With the advent of the digital information age, the dynamics of cyberspace are rapidly evolving, resulting in a significant increase in cyber threats. In this paper, we propose to integrate the Zero Trust (ZT) security model and the MITRE ATT&CK matrix to address the need for enhancing cyber resilience, which is an organization’s ability to recover quickly from a cyber-attack or security incident. This research focuses on a variety of cyber threats that pose significant risks to organizations, including phishing, ransomware, insider threats, and advanced persistent threats (APTs), which are prevalent in public sector organizations. These threats exploit vulnerabilities in an organization’s network and information systems. The ZT model’s principle of "never trust, always verify" ensures that all network traffic is inspected equally and emphasizes key elements such as micro-segmentation, continuous authentication, and the principle of least privilege. The findings of this study provide practical metrics for implementing and managing the effective integration of the ZT and ATT&CK models and demonstrate that this synergy can significantly improve an organization’s resilience to cyber threats. In addition to introducing a new paradigm in cybersecurity, the study highlights the importance of the Zero Trust model as an integral part of a modern security strategy and confirms that organizations can proactively analyze the evolving cyber threat landscape to ensure a more secure and resilient digital future. In particular, the integration between ZT and the MITRE ATT&CK matrix is essential, as current security approaches do not fully address the complexity and sophisticated nature of various cyber threats. These research gaps are identified, and practical solutions are proposed to integrate the two models, thereby strengthening an organization’s cyber defense mechanisms.

In this paper, a proof-of-concept method for detecting abnormal behavior in dementia patients based on a single case study is proposed. This method incorporates the collection of lifelog data using affordable sensors and the development of a machine-learning-based system. Such an approach has the potential to enable the prompt detection of abnormal behavior in dementia patients within nursing homes and to send alerts to caregivers, which could potentially reduce their workload and decrease the risk of accidents and injuries. In a proof-of-concept experiment conducted on a single dementia patient in a Korean nursing home, the proposed system, specifically the multilayer perceptron model, demonstrated exceptional performance, achieving an accuracy of 0.99, a precision of 1.00, a recall of 1.00, and an F1 score of 1.00. While being cost-effective and adaptable to various nursing homes, these results should be interpreted as preliminary, being based on a limited sample. Future research is aimed at validating and improving the performance of the abnormal behavior detection system by expanding the experiments to include lifelog data from multiple nursing homes and a larger cohort of dementia patients. The potential application of this system extends beyond healthcare and medical fields, reaching into smart home environments and various other facilities. This study underscores the potential of this system to enhance patient safety, alleviate family concerns, and reduce societal costs, thereby contributing to the improvement of the quality of life for dementia patients.

Traditional intrusion detection systems (IDS) based on packet signatures are widely used in network security but often fail to detect previously unseen attacks. To overcome this limitation, machine learning-based methods have been explored to identify anomalous patterns in network traffic indicative of unknown intrusions. In this study, we propose an IDS model based on the Long Short-Term Memory Autoencoder (LSTM-AE), specifically a Convolutional Neural Network Bidirectional LSTM Autoencoder (CNN-BiLSTM-AE). The model integrates convolutional layers for spatial feature extraction and bidirectional LSTM layers to capture temporal dependencies in both directions. By leveraging CNNs to extract key spatial features and BiLSTM to model sequential patterns, the proposed architecture enables effective differentiation between normal and malicious traffic. Anomalies are detected by computing reconstruction loss during inference and applying a predefined threshold to classify traffic. The experimental results demonstrate that the CNN-BiLSTM-AE model achieves high detection performance, with an accuracy of 98.1% and an F1-score of 98.3%, highlighting its effectiveness in identifying previously unknown intrusions.

With the advancement of IT technology, intelligent devices such as autonomous vehicles, unmanned equipment, and drones are rapidly evolving. Consequently, the proliferation of defense systems based on these technologies is increasing worldwide. In response, the U.S. Department of Defense is implementing the RMF (Risk Management Framework) to ensure the cybersecurity of defense systems and conducting cybersecurity T&E (test and evaluation) concurrently. However, RMF and cybersecurity T&E conducted during the acquisition phase of defense systems often result in fragmented cybersecurity assessments, excluding the operational environment of the defense systems. This omission fails to account for the complex network integration, data exchange functionalities, and mission-specific requirements in actual cyber attack scenarios. For these reasons, vulnerabilities in defense systems that remain unidentified during the acquisition phase can potentially pose significant cybersecurity threats during operational phases, necessitating substantial costs and efforts for remediation. Therefore, this paper proposes a mission-based cybersecurity T&E model using a Multi-Cyber Range to effectively apply these two systems in a practical manner. The Multi-Cyber Range integrates independently operated cyber ranges into a network to expand the evaluation environment, which better reflects the mission environment of defense systems. The proposed model’s effectiveness is validated using a cyber attack simulation system targeting a virtualized arbitrary defense system. This paper not only presents an enhanced model for mission-based cybersecurity T&E, but also contributes to the advancement of cybersecurity T&E methodologies by providing a concrete application process.

This study presents a metric selection framework and a normalization method for the quantitative assessment of cyber resilience, with a specific focus on availability as a core dimension. To develop a generalizable evaluation model, service types from 1124 organizations were categorized, and candidate metrics applicable across diverse operational environments were identified. Ten quantitative metrics were derived based on five core selection criteria—objectivity, reproducibility, scalability, practicality, and relevance to resilience—while adhering to the principles of mutual exclusivity and collective exhaustiveness. To validate the framework, two availability-oriented metrics—Transactions per Second (TPS) and Connections per Second (CPS)—were empirically evaluated in a simulated denial-of-service environment using a TCP SYN flood attack scenario. The experiment included three phases: normal operation, attack, and recovery. An Area Under the Curve (AUC)-based Normalized Resilience Index (NRI) was introduced to quantify performance degradation and recovery, using each organization’s Recovery Time Objective (RTO) as a reference baseline. This approach facilitates objective, interpretable comparisons of resilience performance across systems with varying service conditions. The findings demonstrate the practical applicability of the proposed metrics and normalization technique for evaluating cyber resilience and underscore their potential in informing resilience policy development, operational benchmarking, and technical decision-making.

Many organizations and researchers, such as NIST, FIRST, MITRE, etc. in the United States, are conducting various cybersecurity research to counter the evolving cyber threats. Research on improving the security level of systems and networks by checking the network environment is one of the main areas of continuous research. To choose the right security countermeasures, you need to ensure that the defense techniques they contain are appropriate for your systems and networks. However, how to determine this is a difficult and complex issue, and as cyber threats evolve, how to determine this will need to evolve with them. To address these issues, this study quantitatively designed six metrics for defense technologies based on system and network environments and used them to conduct experiments on the entire network, as well as experiments on security countermeasures after a cyber-threat has caused damage in a virtual network environment. The proposed method was able to cover a large number of vulnerabilities relative to the number of mitigation techniques applied, and the prioritized list of mitigation candidates allowed us to select the appropriate list of defense techniques for the network. This research can be developed into an automated technology that collects vulnerabilities for the entire system of the network environment to be applied in the future, measures the defense level, prioritizes the complementary defense technologies, and lists them as defenses.