CyCon 2014 will focus on ‘Active Cyber Defence’. Despite lacking a universal definition, active cyber defence is usually seen as entailing proactive measures that are launched to defend against malicious cyber activities or cyber attacks. Due to the growing dependency on information and communication technologies as well as the increasing sophistication of cyber threats, active cyber defence apparently has become an important issue for both public and private entities. During CyCon 2014 the risks and benefits as well as the technical, strategic and legal implications of (applying) active cyber defence will be discussed.

The conference solicits original unpublished research, applications and experience papers on the following or other topics relevant to active cyber defence:

Conceptual framework of active cyber defence
* (Non-)essentiality and (non-)feasibility of a common terminology regarding active cyber defence
* Active cyber defence classification and categorisation
* Levels of activity of active cyber defence
* Active versus passive cyber defence
* Pre-emptive and preventive defence (detecting, tracing and counter-striking, mitigative and retributive counter-actions)
* Self defence, self help, hot pursuit
* Active cyber defence as an instrument of policy – limits and opportunities
* Active cyber defence and different legal regimes: peacetime and armed conflict
* Active cyber defence and aspects of public international law: e.g., sovereignty, non-intervention, use of force
* Political, military, economic and ideological aspects of active cyber defence
* Integrating active cyber defence operations with other (military, security) operations
* Active cyber defence strategies and their relations to conventional warfare
* Active cyber defence and deterrence (overt, obvious and covert cyber operations)
* The position of international and regional organisations in active cyber defence

Actors in active cyber defence
* Military (active, reserve), government, nation states, intelligence, law enforcement, mercenaries, commercial entities, volunteers, terrorists, criminals, hacktivists, etc. and their role in active cyber defence
* Cooperation between stakeholders within the scope of active defence
* Artificial (intelligent) agents
* Identifying, recruiting, training and retaining the cyber workforce

Tactical, operational and strategic aspects of active cyber defence
* Challenges of active cyber defence from political and military perspectives
* Extended situation awareness and mission monitoring within the scope of active cyber defence
* Means of active cyber defence in asymmetric warfare
* Active cyber defence missions and risk management
* Contingency planning for active cyber defence mission assurance
* Active cyber defence in space, ground, airborne, naval and underwater operations
* Arms control for active cyber defence systems

Technical implementation of active cyber defence
* Intrusion detection and malware analysis techniques from the active defence perspective
* Anomaly detection methods for network traffic and system log data focussing on active defence
* Exploitation and malware spreading techniques
* Botnet detection, infiltration and mitigation
* Counter IDS / counter-counter IDS systems and methods
* System resilience

Targeting in active cyber defence operations
* Mission-critical assets, targets and processes in cyber space
* Active cyber defence and cyber attack modelling (distributed cyber-attacks; coordinated multi-party cyber attacks recursion attacks, cyber storm attacks, cyber pranks, hoaxes, etc.)
* Attacker behavioural modelling, motivation, intensions
* Threat detection and predictive modelling in active cyber defence

Impact of using active cyber defence
* Active cyber defence and cyber attack impact propagation and assessment on military missions
* Mission impact assessment
* Active cyber defence and cyber attack verification
* Benefits of employing active cyber defence
* Economic aspects of employing active cyber defence
* Political, ethical, legal and operational risks
* Active cyber defence and issues of international and national criminal law, human rights law, private law, intellectual property, and telecommunication law, ITU regulations
* Consequences of non-state actor actions in international relations and crisis escalation
* Application of the basic principles of the Law of Armed Conflict
* Collateral damage to third party systems
* Rights and duties of Internet Service Providers

Reasoning and attribution requirements for active cyber defence
* Attribution process of complex cyber-attacks, cyber conflicts and campaigns
* Effectiveness of existing attribution methods
* Novel methods for attribution
* Extending cyber attribution process beyond the cyber domain, including conventional warfare and human modelling
* Forensic investigations of active cyber defence activity

Case studies, experiments and prototype active cyber defence systems
* Analysis of prototype active cyber defence systems;
* Experimentation, simulation, mock-ups and test environments for active cyber defence systems
* Evaluation criteria, definitions and metrics within the scope of active cyber defence
* Real-life cases

Active cyber defence models
* Formal models and theoretical foundations of active cyber defence
* Self-organization and adaptability in cyber defence
* Information fusion, big data management and active cyber defence situation awareness
* Automated decision making / decision support in active

Authors are required to first submit an abstract of the planned paper, which should describe the topic and lay out the main aspects as well as the structure of the research (300-500 words). After a preliminary review and acceptance of the abstract, the respective authors will be requested to submit original and unpublished papers meeting high academic research standards (up to 6000 words, incl. footnotes and references). Submitted papers will be subject to a double-blind peer review.

Accepted papers will be published in the printed conference proceedings with an ISBN and made digitally available through the conference website.

Submission details, author guidance, copyright transfer form and other practical information will be made available on the conference website at a later date. The anonymised abstracts and manuscripts must be uploaded electronically to EasyChair.org, for which an account creation at EasyChair.org is required.

Authors of papers accepted for publishing in the conference proceedings are required to make a corresponding presentation at the conference. Speakers will be offered travel (booked by NATO CCD COE), transfer from and to Lennart Meri Tallinn Airport, accommodation and lunches for the duration of the conference, and participation in social and sightseeing activities, depending on the final programme of the conference. Please note that on case of several authors for one paper, only one author will be offered the travel, accommodation and free entrance to the conference.

Important Dates
Abstract submission 01 October 2013
Full paper 10 January 2014
Notification of Authors 3 March 2014
Final Paper 24 March 2014
CyCon on 3-6 June 2014