Manuel Esteve

Cyberattacks are increasing in number and diversity in nature daily, and the tendency for them is to escalate dramatically in the forseeable future, with critical infrastructures (CI) assets and networks not being an exception to this trend. As time goes by, cyberattacks are more complex than before and unknown until they spawn, being very difficult to detect and remediate. To be reactive against those cyberattacks, usually defined as zero-day attacks, cyber-security specialists known as threat hunters must be in organizations’ security departments. All the data generated by the organization’s users must be processed by those threat hunters (which are mainly benign and repetitive and follow predictable patterns) in short periods to detect unusual behaviors. The application of artificial intelligence, specifically machine learning (ML) techniques (for instance NLP, C-RNN-GAN, or GNN), can remarkably impact the real-time analysis of those data and help to discriminate between harmless data and malicious data, but not every technique is helpful in every circumstance; as a consequence, those specialists must know which techniques fit the best at every specific moment. The main goal of the present work is to design a distributed and scalable system for threat hunting based on ML, and with a special focus on critical infrastructure needs and characteristics.

This article presents the development of a geo-visualization tool, which provides police officers or any other type of law enforcement officer with the ability to conduct the spatiotemporal predictive geo-visualization of criminal activities in short and continuous time horizons, according to the real events that are happening: that is, for those geographical areas, time slots, and dates that are of interest to users, with the ability to consider individual events or groups of events. This work used real data collected by the Colombian National Police (PONAL); it constitutes a tool that is especially effective when applied to Real-Time Systems for crime deterrence, prevention, and control. For its creation, the spatial and temporal correlation of the events is carried out and the following deep learning techniques are employed: CNN-1D (Convolutional Neural Network-1D), MLP (multilayer perceptron), LSTM (long short-term memory), and the classical technique of VAR (vector autoregression), due to its appropriate performance in the multi-step and multi-parallel forecasting of multivariate time series with sparse data. This tool was developed with Open-Source Software (OSS) as it is implemented in the Python programming language with the corresponding machine learning libraries. It can be implemented with any geographic information system (GIS) and used in relation to other types of activities, such as natural disasters or terrorist activities.

The number and the diversity in nature of daily cyber-attacks have increased in the last few years, and trends show that both will grow exponentially in the near future. Critical Infrastructures (CI) operators are not excluded from these issues; therefore, CIs’ Security Departments must have their own group of IT specialists to prevent and respond to cyber-attacks. To introduce more challenges in the existing cyber security landscape, many attacks are unknown until they spawn, even a long time after their initial actions, posing increasing difficulties on their detection and remediation. To be reactive against those cyber-attacks, usually defined as zero-day attacks, organizations must have Threat Hunters at their security departments that must be aware of unusual behaviors and Modus Operandi. Threat Hunters must face vast amounts of data (mainly benign and repetitive, and following predictable patterns) in short periods to detect any anomaly, with the associated cognitive overwhelming. The application of Artificial Intelligence, specifically Machine Learning (ML) techniques, can remarkably impact the real-time analysis of those data. Not only that, but providing the specialists with useful visualizations can significantly increase the Threat Hunters’ understanding of the issues that they are facing. Both of these can help to discriminate between harmless data and malicious data, alleviating analysts from the above-mentioned overload and providing means to enhance their Cyber Situational Awareness (CSA). This work aims to design a system architecture that helps Threat Hunters, using a Machine Learning approach and applying state-of-the-art visualization techniques in order to protect Critical Infrastructures based on a distributed, scalable and online configurable framework of interconnected modular components.

This article shows a novel geo-visualization method of dynamic spatiotemporal data that allows mobility and concentration of criminal activity to be study. The method was developed using, only and significantly, real data of Santiago de Cali (Colombia), collected by the Colombian National Police (PONAL). This method constitutes a tool that allows criminal influx to be analyzed by concentration, zone, time slot and date. In addition to the field experience of police commanders, it allows patterns of criminal activity to be detected, thereby enabling a better distribution and management of police resources allocated to crime deterrence, prevention and control. Additionally, it may be applied to the concepts of safe city and smart city of the PONAL within the architecture of Command and Control System (C2S) of Command and Control Centers for Public Safety. Furthermore, it contributes to a better situational awareness and improves the future projection, agility, efficiency and decision-making processes of police officers, which are all essential for fulfillment of police missions against crime. Finally, this was developed using an open source software, it can be adapted to any other city, be used with real-time data and be implemented, if necessary, with the geographic software of any other C2S.

This paper shows a Novel Low Processing Time System focused on criminal activities detection based on real-time video analysis applied to Command and Control Citizen Security Centers. This system was applied to the detection and classification of criminal events in a real-time video surveillance subsystem in the Command and Control Citizen Security Center of the Colombian National Police. It was developed using a novel application of Deep Learning, specifically a Faster Region-Based Convolutional Network (R-CNN) for the detection of criminal activities treated as “objects” to be detected in real-time video. In order to maximize the system efficiency and reduce the processing time of each video frame, the pretrained CNN (Convolutional Neural Network) model AlexNet was used and the fine training was carried out with a dataset built for this project, formed by objects commonly used in criminal activities such as short firearms and bladed weapons. In addition, the system was trained for street theft detection. The system can generate alarms when detecting street theft, short firearms and bladed weapons, improving situational awareness and facilitating strategic decision making in the Command and Control Citizen Security Center of the Colombian National Police.

To successfully confront a disaster, coordinated and collaborative participation of multiple agencies related to public safety is essential by ensuring a response consistent with the requirements of the emergency environment and of those affected. Therefore, permanent information exchange between the agencies involved becomes mandatory, thus enabling them to combine their efforts towards best facing the emergency. This article describes an interoperability platform architecture which allows the exchange of information between the agencies concerned in the management of an emergency through the use of their own information systems and computer tools. The architecture core resides inside the Shared Information Space, in charge of managing the information from the systems integrated within the platform as a single storage entity. It is founded on a non-relational distributed database and a P2P communications network devised to share out the workload between all the platform nodes, thus conferring availability and scalability to the architecture.

The SIMACOP system developed at UPV, with its different versions, offers several additional capabilities as part of localization and navigation. Acting as a very small unit C2 system, with the additional benefit of reduced complexity and cost compared with the different BMS currently on the market, one of the key design concepts of the system is its capability of using any communication mean (HF, VHF, and satellite) besides its full software conception. This design makes the system fully independent from the underlying hardware, including the transmission mean.