original Ranges Using Thresholds/Rules
	6 Identify Granular Community Information/Characteristics Through Relationship Analysis Between Final Size Range and Community Contributions
		6.1 Epidemic Starting Community and Final Size
	7 Protect Network Communities Automatically
		7.1 Set up Rules and Thresholds
		7.2 Real World Use
	8 Discussion
	References
Attacks
Chasing Botnets: A Real Security Incident Investigation
	1 Introduction
	2 Related Works
		2.1 Botnet Infrastructure
		2.2 Attacks
		2.3 Countermeasures
	3 The Storyline of the Security Incident
	4 The Investigation – Incident Report
	5 The Economic Implications
	6 Silver Bulletin for Setting a Server in the Cloud
	7 Conclusions
	References
Software System Exploration Using Library Call Analysis
	1 Introduction
	2 Background and Related Work
	3 Design
	4 Implementation
	5 Training Scenarios
		5.1 Software Exploration
		5.2 Run-Time Analysis and Modification
	6 Conclusion
	References
Security Policies
A Pattern–Driven Adaptation in IoT Orchestrations to Guarantee SPDI Properties
	1 Introduction
	2 Related Work
	3 Background
		3.1 Pattern Language
		3.2 Pattern Definition
		3.3 Pattern Rule
	4 Architecture and Core Building Blocks
		4.1 Node–RED
		4.2 Pattern Orchestrator
		4.3 Pattern Engine
	5 Implementation Details
	6 Comparison with Alternative Approaches
	7 Conclusion
	References
Password Management: How Secure Is Your Login Process?
	1 Introduction
	2 Empirical Study
	3 Entropy
	4 Storage and Password Hashing
		4.1 Stored Information
		4.2 Login Process
	5 Mobile Applications and BYOD Policy
	6 OAuth 2.0
	7 Benchmark
	8 Conclusions
	Appendix I – Question Sets for Users and Administrators
	References
Author Index