Systems Science Commons^™

Director, Military Cyber Institute, Joseph Schafer

Military Cyber Affairs

No abstract provided.

Throughput Of Ascon Compared With Popular Iot Encryption Algorithms, Mitchel R. Harvey (Ryan), Andrew M. Kaiser, Garrett W. Hoiness

Military Cyber Affairs

No abstract provided.

Anomaly Detection Of Network Layer Attacks Against Cyber Physical Systems Using Machine Learning And Deep Learning Techniques, James Alger, Michael Tu

Military Cyber Affairs

This research paper presents the analysis of using machine learning and deep learning algorithms on detecting anomalous network traffic in Cyber-Physical Systems (CPS). Using a real PLC CPS-based system, normal and anomalous network traffic will be captured using Wireshark. The research analyzes a DDoS attack. The focus of the research is to identify the most effective feature combinations and evaluate them on ML and DL models. The emphasis is on enhancing detection strategies rather than exploiting device vulnerabilities. The detection of network attacks often involves handling a vast array of high-level features. Previous studies (Li & Chasaki, 2022) apply machine …

Characterizing Caldera’S Cyber Attack Emulation Capabilities, Caleb Chang, Matthew Cao, Kenyou Teoh, Ekzhin Ear, Shouhuai Xu

Military Cyber Affairs

Autonomous cyber attack emulation can aid cyber defenders to identify and remediate cyber risks. MITRE’s Caldera software is the state-of-the-practice for automated attack emulation. Yet, it has not been systematically analyzed, putting its performance and effectiveness into question. This paper systematically characterizes Caldera’s architecture, abilities and use cases, and assesses its strengths and weaknesses. It draws useful insights, such as: Caldera excels in stealthy access and execution tactics to pilfer data against Windows operating systems. It also discusses two directions for Caldera improvement: module-level automation and end-to-end attack emulation.

The Digital Battlefield: Safeguarding Military Drones Against Cyberattacks, Jason Ashong, Arun Venkitanarayanan, Benjamin Yankson

Military Cyber Affairs

The Internet of Battlefield Things (IoBT) is an advanced network of interconnected devices that significantly enhance military operations through real-time data exchange and situational awareness. While IoBT offers tactical advantages like improved surveillance, reconnaissance, and operational effectiveness, it also introduces substantial cybersecurity risks. Adversaries can exploit vulnerabilities within these networks, potentially compromising mission integrity and national security. This research examines the cybersecurity measures of commercial drone controllers and their correlation with military devices. It aims to enhance future vulnerability assessments with advanced tools and approaches to better secure critical military operations. The study highlights the need for robust security architectures …

Using Blockchain Technology To Help Secure America's Defense Critical Infrastructure, Vimal Buck, Aerin Krebs, Brynn Hillard, Jakob Gerha, Joseph Lutma, Srikar Maduposu, Ted Allen

Military Cyber Affairs

Critical water infrastructure in the United States faces increasing cybersecurity threats from state-sponsored actors, with potentially devastating consequences for national security, economic stability, and public health. (Cybersecurity and Infrastructure Security Agency, 2025). This infrastructure supports defense critical assets and is actively being targeted by various state-sponsored hacking groups, which poses a major concern for civilians and military alike. K. Herath (personal communication, February 24, 2025) reported being aware of two attacks on Ohio water systems during his tenure as Cybersecurity Strategic Advisor to Ohio Governor Mike DeWine.

Water is essential to everyday life and defense and presents as a high-value …

Network And Multipath Traceroute Visualization, Cameron Makowski

Military Cyber Affairs

TraceCam introduces a new paradigm in network path analysis, leveraging GPU-accelerated WebGL visualization, advanced traceroute integrations, and AI-driven insights to transform complex routing data into actionable intelligence. Early prototypes have demonstrated significant improvements in performance, clarity, and multi-path discovery, overcoming traditional limitations in traceroute analysis. By incorporating retrieval-augmented language models and enriched metadata sources like IPinfo.io, TraceCam enables automated anomaly detection, contextual explanations, and rapid root-cause analysis, enhancing operational efficiency. The platform’s architecture ensures scalability and adaptability, supporting deeper investigations and real-time situational awareness. Future development will focus on clustering-based anomaly detection, expanded geographic visualizations, and enhanced AI-generated analysis to …

Quantifying Adversary Military Forces’ Susceptibility To Cognitive Attacks, Bonnie Rushing, Cole Nelson, Shouhuai Xu, Christofer “Raven” O’Keefe, Olga Karpoyan

Military Cyber Affairs

This paper introduces a method to quantify international populations’ susceptibility to cyber cognitive attacks using press freedom and media trust metrics. We present the Cognitive Influence Calculator, a tool that estimates susceptibility (𝑆) based on Press Freedom Scores (PFS) and media trust levels. Findings show that while authoritarian regimes are harder to reach, successful cognitive attacks have greater impacts due to higher trust in state-controlled narratives. Using U.S. wargaming data and international trust metrics, we compute susceptibility scores for the U.S., Russia, China, Iran, and North Korea. Results show an inverse relationship between PFS and media susceptibility, with local/allied …

Forward, Amy Hamilton

Military Cyber Affairs

No abstract provided.

Understanding Russia’S Cyber Policies, Strategies, And Doctrines, Bryan Hancock, Hanh Nguyen, Olga Karpoyan, Ekzhin Ear, Shouhuai Xu

Military Cyber Affairs

This study analyzes the strengths and weaknesses of Russia’s cyber policies, strategies, and doctrines through a systematic set of attributes, leading to key insights: (i) Russia has proactively adapted its cyber policies, strategies, and doctrines to its evolving environment; (ii) Russia actively conducts cognitive warfare, but remains equally vulnerable to it; and (iii) Russia’s cyber posture faces significant challenges, including a limited technological base, shortage of skilled personnel, and restrictive approach to information control, all of which undermine the effectiveness of its strategies. These insights offer valuable implications for US Cyber Command and the Department of Defense.

Characterizing Cyberattacks Against Operational Technology Infrastructures Through The Lens Of Attack Flows, Sherman Kettner, Caleb Chang, Ekzhin Ear, Shouhuai Xu

Military Cyber Affairs

Operational Technology (OT) infrastructures play a critical role in modern society and economy. However, their increasing connectivity with public networks such as the Internet has made them vulnerable to cyberattacks, much like traditional Information Technology (IT) systems. In particular, cyberattacks against OT infrastructures remain relatively underexplored and little understood. In this paper, we aim to deepen our understanding of cyberattacks against OT infrastructures. For this purpose, we propose a methodology, including novel cybersecurity metrics to analyze the attack flows of these attacks in an end-to-end fashion, which allows us to draw useful insights. We demonstrate the utility of the methodology …

Using Digital Twins To Protect Biomanufacturing From Cyberattacks, Brenden Fraser-Hevlin, Alec W. Schuler, B. Arda Gozen, Bernard J. Van Wie

Military Cyber Affairs

Understanding of the intersection of cyber vulnerabilities and bioprocess regulation is critical with the rise of artificial intelligence and machine learning in manufacturing. We detail a case study in which we model cyberattacks on network-mediated signals from a novel bioreactor, where it is important to control medium feed rates to maintain cell proliferation. We use a digital twin counterpart reactor to compare glucose and oxygen sensor signals from the bioreactor to predictions from a kinetic growth model, allowing discernment of faulty sensors from hacked signals. Our results demonstrate a successful biomanufacturing cyberattack detection system based on fundamental process control principles.

Characterizing Advanced Persistent Threats Through The Lens Of Cyber Attack Flows, Logan Zeien, Caleb Chang, Ltc Ekzhin Ear, Dr. Shouhuai Xu

Military Cyber Affairs

Effective cyber defense must build upon a deep understanding of real-world cyberattacks to guide the design and deployment of appropriate defensive measures against current and future attacks. In this abridged paper (of which the full paper is available online), we present important concepts for understanding Advanced Persistent Threats (APTs), our methodology to characterize APTs through the lens of attack flows, and a detailed case study of APT28 that demonstrates our method’s viability to draw useful insights. This paper makes three technical contributions. First, we propose a novel method of constructing attack flows to describe APTs. This abstraction allows technical audiences, …

Securing The Void: Assessing The Dynamic Threat Landscape Of Space, Brianna Bace, Dr. Unal Tatar

Military Cyber Affairs

Outer space is a strategic and multifaceted domain that is a crossroads for political, military, and economic interests. From a defense perspective, the U.S. military and intelligence community rely heavily on satellite networks to meet national security objectives and execute military operations and intelligence gathering. This paper examines the evolving threat landscape of the space sector, encompassing natural and man-made perils, emphasizing the rise of cyber threats and the complexity introduced by dual-use technology and commercialization. It also explores the implications for security and resilience, advocating for collaborative efforts among international organizations, governments, and industry to safeguard the space sector.

Security-Enhanced Serial Communications, John White, Alexander Beall, Joseph Maurio, Dane Fichter, Dr. Matthew Davis, Dr. Zachary Birnbaum

Military Cyber Affairs

Industrial Control Systems (ICS) are widely used by critical infrastructure and are ubiquitous in numerous industries including telecommunications, petrochemical, and manufacturing. ICS are at a high risk of cyber attack given their internet accessibility, inherent lack of security, deployment timelines, and criticality. A unique challenge in ICS security is the prevalence of serial communication buses and other non-TCP/IP communications protocols. The communication protocols used within serial buses often lack authentication and integrity protections, leaving them vulnerable to spoofing and replay attacks. The bandwidth constraints and prevalence of legacy hardware in these systems prevent the use of modern message authentication and …

Enhancing The Battleverse: The People’S Liberation Army’S Digital Twin Strategy, Joshua Baughman

Military Cyber Affairs

No abstract provided.

What Senior U.S. Leaders Say We Should Know About Cyber, Dr. Joseph H. Schafer

Military Cyber Affairs

On April 6, 2023, the Atlantic Council’s Cyber Statecraft Initiative hosted a panel discussion on the new National Cybersecurity Strategy. The panel featured four senior officials from the Office of the National Cyber Director (ONCD), the Department of State (DoS), the Department of Justice (DoJ), and the Department of Homeland Security (DHS). The author attended and asked each official to identify the most important elements that policymakers and strategists must understand about cyber. This article highlights historical and recent struggles to express cyber policy, the responses from these officials, and the author’s ongoing research to improve national security cyber policy.

Operationalizing Deterrence By Denial In The Cyber Domain, Gentry Lane

Military Cyber Affairs

No abstract provided.

Defensive Industrial Policy: Cybersecurity Interventions To Reduce Intellectual Property Theft, Dr. Chad Dacus, Dr. Carl (Cj) Horn

Military Cyber Affairs

Through cyber-enabled industrial espionage, China has appropriated what Keith Alexander, the former Director of the National Security Agency, dubbed “the largest transfer of wealth in history.” Although China disavows intellectual property (IP) theft by its citizens and has set self-sustained research and development as an important goal, it is unrealistic to believe IP theft will slow down meaningfully without changing China’s decision calculus. China and the United States have twice agreed, in principle, to respect one another’s IP rights. However, these agreements have lacked any real enforcement mechanism, so the United States must do more to ensure its IP is …