Human-in-the-loop Anomaly Detection and Contextual Intelligence for Enhancing Cybersecurity Management (2024)

Abstract: Cybersecurity management is a sociotechnical problem comprising organisational knowledge management of humans and technology. Focusing on risk and incident management, we present our approach for enhancing cybersecurity awareness in organisations and ecosystems. By augmenting our cybersecurity awareness platform with human-in-the-loop anomaly detection and machine learning, we are able to handle the dynamics of organisational human activity, as well as the continuous developments in the cybersecurity domain. We illustrate the potential impact of our approach with a realistic example in the healthcare context

## introduction broadly speaking, there are two major cybersecurity management activities for organisations: risk management (including business continuity and disaster recovery -bc/dr) and incident management. risk management activities are more static, with risk identification and implementing relevant risk controls and policies performed regularly. in practice, it can be observed that many organisations do not follow formal and proactive risk management processes but only implement relevant processes after a major incident has happened @xcite . incident management involves detecting, diagnosing, and recovering from it system anomalies caused by accidental or malicious activity. it is mostly the responsibility of the it personnel in an organisation, either by dedicated staff or as a task of the it administrators, and it is usually a manual and labour-intensive task. cybersecurity management is to a large extent a knowledge management problem. from the relevant knowledge domains, both risk and incident management require a solid understanding of current state-of-the-art practices and developments and the ability to adopt and implement adequate solutions/mitigations in the relevant context @xcite . information about the cybersecurity context is readily and digitally available through, e.g., best practices and procedure documents, threat intelligence, and less obvious sources like social media. in contrast, knowledge about the organisational context is a more complicated story. while there is a lot of knowledge and experience available within an organisation, e.g., how the systems and services work and interact in the day-to-day operation and what steps are taken in order to address (security) issues, this knowledge is rarely formally written down @xcite . due to european legislation like the general data protection regulation (gdpr) @xcite and the more recent network and information security directive 2 (nis 2 (the european parliament and the council of the european union, 2022)), many companies may actually be forced to consider and implement formal risk management for the first time. cybersecurity management can benefit from making tacit knowledge in an organisation explicit and digitally available @xcite . artificial intelligence and machine learning (ai/ml) can play an active role in the knowledge management process and ensure that organisations are made aware of anomalies in their systems that are unique to their systems and business processes. it can make sure that the right information is available to the right person to address or mitigate cybersecurity issues. this paper presents novel uses of ai/ml in cybersecurity management, enabled by the information and data available through the cs-aware/cs-aware-next cybersecurity management approach. @xcite is a research effort that provides a novel approach to cybersecurity management based on a novel socio-technical approach @xcite that allows creating an understanding of an organisation that identifies and visualises its social and technical assets and dependencies, as well as the information flows generated by the day-to-day business operations of humans and technology. the approach is designed to be applicable not only to large organisations, but also to smaller organisations, e.g., municipal utility providers or smes covered by the nis2 directive. the cs-aware approach provides a platform that enables risk-and incidentmanagement tasks, such as monitoring for anomalies in real-time and defining policies and business continuity/disaster recovery (bc/dr) tasks, and to allow for incident handling @xcite . the platform includes applications to detect and report the spread of attacks, anomalies, and incidents. for considering the organisational context, we exploit a human in the loop (hitl) approach as described in figure 1 . the creation of the applications starts with the requirements collection and analysis (step 1). the requirements in the project are collected periodically through workshops and focus groups. the application's design (step 2) considers the organisational needs and exploits the available knowledge to prepare data and select and design the algorithm in a customised way. note that the available knowledge includes the internal data (i.e., organisation knowledge) and the ecosystem knowledge shared among several organisations. the ecosystem knowledge includes insights gathered from data contained in public repositories. it includes, for example, cybersecurity news extracted from social media and/or threat intelligence feeds. the design phase is followed by the implementation (step 3) and the go-live of the applications (step 4). in the operation phase, during which the applications are used, the users' feedback is requested to assess the relevance of the sent information and triggers. in this way, the application continuously learns and can automatically evolve over time (step 5). steps 4 and 5 are repeated during an application lifetime. ## related work especially in europe, cybersecurity management in organisations is increasingly driven by legal requirements. starting with the european cybersecurity strategy of 2013, updated in 2020 (european commission, 2020), the european union has put significant effort into developing a legal framework fostering a more secure cyberspace. for businesses and organizations, the most relevant ones are currently the gdpr and nis/nis2, which obliges a significant portion of european organizations to manage cybersecurity in a formal and legally compliant way. compared to nis, the scope of nis2 was extended so that smes and smaller utility providers are also required to follow the directive and implement formal cybersecurity procedures. the gdpr is even more significant, as all organisations that handle personal data of any kind are required to comply with the regulations and protect the data they manage. there are various approaches to formal organisational risk management, the most prominent among them being the nist cybersecurity framework (national institute of standards and technology, 2024) and the iso/iec 27000 family of standards (iso/iec 27000:2016, 2016). they are seen as being mostly applicable to large organisations that have the resources to implement them, and it remains to be seen if smaller organisations (who need to start implementing formal cybersecurity procedures for the first time due to nis 2) will be able to adopt such approaches at a large scale. security information and event management systems (siems) are a widely adopted sophisticated technology for supporting incident management through real-time monitoring for anomalies @xcite . however, they predominantly cater to large organisations' needs and are often not justifiable in smaller organisations due to their high cost. furthermore, current siem systems typically only allow monitoring for network and infrastructure-related anomalies caused by technological aspects; more in-depth monitoring that also takes into account the social component of an organisation and the complex behaviours caused by organisation-specific business processes is not available. the use of ai/ml in cybersecurity management is justified by the fact that conventional data analysis methods have difficulty keeping up with the complexity and speed of modern cyber threats @xcite . artificial intelligence (ai) systems, particularly those using machine learning (ml) and big data architectures, have the potential to detect and mitigate these threats. intelligent cybersecurity management applies various ai methods that eventually seek intelligent decision-making in cyber applications or services (sarker, 2021). ai (or, more specifically, machine learning) has been widely used in cybersecurity for decades in well-known application areas, including malware detection, intrusion detection, and spam detection. typically, such algorithms work on security-related data gathered from different relevant sources, such as network behaviour, database activity, application activity, or user activity. in (sarker, 2021), a survey of ml methods for cybersecurity is provided. supervised techniques can be mainly used for anomaly detection. they can classify and predict malware attacks or cyber anomalies (e.g., decision trees @xcite , logistic regression, random forest (leevy et al., 2021)). in general, unsupervised learning can be used to find hidden patterns and structures from unlabeled data @xcite . it is possible to use clustering to find groups of similar data @xcite . instead, association learning can be used to create recommendations for adopting rule-based machine learning models for incident response and risk management like @xcite . in the cs-aware-next project, we are exploiting such algorithms, adding a context-aware perspective. the organisational knowledge and context will be considered to operationalise threat intelligence in organisational risk and incident management. ## cybersecurity knowledge management at organisational and ecosystem level the cs-aware approach is rooted in systems thinking, based on the core principle that a system needs to be seen as the sum of its components in order to understand all relevant implications, especially in the cybersecurity context. looking at an organisation as a system, it is not only composed of infrastructure and services, but also of people that operate and maintain the infrastructure and services. an organisation is a human activity system and in order to understand it in its full complexity, a socio-technical approach is required to capture all the dynamics within an organisation that influence cybersecurity. we have adopted the soft systems methodology (ssm) developed by peter checkland @xcite for this purpose, in which we work with the people of an organisation (users, technicians, managers, ...) in dedicated workshops to identify the core assets of an organisation, its interdependencies, as well as the detailed information flows that are generated through the different assets in the day-to-day operation of business processes the organisation is concerned with. furthermore, the process includes identifying relevant monitoring sources -log files available through the different assets that can describe the state of an asset over time -and allows monitoring in real-time for potential anomalies and incidents. the output of this process is used for creating the so-called "system dependency graph". the main advantage of this proven method over other cybersecurity assessment methods is that it unlocks the tacit knowledge of the people working in the organisation as to how the systems really work, operate and are maintained in day-to-day operation, which is almost always very different from what is written down in manuals and documentation. it is essential to derive baselines for customised anomaly detection based on the unique knowledge of the people working with the systems on a day-to-day basis -something that will become relevant in the following sections of this paper. the cs-aware approach brings risk and incident management closer together and makes risk management more dynamic. traditionally, identifying organisational assets and critical information flows is a risk management task (performed at regular intervals but not dynamically), whereas monitoring for anomalies is an incident management task traditionally performed using different tools like siems. notable features of cs-aware in this context include: in summary, through the features that the cs-aware platform provides, the data listed in ## human-in-the-loop anomaly detection this section illustrates the complexity of decisionmaking in cybersecurity management and highlights how humans can complement ai/ml-based cyberthreat detection. it presents a framework for organisation (a) a system dependency graph: how assets and dependencies of an organisation interrelate, including any contextual knowledge management information the organisation wants to provide per asset or dependency. ## an example use-case the relevance and the potential impact of our approach are demonstrated with a (simulated, albeit) realistic scenario within the context of healthcare ecosystems. several cyber-incidents have been reported lately in the health sector @xcite . the healthcare ecosystem comprises a plethora of components, such as all of its departments and clinics that provide services to patients, and all operational flows require dedicated access policies. patient medical data (personally identifiable information) is stored and updated according to local, regional, national, and european regulations. we focus our analysis on the case of the hospitals' radiology department operational flow. figure 2 delineates a typical deployment business process of the radiology department. it demonstrates the socio-technical nature of such business processes involving humans and machines. not only are the radiology assessment and the associated dicom image from the outpatient's mriscanner (magnetic resonance imaging) stored in local ris (radiology information system) and pacs (picture archiving and communication system) servers but also in a remote backup infrastructure for business continuity purposes. as a result, patient care improves by allowing specialists to access the information they need when they need it. therefore, upon the patient's approval, an external physician could grant access to these data via a temporary web service. additionally, a patient's personal electronic health record is updated and accessed nationally or cross-border-wise within the eu health dataspace. european medical devices regulation 2017/745 (mdr) dictates general safety and performance requirements (gsprs) to which the mri scanner manufacturer shall demonstrate compliance while in parallel the european union agency for network and information security @xcite recommends that regular updates/patches to networked medical devices, including virus scanners, welldefined access rights and the usage of encryption mechanisms where is necessary (e.g., external access to dicom images) are implemented. to this end, service engineers on the vendor's sides are regularly called for and their work may lead to leaked passwords or make the system more vulnerable to hackers. the critical assets in the business process, depicted in figure 2 , constitute the mri scanner along with its associated workstation and the ris/pacs system. during the last decades, eu hospitals have invested through the national health ministry's procurement policies in mri scanners to enhance the health services provided to the citizens. ## conclusion and outlook the paper describes the approach designed in cs-aware/cs-aware-next. we aim to extend anomaly detection and improve cybersecurity awareness by adopting a hitl approach and considering contextual information. this aims to design applications able to identify well-known and unknown anomalies on the basis of organisational rules and knowledge. in this way, the organisation would benefit from earlier detection, earlier deployment of the patch, improved procurement policies, more effective risk management procedures, and so on. future work will focus on the validation of the approach with the organisations involved in the project.