Cybersecurity Commons^™

Hands-On Ransomware: An Experiential Wannacry Case Study For Undergraduate Cybersecurity Education, Eli Creek Richmond, Thomas R. Devine

Military Cyber Affairs

Ransomware represents one of the most disruptive threats in the cyber landscape, yet hands-on malware analysis remains rare in undergraduate cybersecurity curricula. This paper presents the design, implementation, and evaluation of an experiential learning module centered on the WannaCry ransomware case study, deployed in a senior-level course at West Virginia University. Students performed static and dynamic analysis using industry-standard tools. Pre- and post-module assessments demonstrated measurable gains in self-reported competency across seven technical dimensions. The module's competencies align directly with DoD Cyber Workforce Framework Work Role 212, Cyber Defense Forensics Analyst, supporting education-to-workforce pipeline development.

From Framework To Toolchain: Implementing Zero Trust Architecture In Cloud-Native Environments For Dow Compliance, Shelby C. Snyder

Military Cyber Affairs

Federal agencies face a fiscal year 2027 target for enterprise-wide Zero Trust deployment, but NIST SP 800-207A defines logical components without identifying the Kubernetes technologies that implement them. This paper proposes a three-tier mapping of the Policy Engine, Policy Administrator, and Policy Enforcement Point to service mesh, microsegmentation, and perimeter tooling, stating the criteria by which each component is classified. It then applies a defined rubric to six Zero Trust vendors across component alignment, Kubernetes capability, federal authorization posture, and evidence quality, finding that no single vendor covers all three tiers. The mapping is a testable architectural proposition; a Stage …

Cyberspace Collaborative Awareness: A Model For Unity Of Effort In Homeland Defense, Mike Knapp, Sean Atkins, Matthew Mclaughlin

Joint Force Quarterly

The increasing frequency and severity of cyberattacks against U.S. critical infrastructure continue to confound homeland defense efforts. Defending against state cyber campaigns that threaten the nation’s most critical systems requires a new awareness model that can enable unity of effort across public and private actors. Examining homeland defense awareness in other domains reveals principles and approaches that can inform the development of a collaborative awareness model in cyberspace. This new framework acknowledges the interconnectedness of government and commercial networks and the independent goals of each player in the domain. Doing so provides a viable path to achieving shared domain awareness …

Energy Security Strategy Empowered By Artificial Intelligence, Qiang Ji, Jiaofeng Pan, Yu Song

Bulletin of Chinese Academy of Sciences (Chinese Version)

Against the backdrop of unprecedented changes in a century, geopolitical restructuring has led to the fragmentation of energy game camps, climate change has impacted the resilience of energy infrastructure, and energy transformation has promoted the multidimensional and coordinated expansion of security connotations. Artificial intelligence, with its core advantages such as optimizing geopolitical risk prevention and control, enhancing infrastructure protection, improving energy system efficiency, and accelerating the integration of renewable energy, has promoted the shift of energy security strategy from experience driven to data-driven intelligence, achieving comprehensive risk identification, dynamic evaluation, collaborative response, and full chain monitoring, significantly improving the efficiency, …

Large Models Empowering Cybersecurity: Opportunities And Challenges, Zhuofeng He, Dongbin Hu, Yige Yuan

Bulletin of Chinese Academy of Sciences (Chinese Version)

Cybersecurity serves as a critical pillar for national security and social stability. Large models in cybersecurity are emerging as key enablers for the intelligent transformation of cyber offense and defense systems. As one of the most advanced core technologies in artificial intelligence, large models are introducing new research directions and application paradigms in the cybersecurity domain. This study systematically reviews the current landscape of cybersecurity-oriented large model applications and products, and explores their deployment scenarios in practice. It further analyzes the development trends in model capabilities, industry ecosystems, and trustworthiness, while identifying major practical challenges such as data privacy protection, …

Critical Core Technology Breakthroughs In Large-Scale Models: Industrialization Strategies And Policy Implications, Zhongqi Wu, Yinshan Liu, Tao Dai, Xiaolong Zheng

Bulletin of Chinese Academy of Sciences (Chinese Version)

As a pivotal direction for breakthroughs in key core technologies within the artificial intelligence domain, large-scale models hold strategic significance in securing national scientific and technological sovereignty. This study employs a multidimensional framework encompassing “technological breakthroughs, industrial transformation, and governance policies” to systematically investigate the developmental trajectories and industrialization bottlenecks of large-scale models. At the technological level, while large-scale models exhibit exponential growth in parameter scale and computing power demands, they face critical challenges including the scarcity of high-quality data, insufficient transfer learning capabilities, and reliability-explainability trade-offs. Industrially, these models are reshaping the global industrial chain landscape through a dual-track …

Bridging The Gap: Cybersecurity And Occupational Safety Frameworks In Ai Data Centers, Athena Leader

Discovery Day - Daytona Beach

Bridging the Gap: Cybersecurity and Occupational Safety Frameworks in AI Data Centers   As artificial intelligence infrastructure expands, AI data centers represent a critical and underexamined convergence of cybersecurity and occupational safety risk. Existing frameworks such as NIST, OSHA, and ISO standards were largely developed in isolation, leaving significant gaps in how organizations manage risks that are simultaneously digital and physical in nature. This study investigates the gaps and overlaps between cybersecurity and occupational safety frameworks as they apply specifically to AI data center environments. Drawing on a targeted literature review of established regulatory and standards-based frameworks, this research identifies where …

Geospatial Governance Failures In The Department Of Defense: Contractor Noncompliance, Ai Adoption, And The Parallel Treatment Of Gis And Cybersecurity, Lyndsey Olmstead

Geography and the Environment: Graduate Student Capstones

The Department of Defense's treatment of geographic information systems and cybersecurity as parallel rather than integrated policy domains produces geographically predictable vulnerability patterns across its global military installation footprint. This capstone investigates that conclusion through original spatial analysis, constructing a five-variable composite geospatial vulnerability index across the six U.S. Combatant Command regions using publicly available unclassified data. EUCOM ranked highest overall, driven by GPS/PNT spoofing density, commercial satellite coverage, and cyber incident frequency; CENTCOM ranked second, driven by OSINT exposure incidents and governance risk. The null hypothesis of random geographic distribution is rejected. Findings confirm the structural governance gap documented …

The Security Of Llm-Generated Code, Christopher Brian Gonzalez Ayala

Student Theses

The rapid adoption of Large Language Models (LLMs) in software development has transformed coding practices by enabling automated code generation, completion, and optimization. Despite these advantages, concerns persist regarding the security and reliability of LLM-generated code. This study presents a comprehensive evaluation of both the functional correctness and security of code produced by three prominent LLMs as of early 2026. A total of 4,800 code snippets were generated using 100 security-focused programming prompts derived from the OWASP Top 10:2025, translated across eight natural languages and two phrasing styles (literal and natural developer-oriented prompts). To assess performance, a multi-stage experimental framework …

Next-Generation Democratic Cyber Statecraft - Balancing The Signal: Shutdown Shocks And Democratic Digital Governance, Scott M. Di Panni

School of Public Policy Capstones

This paper develops Next-Generation Democratic Cyber Statecraft (NG-DCS), a unified strategic doctrine for democratic governments to contest the cognitive domain against authoritarian adversaries. Drawing on twenty-six years of cross-national panel data (1999–2024) spanning 213 countries, game-theoretic modeling, and qualitative case analysis, the paper establishes three interconnected empirical and theoretical foundations. First, cross-national OLS regression across 160+ countries demonstrates that regime type is the dominant structural determinant of internet freedom (R²=0.615, β=2.513, p< 0.001), explaining more than twice the variance attributable to per-capita wealth (R²=0.268). Democratic governance, not economic development, produces open digital environments. Second, a two-way fixed effects (TWFE) difference-in-differences study exploiting government-ordered internet shutdowns as discrete policy interventions finds that digital restrictions causally degrade V-Dem governance quality by 0.21–0.38 standard deviations (p< 0.001 across all specifications). Treatment effects are immediate (β=−0.302 at k=0) and persist through five post-treatment years (β=−0.246 at k=+5), indicating structural rather than transitory governance damage. Parallel trends validation (p=0.352) and Callaway–Sant’Anna heterogeneity-robust estimation (ATT=−0.230, SE=0.077) support causal identification. Instrumental variable triangulation (2SLS β=−0.949, p=0.005) confirms that simultaneity was attenuating, not inflating, the primary estimates. Third, formal game-theoretic analysis reveals that the current U.S.–adversary equilibrium is (Restrain, Escalate)—the risk-dominant but Pareto-inferior outcome of a Stag Hunt structure. China, Russia, North Korea, and Venezuela each occupy structurally distinct positions (Stackelberg commitment, asymmetric two-level, autarky, and reactive trigger, respectively), requiring differentiated doctrinal responses rather than a uniform strategic playbook. Generative AI and algorithmic governance are shown to accelerate cognitive vulnerability by collapsing influence operation costs and exploiting engagement-optimized platform architectures that systematically degrade deliberative capacity in democratic populations.

Foxbuddy, Luis Eduardo Garza Jr.

Posters - 2026

Emergency preparedness remains a significant challenge for individuals due to disorganized resource management and lack of accessible guidance. Additionally, cybersecurity risks during emergencies are often overlooked, leaving individuals vulnerable to digital threats such as phishing, scams, and data exposure. FoxBuddy provides a centralized, user-friendly platform that enhances both physical preparedness and cybersecurity awareness.

Digital Redlining In The Smart City: Artificial Intelligence, Housing Law, And Structural Urban Inequality, Spurthi Nrusimhadevara

Undergraduate Scholarship and Creative Works

Artificial intelligence is increasingly used in urban housing systems, where it shapes decisions about tenant screening, rent pricing, lending, zoning, and neighborhood investment. Although these tools are often promoted as efficient and impartial, they frequently rely on historical data that reflect racial, economic, and spatial inequality. As a result, AI systems can reproduce discriminatory outcomes even when protected characteristics are not directly used. This paper examines digital redlining in the smart city and argues that algorithmic housing tools mirror long standing structural inequities that raise significant concerns under fair housing and civil rights law. It evaluates how automated screening, predictive …

Biosecure-Llm Framework: Protecting Llms From Cyberbiosecurity Threats And The Case For Independent Ai Safety Governance, Xavier-Lewis Palmer, Lucas Potter, Srdjan Lesaja, Sotirios Karathanasis, Mohammad Ghasemigol

Computer Science Faculty Publications

Large Language Models (LLMs) are becoming critical infrastructure in scientific, healthcare, and governmental contexts. As frontier AI laboratories increasingly partner with government agencies, a fundamental question arises: Who should control the safety and policy-enforcement layers that constrain model behavior? Current safety mechanisms (LLM guardrails) are typically designed for generic "harmlessness" and operate by detecting semantic patterns and refusing requests. However, they are inadequate governance instruments because they cannot implement auditable, domain-specific controls tied to external regulatory policy objects (e.g., control lists or rules governing personally identifying information). Even a perfectly aligned model is not able to express institution-specific policy without …

Cybersecurity Center For Offshore Wind Energy (Final Project Round), Sachin Shetty

Center for Secure and Intelligent Critical Systems (CSICS) Publications

This project establishes a Cybersecurity Center for Offshore Wind Energy with the objective of designing and operating a cyber-physical testbed for wind energy farms (WEFs) that enables comprehensive cybersecurity research. The testbed incorporates a Supervisory Control and Data Acquisition (SCADA) system connected to turbine models via industrial-grade programmable logic controllers (PLCs) and remote terminal units (RTUs). It supports side-channel data acquisition, implementation and analysis of various cyberattack scenarios, and development of attack detection, mitigation, and best-practice guidance tailored to wind energy systems. During the project, the team expanded the number and fidelity of mathematical turbine models (MTMs), integrated these models …

Three Decades Of Chinese Internet Technology: Social Risks And Prevention Pathways, Zhaokai Yin, Weifu Zhang

Bulletin of Chinese Academy of Sciences (Chinese Version)

With the rapid advancement and application of big data, artificial intelligence, and mobile Internet technologies, network technology has been driving social development, while its negative effects have gradually emerged. Based on a critical perspective and logical reasoning, this study systematically reviews the evolution and characteristic manifestations of social risks in China’s network technology over the past 30 years, revealing multiple hidden dangers it has caused in data governance, capital operation, and political communication. Under the new situation, to prevent and defuse the social risks of network technology, precise measures should be taken from aspects such as value guidance, institutional regulation, …

Selected Artificial Intelligence Provisions In U.S. Fiscal Year 2025 National Defense Authorization Act, Bert Chapman

Libraries Faculty and Staff Presentations

The 2025 Fiscal Year National Defense Authorization Act contains multiple provisions relating to artificial intelligence (AI). These congressionally mandated provisions direct various sections of the Department of Defense (DOD) and individual U.S. armed service branches to execute congressional intent for AI policymaking. Examples of such intent include identifying and planning DOD's AI workforce, demonstrating AI biotechnology applications for national security, improving the human usability of AI systems, and establishing an AI security center. This presentation will note that reports on these initiatives must be prepared for relevant congressional oversight committees, and, in many cases, are in many cases, publicly released …

Does The Transit Industry Understand The Risks Of Cybersecurity And Are The Risks Being Appropriately Prioritized?, Scott F. Belcher, Terri Belcher, James Grimes, Lusa Holmstrom, Andy Souders

Mineta Transportation Institute

The intent of this study is to assess the readiness, resourcing, and capabilities of public transit agencies to detect, identify, be protected from, respond to, and recover from cybersecurity vulnerabilities and threats. This study is an update of the 2020 Mineta Transportation Institute (MTI) study, “Is the Transit Industry Prepared for the Cyber Revolution? Policy Recommendations to Enhance Surface Transit Cyber Preparedness.” In the previous study, the authors found that the transit industry was ill-prepared for cybersecurity attacks. Unfortunately, after four years and the development of new, and often free, resources, the situation has not markedly improved. In fact, this …

The Future Of Ai: Join The Conversation, Jennifer Wojton, Cassandra Branham, Vijay Tummala, Laxima Niure Kandel, Kayla D. Taylor

Publications

Join the Conversation! The Future is AI? There is so much conflicting information about what AI is capable of, how it could/should be used, by whom and for what purpose. In this panel discussion, we hope to provide a baseline of information that will help all participants think critically and articulate thoughtful questions about the mechanics of AI, ethical use or non-use of AI in particular contexts (school, industry, business, art, etc.), and the impacts we are currently experiencing or are likely to experience. Hear from ERAU faculty of different disciplines to discuss what the current state of AI technology …

Computing In The Commonwealth: Specialized Education In Computer Science And Information Technology For High School Students In Virginia – An Environmental Scan, Amy Corning, Jonathan D. Becker, Jon Graham, James Carrigan, Keisha Tennessee

ICRE Publications

Over the past two decades, Virginia has invested substantially in STEM education, in part through specialized programs focused on computer science and information technology (CS/IT). This study represents the first effort to identify Virginia’s specialized secondary CS/IT programs and examine them collectively. Findings from the statewide environmental scan indicate that the programs are delivered through a wide variety of institutional structures, including Governor’s STEM Academies, Governor’s Schools, specialty centers, and academies, but most often through Career and Technical Education (CTE) centers. Programs tend to be concentrated in metropolitan areas, and some rural divisions may not be served. The programs provide …

Maritime Industry Cybersecurity Threats In 2025: Advanced Persistent Threats (Apts), Hacktivism And Vulnerabilities, Minodora Badea, Olga Bucovetchi, Adrian V. Gheorghe, Mihaela Hnatiuc, Gabriel Raicu

Engineering Management & Systems Engineering Faculty Publications

Background: The maritime industry, vital for global trade, faces escalating cyber threats in 2025. Critical port infrastructures are increasingly vulnerable due to rapid digitalization and the integration of IT and operational technology (OT) systems. Methods: Using 112 incidents from the Maritime Cyber Attack Database (MCAD, 2020-2025), we developed a novel quantitative risk assessment model based on a Threat-Vulnerability-Impact (T-V-I) framework, calibrated with MITRE ATT&CK techniques and validated against historical incidents. Results: Our analysis reveals a 150% rise in incidents, with OT compromise identified as the paramount threat (98/100 risk score). Ports in Poland and Taiwan face the …

Enhancing Cyber Situational Awareness Through Dynamic Adaptive Symbology: The Dass Framework, Nicholas Macrino, Sergio Pallas Enguita, Chung-Hao Chen

Electrical & Computer Engineering Faculty Publications

The static nature of traditional military symbology, such as MIL-STD-2525D, hinders effective real-time threat detection and response in modern cybersecurity operations. This research introduces the Dynamic Adaptive Symbol System (DASS), a novel framework enhancing cyber situational awareness in military and enterprise environments. The DASS addresses static symbology limitations by employing a modular Python 3.10 architecture that uses machine learning-driven threat detection to dynamically adapt symbol visualization based on threat severity and context. Empirical testing assessed the DASS against a MIL-STD-2525D baseline using active cybersecurity professionals. Results show that the DASS significantly improves threat identification rates by 30% and reduces response …

From Cyclones To Cybersecurity: A Call For Convergence In Risk And Crisis Communications Research, Ann Marie Reinhold, Ross J. Gore, Barry Ezell, Clemente I. Izurieta, Elizabeth A. Shanahan

VMASC Publications

Effective risk and crisis communication can improve health and safety and reduce harmful effects of hazards and disasters. A robust body of literature investigates mechanisms for improving risk and crisis communication. While effective risk and crisis communication strategies are equally desired across different hazard types (e.g., natural hazards, cyber security), the extent to which risk and crisis communication experts utilize the “lessons learned” from scientific domains outside their own is suspect. Therefore, we hypothesized that risk and crisis communication research is siloed according to academic disciplines at the detriment to the advancement of the field of risk communications research writ …

Long-Term Traffic Prediction Using Deep Learning Long Short-Term Memory, Ange-Lionel Toba, Sameer Kulkarni, Wael Khallouli, Timothy Pennington

School of Cybersecurity Faculty Publications

Traffic conditions are a key factor in our society, contributing to quality of life and the economy, as well as access to professional, educational, and health resources. This emphasizes the need for a reliable road network to facilitate traffic fluidity across the nation and improve mobility. Reaching these characteristics demands good traffic volume prediction methods, not only in the short term but also in the long term, which helps design transportation strategies and road planning. However, most of the research has focused on short-term prediction, applied mostly to short-trip distances, while effective long-term forecasting, which has become a challenging issue …

Security Enhancement In Uav Swarms: A Case Study Using Federated Learning And Shap Analysis, Sushmitha Halli Sudhakara, Lida Haghnegahdar

School of Cybersecurity Faculty Publications

As cyber-physical systems (CPSs) increasingly integrate physical and digital realms, securing critical infrastructure, such as the Port of Virginia, becomes paramount. Among CPSs, Unmanned Aerial Vehicles (UAVs) are vital for monitoring, communication, and supporting the command and control through remote reconnaissance and surveillance missions. These UAV applications often require coordination, planning, and runtime reconfiguration, traditionally managed by human decision-makers. However, this approach has limitations, as extensively documented in the literature. Artificial Intelligence (AI) has emerged as a pivotal tool to address these limitations, enhancing risk mitigation and informed decision-making. This research proposes a machine learning (ML) based security mechanism, leveraging …

Cyberattacks On Port Infrastructures: A Decade Of Trends, Incidents, And Mitigation Strategies (2011-2024), Minodora Badea, Olga Bucovetchi, Adrian V. Gheorghe, Gabriel Raicu

Engineering Management & Systems Engineering Faculty Publications

Port infrastructures are critical to global trade, handling over 80% of the world's cargo by volume. However, their increasing reliance on digital technologies has exposed them to a wide range of cyber threats. This paper provides a comprehensive analysis of cyberattacks targeting port infrastructures from 2011 to the present. We examine the types of attacks, geographical distribution, notable incidents, and underlying vulnerabilities. Additionally, we discuss mitigation strategies and future directions for enhancing cybersecurity in the maritime sector. Our findings highlight the urgent need for robust regulatory frameworks, advanced technological solutions, and collaborative efforts to safeguard critical port operations.

Cyber Warfare And The Future Of Conflict, Victor A. Mercado

Graduate Theses/Dissertations

This thesis examines whether cyber warfare now poses a more immediate threat to U.S. national security than weapons of mass destruction (WMD). Cyber operations have become a dominant instrument of contemporary conflict, with malicious actors operating in a persistent “grey zone” that blurs traditional boundaries between war and peace. These operations target military and civilian entities, both directly and often as collateral damage due to the uncontrollable nature of cyber threats. WMDs, despite their catastrophic destructive potential, remain largely constrained by established deterrence frameworks.

The evolving nature of cyber warfare warrants comparison to WMD effects and impact, as cyber capabilities …

Challenges, Countermeasures, And Forward-Looking Technologies For Cyber Society Governance From System Security Perspective, Hongbin Pei, Jingxin Hai, Pinghui Wang, Xiaohong Guan

Bulletin of Chinese Academy of Sciences (Chinese Version)

With the rapid development and widespread application of artificial intelligence and information technologies, the cyber society has evolved into a new form featuring human-machine integration, mass interaction, and intelligent interconnection. While transforming human life and production, it has also brought security risks such as cyberattacks, privacy breaches, online rumors, and information cocoons, posing serious challenges to social order. Cyber society governance has thus become a key component of national governance modernization. This study proposes the STC governance paradigm from a system security perspective, covering three key dimensions: security (cyber infrastructure security), trustworthiness (credibility of cyber entity identities), and controllability (content …

A Quantitative Study Assessing The Impact Of Financial Sector Safeguards Rules On Us Publicly Traded Companies' Cybersecurity Breach Frequency And Severity, Alan Dinerman

School of Public Service Theses & Dissertations

Cybersecurity failure in the private sector is a growing federal policy priority. Nevertheless, US policy makers struggle with policy instrumentation in this domain. Behavioral public policy theory asserts that a linkage exists between policy target behavioral & cultural attributes and effective policy tool instrumentation. The federal government is now embracing a regulation heavy approach, but little empirical study exists at the nexus of behavioral public policy theory and use of regulatory tools in the cybersecurity policy domain. Since the early 2000s, the financial sector has employed a regulation heavy approach using the Safeguards regulations to facilitate cybersecurity in financial private …

Concept And Development Trend Of Novel E-Infrastructure Platform, Jing Xu, Chuan Tang, Kuangjunyu Yang, Juan Zhang, Ru Huang

Bulletin of Chinese Academy of Sciences (Chinese Version)

E-infrastructure platform has become a critical strategic asset for driving national scientific and technological innovation, and is the focus of strategic deployment by technologically advanced countries globally. This study, through the analysis of relevant strategy documents in the United States, European Union, and the United Kingdom, the relevant concepts and development changes of the novel E-infrastructure platform have been clarified. It also summarizes the planning process and development stages of e-infrastructure platform in the United States, Europe, and the United Kingdom, and analyzes that e-infrastructure platform will develop towards a new type of ecological, intelligent, diversified, and full process novel …

Towards Trust And Reputation As A Service In Society 5.0, Stephan Olariu, Ravi Mukkamala, Meshari Aljohani

Computer Science Faculty Publications

Our paper was inspired by the recent Society 5.0 initiative of the Japanese Government which seeks to create a sustainable human-centric society by putting to work recent advances in technology. One of the key challenges in implementing Society 5.0 is providing trusted and secure services for everyone to use. Motivated by this challenge, this paper makes three contributions that we summarize as follows: Our first main contribution is to propose a novel blockchain and smart contract-based trust and reputation service design to reduce the uncertainty associated with buyer feedback in marketplaces that we expect to see in Society 5.0. Our …