2019 11th International Conference on Cyber Conflict: Silent Battle T. Minárik, S. Alatalu, S. Biondi, M. Signoretti, I. Tolga, G. Visky (Eds.) 28 May – 31 May 2019, Tallinn, Estonia 2019 11TH INTERNATIONAL CONFERENCE ON CYBER CONFLicT: SILENT BATTLE Copyright © 2019 by NATO CCD COE Publications. All rights reserved. IEEE Catalog Number: CFP1926N-PRT ISBN (print): 978-9949-9904-4-3 ISBN (pdf): 978-9949-9904-5-0 COPYRIGHT AND REPRINT PERMissiONS No part of this publication may be reprinted, reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without the prior written permission of the NATO Cooperative Cyber Defence Centre of Excellence ([email protected]). This restriction does not apply to making digital or hard copies of this publication for internal use within NATO, or for personal or educational use when for non-profit or non-commercial purposes, providing that copies bear this notice and a full citation on the first page as follows: [Article author(s)], [full article title] 2019 11th International Conference on Cyber Conflict: Silent Battle T. Minárik, S. Alatalu, S. Biondi, M. Signoretti, I. Tolga, G. Visky (Eds.) 2019 © NATO CCD COE Publications NATO CCD COE Publications LEGAL NOTICE: This publication contains the opinions of the respective authors only. They do not Filtri tee 12, 10132 Tallinn, Estonia necessarily reflect the policy or the opinion of NATO Phone: +372 717 6800 CCD COE, NATO, or any agency or any government. NATO CCD COE may not be held responsible for Fax: +372 717 6308 any loss or harm arising from the use of information E-mail: [email protected] contained in this book and is not responsible for the Web: www.ccdcoe.org content of the external sources, including external websites referenced in this publication. Head of publishing: Jaanika Rannu Layout: Jaakko Matsalu NATO COOPERATIVE CYBER DEFENCE CENTRE OF EXCELLENCE The NATO Cooperative Cyber Defence Centre of Excellence (CCD COE) is a NATO- accredited knowledge hub in Tallinn, Estonia, offering a unique interdisciplinary approach to the most relevant issues in cyber defence. We conduct research, trainings and exercises in four core areas: technology, strategy, operations and law. The heart of the Centre is a diverse group of international experts from military, government, academia and industry, representing currently 21 member nations. Almost half as many nations are aspiring to become member in the years to come. NATO CCD COE’s mission is to support its member nations and NATO in the fields of cyber defence research, training and exercises. The Centre provides cyber defence expertise in the fields of technology, strategy, operations and law, often in an interdisciplinary manner. NATO CCD COE embodies and fosters the cooperation of like-minded nations in cyber defence. Our member nations are allies in NATO and like-minded partners beyond the Alliance. Research Areas Among other research areas, NATO CCD COE experts are currently involved in the analysis of autonomous features of cyber operations, digital forensics, protection of critical infrastructure, Cyber Command and Control, cyber deterrence, cyber effects in battlefield and attribution. NATO CCD COE is home of the Tallinn Manual 2.0, the most comprehensive guide for policy advisors and legal experts on how International Law applies to cyber operations carried out between and against states and state actors. An invaluable analysis by an international group of renowned scholars published in 2017, continues to inspire both academic research and state practice. Most of the Centre’s publications and research papers are available online on the Centre’s website www.ccdcoe.org, similarly to a database of national cyber security strategies, the International Cyber Developments Review and comprehensive overviews of national cyber security organizations. Education and Training NATO CCD COE promotes lifelong learning in cyber security. Our training courses are based on our latest research and cyber defence exercises. To best meet the training requirements of our Allies, Partners and NATO as a whole, we provide courses in different formats and locations, covering a broad range of topics in the technical, legal, strategic and operational cyber security domains. NATO CCD COE is responsible for identifying and coordinating education and training solutions in cyber defence for all NATO bodies across the Alliance. NATO Allied Command Transformation has provided NATO CCD COE with an unconditional quality assurance accreditation for its contribution to high-quality NATO Education and Training. CYCON 2019 SPONSORS TABLE OF CONTENTS Introduction 1 For a Baltic Cyberspace Alliance? 9 Martin C. Libicki “Silent Battle” Goes Loud: Entering a New Era 23 of State-Avowed Cyber Conflict Keir Giles and Kim Hartmann Call to Action: Mobilizing Community Discussion to 37 Improve Information-Sharing About Vulnerabilities in Industrial Control Systems and Critical Infrastructure Daniel Kapellmann and Rhyner Washburn Hidden Risks to Cyberspace Security 61 from Obsolete COTS Software Barış Egemen Özkan and Serol Bulkan Applying Indications and Warning Frameworks to Cyber Incidents 81 Bilyana Lilly, Quentin Hodgson, Lillian Ablon and Adam Moore Recommendations for Enhancing the Results of Cyber Effects 103 Erwin Orye and Olaf Maennel Rough-and-Ready: A Policy Framework to Determine 123 if Cyber Deterrence is Working or Failing Jason Healey and Neil Jenkins The All-Purpose Sword: North Korea’s 143 Cyber Operations and Strategies Ji Young Kong, Kyoung Gon Kim and Jong In Lim NATO Members’ Organizational Path Towards Conducting 163 Offensive Cyber Operations: A Framework for Analysis Max Smeets What are Military Cyberspace Operations Other Than War? 179 Brad Bigelow Covert or not Covert: National Strategies 197 During Cyber Conflict Gil Baram and Udi Sommer The Cyber-ASAT: On the Impact of Cyber 213 Weapons in Outer Space James Pavur and Ivan Martinovic Challenges and Opportunities to Counter Information 231 Operations Through Social Network Analysis and Theory Alicia Bargar, Janis Butkevics, Stephanie Pitts and Ian McCulloh Understanding the Strategic Implications 249 of the Weaponization of Artificial Intelligence Joe Burton and Simona R. Soare Hidden in the Shadow: The Dark Web – 267 A Growing Risk for Military Operations? Robert Koch SamSam and the Silent Battle of Atlanta 291 Kenneth Kraszewski The Contours of ‘Defend Forward’ 307 Under International Law Jeff Kosseff The Rise of the Regionals: How Regional 321 Organisations Contribute to International Cyber Stability Negotiations at the United Nations Level Nikolas Ott and Anna-Maria Osula Layered Sovereignty: Adjusting Traditional 347 Notions of Sovereignty to a Digital Environment Przemysław Roguski The Sound of Silence: International Law and 361 the Governance of Peacetime Cyber Operations Barrie Sander Addressing Adversarial Attacks Against 383 Security Systems Based on Machine Learning Giovanni Apruzzese, Michele Colajanni, Luca Ferretti and Mirco Marchetti Machine Learning-based Detection of C&C Channels 401 with a Focus on the Locked Shields Cyber Defense Exercise Nicolas Känzig, Roland Meier, Luca Gambazzi, Vincent Lenders and Laurent Vanbever Neural Network-Based Technique for Android 421 Smartphone Applications Classification Roman Graf, Ross King and Aaron Kaplan Cyber-Physical Battlefield Platform for 439 Large-Scale Cybersecurity Exercises Joonsoo Kim, Kyungho Kim and Moonsu Jang Resilience of Cyber-Physical Systems: an Experimental 459 Appraisal of Quantitative Measures Giuseppina Murino, Alessandro Armando and Armando Tacchella Detection of Malicious Remote Shell Sessions 479 Pierre Dumont, Roland Meier, David Gugelmann and Vincent Lenders BlackWidow: Monitoring the Dark Web 499 for Cyber Security Information Matthias Schäfer, Martin Strohmeier, Marc Liechti, Markus Fuchs, Markus Engel and Vincent Lenders Towards Measuring Global DDoS Attack Capacity 521 Artūrs Lavrenovs Silent Battles: Towards Unmasking Hidden Cyber Attack 537 Robert Koch and Mario Golling Biographies 557 INTRODUCTION The annual International Conference on Cyber Conflict (CyCon) is entering its second decade. CyCon 2019 is the 11th iteration of the conference, organised by the NATO Cooperative Cyber Defence Centre of Excellence (NATO CCD COE) and taking place in Tallinn from 28 to 31 May 2019. Since 2009, CyCon has become a landmark conference addressing cyber conflict and security from the perspectives of technology, strategy, operations, law and policy. It brings together a trusted circle of decision- makers and experts representing government, the military, academia and the private sector. With the launch of the annual CyCon US conference series in cooperation with the US Army Cyber Institute in 2016, CyCon also serves as a transatlantic forum for the community of interest to discuss the most pressing issues of the cyber domain twice a year. The debates and presentations at CyCon stem both from original research papers submitted by the academic community and from insights offered by renowned experts in the field. The core topic of CyCon 2019 is ‘Silent Battle’. The topic is broad enough to allow for diverse interpretations: a techie will think in terms of vulnerabilities, exploits and patches; a policy advisor could approach it as detection and attribution; a lawyer may interpret it through the lens of responsibility; and the military may approach it in terms of situational awareness.