Cyber systems (CyS) are becoming more and more complex as they are comprised of several infrastructure layers, heterogeneous technologies and dispersed deployments over wide geographical areas (cloud/edge/endpoint) that facilitates multiple attack entry points (vectors). At the same time, CyS attacks are constantly evolving and have become more complex and sophisticated. To address these issues, the ResilMesh architecture aims to provide critical infrastructure security teams with a greater cyber resilience capability by improving cyber resilience using Cyber Situational Awareness (CSA) based security orchestration and analytics framework. The framework enables organizations to achieve real-time defense, reducing attack surface impact by developing tools to combat complexity, disperse infrastructure, delivering flexible placement of security controls across the CyS infrastructure. The architecture combats Advanced Persistent Threat (APT) sophistication by leveraging advanced AI algorithms and tools for early and ongoing attack detection and prediction and improved situation. This paper presents the Resilmesh architecture, a first PoC implementation, as well as an evaluation of the Resilmesh capabilities to detect and mitigate APTs.

The increasing use of deep learning approaches, particularly generative models such as autoencoders (AEs), as Intrusion Detection Systems (IDS) in cybersecurity, introduces vulnerabilities to adversarial attacks. These attacks involve small, malicious perturbations to input data that can deceive the system, disguising attacks as normal behavior. In this paper, we investigate the susceptibility of an AE-based IDS deployed in an Operational Technology (OT) environment, specifically a water distribution system. We explore various defense strategies to enhance model robustness against adversarial attacks, focusing on increasing the minimal perturbation required to evade detection. Our study examines both adversarial training and sensitivity-based training, comparing their effectiveness in hardening the system against adversarial attacks with different number of features available to the attacker (100%, 75%, 50%, 25%, 2%). Results show that while both methods have improved the robustness of the model architecture for some scenarios, no method shows clear improvement on all experiments. This work highlights the importance of adversarial robustness in critical infrastructure protection and provides insights into defense mechanisms for enhancing the security of AE-based IDS systems.

The importance of automated intrusion detection systems, not only in network infrastructures, but also in critical and industrial infrastructures is becoming more evident with the significant increase of cyber-attacks targeting such infrastructures. The most recent research initiatives in this field focus on unsupervised learning methods, due to a constant lack of labelled datasets of a good quality. This paper proposes an enhanced autoencoder based anomaly detection approach for water distribution cyber-attack detection. The proposed approach contains a pipeline of methods, including feature engineering as a pre-processing step, anomaly estimation based on autoencoder, and scores smoothing as a post-processing step. The obtained results are very promising compared to existing approaches.

Overlapped fingerprints can be potentially present in several civil applications and criminal investigations. Segmentation of overlapped fingerprints is a required step in the process of fingerprint separation and subsequent verification. Overlapped fingerprint segmentation is performed manually (and the resulting manually drawn masks are a required additional input) in all of the overlapped latent fingerprints separation approaches in the literature, which make them only semi‐automatic. This study proposes a novel overlapped fingerprint mask segmentation approach, thereby filling that gap in the development of fully automated fingerprint separation solutions. The proposed method uses convolutional neural networks to classify image blocks into three classes – background, single region, and overlapped region. The proposed approach shows satisfactory performance on three different datasets and opens the door for full automation of fingerprint separation algorithms, which is a very promising research area.