Biblio

With the ever-increasing energy demand and enormous development of generation capacity, modern bulk power systems are mostly pushed to operate with narrower security boundaries. Therefore, timely and reliable assessment of power system security is an inevitable necessity to prevent widespread blackouts and cascading outages. In this paper, a new white-box decision tree-based preventive strategy is presented to evaluate and enhance the power system dynamic security versus the credible N-K contingencies originating from transient instabilities. As well, a competent operating measure is expertly defined to detect and identify the islanding and non-islanding conditions with the aid of a wide-area phasor measurement system. The newly developed strategy is outlined by a three-level simulation with the aim of guaranteeing the power system dynamic security. In the first-level, six hundred islanding and non-islanding scenarios are generated using an enhanced version of the ID3 algorithm, referred to as the C4.5 algorithms. In the second-level, optimal C4.5 decision trees are offline trained based on operating parameters achieved by the reduction error pruning method. In the third level, however, all trained decision trees are rigorously investigated offline and online; and then, the most accurate and reliable decision tree is selected. The newly developed strategy is examined on the IEEE New England 39-bus test system, and its effectiveness is assured by simulation studies.

Windows Communication Foundation (WCF) is a communication framework for building connected, service-oriented applications, initially released by Microsoft as part of.NET Framework, but now open source. The WCF message-based communication is a very popular solution used for sending asynchronous messages from one service endpoint to another. Because WCF provides many functionalities it has a large-consuming development model and often the security measures implemented in applications are not proper. In this study we propose a methodology for offensive security analysis of an WCF endpoint or service, from red team perspective. A step by step approach, empirical information, and detailed analysis report of WCF vulnerabilities are presented. We conclude by proposing recommendations for mitigating attacks and securing endpoints.

Anonymous Communication Networks (ACNs) are networks in which, beyond data confidentiality, also traffic flow confidentiality is provided. The most popular routing approach for ACNs also used in practice is Onion. Onion is based on multiple encryption wrapping combined with the proxy mechanism (relay nodes). However, it offers neither sender anonymity nor recipient anonymity in a global passive adversary model, simply because the adversary can observe (at the first relay node) the traffic coming from the sender, and (at the last relay node) the traffic delivered to the recipient. This may also cause a loss of relationship anonymity if timing attacks are performed. This paper presents Onion-Ring, a routing protocol that improves anonymity of Onion in the global adversary model, by achieving sender anonymity and recipient anonymity, and thus relationship anonymity.

In this paper, we study covert communications between a pair of legitimate transmitter-receiver against a watchful warden over slow fading channels. There coexist multiple friendly helper nodes who are willing to protect the covert communication from being detected by the warden. We propose an uncoordinated jammer selection scheme where those helpers whose instantaneous channel gains to the legitimate receiver fall below a pre-established selection threshold will be chosen as jammers radiating jamming signals to defeat the warden. By doing so, the detection accuracy of the warden is expected to be severely degraded while the desired covert communication is rarely affected. We then jointly design the optimal selection threshold and message transmission rate for maximizing covert throughput under the premise that the detection error of the warden exceeds a certain level. Numerical results are presented to validate our theoretical analyses. It is shown that the multi-jammer assisted covert communication outperforms the conventional single-jammer method in terms of covert throughput, and the maximal covert throughput improves significantly as the total number of helpers increases, which demonstrates the validity and superiority of our proposed scheme.

This paper aims to identify Wi-SUN devices using physical layer fingerprint. We first extract physical layer features based on the received Wi-SUN signals, especially focusing on device-specific clock skew and frequency deviation in FSK modulation. Then, these physical layer fingerprints are used to train a machine learning-based classifier and the resulting classifier finally identifies the authorized Wi-SUN devices. Preliminary experiments on Wi-SUN certified chips show that the authenticator with the proposed physical layer fingerprints can distinguish Wi-SUN devices with 100 % accuracy. Since no additional computational complexity for authentication is involved on the device side, our approach can be applied to any Wi-SUN based IoT devices with security requirements.

This paper presents Zero-Day Attack Packet Highlighting System. Proposed system outputs zero-day attack packet information from flow extracted as result of regression inspection of packets stored in flow-based PCA. It also highlights raw data of the packet matched with rule. Also, we design communication protocols for sending and receiving data within proposed system. Purpose of the proposed system is to solve existing flow-based problems and provides users with raw data information of zero-day packets so that they can analyze raw data for the packets.

This demo paper presents the technical details and usage scenarios of μSE: a mutation-based tool for evaluating security-focused static analysis tools for Android. Mutation testing is generally used by software practitioners to assess the robustness of a given test-suite. However, we leverage this technique to systematically evaluate static analysis tools and uncover and document soundness issues.μSE's analysis has found 25 previously undocumented flaws in static data leak detection tools for Android.μSE offers four mutation schemes, namely Reachability, Complex-reachability, TaintSink, and ScopeSink, which determine the locations of seeded mutants. Furthermore, the user can extend μSE by customizing the API calls targeted by the mutation analysis.μSE is also practical, as it makes use of filtering techniques based on compilation and execution criteria that reduces the number of ineffective mutations.

Cross-site scripting (XSS) is a common security vulnerability found in web applications. DOM-based XSS, one of the variants, is becoming particularly more prevalent with the boom of single-page applications where most of the UI changes are achieved by modifying the DOM through in-browser scripting. It is very easy for developers to introduce XSS vulnerabilities into web applications since there are many ways for user-controlled, unsanitized input to flow into a Web API and get interpreted as HTML markup and JavaScript code. An emerging Web API proposal called Trusted Types aims to prevent DOM XSS by making Web APIs secure by default. Different from other XSS mitigations that mostly focus on post-development protection, Trusted Types direct developers to write XSS-free code in the first place. A common concern when adopting a new security mechanism is how much effort is required to refactor existing code bases. In this paper, we report a case study on adopting Trusted Types in a well-established web framework. Our experience can help the web community better understand the benefits of making web applications compatible with Trusted Types, while also getting to know the related challenges and resolutions. We focused our work on Angular, which is one of the most popular web development frameworks available on the market.

The cluster-featured conurbation cyber-physical power system (CPPS) interconnected with tie-lines facing the hazards from catastrophic cascading failures. To achieve better real-time performance, enhance the autonomous ability and improve resilience for the clustered conurbation CPPS, the decentralized cyber structure and the corresponding distributed security control strategy is proposed. Facing failures, the real-time security control is incorporated to mitigate cascading failures. The distributed security control problem is solved reliably based on alternating direction method of multipliers (ADMM). The system overall resilience degradation index(SORDI) adopted reflects the influence of cascading failures on both the topological integrity and operational security. The case study illustrates the decentralized cyber layer and distributed control will decrease the data congestion and enhance the autonomous ability for clusters, thus perform better effectiveness in mitigating the cascading failures, especially in topological perspective. With the proposed distributed security control strategy, curves of SORDI show more characteristics of second-order percolation transition and the cascading failure threshold increase, which is more efficient when the initial failure size is near the threshold values or step-type inflection point. Because of the feature of geological aggregation under cluster-based attack, the efficiency of the cluster-focused distributed security control strategy is more obvious than other nodes attack circumstances.

Due to its minimal price and expandable wireless open system interconnection options for the coming years, wireless mesh networking is appealing, developing, and novel medium of speech, which is why it is becoming a somewhat widely used communication field. In all network types, one of the essential factors for prevalent and trustworthy communication is cybersecurity. The IEEE 802.11 working gathering has created various correspondence guidelines. Yet, they are by and by focusing on the 802.11s standard because of its dynamic setup and geography learning abilities. Information, voice, and directions are steered between hubs employing remote lattice organising. WMNs incidentally give nearby 802.11g admittance to customers and connection neighbours utilising 802.11a "backhaul," but this isn’t generally the situation because of changing requirements, for example, top information rate and inclusion range. The small cross-sectional organisation emerged as a fundamental innovation to enable broadband system management in large regions. It benefits specialised organisations by reducing the cost of sending networks and end customers by providing ubiquitous Internet access anywhere, anytime. Given the idea of wireless mesh networking and the lack of integrated organisational technology, small grid networks are powerless against malicious attacks. In the meantime, the limit of multi-radio multi-channel correspondence, the need for heterogeneous organisation coordination, and the interest for multi-bounce remote equality often render conventional security strategies ineffectual or challenging to carry out. Thus, wireless mesh networking presents new issues that require more viable and relevant arrangements. WMNs have piqued the curiosity of both scholastics and industry because of their promising future. Numerous testbeds are built for research purposes, and business items for veritable WMNs are accessible. Anyway, a few concerns should be cleared up before they can very well become widespread. For example, the accessible MAC and routing conventions are not customisable; the throughput drops impressively with an increasing number of hubs or bounces in WMNs. Because of the weakness of WMNs against various malicious attacks, the security and protection of correspondence is a serious concern. For example, enemies can sniff long-distance correspondence to obtain sensitive data. Attackers can carry out DoS attacks and control the substance of the information sent through compromised hubs, thereby endangering the company’s secret, accessibility authenticity, and integrity. WMNs, like compact Impromptu Organisations (MANETs), share a typical medium, no traffic aggregate point, and incredible topography. Due to these restrictions, normal safety frameworks in wired associations can’t be quickly applied to WMNs. Also, the techniques utilised in MANETs are not viable with WMNs. This is because of the manner in which WMNs expand MANETs in different ways. Framework centres are generally outfitted with an assortment of radios. Then, at that point, many channels are doled out to every centre to work with concurrent data move and diversity.

This paper focuses on the typical business scenario of intelligent factory, it includes the manufacturing process, carries out hierarchical security protection, forms a full coverage industrial control security protection network, completes multi-means industrial control security direct protection, at the same time, it utilizes big data analysis, dynamically analyzes the network security situation, completes security early warning, realizes indirect protection, and finally builds a self sensing and self-adjusting industrial network security protection system It provides a reliable reference for the development of intelligent manufacturing industry.

Along with the advance of science and technology, informationization society construction is gradually perfect. The development of modern information technology has driven the growth of the entire network spatial data, and network security is a matter of national security. There are several countries included in the national security strategy, with the increase of network space connected point, traditional network security space processing way already cannot adapt to the demand. Machine learning can effectively solve the problem of network security. Around the machine learning technology applied in the field of network security research results, this paper introduces the basic concept of network security situational awareness system, the basic model, and system framework. Based on machine learning, this paper elaborates the network security situation awareness technology, including data mining technology, feature extraction technology and situation prediction technology. Recursive feature elimination, decision tree algorithm, support vector machine, and future research direction in the field of network security situational awareness are also discussed.

This paper proposes an artificial immune information security protection technology architecture for embedded system of Electric power equipment. By simulating the three functions of human immunity, namely "immune homeostasis", "immune surveillance" and "immune defense", the power equipment is endowed with the ability of human like active immune security protection. Among them, "immune homeostasis" is constructed by trusted computing technology components to establish a trusted embedded system running environment. Through fault-tolerant component construction, "immune surveillance" and "immune defense" realize illegal data defense, business logic legitimacy check and equipment status evaluation, realize real-time perception and evaluation of power equipment's own security status, as well as fault emergency handling and event backtracking record, so that power equipment can realize self recovery from abnormal status. The proposed technology architecture is systematic, scientific and rich in scalability, which can significantly improve the information security protection ability of electric power equipment.

Neural networks with deep architectures have been used to construct state-of-the-art classifiers that can match human level accuracy in areas such as image classification. However, many of these classifiers can be fooled by examples slightly modified from their original forms. In this work, we propose a novel approach for generating adversarial examples that makes use of only attribution information of the features and perturbs only features that are highly influential to the output of the classifier. We call this approach Attribution Based Adversarial Generation (ABAG). To demonstrate the effectiveness of this approach, three somewhat arbitrary algorithms are proposed and examined. In the first algorithm all non-zero attributions are utilized and associated features perturbed; in the second algorithm only the top-n most positive and top-n most negative attributions are used and corresponding features perturbed; and in the third algorithm the level of perturbation is increased in an iterative manner until an adversarial example is discovered. All of the three algorithms are implemented and experiments are performed on the well-known MNIST dataset. Experiment results show that adversarial examples can be generated very efficiently, and thus prove the validity and efficacy of ABAG - utilizing attributions for the generation of adversarial examples. Furthermore, as shown by examples, ABAG can be adapted to provides a systematic searching approach to generate adversarial examples by perturbing a minimum amount of features.

Software vulnerabilities are weaknesses in software systems that can have serious consequences when exploited. Examples of side effects include unauthorized authentication, data breaches, and financial losses. Due to the nature of the software industry, companies are increasingly pressured to deploy software as quickly as possible, leading to a large number of undetected software vulnerabilities. Static code analysis, with the support of Static Analysis Tools (SATs), can generate security alerts that highlight potential vulnerabilities in an application's source code. Software Metrics (SMs) have also been used to predict software vulnerabilities, usually with the support of Machine Learning (ML) classification algorithms. Several datasets are available to support the development of improved software vulnerability detection techniques. However, they suffer from the same issues: they are either outdated or use a single type of information. In this paper, we present a methodology for collecting software vulnerabilities from known vulnerability databases and enhancing them with static information (namely SAT alerts and SMs). The proposed methodology aims to define a mechanism capable of more easily updating the collected data.

Interleave division multiple access (IDMA) is a multiple-access scheme and it is expected to improve frequency efficiency. Meanwhile, the damage caused by cyberattacks is increasing yearly. To solve this problem, we propose a method of applying radio-wave encryption to IDMA based on chaos modulation to realize physical layer security and the channel coding effect. We show that the proposed scheme ensures physical layer security and obtains channel coding gain by numerical simulations.

Networked embedded systems (which include IoT, CPS, etc.) are vulnerable. Even though we know how to secure these systems, their heterogeneity and the heterogeneity of security policies remains a major problem. Designers face ever more sophisticated attacks while they are not always security experts and have to get a trade-off on design criteria. We propose in this paper the CLASA architecture (Cross-Layer Agent Security Architecture), a generic, integrated, inter-operable, decentralized and modular architecture which relies on cross-layering.

Cyber-physical systems are vulnerable to attacks that can cause them to reach undesirable states. This paper provides a theoretical solution for increasing the resiliency of control systems through the use of a high-authority supervisor that monitors and regulates control signals sent to the actuator. The supervisor aims to determine the control signal limits that provide maximum freedom of operation while protecting the system. For this work, a cyber attack is assumed to overwrite the signal to the actuator with Gaussian noise. This assumption permits the propagation of a state covariance matrix through time. Projecting the state covariance matrix on the state space reveals a confidence ellipse that approximates the reachable set. The standard deviation is found so that the confidence ellipse is tangential to the danger area in the state space. The process is applied to ship dynamics where an ellipse in the state space is transformed to an arc in the plane of motion. The technique is validated through the simulation of a ship traveling through a narrow channel while under the influence of a cyber attack.

Software-defined network (SDN) is a network architecture that used to build, design the hardware components virtually. We can dynamically change the settings of network connections. In the traditional network, it's not possible to change dynamically, because it's a fixed connection. SDN is a good approach but still is vulnerable to DDoS attacks. The DDoS attack is menacing to the internet. To prevent the DDoS attack, the machine learning algorithm can be used. The DDoS attack is the multiple collaborated systems that are used to target the particular server at the same time. In SDN control layer is in the center that link with the application and infrastructure layer, where the devices in the infrastructure layer controlled by the software. In this paper, we propose a machine learning technique namely Decision Tree and Support Vector Machine (SVM) to detect malicious traffic. Our test outcome shows that the Decision Tree and Support Vector Machine (SVM) algorithm provides better accuracy and detection rate.

Nowadays is becoming trivial to have multiple virtual machines working in parallel on hardware platforms with high processing power. This appropriate cost effective approach can be found at Internet Service Providers, in cloud service providers’ environments, in research and development lab testing environment (for example Universities’ student’s lab), in virtual application for security evaluation and in many other places. In the aforementioned cases, it is often necessary to start and/or stop virtual machines on the fly. In cloud service providers all the creation / tear down actions are triggered by a customer request and cannot be postponed or delayed for later evaluation. When a new virtual machine is created, it is imperative to assign unique IP addresses to all network interfaces and also domain name system DNS records that contain text based data, IP addresses, etc. Even worse, if a virtual machine has to be stopped or torn down, the critical network resources such as IP addresses and DNS records have to be carefully controlled in order to avoid IP addresses conflicts and name resolution problems between an old virtual machine and a newly created virtual machine. This paper proposes a provisioning mechanism to avoid both DNS records and IP addresses conflicts due to human misconfiguration, problems that can cause networking operation service disruptions.

Wireless Sensor Network (WSN) is considered as the backbone of Internet of Things (IoT) networks. Authentication is the most important phase that guarantees secure access to such networks but it is more critical than that in traditional Internet because the communications are established between constrained devices that could not compute heavy cryptographic primitives. In this paper, we are studying with real experimentation the efficiency of HIP Diet EXchange header (HIP DEX) protocol over IPv6 over Low Power Wireless Personal Area Networks (6LoWPAN) in IoT. The adopted application layer protocol is Constrained Application Protocol (CoAP) and as a routing protocol, the Routing Protocol for Low power and lossy networks (RPL). The evaluation concerns the total End-to-End transmission delays during the authentication process between the communicating peers regarding the processing, propagation, and queuing times' overheads results. Most importantly, we propose an efficient handshake packets' compression header, and we detailed a comparison of the above evaluation's criteria before and after the proposed compression. Obtained results are very encouraging and reinforce the efficiency of HIP DEX in IoT networks during the handshake process of constrained nodes.

Structural analysis is the study of finding component functions for a given function. In this paper, we proceed with structural analysis of structures consisting of the S (nonlinear Substitution) layer and the A (Affine or linear) layer. Our main interest is the S1AS2 structure with different substitution layers and large input/output sizes. The purpose of our structural analysis is to find the functionally equivalent oracle F* and its component functions for a given encryption oracle F(= S2 ∘ A ∘ S1). As a result, we can construct the decryption oracle F*−1 explicitly and break the one-wayness of the building blocks used in a White-box implementation. Our attack consists of two steps: S layer recovery using multiset properties and A layer recovery using differential properties. We present the attack algorithm for each step and estimate the time complexity. Finally, we discuss the applicability of S1AS2 structural analysis in a White-box Cryptography environment.

The Digital Signature Algorithm (DSA) is a representative of a family of digital signature algorithms that are known to have a number of subliminal channels for covert data transmission. The capacity of these channels stretches from several bits (narrowband channels) to about 256 or so bits (a broadband channel). There are a couple of methods described in the literature to prevent the usage of the broadband channel with the help of a warden. In the present paper, we discuss some weaknesses of the known methods and suggest a solution that is free of the weaknesses and eliminates the broadband covert channel. Our solution also requires a warden who does not participate in signature generation and is able to check any signed message for the absence of the covert communication.

Buffer overflow (BOF) vulnerability is one of the most dangerous security vulnerability which can be exploited by unwanted users. This vulnerability can be detected by both static and dynamic analysis techniques. For dynamic analysis, execution of the program is required in which the behavior of the program according to specifications is checked while in static analysis the source code is analyzed for security vulnerabilities without execution of code. Despite the fact that many open source and commercial security analysis tools employ static and dynamic methods but there is still a margin for improvement in BOF vulnerability detection capability of these tools. We propose an enhancement in Cppcheck tool for statically detecting BOF vulnerability using data flow analysis in C programs. We have used the Juliet Test Suite to test our approach. We selected two best tools cited in the literature for BOF detection (i.e. Frama-C and Splint) to compare the performance and accuracy of our approach. From the experiments, our proposed approach generated Youden Index of 0.45, Frama-C has only 0.1 Youden's score and Splint generated Youden score of -0.47. These results show that our technique performs better as compared to both Frama-C and Splint static analysis tools.

In this research we have explained to set up an Infrared Array Sensor system that is IOT based in order to provide security at remote location. We have tried to Establishment of cloud environment to host IOT application & Development of IOT Application using Asp.net with C\# programming platform. We have Integrated IOT with Infrared Array sensors in order to implement proposed work. In this research camera captures the external event and sent signal to Infrared grid array sensor. Internet of Things (IoT) would enable applications of utmost societal value including smart cities, smart grids & smart healthcare. For majority of such applications, strict dependability requirements are placed on IOT performance, & sensor data as well as actuator commands must be delivered reliably & timely.