EPSRC iCase studentship in Cyber Security Analytics: Deception Approaches for Critical National Infrastructure (with Thales)

对能源、运输管理和供应部门等关键国家基础设施（CNI）的攻击可能会造成灾难性后果。此类攻击可能由各种威胁行为者实施，包括单独的个人、犯罪组织和民族国家。同样，攻击的目标也很广泛，例如寻求关注、恐怖主义、金钱利益和网络战争。攻击者可能会使用大量的方法来达到这些目标。欺骗提供了一个尽可能接近实际物理环境的虚拟环境，以欺骗攻击者相信他们正在攻击真实的系统欺骗有两个目的：在安全的环境中研究攻击者的工具，技术和程序（TTP）。这有助于收集威胁情报。一个著名的例子是经典的“蜜罐”方法。通过将攻击者的注意力和精力从真实的环境吸引到虚拟环境中来保护系统。我们正在寻找一位热情，创造力和技术熟练的候选人，以获得一个令人兴奋和独特的全额资助奖学金机会，研究关键国家基础设施网络安全背景下的欺骗行为。这个博士学位的结果将是新颖的研究，解决了下面列出的挑战的一个子集，并开始开发一个现实的技术实现。成功的候选人将得到卡迪夫大学NCSC网络安全研究卓越学术中心的国际知名研究人员以及泰雷兹国家数字开发中心（NDEC）的行业专家和世界级测试平台的支持。您将加入卡迪夫大学的网络安全分析ESPRC DTP中心，成为在网络安全背景下研究人工智能的人类和算法方面的跨学科学生群体的一员。ObjectivesThis project will investigate existing decision approaches for CNI systems in both the academic and industry domain.现实系统：欺骗系统必须看起来真实，才能说服攻击者。因此，其组件和拓扑结构必须与真实的系统紧密匹配。这是特别具有挑战性的事实，攻击者可以攻击系统，而不仅仅是在网络空间。因此，欺骗系统不仅要模拟数字组件，还要模拟社会和物理系统。现实的响应：系统必须以令人信服的方式对攻击做出反应。由于攻击者可以在物理世界和媒体中监视其攻击的成功，因此这些也必须被覆盖。可伸缩性：根据所讨论的真实的系统，CNI可能涉及大量不同的组件。这就提出了在不完整复制原始系统的情况下以可扩展的方式仿真这些系统的问题。自动化：无法手动为特定的真实的系统生成欺骗系统的实例。因此，项目必须支持自动发现和匹配一个真实的系统，包括组件、拓扑和行为。宣传和影响：欺骗系统将在一个智力上具有挑战性的领域内运行。一方面，为了使其运作，需要公布一些信息（见上文（2））。另一方面，生成关于对CNI的攻击的虚假信息可能会导致问题。此外，当局亦不应公布警方正实施诈骗制度。

Attacks on Critical National Infrastructure (CNI), such as the energy, transport management, and supplies sectors, may have disastrous consequences. Such attacks may be performed by a variety of threat actors, including lone individuals, crime organisations, and nation states. Likewise, the goals of the attacks comprise a wide range, such as attention-seeking, terrorism, monetary gain, and cyber warfare. Attackers may use a large array of approaches to reach these goals. They may perform pure cyberattacks - which can be executed from anywhere in the world.Deception provides a virtual environment that resembles the actual physical environment as closely as possible, in order to fool the attacker into believing they are attacking the real systemDeception has two aims:Enabling the study of attackers' Tools, Techniques, and Procedures (TTPs) within a secure environment. This supports the gathering of threat intelligence. One well-known instance is the classical "honeypot" approach.Defending the system by drawing attackers' attention and effort away from the real environment into the virtual one.We are seeking an enthusiastic, creative and technically skilled candidate for an exciting and unique fully-funded scholarship opportunity to study deception in the context of cybersecurity for critical national infrastructure. The result of this PhD will be novel research that addresses a subset of the challenges outlined below, and begins to develop a realistic technical implementation. The successful candidate will be supported by internationally recognised researchers at Cardiff University's NCSC Academic Centre of Excellence for Cybersecurity Research, as well as industry experts and world class testbeds at Thales' National Digital Exploitation Centre (NDEC). You will join the ESPRC DTP Hub in Cyber Security Analytics at Cardiff University, becoming part of an interdisciplinary cohort of students studying the human and algorithmic aspects of AI in the context of cybersecurity.ObjectivesThis project will investigate existing deception approaches for CNI systems in both the academic and the industrial domain. Due to the context, there are many intellectual, scientific and technical challenges to be addressed:Realistic systems: The deception system must appear realistic in order to convince the attacker. Hence, its components and topology must closely match the real system. This is made particularly challenging by the fact that attackers may attack the system not just in the cyberspace. Therefore, the deception system will have to emulate not just digital components, but social and physical systems as well.Realistic responses: The system must react to attacks in a convincing way. As attackers can monitor the success of their attacks in the physical world and in the media, these must be covered as well.Scalability: Depending on the real system in question, CNI may involve a large number of diverse components. This raises questions of emulating those in a scalable way without replicating the original system in its entirety.Automation: Generating an instance of the deception system for a particular real system cannot be done manually. Therefore, the project must support the automated discovery and matching of a real system, including components, topology, and behaviour.Publicity and impact: The deception system will operate within an intellectually challenging field. On the one hand, some information needs to be publicised in order for it to operate (see (2), above). On the other hand, generating false information about attacks on a CNI may cause problems. In addition, the fact that a deception system is in operation should not be publicised.