Grant: Discovery Grants Program - Individual

Over 90% of all cyber incidents are human enabled. Emails, external websites, and Internet activities are the most challenging end-user applications to secure against attacks such as Denial-of-Service, website defacement, access to sensitive information, and attacks on critical infrastructure, but they cover more than 80% of end-users' daily work activities. Current research focuses are on keeping devices and data secure, but fails to characterize and prioritize the user experience/role as a critical factor in understanding trending cyber-attacks and building new security solutions. Generally speaking, users are becoming ever weaker links in the security chain, making user risk profiling increasingly important and highly useful for vulnerability assessment and risk analysis. The long-term objectives of this research program are: 1)enabling the development of cybersecurity solutions by focusing on human-oriented issues and problems as the most significant vulnerabilities in cyber operations, especially where the current security solutions fail to protect organizations from cyber-attacks; 2) investigating the role of individuals in understanding trending cyber-attacks, managing risks, attributing cyber threats, and building intelligence-driven cybersecurity solutions; and, 3)developing intelligence-driven cybersecurity solutions that will support complex user behaviour and the corresponding threat landscape using data-intensive analytics and user behaviour analysis. The short-term objective is to develop methodologies and techniques for creating an integrated user profiling and cyber attribution framework consisting of 1) a comprehensive data collection and content maintenance framework; 2) user, content and context-based features extraction and contents classification techniques; 3) dynamic user models for capturing user's security-related usage activities, preferences, and baseline behaviour; 4) user behaviour monitoring algorithms to estimate the security-related intent of a user; and 5) a cyber attribution model. The proposed program will explore the development and evolution of human behaviour-centred cybersecurity from the perspectives of 1) Threat profiling by developing an advanced cyber threat intelligence platform for threat derivation, characterization, modelling evolution, and evaluation, and understanding of the nature and complexity of new and emerging cyber threats; 2) Attacker profiling through malicious and risk analysis, malware authors' emergent behaviour, and threat detection; 3) Target profiling through vulnerability analysis; and, 4) Random user profiling through trust and reputation analysis. We will build the profiles for the above objectives in three environments: 1) Work environment: the user is an employee at a private/public organization; 2) Daily environment: a random Internet user or online visitor; and 3) Smart environment: the user works/lives in a smart environment (smart home, smart city, etc.).