**1. Introduction**

The concept of using compound semiconductors as radiation detectors was introduced in 1945 by Van Heerden [1,2], who was the first to be able to detect alpha and gamma rays with solid-state radiation counters. His pioneering results gave rise to a new class of radiation detectors, which is now commonly known as semiconductor detectors. Compared to gas detectors, semiconductor detectors require much lower average energies for the creation of electron-hole pairs (30 eV for gas [3], 3.7 eV for Si [4], 7.8 eV for 4H-SiC [5]), which bring higher energy resolution in radiation spectroscopy [6,7]. Since the 1960s, the most commonly used semiconductor materials have been high-purity silicon (Si) and germanium (Ge), the main limitation of which is that they must operate at liquid nitrogen temperature. Since the 1990s, intense research activity has been carried out on other semiconductors for manufacturing detectors able to operate at room temperature, such as gallium arsenide (GaAs), cadmium telluride (CdTe), and cadmium zinc telluride (CdZnTe) [8–12]. In the last two decades, silicon carbide (SiC) has obtained increasing interest in the field of radiation detectors due to the achievement of a high purity level in the crystal structure and considerable thickness (>100 μm) in the epitaxial layer. This finally achieved recognition for semiconductor detectors as a real alternative to Si-based radiation detectors, which present possibilities but also limitations at and above room temperature, as well as in high-radiation environments [13,14]. There are certain properties that make SiC especially suitable for the realization of ionizing radiation detectors. Thanks to the wide energy bandgap of the polytype 4H-SiC (3.26 eV), which is three times higher than that of Si (1.12 eV), electronic devices fabricated in such material can operate at extremely high temperatures without su ffering from negative e ffects, due to thermally generated charge carriers [15]. Silicon carbide radiation detectors benefit from this property because the wide energy bandgap allows the achievement of very low leakage currents, i.e., very low noise levels, even at the high electric fields applied during their operation. Moreover, the high thermal conductivity of 4H-SiC (3.8 W/cm◦C) enables SiC devices to dissipate large amounts of excess generated heat, which would cause a temperature increase, responsible for degradation of the device's performance. High thermal conductivity is useful for increasing the radiation hardness of the detector, as well as for controlling the operating temperature when the front-end electronics are close to, or in contact with, the detector [16]. Furthermore, SiC can withstand an internal electric field over eight to ten times greater than GaAs or Si (2 MV/cm for 4H-SiC vs. 0.4 MV/cm for GaAs or 0.3 MV/cm for Si) without undergoing avalanche breakdown. This property enables the fabrication of very high-voltage devices [17]. In the case of X-ray detection and spectroscopy, the high breakdown field of 4H-SiC allows, in principle, the detector to work always in the regime of saturated-electron and hole-drift velocities, independently of the detector's active region width. When this operation condition is coupled with epitaxial material of high crystalline quality, a full and fast charge collection can be expected [16], as well as a high sensitivity, as already demonstrated [18]. Such properties allow SiC-based devices to be operated without any costly, bulky, and power-consuming cooling systems, as in the case of Si- or Ge-based devices, while maintaining an excellent signal-to-noise ratio over a wide range of temperatures. This leads to notable advantages in terms of the lower cost, more compact size, lighter weight, lower power consumption, and higher performance of SiC detectors. Further explanation of the electrical properties of SiC in connection with the ionizing detector performance benefits can be found in [16].

Microstrip detectors find application where the position of the radiation interaction is necessary information for the physical process to be studied. The advantage of using microstrips with respect to other position-sensitive detectors, such as pixel detectors, is a lower number of readout channels. Several microstrip detectors have been developed in Si for high-energy physics, or in Ge, CdTe and GaAs for X-ray spectroscopy [19–22]. In this work, we investigated the electrical and spectroscopic performance of two innovative position-sensitive radiation detectors in epitaxial 4H-SiC, using microstrip geometry. The detectors were characterized in detail at di fferent temperatures and applied bias voltages. The obtained results are presented and discussed in the following sections.

#### **2. Materials and Methods**

Two di fferent designs of silicon carbide microstrip detectors have been realized on top of two-inch high-purity epitaxial 4H-SiC wafer produced by LPE Epitaxial Technology Center [23]. Each detector consists of 32 strips with a length of 2 mm, a width of either 25 μm (SM1) or 50 μm (SM3), and a pitch of either 55 μm (SM1) or 100 μm (SM3)—see Figure 1. Each of these strips can be read out independently by a front-end electronics channel, and therefore behaves as a separate detector. A cross-sectional view of the 4H-SiC microstrip structure is shown in Figure 2. The SiC epitaxial layer, which is the active region of the detector, has a maximum thickness of 124 μm, as experimentally measured (Figure 3).

The application of a reverse bias at the common back electrode (ohmic contact) creates a depletion region, *xd*, depending on the applied bias, *VR*, and the residual doping (donor) concentration, ND, within the material, according to

$$\mathbf{x}\_d = \sqrt{\frac{2\varepsilon\_0 \varepsilon\_r}{qN\_D} \left(\psi\_{bi} - V\_R - \frac{kT}{q}\right)}\tag{1}$$

where ψ*bi* is the built-in potential and the term *kT q* arises from the contribution of the majority-carrier distribution tail [24].

**Figure 1.** Photographs of the two microstrip detectors used in this work, together with a detail of their peripheral regions with bonding pads.

**Figure 2.** Cross-sectional view of the 4H-SiC microstrip structure.

The residual doping concentration depends on the homogeneity of the epitaxial layer. The donor concentration profile, *ND*(*x*), was determined as a function of the depleted layer width from capacitance-voltage measurements, as described in Section 3.


*2.2.2 Clinical observation-based drug repurposing*

*Drug Repurposing - Hypothesis, Molecular Aspects and Therapeutic Applications*

In disease-centered paradigm, the observation and analysis of data from phenotypic assays, clinical trials, and literature could be an important resource for drug repositioning, as previously mentioned, this type of repositioning is oriented toward the clinical outcomes rather than the exact molecular mechanism behind the drug switch; from other angle, the researcher aims to find certain fingerprint on the genetic or proteomic level to support the repositioning hypothesis; for example, the transcriptomic analysis of different types of autoimmune diseases could reveal similar pattern of gene expression, which means that the same drug could be used

Qu et al. applied integrative clinical transcriptomic analyses for finding new drugs for treatment of psoriasis. First, gene expression analysis of samples collected from psoriasis patient and normal volunteers were used to identify molecular targets associated with the disease, and then, connectivity map analysis revealed potential drugs for the identified targets, which were resveratrol **(16)**, tiabendazole **(17)**, monobenzone **(18)**, parthenolide **(18)**, doxycycline **(19)**, and methotrexate **(20)** [32].

Also, Patrick et al. gathered drug-related information from more than 20 million articles using machine learning based on word embedding to build a model that highlights drug-disease relationship in order to repurpose drugs for treatment of immune-mediated dermatological conditions, where prednisone **(21)**, triamcinolone **(22)**, budesonide **(23)**, hydroxychloroquine **(24)**, and leflunomide **(25)** were among the top five predicted drugs for treatment of psoriasis [33]. The chemical

*2.2.1 Application of data mining and omics in drug repositioning*

structure of compounds **(15–25)** is demonstrated in **Figure 7**.

**2.2 Disease-centered drug repositioning**

for different types of immunity-related condition.

*Chemical structure of resveratrol* **(16)***, tiabendazole* **(17)***, monobenzone* **(18)***, parthenolide* **(18)***, doxycycline*  **(19)***, methotrexate* **(20)** *prednisone* **(21)***, triamcinolone* **(22)***, budesonide* **(23)***, hydroxychloroquine* **(24)***, and*

**54**

**Figure 7.**

*leflunomide* **(25)***.*

Bimatoprost **(26)**, a prostaglandin analog, was used for treatment of glaucoma patient, but several clinical observations reported the occurrence of eyelash hypertrichosis; so, it was used for induction of eyelash regrowth in alopecia areata and for cosmeceutical purposes [34, 35].

Phenytoin **(27)** is one of the first discovered antiepileptic drugs; after its introduction to the market, gingival hyperplasia was reported as a side effect for the treatment, which triggered dermatologist to evaluate its ability to heal wounds; so, phenytoin has been evaluated by several clinical studies, where it proved to be useful in treatment of wounds in topical and oral forms; however, the exact mechanism of action is still ambiguous [36].

Bevacizumab, a monoclonal antibody that is used for treatment of several types of cancer, was observed to achieve complete remission of psoriasis in metastatic colon cancer without any other treatment for psoriasis [37]; a case which was reported again in another study that described the same effect in metastatic renal cell cancer, psoriasis, and psoriatic arthritis patient, which means the bevacizumab could be repurposed for treatment of these dermatoses; also, it sheds the light on the importance of (VEGF) as a target for treatment of inflammatory skin conditions [38].

The Janus kinase (JAK) inhibitor, tofacitinib **(28)**, was developed originally for management of rheumatoid arthritis, ulcerative colitis and other autoimmune diseases, but it was repurposed for psoriasis and atopic dermatitis since JAK was found to be contributing in the pathogenesis of these diseases, and currently, several clinical trials were performed to assess its clinical significance and concluded that response rates in tofacitinib-treated group were significantly higher compared to that in placebo [39–41].

Metformin **(29)**, a type-2 diabetes medication, reduces insulin resistance; however, its mechanism is not completely understood; so, it was suggested as a treatment of several dermatological conditions associated with insulin resistance such as acanthosis nigricans and acne; this was supported by several clinical trials where the patients showed complete resolution. It also was employed in treatment of hyperpigmentation due to its inhibitory effect on tyrosinases, the key enzymes in melanin biosynthesis. The anti-melanogenic effect of metformin was demonstrated experimentally on human skin biopsies and reconstituted human epidermis; also, clinical trials showed that metformin efficacy is comparable to TCC in treating melasma [42–44].

Finally, minoxidil **(30)**, which is a well-known case in drug repositioning, was initially used for treatment of hypertension since its strong vasodilator effect but during clinical trials, hair regrowth was noticed in patients with androgenic alopecia such effect is contributed by stimulating the vascular bed nearby the hair follicles which lead to better environment for hair growth. It was suggested that the ability of minoxidil to activate cytoprotective prostaglandin synthase-1 and stimulate adipose-derived stem cells (ASCs) [45, 46].

#### *2.2.3 Phenotypic screening for drug repositioning*

Niclosamide (NCL) **(31)** is an anti-helminthic drug that has been utilized for long time with considerable safety profile; several studies reported its antiinflammatory and anticancer activities, highlighting the potential of repurposing for different indications; Thatikonda et al. used imiquimod (IMQ )-induced BALB/c mouse model to evaluate the efficacy of NCL for treatment of psoriasis, where it alleviated epidermal hyperplasia and inflammation induced by IMQ via downregulating p65, STAT3, NFATc-1, and NF-κB transcription factors along with Ki-67, ICAM-1, and Akt protein expression [47].

**Figure 8.**

*Chemical structure of bimatoprost* **(26)***, phenytoin* **(27)***, tofacitinib* **(28)***, metformin* **(29)***, minoxidil* **(30)***, niclosamide* **(31)***, carvedilol* **(32)***, and cannabidiol (CBD)* **(33)***.*

Hall et al. used zebrafish neutrophil migration assay, for evaluation of the suppressive effect of 1280 approved drugs on recruitment of neutrophils; where drugs showing prominent anti-inflammatory activity were further tested in atopic dermatitis animal model, among them 11 drugs which was not reported previously as anti-inflammatory agent [48].

Chang et al. used in vivo model of chemically induced murine skin tumorigenesis to confirm the hypothesis of repositioning of beta blocker for treatment of skin cancer, since several studies showed that stress-related catecholamine hormone expression can affect tumor progression [49].

Carvedilol **(32)**, when administrated orally and topically, prevented DMBAinduced epidermal hyperplasia, suggesting that it may serve as a new agent for protecting against skin cancer [50], which was supported by another study that demonstrated the preventive effect of carvedilol applied topically after UV exposure; so, it can be repositioned as prophylactic agent against skin inflammation and cancer [51].

Cannabidiol (CBD) **(33)** is a nonpsychoactive phytocannabinoid found in *Cannabis sativa*. It is approved recently for the treatment of seizures associated with two uncommon and serious forms of epilepsy, Dravet syndrome, and Lennox-Gastaut syndrome. Oláh et al. reported that CBD-treated human sebocytes and human skin organ in vitro showed strong antiproliferative, lipostatic, and antiinflammatory effects mediated by a plethora of receptors, ion channels, and other components of the endocannabinoid system [52]. These findings were confirmed later by clinical trial showing that CBD administrated as an ointment is an effective and noninvasive option for enhancing the quality of life in patients with some skin disorders, especially those with inflammatory background [53]. The chemical structure of compounds **(26–33)** is depicted in **Figure 8**.

#### **3. Concluding remarks and future perspective**

Drug repositioning is an important strategy to maximize the benefits from already approved drugs; it will not only contribute to reduction of time and cost

**57**

**Author details**

**Conflict of interest**

Farid A. Badria1

Mansoura, Egypt

Kafrelsheikh, Egypt

\* and Abdullah A. Elgazar2

\*Address all correspondence to<EMAIL_ADDRESS>
provided the original work is properly cited.

1 Department of Pharmacognosy, Faculty of Pharmacy, Mansoura University,

2 Department of Pharmacognosy, Faculty of Pharmacy, Kafrelsheikh University,

© 2020 The Author(s). Licensee IntechOpen. This chapter is distributed under the terms of the Creative Commons Attribution License (http://creativecommons.org/licenses/ by/3.0), which permits unrestricted use, distribution, and reproduction in any medium,

*Drug Repurposing in Dermatology: Molecular Biology and Omics Approach*

logical condition and enhance the quality of life of patients.

The authors declare no conflict of interest.

for drug discovery but also could help to develop new therapeutics for orphan and ignored diseases. While historic cases of drug repositioning were inspired by serendipity and observations, more systematic approaches became well established by time. In silico and data mining tools could help to analyze the large amount of data available from omics, phenotypic assay, and clinical investigations by revealing novel relationship between drugs, targets, and different pathways of diseases as described in this chapter; the integration of different tools of drug repurposing will allow the identification of safe and effective therapeutics for treatment of dermato-

*DOI: http://dx.doi.org/10.5772/intechopen.93344*

*Drug Repurposing in Dermatology: Molecular Biology and Omics Approach DOI: http://dx.doi.org/10.5772/intechopen.93344*

for drug discovery but also could help to develop new therapeutics for orphan and ignored diseases. While historic cases of drug repositioning were inspired by serendipity and observations, more systematic approaches became well established by time. In silico and data mining tools could help to analyze the large amount of data available from omics, phenotypic assay, and clinical investigations by revealing novel relationship between drugs, targets, and different pathways of diseases as described in this chapter; the integration of different tools of drug repurposing will allow the identification of safe and effective therapeutics for treatment of dermatological condition and enhance the quality of life of patients.


*Article* **Bcl10 Regulates Lipopolysaccharide-Induced Pro-Fibrotic Signaling in Bronchial Fibroblasts from Severe Asthma Patients**

**Rakhee K. Ramakrishnan 1, Khuloud Bajbouj 1, Maha Guimei 2, Surendra Singh Rawat 3, Zaina Kalaji 1, Mahmood Y. Hachim 3, Bassam Mahboub 1,4, Saleh M. Ibrahim 1,5, Rifat Hamoudi 1,6,\*, Rabih Halwani 1,7,\* and Qutayba Hamid 1,8,\***

**Abstract:** Subepithelial fibrosis is a characteristic hallmark of airway remodeling in asthma. Current asthma medications have limited efficacy in treating fibrosis, particularly in patients with severe asthma, necessitating a deeper understanding of the fibrotic mechanisms. The NF-κB pathway is key to airway inflammation in asthma, as it regulates the activity of multiple pro-inflammatory mediators that contribute to airway pathology. Bcl10 is a well-known upstream mediator of the NF-κB pathway that has been linked to fibrosis in other disease models. Therefore, we investigated Bcl10 mediated NF-κB activation as a potential pathway regulating fibrotic signaling in severe asthmatic fibroblasts. We demonstrate here the elevated protein expression of Bcl10 in bronchial fibroblasts and bronchial biopsies from severe asthmatic patients when compared to non-asthmatic individuals. Lipopolysaccharide (LPS) induced the increased expression of the pro-fibrotic cytokines IL-6, IL-8 and TGF-β1 in bronchial fibroblasts, and this induction was associated with the activation of Bcl10. Inhibition of the Bcl10-mediated NF-κB pathway using an IRAK1/4 selective inhibitor abrogated the pro-fibrotic signaling induced by LPS. Thus, our study indicates that Bcl10-mediated NF-κB activation signals increased pro-fibrotic cytokine expression in severe asthmatic airways. This reveals the therapeutic potential of targeting Bcl10 signaling in ameliorating inflammation and fibrosis, particularly in severe asthmatic individuals.

**Keywords:** severe asthma; bronchial fibroblasts; fibrosis; Bcl10; NF-κB pathway; cytokines


*2.2. Synthesis of Ag@Au Nanoparticles*

First, we mixed the silver nanoball seeds with 100 µL of 1 mM glutathione solution in a 1.5 mL centrifuge tube at room temperature; using an IKA shaker, we then vortexed it for 1 min, and incubated it for 1 h to make glutathione modified into silver nanospheres by the Ag–S bond. At the same time, we added 4.0 mL ultrapure water to a 20 mL glass flask, followed by 200 µL of 10 mM HAuCl4·3H2O solution and 0.8 mL of 0.1 M CTAB solution. The mixed solution was stirred at 500 rpm for 30 min at room temperature using an IKA magnetic stirring device, mixed well, and then 475 µL of 0.1 M ascorbic acid solution was added, stirring was continued at room temperature for 5 min, and the mixed solution was used as a growth solution. Finally, the silver nanospheres modified with glutathione were added to the growth solution, and the reaction was carried out at room temperature under magnetic stirring for 2 h. The resulting product was centrifuged at 5000 rpm for 10 min; the supernatant was removed, and washed twice with water and ethanol, respectively. In order to explore the effect of the amount of silver nanoball seeds added on the produced Ag@Au NPs, we added 40 µL, 80 µL, 160 µL, and 500 µL of silver nanosphere seeds to the reaction, without changing any of the other reaction conditions.


2.1.1. Complementary Metal-Oxide-Semiconductor (CMOS) Transistor

Incorporating active electronic devices into a passive metasurface allows for fast dynamic control, but the application is limited to microwave frequencies. In 2020, Venkatesh et al. presented a programmable metasurface using complementary metal-oxide-semiconductor (CMOS) transistors operating at 0.3 THz beyond its cutoff frequencies [52]. They applied a 65 nm industry-standard CMOS process to fabricate the metasurface in a silicon chip tile, consisting of 12 × 12 arrays (Figure 2a). Each meta-atom contained eight n-type metaloxide-semiconductor (NMOS) transistors for an eight-bit reconfiguration at gigahertz (GHz) speed. Parallel subwavelength inductive microloops were added to the transistor for local resonance to suppress the non-negligible parasitic capacitance leakage. An amplitude modulation of 25 dB was achieved between all switches open (maximum transmission) and closed (minimum transmission) states. A demonstration of the 2 × 2 tiled chips (Figure 2b) for holographic projections of the letter 'P' is shown in Figure 2c. The unit-cell structure was derived from a general C-shaped split-ring resonator (SRR), which controls the transmitted amplitude and phase by varying the gap-opening orientation and size, respectively. This was realized by selectively switching the eight transistors of a meta-atom, leading to 256 states in total. Due to the symmetric configuration, each meta-atom had 84 unique codes and realized a phase coverage of 260◦. Beam steering from 0◦ to ±30◦ was achieved by configuring the unit cell in three different phase profiles and meta-atom digital settings (Figure 2d).

**Figure 2.** CMOS transistor-enabled reconfigurable metasurface. (**a**–**d**) GHz-speed programmable metasurfaces using CMOS-based chip tiles. (**a**) A single silicon chip tile consists of a 12 × 12 array (left).

The enlarged portion (right) shows the unit-cell structure with active NMOS transistors embedded in the gap of inductive microloops. Each unit cell has an eight-bit control, enabling 256 states for amplitude and phase control. (**b**) Photo of the fabricated 2 × 2 tiled chips, which were wire-bonded to a customized printed circuit board for external voltage control. (**c**) Amplitude modulation was experimentally demonstrated as a holographic projection of the letter 'P'. (**d**) Beam steering at ±30◦ with the corresponding three different phase profiles and meta-element digital settings. Reprinted from Ref. [52]. (**e**–**g**) Reconfigurable metasurface based on CMOS structures. (**e**) A bias voltage is applied for transmitted amplitudes and phase modulation. The reconfigurable metamaterial can be divided into subsections for greater functionality. (**f**) Cross section of the unit cell, consisting of six layers for the CMOS transistor configuration. (**g**) Layout with wire connection for the biasing control. Reprinted from Ref. [53].

By utilizing custom-designed CMOS-based semiconductor structures, it is possible to circumvent the cutoff frequency limitation of commercial transistors (Figure 2e) [53]. The meta-atom structure, consisting of a square SRR on top of a six-layer CMOS-based semiconductor structure, is shown in Figure 2f. The gap of the SRR was connected to the source and drain of a metal-oxide-semiconductor field-effect transistor (MOSFET) through vias (Figure 2g). The metasurface was fabricated with 180 nm CMOS technology. With a bias voltage from 0 V to 1.8 V, a redshifted frequency of 35 GHz and a phase difference of 3◦ were achieved at 0.3 THz. Although the phase modulation was limited, the authors presented an alternative solution for realizing a CMOS-based reconfigurable metasurface.


**7. Conclusions**

This chapter primarily addresses the fundamental concepts of perovskites, their structure, classification of perovskites, their synthesis, their distinctive features, and their applications. Because of its many unique properties, including enormous magnetoresistance, multiferroics, superconductivity, etc., perovskite structured materials have received a great deal of research attention. Perovskites have unique and unusual physical properties that have been extensively studied for both real-world use and theoretical research. Applications for photonic and optoelectronic devices, effective solar cells, fuel cells, spintronics, electrical machines, random - access memory, electrochemical double layer capacitors, and other novel device concepts are just a few of the many novel device concepts that have been made possible by perovskites in the field of materials science.


**3. Methods**

#### **Cognitive sciences applied to cybersecurity; an exploration based on PRISMA**.

The methodology used in this study was the development of a systematic literature review based on the PRISMA methodology, which includes four stages: identification, screening, eligibility analysis, and inclusion (see Figure 2). Study selection was based on

a systematic review following the Prisma Guidelines [21]. In the identification stage, we found works in the following databases: Springer, Scopus, IEEE, Association for Computing Machinery (ACM), Web of Science, and Science Direct, in the last three years, 2019 to 2020, to identify the trends in cybersecurity. The search queries established were the following:

**Figure 2.** SLR according to Prisma methodology.

The inclusion criteria were: (i) documents published on the scientific database from 2019 to 2021. The exclusion criteria included: (i) documents not related to cybersecurity and (ii) documents out of the research period (2019–2021). Figure 3 shows the screening and eligibility process of the 1244 studies. Then, based on the review of papers' titles and abstracts using a web application, Rayyan, created for the systematic review process, we removed the papers that did not comply with the inclusion criteria. At the end of the screening process, 813 articles were selected for full-text reading. Finally, we removed studies without clear proposals in the cybersecurity field, excluding 748 papers.

**Figure 3.** General topics in cybersecurity between 2019 to 2021.

#### **Qualitative analysis using text mining technique.**

Text mining, which is considered another field in cognitive science, is essential for qualitative cybersecurity research. However, text mining requires text cleaning and tok-

enization as prerequisites. In this way, the cleaning process of text, within the scope of text mining, consists of eliminating everything that does not provide information on its subject, structure, or content from the corpus. It should be noted that there is no single way to do this step. It depends on the purpose of the analysis and the text source. We applied a text mining analysis using R software to all 748 studies obtained in the included stage of PRISMA methodology. Thus, we eliminated non-informative patterns (web page URLs), punctuation marks, and single characters. We generated the text tokenization, which divides the text into the units for the analysis in question. We proceeded to store the tokenized text. Each element of the tokenized\_text column is a list with a character vector containing the generated tokens. However, there has been a significant change when doing the tokenization process. Before the text's division, the study elements (observations) were the titles and keywords of selected papers. Each one was in a row, thus fulfilling the condition of tidy data: one observation per row. When performing the tokenization, the study element has become each token (word), thus violating the condition of tidy data. Thus, each token list must be expanded to recover the ideal structure, doubling the other columns' value as many times as necessary [29]. We carried out the analysis for the years 2020–2021, obtaining the results in Table 2 and Figure 3.

**Table 2.** General topics in cybersecurity between 2019 to 2021.

We included the studies of all the works that evidenced the development of strategies and structures in cybersecurity. Furthermore, we considered articles referring to models developed for learning defense against a cyberattack.

Then, we developed a word cloud process to obtain more detail on scientific studies' contributions in the cybersecurity domain. Algorithm 1 shows the R script used to determine the cybersecurity topics, and Figure 4 shows the word cloud results.

**Figure 4.** Results of a word cloud of 748 papers.

#### **Cybersecurity attacks and their impact**

According to the World Economic Forum [1], cyberattacks were considered a fifth of the worldwide risks above food crisis in 2020. Adversaries developed several cyberattack scenarios. For instance, the United States Department of Justice discloses public information about scams perpetrated through websites, social networks, emails, and robocalls, among other means. All these related to fake news about COVID-19 vaccines, treatments, protective equipment, and obviously, about criminals who conducted fake businesses to steal identities or file fraud cite the USDJ. Another cybersecurity scenario covered by the United States Department of Justice is when adversaries send text messages using fictitious phone numbers and social media accounts to harass, intimidate, cyberstalk, and attempt to sexextort women [30]. On the other hand, CISA mentions that adversaries use Bots to conduct credential harvesting, mail exfiltration, crypto mining, point-of-sale data exfiltration, and the deployment of ransomware [31]. According to the FBI, from 2015 to 2019, reports about fraud in the FBI's Internet Crime Complaint Center (IC3) went from USD 1.1 billion to USD 3.5 billion [32]. Establishing the most appropriate cybersecurity defense solution is necessary to identify the characteristics of cyberattacks [33]. There are currently a great variety of cyberattacks [34]; Table 3 shows those that are the most recurrent among the selected papers for this study.

**Table 3.** Cybersecurity attacks detected in text mining process.

We contrasted this result with an international organization related to cybersecurity. We found that some of them were considered the most relevant cyberattacks in the year 2020, according to The European Union Agency for Cybersecurity (ENISA) [34]. Additionally, we compared this result with the report of a specialized cybersecurity firm. We found that four out of nine attacks documented in our study had a growth rate of between 7 and 25 percent in 2020 in America, Europe, and Asia (see Table 4). According to [67], a classification of cyberattacks is based on the effects they cause against a system or its architecture: misuse of resources; user access compromise; root access compromise; web access; malware; and denial of service.

**Table 4.** Growth rate percentage of cyberattack 2020.

Other cyberattacks use machines as attack vectors [68], while others focus on human behaviors [69]. In the case of phishing, attackers seek to exploit human vulnerabilities resulting from factors such as solidarity, desperation, or authority control to carry out their attack [70]. In contrast, Ransomware attacks exploit vulnerabilities in operating systems or applications to encrypt users' or organizations' sensitive information [71]. Within this context, Watering hole attackers use exploit kits with stealth features and seek to compromise a specific group of end-users by infecting websites [65]. A malicious URL attacker defines a link created to distribute malware or facilitate a scam [72]. Form hacking is a type of cyberattack where hackers inject malicious JavaScript code into legitimate website payment forms [73]. Table 5 shows a classification of attacks based on an adversary's resource (machine or human).

X represents the affectation of target due to attack.

Another way to classify cyberattacks could be based on the target, such as energy, healthcare, and transportation [74,75]. Table 6 shows some services considered targets by adversaries. An exciting fact obtained from text mining analysis is that most research works focus on cybersecurity in the energy domain. False data injection is the most famous attack in energy services because it focuses on modifying forecasted demand data [76]. The main issue with energy services, such as smart grids, is connected to network infrastructure and smart meters, which could have some vulnerabilities. This aspect increases the probability of cyberattacks on smart grid infrastructures [77]. Research focuses on preventing and overcoming cyberattacks by using machine learning techniques, such as artificial neural networks, to solve cybersecurity challenges, especially with the considerable volume of data on power systems [74].

**Table 6.** Classification of cybersecurity attacks based on target services.

Table 7 shows topics related to cybersecurity in energy facilities. Healthcare is another domain of interest for adversaries for sensitive and personal information [75]. In healthcare, one relevant issue is legacy software [78]. It is difficult for some hospitals or medical centers to migrate their medical records to new systems, e.g., for factors such as budget, data format, or time; this could be a disadvantage from a cybersecurity perspective. Some research is focused on improving authentication methods to reduce this gap [79], following the topics related to healthcare cybersecurity:

Adversary takes advantage of vulnerabilities in different domains, such as [80]:

**Table 7.** Cybersecurity topics related to energy facilities.

The growth of new electronic services and technologies such as IoT, big data, and artificial intelligence have allowed the development of new attack vectors [81,82]. IoT has generated interest by adversaries in carrying out security attacks due to its lack of advanced security and great coverage [83]. IoT solutions are very attractive for attackers because of the variety of attacks that can be performed on different components of IoT, among which we can mention the following [84]:

• Mobile devices;

The growth of crypto-currency and distributed authentication architecture is driving the use of blockchain architecture [85]. Another use of blockchain is in healthcare organizations to improve data integrity, authentication, and privacy issues, especially those with sensitive features such as medical records [86]. On the other hand, IoT is growing in different domains such as healthcare, smart city, and smart home [26]. Establishing authentication such as PKI architectures for IoT ecosystems could be expensive for many IoT devices, so smart contracts based on blockchain architecture are an alternative [87]. Following, we outline the topics related to blockchain and cybersecurity in papers selected in this work, which were developed between 2019 to 2021:

Some cyberattacks take advantage of new technologies such as 5G, IoT, and the cloud to perform DDoS attacks [88]. The growth of IoT devices with limited computational resources and lack of security configurations make them vulnerable to different cyberattacks. For instance, Mirai Botnet malware exploited the vulnerabilities of an estimated 600,000 IoT devices, resulting in massive Distributed Denial of Service (DDoS) attacks [89]. Cloud computing services are used to launch Distributed Denial of Service (DDoS) attacks. However, adversaries are focusing on low-rate DDoS attacks because they are more challenging to detect due to their stealthy and low-rate traffic [58].

On the other hand, using the hijacked Connection-less Lightweight Directory Access Protocol, an attacker could perform DDoS attacks at 2.3 terabytes per second [90]. Social media platforms have achieved relevance for interaction and social information exchange. However, the attackers have used them to deceive people and make them victims of attacks [91]. An adversary has found a striking attack target in humans because they can be deceived through persuasion techniques [15]. Attacks based on human vulnerabilities, called social engineering, have grown in recent years [66]. Figure 5 shows a word cloud of topics related to social engineering. We can observe that human factors are relevant in this kind of attack. The pandemic has created tremendous pressure on cybersecurity aspects. During the COVID-19 pandemic, the social engineering attacks carried out were phishing, spamming, and scamming. These attacks were combined with socio-technical methods such as fake emails, websites, and mobile apps [92]. The need to work remotely has changed the attack surface of organizations. Attacks on VPNs, hijacking of video meetings, fake news campaigns, and phishing attacks have increased during the COVID-19 pandemic [15]. According to the text mining process, we identified the following topics related to COVID-19 and cybersecurity:

**Figure 5.** Word cloud of topics related to Social Engineering.

#### **Challenges in cybersecurity solutions**

To face cyberattacks, organizations have established cybersecurity mechanisms that could be physical, software-oriented, or procedural. Below, we show some of the most common defense mechanisms:

The mechanisms described above are the most common solutions for cyberattacks. However, it is possible to define specific defense mechanisms for each type of cyberattack in some cases. For instance [67], the two defense techniques against phishing attacks are:

However, MITRE [93] has defined 245 techniques that the attacker could use for executing cyberattacks. The techniques are distributed in 14 stages; each stage is associated with the attackers' process of executing cyberattacks. Figure 6 shows the number of techniques associated with each stage. Figure 7 shows the frequency of MITRE techniques included in the works selected in this study, which were developed between 2019 and 2021. Our text mining analysis found that the most relevant techniques are reconnaissance, discovery, lateral movement, collection, command-control, and impact. On this point, it is important to mention that the absence of frequency in other techniques, such as initial access or privilege escalation, is not an indicator that these techniques are not used in cyberattacks. The information shown in Figure 8 reveals that researchers are more focused on the result of one specific technique in their study. However, for the review made, we can observe that not all selected works considered the cycle of a cyberattack; this aspect is relevant for developing a good defense strategy. We found that most of the techniques mentioned in the selected studies focused on gathering information, such as reconnaissance, discovery, and collection.

**Figure 6.** Cybersecurity Techniques according to MITRE.

**Figure 7.** Techniques MITRE identified in works selected in this study.

TechniquesMITREusedinvertical domainssuchasEnergy,SocialEngineering,

 and IoT.

**Figure 8.**

Figure 8 shows the relation between cybersecurity techniques and domain attacks: energy, IoT, and social engineering. We observed that the relevance of a specific technique depends on the type of cyberattack. For instance, the most relevant techniques in social engineering are reconnaissance, resource development, persistence, and defense evasion. On the other hand, the most relevant techniques in IoT attacks are credential access, lateral movement, and collection. This number of techniques could be a challenge because cybersecurity analysts need to have the capability to detect them in real-time when they are used in cyberattacks to select the best defense strategy.

Figure 9 shows some variants of cybersecurity attacks based on social engineering, which show the incredible versatility of attacks, which can vary depending on the attack techniques used digitally, in person, or by phone.

**Figure 9.** Classification of Social Engineering attacks.

Cybersecurity solutions require adapting to new challenges:

Cybersecurity firms and researchers have been developing some alternatives by mainly focusing on anomaly detection. Inside the anomaly detection process, the objective is to detect some pattern, behavior, or component used by attackers [94]. Table 8 shows topic development from 2019 to 2021 related to anomaly detection. Cybersecurity companies and researchers in the field have moved on from reactive solutions to proactive ones [95].

**Table 8.** Cybersecurity topics related to IoT.

Cybersecurity research is trying to stay one step ahead and take advantage of cybersecurity analysts' cognitive capabilities to define proactive cybersecurity defense strategies. So, several research types are focused on incorporating cognitive models to generate these proactive solutions. In the selected period (2019–2021), several studies included artificial intelligence and machine earning concepts applied to cybersecurity (See Table 9).

**Table 9.** Topics related to anomalies.

The use of supervised machine learning such as Decision Tree (DT), Support Vector Machine (SVM), Naïve Bayes (NB), Random Forest (RF), and unsupervised algorithms such as K-nearest neighbor (kNN) and Artificial Neural Network (ANN's) for building intrusion detection systems (IDS), or anomaly pattern detection, are the most exciting topics in cybersecurity. A relevant fact observed in the selected papers was the growing number of studies related to deep learning applications. Researchers have considered deep learning a good alternative for facing different cybersecurity issues. How can deep learning be applied to detect IoT attacks, APT, DDoS, malware, and anomaly detection? An interesting fact is that there are three variants of deep learning:

Table 10 shows topics identified from papers in the text mining process related to security in IoT. Research focus on defense solutions to face DDoS include the use of cognitive sciences approaches such as [88]:

**Table 10.** Machine learning applied to cybersecurity.

Below there are some approaches of studies between 2019 and 2021 with solutions based on machine learning and deep learning for identifying malicious URLs or sentiment analysis in social media:

Game theory is another alternative of cognitive sciences applied to cybersecurity. Its objective is to try to guess the next step for adversaries during cyberattacks. Figure 10 shows a word cloud with topics related to game theory. We identified that game theory could be applied to different domains such as energy, investment, cyber-physical systems, and computer security. Additionally, game theory research shows approaches in defense mechanisms, information dissemination, and decision making. Game theory uses computational modeling to take advantage of security analysts' cognitive processes and adversaries to improve decision-making based on information analysis to face attacks [96]. Game theory is mostly used in the economy field, which is responsible for studying optimal decisions and strategies for given situations. According to the definition of Nash equilibrium, the strategy or set of strategies of each player responds to the other players' actions to maximize each player's profit. The player's strategy is a specific action at a particular moment of the game [96]. A game is defined as interacting with two or more participants seeking a reward. During the game, participants develop strategies to maximize their profit. Players do not necessarily represent people; they can be organizations or groups. There are two classic games in-game theory: cooperative games and non-cooperative games. There are two ways for the mathematical representation of a game: a standard form using matrices and an extensive form using decision trees. A cooperative game is based on the players' interaction reaching agreements to establish the decision-making that each player will carry out, achieving the objective of reaching coalitions, and determining how to distribute the rewards [97]. However, in non-cooperative games, each player must decide what decision to make without knowing the rest's decisions. These are more subject to the reality of what happens in the cybersecurity domain. Complete information games are those in which each player knows all the events in the game's course from the beginning, especially when making a decision. A classic example of a complete information game is the game of chess. Incomplete information games, in most cases, are simultaneous decision-making games, so each player knows something that the others do not. Interactions between an adversary and the user could be modeled based on two players' stochastic game. Using a non-linear program is possible to compute Nash equilibrium to define the best response strategies for players [98]. Developing games that consider cost, time, reward, and performance could define effective game strategies.

**Figure 10.** Game theory research topics.

#### **4. Results and Discussion**

*Cognitive Cybersecurity Model*

Our text mining process found that the works selected in this study do not consider indirect cognitive processes or cognitive models such as OODA or MAPE-K. Including

game theory in cybersecurity can lead to strategies to minimize cyberattacks from a cognitive perspective. A complete information model is the most appropriate to obtain the best decision from the game theory approach. Big network environments are very complex scenarios for developing detection and protection cybersecurity solutions. The integration of machine learning and deep learning with game theory techniques could improve proactive security solutions. Concerning Figure 2, Cassenti et al. [23] mention that technology does not consider the user learning processes. From our perspective, the game theory approach could be a solution to this because it validates the user's decision-making processes based on a set of experiences and patterns. From the game theory perspective, if the user (player) improves the learning process or the decision-making process based on cognitive processes, the probability of winning the game increases. In this sense, we propose in Figure 11, a cognitive cybersecurity model based on integrating cognitive process and machine learning, deep learning, and game theory approach applied in cybersecurity. As shown in Figure 11, we structured the model into three layers. The first layer of the cognitive model addresses the aspects of perception related to the cognitive processes. It associates them with sources of information that can be analyzed to establish patterns of anomalies based on space-time criteria. The second layer establishes the association of the understanding processes with machine learning (ML) techniques or deep learning (DL) that can be used for the anomaly detection processes. This association must have bi-directional feedback between analysts and technology to improve ML or DL algorithms' training processes. The way towards the analysis allows us to generate perspicacity about cybersecurity situation awareness. Additionally, this feedback should support the improvement in the analyst's cognitive processes to detect cyberattacks.

**Figure 11.** Proposal for a Cognitive Cybersecurity model.

Finally, the third layer associates the cognitive projection process with game theory techniques. At this level, the decision-making processes to establish the best defense strategy must be supported by the information obtained from the ML and DL processes carried out in the lower layer. The bidirectional relation, in one sense, is the computational model of the game theory component. In another sense, it should improve the cognitive decision-making processes. However, establishing the proposed model is complex without obtaining all the information from the analyst and adversary (See Figure 12). Modeling the adversary's characteristics would allow analysts to have a complete vision to establish a better decision. For instance, they knew that the adversary could use a combination of tools (T), techniques (Th), and procedures (C2F). However, the list of tools and procedures can be extensive and varied. Below is a list of the most widespread RATs:

	- FudgeC2 is a campaign-orientated Powershell C2;
	- Callidus is an open-source C2 framework that leverages Outlook, OneNote, Microsoft Teams for command and control;
	- APfell is a cross-platform, OPSEC aware, red teaming, post-exploitation C2 framework;
	- DaaC2: is an open-source C2 framework that makes use of Discord as a C2;
	- Koadic is an open-source for post-exploitation;
	- TrevorC2 is a client/server model for masking command and control through web browsers

**Figure 12.** Attack and defense components.

We represent in Equation (1) the attack as the combination of tools (T), procedures (C2F), and techniques (Th), where w represents the weights based on the tool, procedure, and technique used by the adversary.

$$\text{Attack} = \text{w(T)} + \text{w(C2F)} + \text{w(T h)}\tag{1}$$

On the other hand, cybersecurity analysts developed a set of cognitive processes to establish the defense process. From a macro vision, the analyst must decide if a possible event could be an attack or not, based on the cognitive process of perception. Bitzer et al. [99] mention that perceptual decision making is applied to two-alternative forced-choice tasks to judge perceptual feature differences. According to Bitzer, driftdiffusion models have been used to quantitatively analyze behavioral data, i.e., reaction times and accuracy. In the same vein, Dale et al. [100] mention that the cognitive analysis of vast amounts of data requires the application of the heuristics process and that people often mistakenly judge the likelihood of a situation by not taking all relevant data into account. However, according to Nikoli´c et al. [101], the application of heuristics as mental strategies and certain deformations in the thoughts and perceptions of decision makers affect their attitudes and approach to problem solving. Trueblood et al. [102] mention that we need to understand how people make perceptual decisions to improve training to minimize misdiagnoses in the medical field. So, let us adapt this approach to cybersecurity: the defense strategy must be oriented toward the factors associated with the cognitive process; this is described in Equation (2), where: R.T is the Response Time associated with the time

for executing a defense action by a cybersecurity analyst; H.T is the heuristic thinking associated with the process of selecting a decision; B is the Bias related to human thinking, and S.A is the speed accuracy in the decision-making process.

$$\text{Cogarithmic Process} = \mathbf{w1(R.T)} + \mathbf{w2(H.T)} + \mathbf{w3(B)} + \mathbf{w4(S.A)}\tag{2}$$

where wi is the weight assigned to each variable.

Once the cognitive process has been carried out, the best decision is made considering the weight of each variable in the cognitive process, expressed in Equation (3).

$$\text{Decision(j)} = \text{(AP j)} \cdot \text{Cogarithmic process} \tag{3}$$

where Delta P j is the variation due to weights in cognitive processes. Therefore, the defense strategy is expressed as Equation (4).

$$\text{Defense} = \text{(Decision j)} + \text{Error} \tag{4}$$

However, analysts in the cybersecurity decision-making process could be affected by factors such as Bias and speed accuracy. Bias (B) effects and speed-accuracy effects are ubiquitous in experimental psychology. Bias effects arise when the two stimulus alternatives occur with unequal frequency or have unequal rewards attached to them. Speed-accuracy (SA) effects arise as the result of explicit instructions emphasizing speed or accuracy [103]. Computational models of decision making present a solution to this problem. In particular, we choose Response Time (RT) models such as the drift-diffusion model (D.D.M.), proposed by Ratcliff [103], and the linear ballistic accumulator (LBA) model, proposed by Brown [104]. Accumulator models assume that evidence is accumulated over time until a threshold amount is reached for a commitment to that response option. These models contain four primary parameters related to different psychological components of simple decisions: caution, Bias, stimulus processing, and motor sense.