Category: Cyber Security

UWE Bristol Capture The Flag Falcons take flight

Author Anna Jones | Posted on

By Ian Caple, MSc Cyber Security student (September 2023 cohort)

Saturday 24th of Febuary saw the birth of a new student-led cyber security initiative, UWE Bristol Capture The Flag Falcons (CTF). Students from across the school of computer science came together to take part in a CTF competition. Undergrads and Postgrads alike took part in a series of cyber security related challenges from Web exploration, cryptography, digital forensic challenges such as hacking veracrypt containers.

In teams of 2 or 3, students battled their way through a series of challenges, hacking their way in ir exploiting vulnerabilities to gain access to areas they shouldn’t be to find the flags.

17 students in all took part giving UWE CTF Falcons a great starting point for the future of the Falcons. After 8 eventful hours that saw every team overcome multiple challenges the CTF challenge was won by The Phishermen – 3rd year BSc Cyber Security and Digital Forensics students Harvey Keane, Callum Duncan and Ash Floyd, who captured a staggering 13 of 15 flags.

But the real winners was everyone who took part and can say they were they when UWE CTF Falcons took flight.

A huge thank you and honourable mention needs to go to our teaching staff Alan Mills and Jon White for helping us set up the challenges and making the day as much fun as it was!

UWEcyber students and CyberWomen@UWE support Cynam EmPowerCyber to inspire 1000 year 8 schoolgirls

Author Anna Jones | Posted on

The recent “EmpowerCyber 2023” cyber outreach event, hosted by Cynam in Gloucester was attended by 1000 Year 8 schoolgirls from across the region and supported by 30 different industry partners.

The event aims to ignite curiosity and empower young girls to explore the incredible opportunities in the world of cyber security, opportunities they may not have otherwise considered. This works towards addressing the UK’s digital skills gap and striving for better female representation in the cyber workforce.

The UWECyber team, supported by our BSc Cyber Security and Digital Forensics, and MSc Cyber Security students, hosted a “Future Funfair” event. The event uses Lego-based funfair rides to where simulated attacks on cyber physical systems can be investigated and mitigated against by the students. These scenarios bring to life the importance of cybersecurity in everyday technology, from safeguarding personal data to protecting national infrastructure.

The CyberWomen@UWE

Additionally the CyberWomen@UWE group provided a cryptography-based murder mystery event. This challenging and exciting activity immersed the girls in the world of digital sleuthing, decrypting messages, and solving cyber puzzles. It was a powerful demonstration of how cyber skills can be applied in creative and critical thinking scenarios.

The involvement of 30 different industry partners was instrumental in the success of EmpowerCyber 2023. Their contributions offered valuable insights into the real-world applications of cyber and STEM skills, showcasing a wide array of career possibilities in these fields. This industry collaboration also highlighted the growing need for skilled professionals in the cybersecurity sector.

The UWE Cyber team
Supporting the students

Through initiatives like EmpowerCyber 2023, cyber outreach activities play critical role in reducing the gender gap in STEM and cyber fields. By capturing the interest of young girls at a crucial stage in their education, this event has laid the groundwork for nurturing a generation of empowered, cyber-aware women ready to take on the challenges of tomorrow’s tech landscape.

South West Cyber Resilience Centre launch our new academic year of UWEcyber guest seminars

Author Anna Jones | Posted on

This week saw the launch of our UWEcyber guest seminar series for the new academic year. Each week we invite guests from industry, government and academia to talk with our students about the latest developments in the cyber security landscape.

This week, we welcomed Mark Moore from the South West Cyber Resilience Centre (SWCRC), a initiative set up to bring policing and academia together to support regional SMEs to upskill in cyber security.

SWCRC provides a fantastic opportunity for our students to be part of a network beyond the University, to work with students from across the UK, and to help SMEs that may not necessarily be tech savvy improve their posture against cyber attacks.

The SWCRC provides paid opportunities for occasional work, that would compliment at UWE Bristol. We have seen UWE Bristol students be successful in applying for this scheme in previous years, and we are keen to ensure that this success continues. For more details, please visit: South West Cyber Resilience Centre SWCRC

UWE Bristol researchers conduct first longitudinal study on evolving vulnerabilities in cloud and application security 

Author Anna Jones | Posted on

A team of UWE Bristol researchers have conducted a major new study into the evolving security landscape of modern cloud infrastructures. The study, recently published in the Computers and Security journal, investigates container security for over 400 applications and services over a 9-month period, to assess what the security vulnerabilities of these services are, and the frequency of when these vulnerabilities are resolved. The findings show many cases where vulnerabilities remain persistent even when updated versions of the application are released. However, we also investigate the real-world nature of these vulnerabilities, to assess the true risk of utilising these services in both local and remote settings, recognising that whilst some security scans may highlight a vulnerability, the vulnerability can not actually be exploited given the use case of the application. 

Alan Mills, lead author of the study says “Container security is a growing area of concern, with the increasing use of micro-services we need to ensure that cyber security keeps pace, while avoiding common pit falls around vulnerability assessment. By assessing container security over an extended time-period and analysing our results from multiple areas, all with a focus on real world risk, we present findings which inform further academic studies and industry-based decision making.”

The study was conducted in collaboration with Jonathan White and Professor Phil Legg. Alan is currently a Lecturer in Cyber Security studying for a part-time DPhil on the topic of container and cloud security.

The paper, Longitudinal risk-based security assessment of docker software container images, is now available as Open Access from the Computers and Security journal.

UWEcyber academics present at annual NCSC Education Ecosystem Conference

Author Anna Jones | Posted on

Last week, a team from UWEcyber attended the annual NCSC Education Ecosystem conference hosted in Leeds. Ian Johnson (AHOD Cyber Security) and Phil Legg (Professor of Cyber Security) attended as Co-Directors of the UWEcyber Academic Centre of Excellence in Cyber Security Education (ACE-CSE), along with Aida Abzhaparova (Senior Lecturer in Cyber Security and Global Politics) and Alan Mills (Lecturer in Cyber Security), who have both led outreach projects through the ACE-CSE this year. Phil Legg also presented an interactive session at the conference along with his external colleagues from Abertay University and the University of Roehampton as part of his ongoing leadership within the CISSEUK initiative to bring greater collaboration between academia, industry and government, and to improve the connectivity of the education pipeline into cyber security.

Alan Mills presented on the ACE-CSE project for upskilling school teachers across the region. This year, we expanded our teacher training initiative to cover six workshops across two locations (UWE Bristol and Gloucestershire College, Cheltenham), to reach a more varied and diverse mix of educators across the South West region. The workshops were specifically structured around three themes: cyber security for young people (for students years 7-9), cyber security basics (for students years 9-11), and cyber security careers and apprenticeships (for students years 11-13). The project has proved to be a success, with excellent feedback from the teachers who attended, and with a number of follow-up collaborations already underway. We continue to work closely with schools across the region, to help both students and teachers alike to upskill in their cyber security knowledge and expertise.

Phil Legg giving his presentaton

Aida Abzhaparova then presented on the ACE-CSE project for upskilling SMEs across the region. This wa a collaborative project between the cyber security team at UWE, and the DRAGoN team who focus on issues of data governance and privacy – bringing together these two core areas from within UWE to deliver combined workshops. Over two workshops we have helped over 17 SMEs to better understanding cyber security issues, and how they relate to their specific organisation, from construction, to accounting, and even circus skills – the diversity of organisations that chose to attend was fantastic to see! We have also helped to introduce SMEs to the “Five Safes” model developed by DRAGoN as a suitable means of thinking about the access and usage of sensitive data within their organisation.

The conference brings together academia, industry and government, including the Department for Science, Innovation and Technology, the Department for Education, NCSC and GCHQ, as well as the UK Cyber Security Council and other major stakeholders across UK cyber security.

UWE Bristol researchers develop novel defence against adversarial machine learning attacks on Cyber Security Intrusion Detection Systems

Author Anna Jones | Posted on

As cyber attacks evolve in their sophistication, Intrusion Detection Systems (IDS) have often been seen as a way to mitigate threats on computer networks.

Yet, attackers continue to evade detection and cause disruption through the spread of malicious software and other common attack processes. There is a growing trend of being able to evade machine learning systems to conduct attacks, by effectively compromising the intended functionality of the machine learning system.

Recent work by Andrew McCarthy, a PhD student at UWE Bristol studying cyber security analytics, has been able to demonstrate both the feasibility of conducting such attacks against Intrusion Detection Systems, as well as proposing a novel approach to combat against the vulnerabilities that machine learning classifiers may exhibit.

Whilst the domain of adversarial machine learning often addresses computer vision systems, this cutting-edge research applies these concepts in cyber security, to understand what future threats may look like, and how best to develop Intrusion Detection Systems to avoid such vulnerabilities.

The results of Andrew’s recent PhD work have just been published in the high-ranking Journal of Information Systems and Applications (Elsevier). Andrew is in the final stages of completing his PhD study, working with Professor Phil Legg (Director of Studies) and supported by industry partner Techmodal through the UWE Partnership PhD scheme.

The full paper is available online.

Research success working with the UK Defence Sector to defend our cyber space

Author Anna Jones | Posted on

For the UK Defence Sector, there is an ever-growing need to defend in our cyber space as well as the traditional domains of land, air, space and sea. Understanding the complexities of monitoring cyber space to ensure that an operational mission is a challenging task, that involves collating indicators of compromise and other related sources of information and applying data science skills to aggregate and reason about incoming observations. A team of UWE researchers, led by Professor Phil Legg, are working with Bristol-based TRIMETIS to develop innovation in this domain, and together the team have recently secured £200,000 funding from the Defence Science and Technology Laboratory (DSTL) to support two new research projects that address these problems.

The first project seeks to understand the human-machine teaming aspects of how analysts can interrogate and reason about data observations to inform cyber defence. Furthermore, by developing improved human-machine teaming efforts, underpinning by machine learning techniques, will enable improved decision-making in response to cyber threats, and an improved synergy between how machine learning can help to reason about data and improve a human analyst’s workflow, whilst also developing a model to understand how a human analyst will reason about data, such that this can improve the system interaction further. 

The second project seeks to understand how humans can better serve as sensors about the environment to protect and defend against threats. This involves improved reporting mechanisms of threats, both online and offline, and how this information can be integrated within larger data analytics and reasoning platforms about a given mission. The project will seek to understand the barriers of reporting, and how technology can enable better data collection from observers, such that this information can then be better utilised within human-machine based analysis.

The two projects will both launch in January 2023 and will run for 9 months. The resulting outputs will be shared with the defence communities and through wider academic dissemination. This recent set of projects complement the portfolio of work that UWEcyber has conducted with DSTL and the defence community over a number of years, with previous DSTL-funded UWE projects including ARCD (2022), HASTE (2018), and RicherPicture (2015, 2017).

Measuring the Suitability of Artificial Intelligence in Autonomous Resilience for Cyber Defence

Author Anna Jones | Posted on

Artificial Intelligence has attracted wide use in many aspects of society, from facial recognition and recommendation systems, through to predicting crime rates and autonomous vehicles. AI technologies are widely used in defence, including how agent-based systems can detect and respond to cyber threats when under attack from adversaries.

Whilst this continues to be a ripe area of research, there are important questions to be asked about the suitability of AI within autonomous resilience for cyber defence, relating to the usability of AI, specifically on how end users may utilise the decisions that are generated by an AI defence system, and how an end user can better understand and reason about how the decisions of the AI are formulated.

UWE researchers Professor Phil Legg and Andrew McCarthy are working with TRIMETIS and PA Consulting to address this important research question, supported by QinetiQ and the Defence Science and Technology Laboratory (DSTL). The project is part of the SERAPIS Framework that supports rapid research and innovation to supply into the UK Ministry of Defence.

This programme of research will impact on how the UK can better identify, investigate and respond to threats in the cyber domain, as well as the impact of cyber across traditional defence areas of land, sea, air and space, and understand the role that artificial intelligence and agent-based systems will have in maintaining the defence and security of the UK.

Cyber Security in Connected Places: Attack Detection in RPL-based Internet of Things

Author Anna Jones | Posted on

By Sarfraz Brohi, Senior Lecturer Cyber Security

Connected places such as smart cities have enabled urban planners to improve citizens’ quality of life by collecting, storing, processing and analysing data. Internet of Things (IoT) is one of the driving technologies of connected places. It integrates different city functions such as parking systems, mobility services, waste management, healthcare and emergency services. Unfortunately, IoT has vulnerabilities that attackers could exploit due to the massive processing of sensitive data. Cyber security breaches in IoT-powered connected places could violate citizens’ privacy, endanger life and cause economic disaster.

IoT security encompasses a massive area of research with a wide array of open challenges. Dr Sarfraz Brohi (Senior Lecturer in Cyber Security at CSCT-UWE, Bristol) collaborated with the researchers from Taylor’s University, Malaysia (Dr Noor Zaman: Cluster head for cyber security research, Ms Fatima Zahra and Dr Navid Khan) and Taif University, Saudi Arabia (Dr Mehedi Masud and Dr Mohammed A. AlZain) to address crucial IoT-specific rank and wormhole attacks by creating a machine learning model.

The fundamental components of an IoT-enabled infrastructure usually include sensors, RFIDs, microcontrollers and digital devices. These components are low power and lossy due to their small size and simple architecture. Therefore, they use lightweight routing standards and protocols for data transmission. RPL is one such protocol used in IoT networks. RPL-based IoT networks are vulnerable to two types of attacks: WSN-inherited attacks and RPL-specific attacks. Rank and wormhole attacks are examples of high-impact attacks from these categories where attackers target the protocol and sensor network vulnerabilities to disrupt network functionalities and compromise resources.

F. Zahra, NZ. Jhanjhi, SN. Brohi, NA. Khan, M. Masud, and MA. AlZain, generated a dataset and developed a model for detecting RPL-specific and WSN-inherited attacks in RPL-based IoT: LIoTN-RPL dataset and MC-MLGBM model. The LIoTN-RPL data pool consists of network traffic data extracted from various network models. These network models have been designed considering three scenarios – one benign and two attack scenarios – and simulated based on the number of IoT nodes and state of nodes. The MC-MLGBM classifies three target classes and addresses two attacks. In this research, they have used accuracy, precision and recall to evaluate the proposed model. To avoid accuracy bias, they have also used cross entropy, Cohen’s Kappa, and MCC as performance evaluation metrics. The existing models usually focus on one category of attacks. The proposed model provides a conceptual framework for aggregately addressing both in RPL-based IoT networks.

The results of this research are discussed in the paper “Rank and Wormhole Attack Detection Model for RPL-based Internet of Things using Machine Learning”, published in the MDPI Sensors special issue on Advances in IoT Privacy, Security and Applications. Authors have reviewed recent methodologies for addressing security issues in IoT and techniques used to detect the attacks. Furthermore, they have analysed the data collection methods in the research domain. This research observed the scarcity of publicly available RPL attack datasets and the prevalence of self-generated datasets using simulators like Cooja. The future direction of this research focuses on more experiments by designing and simulating other RPL-specific and WSN-inherited attack models. LIoTN-RPL will be released as an open-source dataset to the research community to facilitate the development of ML models for attack detection in RPL-based IoT networks.

Read the full article.

UWE Bristol research to help uncover and mitigate against hundreds of online public software supply chain vulnerabilities

Author Anna Jones | Posted on

Many software and cloud platforms rely on the use of containerisation, a modern technique of deploying multiple software services quickly, securely and efficiently on large-scale cloud computing resources such as Microsoft Azure and Amazon Web Services (AWS). Platforms such as DockerHub provide an online repository of over 100,000 ready-to-deploy containers that are used widely in many of today’s modern software platforms. Whilst this offers great convenience for development teams, many of these containers may exhibit vulnerabilities, which if not managed, can introduce vulnerabilities into a company software stack. Recent security issues such as the log4j vulnerability and the Solarwinds Orion attack highlight the growing concern around software supply chain security, the dependencies that are made by development teams on third party software, and the implications of identifying and remediating such vulnerabilities later down the line.

As part of our CSC3 research, Alan Mills, Jonathan White and Phil Legg, have developed a suite of docker security visualisation and remediation tools: OGMA and BORVO. The suite of tools enable developer and security teams to quickly identify vulnerabilities against a variety of container security scanning platforms. Results from existing scanning tools can often differ or conflict, and so our aggregated approach helps provide a unified analysis to address conflicts and provide a visual means for thorough examination the results. Our approach also provides a more intuitive risk assessment that considers the true impact of vulnerabilities, such as how easily the vulnerability could actually be exploited by external or internal actors. Furthermore, the suite also provides developers with informed assessment of how to remediate the security issues whilst preserving the intended software functionality that is dependent on the container.

Our research paper “OGMA: Visualisation for Software Container Security Analysis and Automated Remediation” has been peer-reviewed and accepted for the IEEE Conference on Cyber Security and Resilience where the work will be presented and published at the end of July. We will also be sharing our insights in our related presentation on “Securing the Supply Chain – Practicality v Paranoia” at the upcoming BSides Cheltenham conference this weekend, which is a community-organised event for the regional cyber security industry and enthusiasts, and follows our lightning talk on software supply chain security delivered at CYBERUK 2022 earlier this year. OGMA and BORVO are both released as open-source applications that we have made available to the wider research community, to facilitate the examination and remediation of software vulnerabilities in containerised applications. For more details, including how to download and use the tools, please visit our GitHub page.

Back to top