Publications by Dr Virginia Franqueira

In the current era, satisfying the appetite of data hungry models is becoming an increasingly challenging task. This challenge is particularly magnified in research areas characterised by sensitivity, where the quest for genuine data proves to be elusive. The study of violence serves as a poignant example, entailing ethical considerations and compounded by the scarcity of authentic, real-world data that is predominantly accessible only to law enforcement agencies. Existing datasets in this field often resort to using content from movies or open-source video platforms like YouTube, further emphasising the scarcity of authentic data. To address this, our dataset aims to pioneer a new approach by creating the first synthetic virtual dataset for violence detection, named the Weapon Violence Dataset (WVD). The dataset is generated by creating virtual violence scenarios inside the photo-realistic video game namely: Grand Theft Auto-V (GTA-V). This dataset includes carefully selected video clips of person-to-person fights captured from a frontal view, featuring various weapons—both hot and cold across different times of the day. Specifically, WVD contains three categories: Hot violence and Cold violence (representing the violence category) as well as No violence (constituting the control class). The dataset is designed and created in a way that will enable the research community to train deep models on such synthetic data with the ability to increase the data corpus if the needs arise. The dataset is publicly available on Kaggle and comprises normal RGB and optic flow videos.

Learning from cyber incidents is crucial for organisations to enhance their cyber resilience and effectively respond to evolving threats. This study employs neo-institutional and organisational learning theories to examine how organisations learn from incidents and gain insights into the challenges they face. Drawing on qualitative research methods, interviews were conducted with 34 security practitioners from organisations operating in the UK spanning a range of industries. The findings highlight the importance of consciously evaluating learning practices and creating a culture of openness to hear about incidents from employees, customers and suppliers. Deciding which incidents to learn from, as well as who should participate in the learning process, emerged as critical considerations. Overcoming defensiveness and addressing systemic causes were recognised as barriers to effective learning. The study emphasises the need to assess the value and impact of identified lessons and to avoid superficial reviews that treat symptoms rather than underlying causes to improve resilience. While progress has been made in learning from incidents, further enhancements are needed. Practical recommendations have been proposed to suggest how organisations may gain valuable insights for maximising the benefits derived from incident learning. This research contributes to the existing knowledge on organisational learning and informs future studies exploring the social and political influences on the learning process. By considering the suggested recommendations, organisations may strengthen their cyber security, foster a culture of continuous improvement, and respond effectively to the dynamic cyber security landscape.

Over the past 15 years, digital evidence has been identified as a leading cause, or contributing factor, in wrongful convictions in England and Wales. To prevent legal decision-makers from being misled about the relevance and credibility of digital evidence and to ensure a fair administration of justice, adopting a balanced, systematic and transparent approach to evaluating digital evidence and disseminating results is crucial. This paper draws on general concepts from argumentation theory, combined with key principles and concepts from probabilistic and narrative/scenario approaches to develop arguments and analyse evidence. We present the "Argument-Based Method for Evaluative Opinions", which is a novel method for producing argument-based evaluative opinions in the context of criminal investigation. The method may be used stand-alone or in combination with other qualitative or quantitative/statistical methods to produce evaluative opinions, highlighting the logical relationships between the components making up the argument supporting a hypothesis. To facilitate a structured assessment of the credibility and relevance of the individual argument components, we introduce an Argument Evaluation Scale and, ultimately, an Argument Matrix for a holistic determination of the probative value of the evidence.

Manually labelling datasets for training violence detection systems is time-consuming, expensive, and labor-intensive. Mind wandering, boredom, and short attention span can also cause labelling errors. Moreover, collecting and distributing sensitive images containing violence has ethical implications. Automation is the future for labelling sensitive image datasets. Deep labeller is a two-stage Deep Learning (DL) method that uses pre-trained DL object detection methods on MS-COCO for automatic labelling. The Deep Labeller method labels violent and nonviolent images in WVD and USI. In stage 1, WVD generates weak labels using synthetic images. In stage 2, the Deep labeller method is retrained on weak labels. USI dataset is used to test our method on real-world violence. Deep labeller generated weak and strong labels with an IoU of 0.80036 in stage 1 and 0.95 in stage 2 on the WVD. Automatically generated labels. To test our method's generalisation power, violent and nonviolent image labels on USI dataset had a mean IoU of 0.7450.

Cyber security incidents are now prevalent in many organisations. Arguably, those who can learn from security incidents and address the underlying causes will reduce the prevalence of similar ones in the future. This research provides a new examination of how organisations learn from incidents by systematically reviewing academic research on organisational learning from cyber security incidents and identifies further research needed in this area. To do this, it considers three research questions: what research has been conducted on learning from cyber security incidents, what learning practices in organisations have been found by research and what improvements have been recommended, and what further research is needed as organisations learn from such incidents. Using the PRISMA method, a total of 3,986 articles were extracted and, from these, a relevant set of 30 were selected for analysis to map the body of research, and to identify future research avenues. Despite learning lessons being recommended by both researchers and industry standards, our findings suggest that this advice is not being fully adopted by organisations. Importantly, these studies have found inadequate participation in learning activities, with superficial causal investigations, scarce effort on ensuring lessons are implemented and no evaluation if the actions taken actually reduce future security incidents. More research is needed to understand the right level and which learning practices to invest in for the greatest impact. For practitioners, this review discusses the essential elements of an effective process to learn from incidents. This review provides academics with a novel synthesis of the research undertaken on this topic, enabling them to incorporate the significant findings into their work and potentially explore the research agenda suggested.

Contribution: This paper presents a systematic literature review of research concerning cyber security education for children (under 18s) on a global scale. Background: While the internet brings great convenience to children, it can potentially cause harms due to lack of knowledge about online risks. Research Questions: 1. What cyber security skills are taught to children worldwide? 2. What are key strategies/methods for cyber security education? 3. What stakeholders are regarded as responsible for cyber security education of children? Methodology: Using the PRISMA protocol for literature search, 412 papers published between January 2015 and June 2021 were retrieved and 44 were identified for thematic analysis. Findings: The content considered for cyber security education varies greatly between nations, being therefore inconsistent and filled with gaps. This paper suggests curriculum content framed around six broad categories of cyber security awareness for educators and policy makers to follow, and further recommends that curriculum should be influenced not only by expert advice, but also through a 'bottom-up' approach listening to children's voice to adequately gauge the level of internet engagement and their activities. This paper finds that innovative teaching methods (e.g., gamification) are claimed to provide 'hands on' and 'real life' experiences that greatly enhance traditional classroom teaching (e.g., mentoring), but existing literature lacks evaluation of comparative effectiveness. Lastly, the paper finds that the primary provider for cyber security education, from the sample analysed, is regarded as schoolteachers, supported by parents and by a formal curriculum resourced adequately by governments.

An emerging concern in relation to the importance of technology and social media in everyday life relates to their ability to facilitate online and offline stalking, domestic violence and escalation to homicide. However, there has been little empirical research, or policing and policy attention to this domain. This study examined the extent to which there was evidence of the role of technology and cyberstalking in domestic homicide cases based on analysis of 41 Domestic Homicide Review (DHR) documents, made available by the Home Office (UK). Three interviews were also conducted with victims or family members of domestic homicide in the UK. It aimed to develop a deeper understanding of the role of technology in facilitating these forms of victimisation to inform further development of investigative practice, risk assessment and safeguarding procedures. Key themes identified by the thematic analysis undertaken related to behavioural and psychological indicators of cyberstalking, evidence of the role of technology in escalation to homicide, and the digital capabilities of law enforcement. Overall, the results indicated that: (1) there was evidence of technology and social media playing a facilitating role in these behaviours, (2) the digital footprints of victims and perpetrators were often overlooked in police investigations and the DHR process, and (3) determining the involvement of technology in such cases is important for risk assessment and earlier intervention to prevent escalation of behaviour to domestic homicide. It also indicates the importance of further developing evidencebased approaches to preventing and responding for victims, the police and other practitioners.

Digital forensic practitioners are increasingly facing examinations which are both complex in nature and structure. Throughout this process, during the examination and analysis phases, the practitioner is constantly drawing logical inferences which will be reflected in the reporting of results. Therefore, it is important to expose how all the elements of an investigation fit together to allow review and scrutiny, and to support associated parties to understand the components within it. This paper proposes the use of 'Structured Argumentation' as a valuable and flexible ingredient of the practitioners' thinking toolbox. It explores this approach using three case examples which allow discussion of the benefits and application of structured argumentation to real world contexts. We argue that, despite requiring a short learning curve, structured argumentation is a practical method which promotes accessibility of findings facilitating communication between technical and legal parties, peer review, logical reconstruction, jury interpretation, and error detection.

Two recent and promising additions to the internet protocols are TCP-BBR and QUIC. BBR defines a congestion policy that promises a better control in TCP bottlenecks on long haul transfers and can also be used in the QUIC protocol. TCP-BBR is implemented in the Linux kernels above 4.9. It has been shown, however, to demand careful fine tuning in the interaction, for example, with the Linux Fair Queue. QUIC, on the other hand, replaces HTTP and TLS with a protocol on the top of UDP and thin layer to serve HTTP. It has been reported to account today for 7% of Google's traffic. It has not been used in server-to-server transfers even if its creators see that as a real possibility. Our work evaluates the applicability and tuning of TCP-BBR and QUIC for data science transfers. We describe the deployment and performance evaluation of TCP-BBR and comparison with CUBIC and H-TCP in transfers through the TEIN link to Singaren (Singapore). Also described is the deployment and initial evaluation of a QUIC server. We argue that QUIC might be a perfect match in security and connectivity to base services that are today performed by the Xroot redirectors.

The Internet of Things (IoT) has experienced significant growth over recent years and Gartner predicts that, by 2020, 21 billion IoT endpoints will be in use. The potential behind widespread usage of small devices capable of collecting, transmitting, or acting upon data has been fueling interest both from industry and academia. Security and forensics are two of the topics facing major challenges in this paradigm, on par with or even more prominent than other computing paradigms. Aspects such as low processing power and small storage capacity of such IoT devices contribute to their typically poor built-in security and forensics capabilities. Their reliance on cloud computing and mobile apps to operate and provide services increases the attack surface, distributing the collection of digital evidence and making reconstruction activities (to answer questions as what, where, when, who, why, and how) harder.

The increasing use of social media networks on handheld devices, especially smartphones with powerful built-in cameras, and the widespread availability of fast and high bandwidth broadband connections, added to the popularity of cloud storage, is enabling the generation and distribution of massive volumes of digital media, including images and videos. Such media is full of visual information and holds immense value in today's world. The volume of data involved calls for automated visual content analysis systems able to meet the demands of practice in terms of efficiency and effectiveness. Deep learning (DL) has recently emerged as a prominent technique for visual content analysis. It is data-driven in nature and provides automatic end-to-end learning solutions without the need to rely explicitly on predefined handcrafted feature extractors. Another appealing characteristic of DL solutions is the performance they can achieve, once the network is trained, under practical constraints. This paper identifies eight problem domains which require analysis of visual artifacts in multimedia. It surveys the recent, authoritative, and the best performing DL solutions and lists the datasets used in the development of these deep methods for the identified types of visual analysis problems. This paper also discusses the challenges that the DL solutions face which can compromise their reliability, robustness, and accuracy for visual content analysis.

The state-of-the-art and practice show an increased recognition, but limited adoption, of Behavioural Evidence Analysis (BEA) within the Digital Forensics (DF) investigation process. Yet, there is currently no BEA-driven process model and guidelines for DF investigators to follow in order to take advantage of such an approach. This paper proposes the Behavioural Digital Forensics Model to fill this gap. It takes a multidisciplinary approach which incorporates BEA into in-lab investigation of seized devices related to interpersonal cases (i.e., digital crimes involving human interactions between offender(s) and victim(s)). The model was designed based on the application of traditional BEA phases to 35 real cases, and evaluated using 5 real digital crime cases - all from Dubai Police archive. This paper, however, provides details of only one case from this evaluation pool. Compared to the outcome of these cases using a traditional DF investigation process, the new model showed a number of benefits. It allowed a more effective focusing of the investigation, and provided logical directions for identifying the location of further relevant evidence. It also enabled a better understanding and interpretation of victim/offender behaviours (e.g., probable offenders' motivations and modus operandi), which facilitated a more in depth understanding of the dynamics of the specific crime. Finally, in some cases, it enabled the identification of suspect's collaborators, something which was not identified via the traditional investigative process.

Vehicular Ad-Hoc Network (VANET), a vital component of Intelligent Transportation Systems (ITS) technology, relies on communication between dynamically connected vehicles and static Road Side Units (RSU) to offer various applications (e.g., collision avoidance alerts, steep-curve warnings and infotainment). VANET has a massive potential to improve traffic efficiency, and road safety by exchanging critical information between nodes (vehicles and RSU), thus reducing the likelihood of traffic accidents. However, this communication between nodes is subject to a variety of attacks, such as Man-In-The-Middle (MITM) attacks which represent a major risk in VANET. It happens when a malicious node intercepts or tampers with messages exchanged between legitimate nodes. In this paper, we studied the impact on network performance of different strategies which attackers can adopt to launch MITM attacks in VANET, such as fleet or random strategies. In particular, we focus on three goals of MITM attacks—message delayed, message dropped and message tampered. The simulation results indicate that these attacks have a severe influence on the legitimate nodes in VANET as the network experience high number of compromised messages, high end-to-end delays and preeminent packet losses.

Vehicular ad-hoc network (VANET) provides a unique platform for vehicles to intelligently exchange critical information, such as collision avoidance messages. It is, therefore, paramount that this information remains reliable and authentic, i.e., originated from a legitimate and trusted vehicle. Trust establishment among vehicles can ensure security of a VANET by identifying dishonest vehicles and revoking messages with malicious content. For this purpose, several trust models (TMs) have been proposed but, currently, there is no effective way to compare how they would behave in practice under adversary conditions. To this end, we propose a novel trust evaluation and management (TEAM) framework, which serves as a unique paradigm for the design, management, and evaluation of TMs in various contexts and in presence of malicious vehicles. Our framework incorporates an asset-based threat model and ISO-based risk assessment for the identification of attacks against critical risks. The TEAM has been built using VEINS, an open source simulation environment which incorporates SUMO traffic simulator and OMNET++ discrete event simulator. The framework created has been tested with the implementation of three types of TMs (data oriented, entity oriented, and hybrid) under four different contexts of VANET based on the mobility of both honest and malicious vehicles. Results indicate that the TEAM is effective to simulate a wide range of TMs, where the efficiency is evaluated against different quality of service and security-related criteria. Such framework may be instrumental for planning smart cities and for car manufacturers.

Previous studies examining the investigative challenges and needs of Digital Forensic (DF) practitioners have typically taken a sector-wide focus. This paper presents the results of a survey which collected text-rich comments about the challenges experienced and related suggestions for improvement in the investigation of Indecent Images of Children (IIOC) cases. The comments were provided by 153 international DF practitioners (28.1% survey response rate) and were processed using Thematic Analysis. This resulted in the identification of 4 IIOC-specific challenge themes, and 6 DF-generic challenges which directly affect IIOC. The paper discusses these identified challenges from a practitioner perspective, and outlines their suggestions for addressing them.

We investigate the problem of line detection in digital image processing and in special how state of the art algorithms behave in the presence of noise and whether CPU efficiency can be improved by the combination of a Monte Carlo Tree Search, hierarchical space decomposition, and parallel computing. The starting point of the investigation is the method introduced in 1962 by Paul Hough for detecting lines in binary images. Extended in the 1970s to the detection of space forms, what came to be known as Hough Transform (HT) has been proposed, for example, in the context of track fitting in the LHC ATLAS and CMS projects. The Hough Transform transfers the problem of line detection, for example, into one of optimization of the peak in a vote counting process for cells which contain the possible points of candidate lines. The detection algorithm can be computationally expensive both in the demands made upon the processor and on memory. Additionally, it can have a reduced effectiveness in detection in the presence of noise. Our first contribution consists in an evaluation of the use of a variation of the Radon Transform as a form of improving theeffectiveness of line detection in the presence of noise. Then, parallel algorithms for variations of the Hough Transform and the Radon Transform for line detection are introduced. An algorithm for Parallel Monte Carlo Search applied to line detection is also introduced. Their algorithmic complexities are discussed. Finally, implementations on multi-GPU and multicore architectures are discussed.

The emergence of 5G networks will allow cloud computing providers to offer more convenient services. However, security and privacy issues of cloud services in 5G networks represent huge challenges. Recently, to improve security and privacy, a novel primitive was proposed by Ma et al. in TIFS 2015, called public key encryption with equality test supporting flexible authorization (PKEET-FA). However, the PKEET scheme lacks verification for equality test results to check whether the cloud performed honestly. In this paper, we expand the study of PKEET-FA and propose a verifiable PKEET (V-PKEET) scheme, which, to the best of our knowledge, is the first work that achieves verification in PKEET. Moreover, V-PKEET has been designed for three types of authorization to dynamically protect the privacy of data owners. Therefore, it further strengthens security and privacy in 5G networks.

Vehicular Networks (VANET) are the largest real-life paradigm of ad hoc networks which aim to ensure road safety and enhance drivers' comfort. In VANET, the vehicles communicate or collaborate with each other and with adjacent infrastructure by exchanging significant messages, such as road accident warnings, steep-curve ahead warnings or traffic jam warnings. However, this communication and other assets involved are subject to major threats and provide numerous opportunities for attackers to launch several attacks and compromise security and privacy of vehicular users. This paper reviews the cyber security in VANET and proposes an asset-based approach for VANET security. Firstly, it identifies relevant assets in VANET. Secondly, it provides a detailed taxonomy of vulnerabilities and threats on these assets, and, lastly, it classifies the possible attacks in VANET and critically evaluates them.

Empirical and anecdotal evidence indicates that cyberharassment is more prevalent as the use of social media becomes increasingly widespread, making geography and physical proximity irrelevant. Cyberharassment can take different forms (e.g., cyberbullying, cyberstalking, cybertrolling), and be motivated by the objectives of inflicting distress, exercising control, impersonation, and defamation. Little is currently known about the modus operandi of offenders and their psychological characteristics. Investigation of these behaviours is particularly challenging because it involves digital evidence distributed across the devices of both alleged offenders and victims, as well as online service providers, sometimes over an extended period of time. This special issue aims to improve understanding of cyberharassment from a multidisciplinary perspective in order to further develop theoretical knowledge and investigative practice.

nderstanding of the offender, the victim, the crime scene, and the dynamics of the crime. It can add meaning to the evidence obtained through digital forensic techniques and assist investigators with reconstruction of a crime. There is, however, little empirical research examining the application of BEA to actual criminal cases, particularly cyberstalking cases. This study addresses this gap by examining the utility of BEA for such cases in terms of understanding the behavioural and motivational dimensions of offending, and the way in which digital evidence can be interpreted. It reports on the forensic analysis of 20 cyberstalking cases investigated by Dubai Police in the last five years. Results showed that BEA helps to focus an investigation, enables better understanding and interpretation of victim and offender behaviour, and assists in inferring traits of the offender from available digital evidence. These benefits can help investigators to build a stronger case, reduce time wasted to mistakes, and to exclude suspects wrongly accused in cyberstalking cases.

In Digital Forensics, the number of person-hours spent on investigation is a key factor which needs to be kept to a minimum whilst also paying close attention to the authenticity of the evidence. The literature describes challenges behind increasing person-hours and identifies several factors which contribute to this phenomenon. This paper reviews these factors and demonstrates that they do not wholly account for increases in investigation time. Using real case records from the Dubai Police, an extensive study explains the contribution of other factors to the increase in person-hours. We conclude this work by emphasizing on several factors affecting the person-hours in contrast to what most of the literature in this area proposes.

Computer-based systems are increasingly being exposed to evolving security threats, which often reveal new vulnerabilities. A formal analysis of the evolving threats is difficult due to a number of practical considerations such as incomplete knowledge about the design, limited information about attacks, and constraints on organisational resources. In our earlier work on RISA (RIsk assessment in Security Argumentation), we showed that informal risk assessment can complement the formal analysis of security requirements. In this paper, we integrate the formal and informal assessment of security by proposing a unified meta-model and an automated tool for supporting security argumentation called OpenRISA. Using a uniform representation of risks and arguments, our automated checking of formal arguments can identify relevant risks as rebuttals to those arguments, and identify mitigations from publicly available security catalogues when possible. As a result, security engineers are able to make informed and traceable decisions about the security of their computer-based systems. The application of OpenRISA is illustrated with examples from a PIN Entry Device case study.

Introduction to Special Issue on Risk and Trust in Embedded Critical Systems.

The sequential computation of hashes at the core of many distributed storage systems and found, for example, in grid services can hinder efficiency in service quality and even pose security challenges that can only be addressed by the use of parallel hash tree modes. The main contributions of this paper are, first, the identification of several efficiency and security challenges posed by the use of sequential hash computation based on the Merkle-Damgard engine. In addition, alternatives for the parallel computation of hash trees are discussed, and a prototype for a new parallel implementation of the Keccak function, the SHA-3 winner, is introduced.

Companies are increasingly engaging in complex inter-organisational networks of business and trading partners, service and managed security providers to run their operations. Therefore, it is now common to outsource critical business processes and to completely move IT resources to the custody of third parties. Such extended enterprises create individuals who are neither completely insiders nor outsiders of a company, requiring new solutions to mitigate the security threat they cause. This paper improves the method introduced in Franqueira et al. (2012) for the analysis of such threat to support negotiation of security agreements in B2B contracts. The method, illustrated via a manufacturer-retailer example, has three main ingredients: modelling to scope the analysis and to identify external insider roles, access matrix to obtain need-to-know requirements, and reverse-engineering of security best practices to analyse both pose-threat and enforce-security perspectives of external insider roles. The paper also proposes future research directions to overcome challenges identified.

A review of the state of the art of role-based access control can help practitioners assess RBAC's applicability to their organization and indicates where more research is needed to improve the RBAC model.

Modern society relies on and profits from well-balanced computerized systems. Each of these systems has a core mission such as the correct and safe operation of safety critical systems or innovative and effective operation of e-commerce systems. It might be said that the success of these systems depends on their mission. Although the concept of ''well-balanced" has a slightly different meaning for each of these two categories of systems, both have to meet customer needs, deliver capabilities and functions according to expectations and generate revenue to sustain today's highly competitive market. Tighter financial constraints are forcing safety critical systems away from dedicated and expensive communication regimes, such as the ownership and operation of dedicated communication links, towards reliance on third parties and standardized means of communication. As a consequence, knowledge about their internal structures and operations is more widely and publicly available and this can make them more prone to security attacks. These systems are, therefore, moving towards a remotely exploitable environment and the risks associated with this must be controlled.Risk management is a good tool for controlling risk but it has the inherent challenge of quantitatively estimating frequency and impact in an accurate and trustworthy way. Quantifying the frequency and impact of potential security threats requires experience-based data which is limited and rarely reusable because it involves company confidential data. Therefore, there is a need for publicly available data sources that can be used in risk estimation. This paper presents a risk estimation model that make suse of one such data source, the Common Vulnerability Scoring System (CVSS). The CVSS Risk Level Estimation Model estimates a security risk level from vulnerability information as a combination of frequency and impact estimates derived from the CVSS. It is implemented as a Bayesian Belief Network(BBN) topology, which allows not only the use of CVSS-based estimates but also the combination of disparate information sources and, thus, provides the ability to use whatever risk information that is avail-able. The model is demonstrated using a safety- and mission-critical system for drilling operational support, the Measurement and Logging While Drilling (M/LWD) system.

Large industries usually imply geographically dispersed supply chains composed of facilities localized in diverse regions. These facilities commonly involve operational technology (OT) (i.e., industrial control systems—ICS) and information technology (IT) infrastructures, which require integration to enable information processing. Such integration, achieved through cyber-physical systems, and leveraged by the Industry 4.0 emergence, may transform the industry and facilitate the transformation of vast data volumes into valuable information. Security risks posed by dispersed cyber-physical systems may be substantial, and dealing with cybersecurity issues in such context could be very expensive. This study reviews directives regarding cybersecurity risks in companies with dispersed supply chains and also applicable international cybersecurity standards and regulations to derive a strategy to manage cybersecurity in integrated industrial networks. The strategy proposes centralized services, optimized perimeter segregation, and data flow policies among OT and IT networks to balance the trade-off between a high level of protection with cost-effectiveness.

Vehicular ad-hoc network (VANET) and internet-of-vehicles (IoV) are complex networks which provide a unique platform for vehicles to communicate and exchange critical information (such as collision avoidance warnings) with each other in an intelligent manner. Thus, the information disseminated in the network should be authentic and originated from legitimate vehicles. Creating a trusted environment in the network can enable the vehicles to identify and revoke malicious ones. Trust is an important concept in VANET and IoV to achieve security in the network, where every vehicle equipped with an appropriate trust model can evaluate the trustworthiness of the received information and its sender. This chapter discusses trust in both VANET and IoV and identifies various trust models developed for VANET and IoV. The contribution of this chapter is threefold. First, the authors present a detailed taxonomy of trust models in VANET and IoV. Second, they provide current trends in the domain of trust management specifically for VANET and IoV, and finally, they provide various open research directions.

PhotoDNA is a perceptual fuzzy hash technology designed and developed by Microsoft. It is deployed by all major big data service providers to detect Indecent Images of Children (IIOC). Protecting the privacy of individuals is of paramount importance in such images. Microsoft claims that a PhotoDNA hash cannot be reverse engineered into the original image; therefore, it is not possible to identify individuals or objects depicted in the image. In this chapter, we evaluate the privacy protection capability of PhotoDNA by testing it against machine learning. Specifically, our aim is to detect the presence of any structural information that might be utilized to compromise the privacy of the individuals via classification. Due to the widespread usage of PhotoDNA as a deterrent to IIOC by big data companies, ensuring its ability to protect privacy would be crucial. In our experimentation, we achieved a classification accuracy of 57.20%. This result indicates that PhotoDNA is resistant to machine-learning-based classification attacks.

Developments in Blockchain technology have enabled the creation of smart contracts; i.e., self-executing code that is stored and executed on the Blockchain. This has led to the creation of distributed, decentralised applications, along with frameworks for developing and deploying them easily. This paper describes a proof-of-concept system that implements a distributed online marketplace using the Ethereum framework, where buyers and sellers can engage in e-commerce transactions without the need of a large central entity coordinating the process. The performance of the system was measured in terms of cost of use through the concept of 'gas usage'. It was determined that such costs are significantly less than that of Amazon and eBay for high volume users. The findings generally support the ability to use Ethereum to create a distributed on-chain market, however, there are still areas that require further research and development.

The dramatic drop in price of computing hardware, coupled with the recent breakthroughs in embedded systems design that enabled the integration of high‐level software and low‐level electronics, have created a paradigm shift in embedded systems development. This has led to the development of different varieties of user‐friendly Internet of Things (IoT) hardware development platforms for IoT prototyping. The ubiquity of such prototyping platforms has undoubtedly contributed toward the explosive growth of the IoT, which is already seeping into all areas of human endeavor, including transportation, logistics, business, and healthcare. Building IoT projects that can be controlled over the Internet can be challenging, especially for beginners. This chapter discusses the design and development of prototypes for IoT applications with focus on Arduino and Raspberry Pi platforms. The aim is to provide insightful information on best practices for designing and prototyping IoT projects, as well as to serve as step‐by‐step guidelines for beginners.

Vehicular Ad-hoc Network (VANET) is a key technology in the domain of transportation which serves as a platform for vehicles to communicate with each other and intelligently exchange critical information, such as collision avoidance messages. Given that potentially life critical information could be exchanged in real time among network entities, it is paramount that this information is authentic (from a legitimate source), reliable and accurate. Moreover, mobility of vehicles creates different contexts in VANET resulting in a diversity of requirements for trust management. This work focuses on the effective modelling and management of trust both as a prerequisite to inter-vehicle communication and as a security measure. To this end, we propose a comprehensive set of criteria which work towards the effective modelling and management of trust in VANET to ensure that the unique characteristics of the network (such as high mobility, dispersion of vehicles, and lack of central architecture) are considered. The contribution of this paper is twofold. (1) We propose 16 criteria for effective trust management in VANET, and (2) evaluate various available trust models based on these proposed criteria.

The highly crafted lines of code which constitute the Locky cryptolocker ransomware are there to see in plain text in an infected machine. Yet, this forensic evidence does not lead investigators to the identity of the extortionists nor to the destination of the ransom payments. Perpetrators of this ransomware remain unknown and unchallenged and so the ransomware cyber crimewave gathers pace. This paper examines what Locky is, how it works, and the mechanics of this malware to understand how ransom payments are made. The financial impact of Locky is found to be substantial. The paper describes methods for "following the money" to assess how effectively such a digital forensic trail can assist ransomware investigators. The legal instruments that are being established by the authorities as they attempt to shut down ransomware attacks and secure prosecutions are evaluated. The technical difficulty of following the money coupled with a lack of registration and disclosure legislation mean that investigators of this cybercrime are struggling to secure prosecutions and halt Locky.

Password managers address the usability challenge of authentication, i.e., to manage the effort in creating, memorising, and entering complex passwords for an end-user. Offering features such as creating strong passwords, managing increasing number of complex passwords, and auto-filling of passwords for variable contexts, their security is as critical as the assets being protected by the passwords. Previous security risk analyses have focused primarily on cloud- and browser-based password managers, whilst the security risks of local password managers were left under-explored. Taking a systematic forensic analysis approach, this paper reports on a case study of three popular local password managers: KeePass (v2.28), Password Safe (v3.35.1) and RoboForm (v7.9.12). It revealed risks that either the master password or the content of the password database could be found unencrypted in Temp folders, Page files or Recycle bin, even after applications had been closed. As a consequence, an attacker or a malware with access to the computer on which the password managers were running may be able to steal sensitive information, even though these password managers are meant to keep the databases encrypted and protected at all times. These findings point to directions to mitigate the identified risks.

It became almost fashionable to refer to the term "flipped" in higher education. Expressions like flipped learning and flipped classroom are often used interchangeably as an indication of innovation, flexibility, creativity and pedagogical evolution. We performed an exploratory study on this topic following the Critical Interpretive Synthesis methodology for analysis of the literature. Our findings indicated that the term "Flipped Learning" is misleading and that, in fact, the synthetic concept behind it is "Flipped Teaching". We derived a synthesising argument, in the format of two synthesis models, of the potential benefits promoted by flipped teaching and the potential issues which affect its success in practice. Those models allow STEM course tutors not only to make informed decisions about whether to flip teaching or not, but also to better prepare for flipping.

In extended enterprises, the traditional dichotomy between insiders and outsiders becomes blurred: consultants, freelance administrators, and employees of business partners are both inside and outside of the enterprise. As a consequence, traditional controls to mitigate insider and outsider threat do not completely apply to this group of individuals, and additional or improved solutions are required. The ISO 27002 security standard, recognizing this need, proposes third-party agreements to cover security requirements in B2B relationships as a solution, but leaves open how to realize them to counter security problems of inter-organizational collaboration. To reduce this gap, this chapter presents a method for identifying external insiders and analyzing them from two perspectives: as threats and as possible mitigation. The output of the method provides input for further engineering of third-party agreements related to non-measurable IT security agreements; the authors illustrate the method using a manufacturer-retailer example. This chapter also provides an overview of the external insider threat, consisting of a review of extended enterprises and of challenges involved with external insiders.

When software systems are verified against security requirements, formal and informal arguments provide a structure for organizing the software artifacts. Our recent work on the evolution of security-critical software systems demonstrates that our argumentation technique is useful in limiting the scope of change and in identifying changes to security properties. In support of this work, we have developed OpenArgue, a tool for syntax checking, visualizing, formalizing, and reasoning about incremental arguments. OpenArgue has been integrated with requirements engineering tools for Problem Frames and i*, and applied to an Air Traffic Management (ATM) case study.

From literature study, we collected: (a) a set of core features of the RBAC model, according to the ANSI/INCITS 359:2004 RBAC standard, (b) implicit assumptions, (c) a set of strengths, and (d) a set of phenomena which may limit these strengths in practice. To acquire insights about these four elements and complement our initial set of strengths and phenomena, a survey was designed and launched online between June and July 2011. This report consolidates results obtained from the survey.

The composition of vulnerabilities in attack scenarios has been traditionally performed based on detailed pre- and post-conditions. Although very precise, this approach is dependent on human analysis, is time consuming, and not at all scalable. We investigate the NIST National Vulnerability Database (NVD) with three goals: (i) understand the associations among vulnerability attributes related to impact, exploitability, privilege, type of vulnerability and clues derived from plaintext descriptions, (ii) validate our initial composition model which is based on required access and resulting effect, and (iii) investigate the maturity of XML database technology for performing statistical analyses like this directly on the XML data. In this report, we analyse 27,273 vulnerability entries (CVE [1]) from the NVD. Using only nominal information, we are able to e.g. identify clusters in the class of vulnerabilities with no privilege which represent 52% of the entries.

Industrial control systems (ICS) operate on serial based networks which lack proper security safeguards by design. They are also becoming more integrated to corporate networks, creating new vulnerabilities which expose ICS networks to increasing levels of risk with potentially significant impact. Despite those risks, only a few mechanisms have been suggested and are available in practice as cybersecurity safeguards for the ICS network layer, maybe because they might not be commercially viable. Intrusion detection systems (IDS) are typically deployed in the corporate networks to protect against attacks since they are based on TCP/IP. However, IDS are not used in serial based ICS networks yet. This study examines and compares modern Artificial Intelligence (AI) techniques applied in IDS that are potentially useful for serial-based ICS networks. The results showed that current AI-based IDS methods are viable in such networks. A mix of AI techniques would be the best way forward to detect known attacks via rules and novel attacks, not previously mapped, via supervised and unsupervised techniques. Despite these strategies' limited use in serial-based networks, their adoption could significantly strengthen cybersecurity of ICS networks.

Child sexual exploitation and abuse (CSEA) and the associated distribution of child sexual abuse material (CSAM) are serious offences online and offline. They are exacerbated by the increased popularity of dark web markets, in which vendors and buyers can exchange CSAM while hiding their identities. The aim of this paper is to improve our understanding of the CSEA landscape in dark web markets. We reviewed and collated four groups of keywords (a total of 198) for the detection/discovery of potential CSAM on the dark web market. This allowed us to conduct a systematic data collection (i.e., scraping) on dark web markets containing CSAM to create a new text-based dataset and perform further analysis. We found that CSAM is more public in the Chinese market, but not in the mainstream English market. To illustrate this point, we detected 724 CSAM items in the two Chinese dark web markets studied, but none in the eight English markets. While the prices of these CSAM remain low, we found that there were 3,449 sales over the 44-week observation period, implying that CSAM has been commercialised to some extent. We also noticed that mainstream cloud-based data storage services were used for the distribution and sharing of CSAM. We hope that the findings presented in this paper can help relevant stakeholders to understand the CSAM landscape in the dark web market better, which in turn may be used to devise more effective countermeasures to combat CSEA and CSAM.

This paper describes a system to detect anomalies in non-IP (Internet Protocol) industrial networks on Industrial Control Systems (ICS). Non-IP industrial networks are widely applied in ICS to connect sensors and actuators to control systems or business networks. They were designed to be in an air-gapped security environment and therefore contain almost no cyber security features and are vulnerable to various attacks. Even though they are part of the communication layers, a few external cyber security controls are applied in this crucial tier. As an extension of the work by De Moura et al. (2021), this study proposes and tests the proof-of-concept of an agnostic anomaly detection system (AADS) to detect anomalies on any non-IP industrial network (e.g., DeviceNet, CANBus) as an additional cyber security measure working at the physical network layer. The proof-of-concept is comprised of three modules, including hardware and software components: data gathering (sniffer), parser, and detection. Testing the proof-of-concept in an industrial lab network (i.e., a Profibus-DP lab network) showed the proposal's feasibility with a detection rate above 99% (overall accuracy: 99.59%; F1-Score: 99.18%).

Cyber security is a topic of increasing relevance in relation to industrial networks. The higher intensity and intelligent use of data pushed by smart technology (Industry 4.0) together with an augmented integration between the operational technology (production) and the information technology (business) parts of the network have considerably raised the level of vulnerabilities. On the other hand, many industrial facilities still use serial networks as underlying communication system, and they are notoriously limited from a cyber security perspective since protection mechanisms available for TCP/IP communication do not apply. Therefore, an attacker gaining access to a serial network can easily control the industrial components, potentially causing catastrophic incidents, jeopardizing assets and human lives. This study proposes a framework to act as an anomaly detection system (ADS) for industrial serial networks. It has three ingredients: an unsupervised K-means component to analyse message content, a knowledge-based expert system component to analyse message metadata, and a voting process to generate alerts for security incidents, anomalous states, and faults. The framework was evaluated using the Profibus-DP, a network simulator which implements a serial bus system. Results for the simulated traffic were promising: 99.90% for accuracy, 99,64% for precision, and 99.28% for F1-Score. They indicate feasibility of the framework applied to serial-based industrial networks.

Globalization implies geographically dispersed supply chains composed of facilities strategically located in several countries and regions of the world. These structures commonly involve several Operational Technology (OT) and Information Technology (IT) infrastructures and integration to enable accurate and useful information processing. Such integration (also called Cyber-Physical Systems) transforms the industry and facilitates massive data volumes' systematic transformation into valuable information. Security risks posed by such integration may be substantial and, depending on the size of the company, and the number of integration points, dealing with them could easily cost millions of dollars. With the main objective of studying available strategies to manage security risks in companies with dispersed supply chains, this paper reviews international cyber-security standards and regulations and proposes a more comprehensive strategy. The strategy includes IT services, optimized perimeter segregation, and data flow policies among OT and IT networks to balance a high level of protection and cost-effectiveness.

Digital forensics can narrow key issues pending before a criminal or civil tribunal, resulting in a plea/settlement or a judicially economical trial. To support this, measures facilitating effective discourse between all parties regarding evidential matters may have value to judicial processes, where this session introduces the concept of Structured Argumentation (SA) for this purpose. The use of SA, applied to digital forensics investigations, was proposed and illustrated by Franqueira and Horsman (2020). It allows elaboration of investigative hypotheses, exposing not only how different (digital and/or non-digital) evidence logically fit together, but also the processes followed and conclusions reached, avoiding needless delay when arriving at a plea/disposition in a matter and/or narrowing the issues at a subsequent trial/proceeding. This session will be organised into 3 parts. First, the SA scheme (i.e., claim, ground, warrant, backing and rebuttal) and its dynamics will be described. Second, the results of an evaluation of SA applied to an anonymised video authentication case, from the field, will be presented. Finally, lessons learned and discussion points in relation to the use of SA, in theory and practice, will be elaborated.

Violence detection is becoming increasingly relevant in many areas such as for automatic content filtering, video surveillance and law enforcement. Existing datasets and methods discriminate between violent and non-violent scenes based on very abstract definitions of violence. Available datasets, such as "Hockey Fight" and "Movies", only contain fight versus non-fight videos; no weapons are discriminated in them. In this paper, we focus explicitly on weapon-based fighting sequences and propose a new dataset based on the popular action-adventure video game Grand Theft Auto-V (GTA-V). This new dataset is called "Weapon Violence Dataset" (WVD). The choice for a virtual dataset follows a trend which allows creating and labelling as sophisticated and large volume, yet realistic, datasets as possible. Furthermore, WVD also avoids the drawbacks of access to real data and potential implications. To the best of our knowledge no similar dataset, that captures weapon-based violence, exists. The paper evaluates the proposed dataset by utilising local feature descriptors using an SVM classifier. The extracted features are aggregated using the Bag of Visual Word (BoVW) technique to classify weapon-based violence videos. Our results indicate that SURF achieves the best performance.

Bitcoin has introduced a new concept that could feasibly revolutionise the entire Internet as it exists, and positively impact on many types of industries including, but not limited to, banking, public sector and supply chain. This innovation is grounded on pseudo-anonymity and strives on its innovative decentralised architecture based on the blockchain technology. Blockchain is pushing forward a race of transaction-based applications with trust establishment without the need for a centralised authority, promoting accountability and transparency within the business process. However, a blockchain ledger (e.g., Bitcoin) tend to become very complex and specialised tools, collectively called "Blockchain Analytics", are required to allow individuals, law enforcement agencies and service providers to search, explore and visualise it. Over the last years, several analytical tools have been developed with capabilities that allow, e.g., to map relationships, examine flow of transactions and filter crime instances as a way to enhance forensic investigations. This paper discusses the current state of blockchain analytical tools and presents a thematic taxonomy model based on their applications. It also examines open challenges for future development and research.

The utility of Behavioural Evidence Analysis (BEA) has gained attention in the field of Digital Forensics in recent years. It has been recognized that, along with technical examination of digital evidence, it is important to learn as much as possible about the individuals behind an offence, the victim (s) and the dynamics of a crime. This can assist the investigator in producing a more accurate and complete reconstruction of the crime, in interpreting associated digital evidence, and with the description of investigative findings. Despite these potential benefits, the literature shows limited use of BEA for the investigation of cases of the possession and dissemination of Sexually Exploitative Imagery of Children (SEIC). This paper represents a step towards filling this gap. It reports on the forensic analysis of 15 SEIC cases involving P2P file sharing networks, obtained from the Dubai Police. Results confirmed the predicted benefits and indicate that BEA can assist digital forensic practitioners and prosecutors.

Cloud computing has gained popularity due to its efficiency, robustness and cost effectiveness. Carrying out digital forensic investigations in the cloud is currently a relevant and open issue. The root of this issue is the fact that servers cannot be physically accessed, coupled with the dynamic and distributed nature of cloud computing with regards to data processing and storage. This renders traditional methods of evidence collection impractical. The use of provenance data in cloud forensics is critical as it provides forensic investigators with data history in terms of people, entities and activities involved in producing related data objects. Therefore, cloud forensics requires effective provenance collection mechanisms. This paper provides an overview of current provenance challenges in cloud computing and identifies limitations of current provenance collection mechanisms. Recommendations for additional research in digital provenance for cloud forensics are also presented.

When showing that a software system meets certain security requirements, it is often necessary to work with formal and informal descriptions of the system behavior, vulnerabilities, and threats from potential attackers. In earlier work, Haley et al. [1] showed structured argumentation could deal with such mixed descriptions. However, incomplete and uncertain information, and limited resources force practitioners to settle for good-enough security. To deal with these conditions of practice, we extend the method of Haley et al. with risk assessment. The proposed method, RISA (RIsk assessment in Security Argumentation), uses public catalogs of security expertise to support the risk assessment, and to guide the security argumentation in identifying rebuttals and mitigations for security requirements satisfaction. We illustrate RISA with a realistic example of PIN Entry Device.

Little attention has been given so far to the process of security risk management at the early stages of system development. Security has been addressed by isolated security assurance practices, some of which consider risks and mitigations but they do not provide an overview of the overall security state of the system being developed. This paper takes the position that (1) these isolated security assurance practices should be fully integrated and should be embedded in short iterations of risk assessment, treatment and acceptance, providing input for updating security requirements and for security risk management, and that (2) available empirical data from public catalogs and databases should be used as a source of expertise, to leverage past experiences, and therefore reduce, although not eliminate, subjectivity of human judgment. Borrowing from the agile software development and project management philosophy, we introduce the idea of a light weight, agile approach to security risk management integrated to the development life cycle.

Making well-founded security investment decisions is hard: several alternatives may need to be considered, the alternatives' space is often diffuse, and many decision parameters that are traded-off are uncertain or incomplete. We cope with these challenges by proposing a method that supports decision makers in the process of making well-founded and balanced security investment decisions. The method has two fundamental ingredients, staging and learning, that fit into a continuous decision cycle. The method takes advantage of Real Options thinking, not only to select a decision option, but also to compound it with other options in following decision iterations, after reflection on the decision alternatives previously implemented. Additionally, our method is supported by the SecInvest tool for trade-off analysis that considers decision parameters, including cost, risks, context (such as time-to-market and B2B trust), and expected benefits when evaluating the various decision alternatives. The output of the tool, a fitness score for each decision alternative, allows to compare the evaluations of the decision makers involved as well as to include learning and consequent adjustments of decision parameters. We demonstrate the method using a three decision alternatives example.

Increasingly, organizations collaborate with other organizations in value webs with various arrangements, such as outsourcing, partnering, joint ventures, or subcontracting. As the Jericho Forum (an industry consortium of the Open Group) observed, in all these forms of collaboration, the boundaries between organizations become permeable and, as a consequence, insiders and outsiders can no longer be neatly separated using the notion of a perimeter. Such organizational arrangements have security implications because individuals from the value web are neither outsiders nor completely insiders. To address this phenomenon this paper proposes a third set of individuals, called External Insiders. External insiders add challenges to the already known insider threat problem because, unlike outsiders, external insiders have granted access and are trusted; and, unlike traditional insiders, external insiders are not subjected to as many internal controls enforced by the organization for which they are external insiders. In fact, external insiders are part of two or more organizational control structures, and business-to-business contracts are often insufficiently detailed to establish security requirements at the level of granularity needed to counter the threat they pose.

Attack graphs are an important support for assessment and subsequent improvement of network security. They reveal possible paths an attacker can take to break through security perimeters and traverse a network to reach valuable assets deep inside the network. Although scalability is no longer the main issue, Attack Graphs still have some problems that make them less useful in practice. First, Attack Graphs remain difficult to relate to the network topology. Second, Attack Graphs traditionally only consider the exploitation of vulnerable hosts. Third, Attack Graphs do not rely on automatic identification of potential attack targets. We address these gaps in our MsAMS (Multi-step Attack Modelling and Simulation) tool, based on Mobile Ambients. The tool not only allows the modelling of more static aspects of the network, such as the network topology, but also the dynamics of network attacks. In addition to Mobile Ambients, we use the pagerank algorithm to determine targets and hub scores produced by the HITS (Hypertext Induced Topic Search) algorithm to guide the simulation of an attacker searching for targets.

Security management is about calculated risk and requires continuous evaluation to ensure cost, time and resource effectiveness. Parts of which is to make future-oriented, cost-benefit investments in security. Security investments must adhere to healthy business principles where both security and financial aspects play an important role. Information on the current and potential risk level is essential to successfully trade-off security and financial aspects. Risk level is the combination of the frequency and impact of a potential unwanted event, often referred to as a security threat or misuse. The paper presents a risk level estimation model that derives risk level as a conditional probability over frequency and impact estimates. The frequency and impact estimates are derived from a set of attributes specified in the Common Vulnerability Scoring System (CVSS). The model works on the level of vulnerabilities (just as the CVSS) and is able to compose vulnerabilities into service levels. The service levels define the potential risk levels and are modelled as a Markov process, which are then used to predict the risk level at a particular time.

Attackers take advantage of any security breach to penetrate an organisation perimeter and exploit hosts as stepping stones to reach valuable assets, deeper in the network. The exploitation of hosts is possible not only when vulnerabilities in commercial off-the-shelf (COTS) software components are present, but also, for example, when an attacker acquires a credential on one host which allows exploiting further hosts on the network. Finding attacks involving the latter case requires the ability to represent dynamic models. In fact, more dynamic aspects are present in the network domain such as attackers accumulate resources (i.e. credentials) along an attack, and users and assets may move from one environment to another, although always constrained by the ruling of the network. In this paper we address these dynamic issues by presenting MsAMS (Multi-step Attack Modelling and Simulation), an implemented framework, based on Mobile Ambients, to discover attacks in networks. The idea of ambients fits naturally into this domain and has the advantage of providing flexibility for modelling. Additionally, the concept of mobility allows the simulation of attackers exploiting opportunities derived either from the exploitation of vulnerable and non-vulnerable hosts, through the acquisition of credentials. It also allows expressing security policies embedded in the rules of the ambients.

Insider threat is becoming comparable to outsider threat in frequency of security events. This is a worrying situation, since insider attacks have a high probability of success because insiders have authorized access and legitimate privileges. Despite their importance, insider threats are still not properly addressed by organizations. We contribute to reverse this situation by introducing a framework composed of a method for identification and assessment of insider threat risks and of two supporting deliverables for awareness of insider threat. The deliverables are: (i) attack strategies structured in four decomposition trees, and (ii) a matrix which correlates defense strategies, attack strategies and control principles. The method output consists of goal-based requirements for the defense against insiders.

This paper presents an evolutionary approach for learning attack specifications that describe attack scenarios. The objective is to find vulnerabilities in computer networks which minimise the cost of an attack with maximum impact. Although we focus on insider threat, the proposed approach applies to networks in general, including social networks and computer grid.

An important aspect of IT security governance is the proactive and continuous identification of possible attacks in computer networks. This is complicated due to the complexity and size of networks, and due to the fact that usually network attacks are performed in several steps. This thesis proposes an approach called MsAMS (Multi-step Attack Modelling and Simulation), demonstrated by a proof-of-concept tool, to automatically find such multi-step attacks. The novelty of MsAMS is the fact that it applies Mobile Ambients and Combinatorial Optimization, more specifically Heuristic Search, to the domain of multi-step network attacks. A variant of ambient calculus is used to model networks, and heuristic search is used to simulate attackers searching for possible attacks in the modelled network. Additionally, and in support to these two aspects, MsAMS uses algorithms from the domain of Link Analysis Ranking, traditionally applied to the domain of Web search. Mobile Ambients allow us to fully represent the hierarchical topology of a network as part of the network model itself. This is essential to relate insights gained from the model to the real network. Furthermore, we can represent dynamics of attacks such as credential theft, what increases the spectrum of possibilities available for attackers since it allows considering non-vulnerable as well as vulnerable hosts as attack steps. Optimization allows managing the complexity of the problem of finding multi-step attacks involving credentials without compromising the scalability of the approach for practical use. Therefore, the MsAMS approach comprises: (i) a formal representation of the solution which allows its automatic computation, in our case, the representation of an attack step in a notation based on Mobile Ambients, (ii) a search engine which implements a heuristic method for composing attack steps into multi-step attacks, and (iii) fitness functions used by the search engine for the selection of attack steps among alternatives, according to automatically computed metrics. Similar to search engines that use the structure of the World Wide Web to score webpages, the MsAMS approach proposes the use of the structure of a network to score network assets. In particular, MsAMS uses PageRank and HITS ranking schemes as sources of scalable metrics to: 1. assign asset value automatically to all ambients represented in the network, based on network connectivity rather than on financial value, providing an absolute and comparable view of asset value. Those values support the network administrator in the process of selecting a target. 2. assign a cost value automatically to all ambients represented in the network, also based on network connectivity rather than on financial value, providing an absolute and comparable view of cost for attack steps. Such a measure of cost allows the incorporation of rationality to the ambient-attacker which simulates a strategy of a real-attacker.

Export containers must be carried over from the port storage area to container ships to be delivered to their destination. Optimizing containers' transport routing is essential in order to enhance port performance and save costs. This thesis deals with a single vehicle routing problem in a container terminal environment. Heuristic strategies Beam Search and Ant Colony Optimization are proposed to solve the problem and are tested comparatively. A new strategy for container collection is proposed as a substitute for the traditional greedy strategy of container collection.

Cloud Computing is becoming more and more appealing to organisations and individuals as a platform for ubiquitous, on-demand, high power and low cost computation. Unsurprisingly, the benefits and opportunities of clouds attract not only legitimate users, but also cybercriminals. It exacerbates the possibility of large-scale illegal activities (e.g., storage and distribution of illicit material, deployment of botnet infrastructure, and phishing campaigns), facilitates novel business models, such as crime-as-a-service and "dark clouds", and enables new forms of attacks and data misuse. This reality poses many challenges to different stakeholders in terms of preventing (the security aspect) and reacting (the forensics aspect) to those illegal activities. This thematic series contains technical papers and case-studies from academic and professional perspectices with a focus on advancing the practice of cloud forensics and cloud security.

Empirical and anecdotal evidence indicates that cyberharassment is more prevalent as the use of social media becomes increasingly widespread, making geography and physical proximity irrelevant. Cyberharassment can take different forms (e.g., cyberbullying, cyberstalking, cybertrolling), and be motivated by the objectives of inflicting distress, exercising control, impersonation, and defamation. Little is currently known about the modus operandi of offenders and their psychological characteristics. Investigation of these behaviours is particularly challenging because it involves digital evidence distributed across the devices of both alleged offenders and victims, as well as online service providers, sometimes over an extended period of time. This special issue aims to improve understanding of cyberharassment from a multidisciplinary perspective in order to further develop theoretical knowledge and investigative practice.

Special issue

This report summarises research results from a research project, sponsored by the GFCE, on pre-university cyber security education in a global context. The research was conducted in three stages: a systematic literature review; desk research on gathering relevant public information on the internet; and a number of semi-structured interviews with sampled stakeholders. The results learned from the research led to the following key findings and main recommendations, which we hope can help stakeholders around the globe to improve cyber security education in a pre-university setting. (Please refer to the report for the key findings and main recommendations.)

An Infographic of the Technology Facilitated Intimate Partner Violence Home Office funded project.

Appendices and supplemental materials to the REA submitted as part of the Home Office funded report on Technology Facilitated Intimate Partner Violence: A multidisciplinary examination of prevalence, methods used by perpetrators and the impact of COVID-19.

A multidisciplinary team of academics from the University of Kent's Institute for Cyber Security in Society (iCSS) received funding from the Home Office Domestic Abuse Perpetrators Fund to conduct research into the perpetration of Technology Facilitated Intimate Partner Violence (TFIPV). The project comprised of 4 workstreams: 1) A Rapid Evidence Assessment (REA) of the evidence base around TFIVP, 2) A thorough analysis of a representative sample of cases of TFIPV as reported to The Cyber Helpline, 3) interviews and surveys with Helpline Responders around their experiences responding to TFIPV and 4) a synthesis of the findings and a visual presentation.

A multidisciplinary team of academics from the University of Kent's Institute for Cyber Security in Society (iCSS) received funding from the Home Office Domestic Abuse Perpetrators Fund to conduct research into the perpetration of Technology Facilitated Intimate Partner Violence (TFIPV). The project comprised of 4 workstreams: 1) A Rapid Evidence Assessment (REA) of the evidence base around TFIVP, 2) A thorough analysis of a representative sample of cases of TFIPV as reported to The Cyber Helpline, 3) interviews and surveys with Helpline Responders around their experiences responding to TFIPV and 4) a synthesis of the findings and a visual presentation.

Recent advancements in AI, especially deep learning, have contributed to a significant increase in the creation of new realistic-looking synthetic media (video, image, and audio) and manipulation of existing media, which has led to the creation of the new term ``deepfake''. Based on both the research literature and resources in English and in Chinese, this paper gives a comprehensive overview of deepfake, covering multiple important aspects of this emerging concept, including 1) different definitions, 2) commonly used performance metrics and standards, and 3) deepfake-related datasets, challenges, competitions and benchmarks. In addition, the paper also reports a meta-review of 12 selected deepfake-related survey papers published in 2020 and 2021, focusing not only on the mentioned aspects, but also on the analysis of key challenges and recommendations. We believe that this paper is the most comprehensive review of deepfake in terms of aspects covered, and the first one covering both the English and Chinese literature and sources.

In recent years there has been substantial growth in the capabilities of systems designed to generate text that mimics the fluency and coherence of human language. From this, there has been considerable research aimed at examining the potential uses of these natural language generators (NLG) towards a wide number of tasks. The increasing capabilities of powerful text generators to mimic human writing convincingly raises the potential for deception and other forms of dangerous misuse. As these systems improve, and it becomes ever harder to distinguish between human-written and machine-generated text, malicious actors could leverage these powerful NLG systems to a wide variety of ends, including the creation of fake news and misinformation, the generation of fake online product reviews, or via chatbots as means of convincing users to divulge private information. In this paper, we provide an overview of the NLG field via the identification and examination of 119 survey-like papers focused on NLG research. From these identified papers, we outline a proposed high-level taxonomy of the central concepts that constitute NLG, including the methods used to develop generalised NLG systems, the means by which these systems are evaluated, and the popular NLG tasks and subtasks that exist. In turn, we provide an overview and discussion of each of these items with respect to current research and offer an examination of the potential roles of NLG in deception and detection systems to counteract these threats. Moreover, we discuss the broader challenges of NLG, including the risks of bias that are often exhibited by existing text generation systems. This work offers a broad overview of the field of NLG with respect to its potential for misuse, aiming to provide a high-level understanding of this rapidly developing area of research.

The presence of children in the online world is increasing at a rapid pace. As children interact with services such as video sharing, live streaming, and gaming, a number of concerns arise regarding their security and privacy as well as their safety. To address such concerns, the UK's Information Commissioner's Office (ICO) sets out 15 criteria alongside a risk management process for developers of online services for children. We present an analysis of 15 ICO criteria for age appropriate design. More precisely, we investigate whether those criteria provide actionable requirements for developers and whether video sharing and live streaming platforms that are used by children of different age ranges (i.e., TikTok, Twitch and YouTube Kids) comply with them. Our findings regarding the ICO criteria suggest that some criteria such as age verification and transparency provide adequate guidance for assessment whereas other criteria such as parental controls, reporting of inappropriate content, and handling of sensitive data need further clarification. Our findings regarding the platforms themselves suggest that they choose to implement the simplest form of self-declared age verification with limited parental controls and plenty of opportunities.