A methodology for tracking and analysing the needs for standardization and certification harmonization thorough the project life cycle will be defined and enforced, which will allow the early identification of issues related to the conceptualization, design, implementation, integration and deployment of tools for support the EU disaster resiliency; which will be facilitated by a complete consultation strategy to the different stakeholders that are expected to act at each capability development phase, ranging from providers to end users. On these grounds H2020-VALKYRIES will develop, integrate and demonstrate capabilities for enabling immediate and coordinated emergency response including search and rescue, security and health, in scenarios of natural/provoked catastrophes with multiple victims, with special application in cases in which several regions or countries are affected and hence greater interoperability being required. H2020-VALKYRIES will propose both design and development of a modular, interoperable, scalable and secure-oriented reference integration, called SIGRUN, which will allow the integration between legacy solutions and new technologies in a framework of harmonized solutions. SIGRUN will be able to deploy services and dynamically adapt its behaviour, as the emergency requires it. A series of demonstration scenarios will be developed placing an emphasis on cross-border and cross-sectorial BLOS (Beyond Line of Sight) scenarios, where the usual communications infrastructure could have been damaged, and emergency response teams are deployed without an accurate view of the operation environment.

As the military sector digitalizes, there is a broader need for distributed computation and storage solutions deployable at the operational edge, which pose the potential of minimizing the conventional information exchanges by among others, proved enhancements in terms of latency and communication cost. The state of the art refers to multiple applications of edge computing with a vast value on tactical clouds, with may range from enabling optimized transmissions, to federated machine learning and data fusion services. However, very few of them explore the risks they entail in terms of sustainability, were an inappropriate orchestration of the edge capabilities may for example, mistakenly or maliciously deplete the energy sources that feed their supportive infrastructure, or cause electromagnetic alterations exploitable by electronic warfare actuations. In order to facilitate their understanding and contribute to their mitigation, this paper delves into the problematic inherent in Tactical Denial of Sustainability (TDoS) against tactical clouds. The conducted research introduces a framework to prevent TDoS and if required, identify their symptoms and mitigate their damage. The proposal is settled on the Self-Organizing Network (SON) paradigm and its Self-Protection (SP) applications, which benefits of their synergy with the Observe-Orient-Decide-Act (OODA) loop towards dynamically and adaptively triggering proportional reactions.

The rapid advance towards the digitalisation of the defence sector consolidates cyberspace as an essential domain of military operation, where cyber offensive, defensive, supportive and supported actions coexist with hitherto conventional kinetic deployments. The cyberspace as a battlefield poses several characteristics (asymmetric cause/effect, anonymity, large reachability, etc.) that make it unique in its convergence with hybrid actions, nowadays considered a backbone of “grey zone” conflicts. Due to its novelty, continuous upgrading and emergence of new cyber disruptive capabilities, the cyberdefence entails a variant ethical and political field, with a growing gap on lexical, conceptual, regulatory and ethical harmonisations that proved to be a major obstacle to orchestrating civil-military cooperation, ranging from industrial development up to research/academic collaboration. In order to contribute to this gap mitigation, the paper presents a pre-harmonization action that explored the cyberdefence background identifying terminological discussions, cyber implications of operating on the grey zone, the cyber jus in bello concept, the evolving ecosystem of related legal frameworks, doctrine and manuals. It concludes with an analysis of the related regulatory challenges and opportunities, in this way attempting to facilitate and motivate further related and multidisciplinary research.

There are several factors that make cyber operations stressful, which include their complexity, unpredictability, and a continuum of decisions involving high risk and fast cost-benefit reasoning. These operations are subject to the reception of a large number of events to which the operator must learn (feedback) and respond appropriately in a timely manner, presenting particular cyber stressors able to trigger combat exhaustion battle fatigue. Their consequences will vary and evolve according to changes in the operational context, which makes them difficult to prevent, detect and mitigate. Among others, these attenuate the perception of a lack of self-efficacy, reduces the cyber decision-maker ability of distinguishing ally, neutral and hostile assets; or tend to wrongly perceive the decision cost (effort, time, self-protection, etc.) as much higher than the expected benefits. With the motivation of facilitating the understanding of the impact of the combat and operational stress at cyber operations, this paper discusses the related recent insights for cognitive dominance at decision making on the cyberspace.

The lack of suitable datasets and evaluation processes entails one of the most challenging gaps on the digital transformation era, where data-driven solutions like machine learning algorithms constitute a key pillar of the digitalization, virtualization and analytical on the emerging cyber-physical and ergonomic capabilities. This problem is even greater in the cyber defence domain, where for security or technical reasons, there is not data publicly or on-demand available concerning the role of the cyberspace on military operations. In this context, the expression popularized by the machine learning community "you go to the war with the data you have, not the data you might want" can be literally applied. In order to contribute to overcome this gap, this paper introduces CYSAS-S3, a novel dataset designed and created as the result of a research action that explores the principal needs on datasets by cyber commands, resulting in the generation of a collection of samples that correlated the impact of Advanced Persistent Threat (APT) behaviours and each phase of their cyber kill chain, regarding mission-level operations and goals.

The emerging need for cyber defence capabilities able to bring closer cyberspace supremacy in joint military operations has led defence practitioners to begin a cyber race where academy, researchers, industry and military organizations work together. Because of the higher maturity of civilian technologies for cybersecurity, this often involves adapting capabilities not initially intended for military use to new dual-use requirements, where concepts like operations, missions or Courses of Action (CoAs) shall be presented and aligned with the military doctrine. One of the main 'battle horses' in this transformation is to develop supporting systems able to facilitate the mission-centric acquisition of Cyber Situational Awareness (CSA), where the observations in the cyberspace shall be properly correlated, propagated and understood in the scope of planned/ongoing mission. But despite these CSA needs, there is a wide methodological gap in the lack of suitable validation and verification frameworks, which not only relies on the raising need for capabilities able to verify if the existing solutions meet the requirements to operate on military actions, but also to support the thorough development life-cycle of brand new cyber defence technologies. In these grounds, this research introduces a novel evaluation framework able to guide the evaluation of CSA related tools, for which three core validation concepts are discussed: Software, operational and application tests. They cover from the day-to-day implementation of the new capabilities, to their ability of facilitating that human decision-makers acquire a joint operational picture.

As the digitalization of the military conflicts increases, gaining decision superiority become the key to enhance the likelihood of success, which among others is enabled by bringing to the tactical edge emerging ICT paradigms like advanced data fusion, Artificial Intelligence, distributed computation or end-to-trust. Based on them, Tactical Clouds will allow the provisioning of C3 services for enhancing the development of the tactical pillars of modern join military operations, like Intelligence, Surveillance, Situational Awareness, or support to decision-making. But the adoption of new technological enablers bring novel and unexplored challenges that when no remediated, may jeopardize the operability of the digital tactical assets, being the cyber defence an essential cornerstone for their safeguarding. In these grounds, the main purpose of the conducted research is to review and analyze the denial of sustainability problem on tactical combat clouds; which entails a rara avis topic on the existing bibliography among other due to the novelty, secrecy and low level of technological maturity on their related digital enablers. The research presents and scoping action that developed the following secondary objectives: 1) to frame the denial of sustainability threats on the emerging Tactical Cloud paradigm; 2) to formalize the Tactical Denial of Sustainability (TDoS) concept; 3) to introduce the phasing, potential attack surfaces, terrains and impact of TDoS attacks; 4) to illustrate heterogeneous CONOPS that facilitate the understanding of TDoS; and 5) to raise and encourage the development of further research topics and actions.

The rapid evolution of the emerging communication landscape prompted the rise of never seen before threats, in this way encouraging the development of more effective Network-based Intrusion Detection Systems (NIDS) able to recognize outlying behaviors. But despite the theoretical effectiveness of the existing state-of-the-art, the in-depth review of the bibliography suggests the need for their constant adaptation to the changes in their operational environment and preventing being evaded by mimicry methods. The latest threats attempt to hide the malicious actions in a tangle of statistical features that simulate the normal use of the protected network, so they acquire a greater chance of avoiding the defensive actuators. In order to contribute to their mitigation, this paper introduces a novel intrusion detection strategy resistant against mimicry. The proposal constructs models of the network usage and from them, analyzes the binary contents of the traffic payload looking for outlying patterns that may evidence malicious contents. In contrast to most previous solutions, our research overcomes the traditional strengthening via randomization, by taking advantage of scoring the suspicious packet similarity between legitimate and previously built adversarial models. Its effectiveness was evaluated on the public datasets DARPA'99 and UCM 2011, where its ability to recognize attacks obfuscated by imitation was proven.

The forthcoming 5G operational environment entails heterogeneous and multi-dimensional ecosystems where cyber assets, digital actors and cyber-physical risks coexist. In this context, the prediction and anticipation of the attacks propagation thorough the targeted systems promises to be some of the major workhorses of the emerging self-protection capabilities. In the grounds of the Self-Organizing Network (SON) paradigm, it is expected that by taking into account proactive actuations, the decision and enforcement of the best courses of action will be enhanced. With the aim on contributing to their planning and execution, this paper introduces a novel framework for proactive self-protection on 5G environments, the description of an architectural framework able to sustain the rest of the anticipation enablers, the formalization of a knowledge representation and reasoning strategy for active cyber threat mitigation, and a prediction strategy adapted to the difficulties inherent in analyzing events on 5G scenarios. The effectiveness of the proposal has been demonstrated by proof-of-concept instantiation for anticipating the impact of Denial of Service (DoS) attacks on a real communication environment.

In the last decade, crypto-ransomware evolved from a family of malicious software with scarce repercussion in the research community, to a sophisticated and highly effective intrusion method positioned in the spotlight of the main organizations for cyberdefense. Its modus operandi is characterized by fetching the assets to be blocked, their encryption, and triggering an extortion process that leads the victim to pay for the key that allows their recovery. This paper reviews the evolution of crypto-ransomware focusing on the implication of the different advances in communication technologies that empowered its popularization. In addition, a novel defensive approach based on the Self-Organizing Network paradigm and the emergent communication technologies (e.g. Software-Defined Networking, Network Function Virtualization, Cloud Computing, etc.) is proposed. They enhance the orchestration of smart defensive deployments that adapt to the status of the monitoring environment and facilitate the adoption of previously defined risk management policies. In this way it is possible to efficiently coordinate the efforts of sensors and actuators distributed throughout the protected environment without supervision by human operators, resulting in greater protection with increased viability

This paper reviews the Economic Denial of Sustainability (EDoS) problem in emerging network scenarios. The performed research studied them in context of adaptive approaches grounded on self-organizing networks (SON) and Network Function Virtualization (NFV). In particular, two novel threats were reviewed in depth: Workload-based EDoS (W-EDoS) and Instantiation-based EDoS (I-EDoS). With the aim to contribute to their mitigation a security architecture with network-based intrusion detection capabilities is proposed. This architecture implements machine learning techniques, network behaviour prediction, adaptive thresholding methods, and productivity-based clustering for detecting entropy-based anomalies based on the observed workload (W-EDoS) or suspicious variations of the productivity observed at the virtual instances (I-EDoS). A detailed experimentation has been conducted considering different calibration parameters under different network scenarios, on which the security architecture has been assessed. The results have proven good accuracy levels, hence demonstrating the proposal effectiveness.