Cyber intelligence (Computer security)

A modern urban infrastructure no longer operates in isolation but instead leverages the latest technologies to collect, process, and distribute aggregated knowledge to improve the quality of the provided services and promote the efficiency of resource consumption. However, the ambiguity of ever-evolving cyber threats and their debilitating consequences introduce new barriers for decision-makers. Numerous techniques have been proposed to address the cyber misdemeanors against such critical realms and increase the accuracy of attack inference; however, they remain limited to detection algorithms omitting attack attribution and impact interpretation. The lack of the latter prompts the transition of these methods to operation difficult to impossible.
In this dissertation, we first investigate the threat landscape of smart cities, survey and reveal the progress in data-driven methods for situational awareness and evaluate their effectiveness when addressing various cyber threats. Further, we propose an approach that integrates machine learning, the theory of belief functions, and dynamic visualization to complement available attack inference for ICS deployed in the realm of smart cities. Our framework offers an extensive scope of knowledge as opposed to solely evident indicators of malicious activity. It gives the cyber operators and digital investigators an effective tool to dynamically and visually interact, explore and analyze heterogeneous, complex data, and provide rich context information. Such an approach is envisioned to facilitate the cyber incident interpretation and support a timely evidence-based decision-making process.

While the seamless interconnection of IoT devices with the physical realm
is envisioned to bring a plethora of critical improvements on many aspects and in
diverse domains, it will undoubtedly pave the way for attackers that will target and
exploit such devices, threatening the integrity of their data and the reliability of
critical infrastructure. The aim of this thesis is to generate cyber threat intelligence
related to Internet-scale inference and evaluation of malicious activities generated by
compromised IoT devices to facilitate prompt detection, mitigation and prevention of
IoT exploitation.
In this context, we initially provide a unique taxonomy, which sheds the light
on IoT vulnerabilities from five di↵erent perspectives. Subsequently, we address the
task of inference and characterization of IoT maliciousness by leveraging active and
passive measurements. To support large-scale empirical data analytics in the context
of IoT, we made available corresponding raw data through an authenticated platform.