Resiliency and Security, 2014

 
SoS Logo

Resiliency and Security, 2014

 

Resiliency is one of the five hard problems in cybersecurity science.  The work presented here was produced in 2014.

 

Bodeau, D.; Brtis, J.; Graubart, R.; Salwen, J., "Resiliency Techniques For Systems-Of-Systems Extending And Applying The Cyber Resiliency Engineering Framework To The Space Domain," Resilient Control Systems (ISRCS), 2014 7th International Symposium on, pp. 1, 6, 19-21 Aug. 2014. doi: 10.1109/ISRCS.2014.6900099
Abstract: This paper describes how resiliency techniques apply to an acknowledged system-of-systems. The Cyber Resiliency Engineering Framework is extended to apply to resilience in general, with a focus on resilience of space systems. Resiliency techniques can improve system-of-systems operations. Both opportunities and challenges are identified for resilience as an emergent property in an acknowledged system-of-systems.
Keywords: aerospace computing; security of data; cyber resiliency engineering framework; resiliency technique; space domain; system-of-systems operations; Collaboration; Dynamic scheduling;Interoperability;Monitoring;Redundancy;Resilience;Space vehicles; cyber security; resilience; system-of-systems (ID#: 15-5324)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6900099&isnumber=6900080

 

Bin Hu; Gharavi, H., "Smart Grid Mesh Network Security Using Dynamic Key Distribution with Merkle Tree 4-Way Handshaking," Smart Grid, IEEE Transactions on, vol. 5, no. 2, pp. 550, 558, March 2014. doi: 10.1109/TSG.2013.2277963
Abstract: Distributed mesh sensor networks provide cost-effective communications for deployment in various smart grid domains, such as home area networks (HAN), neighborhood area networks (NAN), and substation/plant-generation local area networks. This paper introduces a dynamically updating key distribution strategy to enhance mesh network security against cyber attack. The scheme has been applied to two security protocols known as simultaneous authentication of equals (SAE) and efficient mesh security association (EMSA). Since both protocols utilize 4-way handshaking, we propose a Merkle-tree based handshaking scheme, which is capable of improving the resiliency of the network in a situation where an intruder carries a denial of service attack. Finally, by developing a denial of service attack model, we can then evaluate the security of the proposed schemes against cyber attack, as well as network performance in terms of delay and overhead.
Keywords: computer network performance evaluation; computer network security; cryptographic protocols; home networks; smart power grids; substations; trees (mathematics); wireless LAN; wireless mesh networks; wireless sensor networks; EMSA; HAN; IEEE 802.11s; Merkle tree 4-way handshaking scheme; NAN; SAE; WLAN; cost-effective communications; cyber attack; denial-of-service attack model; distributed mesh sensor networks; dynamic key distribution strategy updating; efficient mesh security association; home area networks; neighborhood area networks; network performance; network resiliency improvement; plant-generation local area networks; security protocols; simultaneous authentication-of-equals; smart grid mesh network security enhancement; substation local area networks; wireless local area networks; Authentication; Computer crime; Logic gates; Mesh networks; Protocols; Smart grids; EMSA; IEEE 802.11s;SAE; security attacks; security protocols; smart grid; wireless mesh networks (ID#: 15-5325)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6599007&isnumber=6740878

 

Teng Xu; Potkonjak, M., "A Lightweight Security Primitive Using Laser-Based Fault Injection," SENSORS, 2014 IEEE, pp. 1248, 1251, 2-5 Nov. 2014. doi: 10.1109/ICSENS.2014.6985236
Abstract: Security and low power are essential requirements for sensor networks. In order to meet these requirements we have proposed a new type of lightweight security primitive using laser-based fault injection. The essential idea is to use lasers to cut the wires in the circuit layouts, thus to intentionally introduce faults in circuits. We have the following key observations: (1) Large VLSI ICs with partial faults can produce highly unpredictable outputs. (2) Faults in different positions in circuits can cause huge difference in outputs alternation. Therefore, we take advantage of the excellent output randomness of the circuit after fault-injection and directly use it as a security primitive. Compared to the traditional security primitive, e.g., PUF, our proposed laser-based security primitive is robust and resiliency against conditions of operations. More importantly, it employs very low power consumption, therefore providing an ideal platform for sensor networks. We compare the fault injection on standard modules, such as adders, multipliers, and XOR networks and further propose the best architecture. Our statistical tests indicate that by using the laser-based fault injection, lightweight security primitives for sensor networks with small footprint and low energy can be created.
Keywords: VLSI; fault diagnosis; low-power electronics; wireless sensor networks; XOR networks; adders; large VLSI ICs; laser-based fault injection; lightweight security primitive; low power consumption; multipliers; wireless sensor networks; Adders; Circuit faults; Hardware; Laser theory; Logic gates; Security (ID#: 15-5326)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6985236&isnumber=6984913

 

Alexiou, N.; Basagiannis, S.; Petridou, S., "Security Analysis Of NFC Relay Attacks Using Probabilistic Model Checking," Wireless Communications and Mobile Computing Conference (IWCMC), 2014 International, pp.524,529, 4-8 Aug. 2014. doi: 10.1109/IWCMC.2014.6906411
Abstract: Near Field Communication (NFC) is a short-ranged wireless communication technology envisioned to support a large gamut of smart-device applications, such as payment and ticketing applications. Two NFC-enabled devices need to be in close proximity, typically less than 10 cm apart, in order to communicate. However, adversaries can use a secret and fast communication channel to relay data between two distant victim NFC-enabled devices and thus, force NFC link between them. Relay attacks may have tremendous consequences for security as they can bypass the NFC requirement for short range communications and even worse, they are cheap and easy to launch. Therefore, it is important to evaluate security of NFC applications and countermeasures to support the emergence of this new technology. In this work we present a probabilistic model checking approach to verify resiliency of NFC protocol against relay attacks based on protocol, channel and application specific parameters that affect the successfulness of the attack. We perform our formal analysis within the probabilistic model checking environment PRISM to support automated security analysis of NFC applications. Finally, we demonstrate how the attack can be thwarted and we discuss the successfulness of potential countermeasures.
Keywords: access protocols; formal verification; near-field communication; telecommunication security; wireless channels; NFC protocol; NFC relay attacks; automated security analysis; fast communication channel; formal analysis; near field communication; probabilistic model checking environment PRISM; secret communication channel; short range communications; short-ranged wireless communication technology; smart device applications; Delays; Model checking; Probabilistic logic; Relays; Security; Transport protocols; Near Field Communication; probabilistic model checking; relay attack; security analysis (ID#: 15-5327)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6906411&isnumber=6906315

 

Zonouz, S.; Davis, C.M.; Davis, K.R.; Berthier, R.; Bobba, R.B.; Sanders, W.H., "SOCCA: A Security-Oriented Cyber-Physical Contingency Analysis in Power Infrastructures," Smart Grid, IEEE Transactions on, vol.5, no. 1, pp. 3, 13, Jan. 2014. doi: 10.1109/TSG.2013.2280399
Abstract: Contingency analysis is a critical activity in the context of the power infrastructure because it provides a guide for resiliency and enables the grid to continue operating even in the case of failure. In this paper, we augment this concept by introducing SOCCA, a cyber-physical security evaluation technique to plan not only for accidental contingencies but also for malicious compromises. SOCCA presents a new unified formalism to model the cyber-physical system including interconnections among cyber and physical components. The cyber-physical contingency ranking technique employed by SOCCA assesses the potential impacts of events. Contingencies are ranked according to their impact as well as attack complexity. The results are valuable in both cyber and physical domains. From a physical perspective, SOCCA scores power system contingencies based on cyber network configuration, whereas from a cyber perspective, control network vulnerabilities are ranked according to the underlying power system topology.
Keywords: power grids; power system planning; power system security; SOCCA; accidental contingency; control network; cyber components; cyber network configuration; cyber perspective; cyber-physical security evaluation; grid operation; malicious compromises; physical components; power infrastructures; power system contingency; power system topology; security-oriented cyber-physical contingency analysis; Algorithm design and analysis; Indexes; Mathematical model; Network topology; Power grids; Security; Contingency analysis; cyber-physical systems; security; situational awareness; state estimation (ID#: 15-5328)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6687271&isnumber=6693741

 

Hussain, A.; Faber, T.; Braden, R.; Benzel, T.; Yardley, T.; Jones, J.; Nicol, D.M.; Sanders, W.H.; Edgar, T.W.; Carroll, T.E.; Manz, D.O.; Tinnel, L., "Enabling Collaborative Research for Security and Resiliency of Energy Cyber Physical Systems," Distributed Computing in Sensor Systems (DCOSS), 2014 IEEE International Conference on , vol., no., pp.358,360, 26-28 May 2014. doi: 10.1109/DCOSS.2014.36
Abstract: The University of Illinois at Urbana Champaign (Illinois), Pacific Northwest National Labs (PNNL), and the University of Southern California Information Sciences Institute (USC-ISI) consortium is working toward providing tools and expertise to enable collaborative research to improve security and resiliency of cyber physical systems. In this extended abstract we discuss the challenges and the solution space. We demonstrate the feasibility of some of the proposed components through a wide-area situational awareness experiment for the power grid across the three sites.
Keywords: fault tolerant computing; power engineering computing; power grids; security of data; collaborative research; cyber physical system resiliency; cyber physical system security; energy cyber physical systems; power grid; wide-area situational awareness experiment; Collaboration; Communities; Computer security; Data models; Phasor measurement units; Power systems; cyber physical systems; energy; experimentation (ID#: 15-5329)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6846190&isnumber=6846129

 

Shila, D.M.; Venugopal, V., "Design, Implementation and Security Analysis Of Hardware Trojan Threats In FPGA," Communications (ICC), 2014 IEEE International Conference on, pp. 719, 724, 10-14 June 2014. doi: 10.1109/ICC.2014.6883404
Abstract: Hardware Trojan Threats (HTTs) are stealthy components embedded inside integrated circuits (ICs) with an intention to attack and cripple the IC similar to viruses infecting the human body. Previous efforts have focused essentially on systems being compromised using HTTs and the effectiveness of physical parameters including power consumption, timing variation and utilization for detecting HTTs. We propose a novel metric for hardware Trojan detection coined as HTT detectability metric (HDM) that uses a weighted combination of normalized physical parameters. HTTs are identified by comparing the HDM with an optimal detection threshold; if the monitored HDM exceeds the estimated optimal detection threshold, the IC will be tagged as malicious. As opposed to existing efforts, this work investigates a system model from a designer perspective in increasing the security of the device and an adversary model from an attacker perspective exposing and exploiting the vulnerabilities in the device. Using existing Trojan implementations and Trojan taxonomy as a baseline, seven HTTs were designed and implemented on a FPGA testbed; these Trojans perform a variety of threats ranging from sensitive information leak, denial of service to beat the Root of Trust (RoT). Security analysis on the implemented Trojans showed that existing detection techniques based on physical characteristics such as power consumption, timing variation or utilization alone does not necessarily capture the existence of HTTs and only a maximum of 57% of designed HTTs were detected. On the other hand, 86% of the implemented Trojans were detected with HDM. We further carry out analytical studies to determine the optimal detection threshold that minimizes the summation of false alarm and missed detection probabilities.
Keywords: field programmable gate arrays; integrated logic circuits; invasive software; FPGA testbed; HDM;HTT detectability metric; HTT detection; ICs; RoT; Trojan taxonomy; denial of service; hardware Trojan detection technique; hardware Trojan threats; integrated circuits; missed detection probability; normalized physical parameters; optimal detection threshold; power consumption; root of trust; security analysis; sensitive information leak; summation of false alarm; timing variation; Encryption; Field programmable gate arrays; Hardware; Power demand; Timing; Trojan horses; Design; Hardware Trojans; Resiliency; Security (ID#: 15-5330)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6883404&isnumber=6883277

 

Msolli, A.; Helali, A.; Maaref, H., "Enhance Resiliency To Pool Based Key Pre-Distribution Scheme," Computer & Information Technology (GSCIT), 2014 Global Summit on, pp. 1, 4, 14-16 June 2014. doi: 10.1109/GSCIT.2014.6970107
Abstract: The security of the information stored or transmitted through a wireless sensor network against attacks is a primary objective. Key management includes many security services such as confidentiality and authentication. Under the constraints of WSN, designing a scheme of key management is a major challenge. In this paper, we improve the resilience of pool based on symmetric key pre-distribution scheme against capture nodes and secure connectivity coverage.
Keywords: cryptography; telecommunication security; wireless sensor networks; WSN; connectivity coverage security; information security; key management; pool based key predistribution scheme; resiliency enhancement; symmetric key predistribution scheme; wireless sensor network; Cryptography; Simulation; cryptography; key management scheme; resiliency against nodes capture; wireless sensors network (ID#: 15-5331)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6970107&isnumber=6970090

 

Mihai-Gabriel, I.; Victor-Valeriu, P., "Achieving Ddos Resiliency In A Software Defined Network By Intelligent Risk Assessment Based On Neural Networks And Danger Theory," Computational Intelligence and Informatics (CINTI), 2014 IEEE 15th International Symposium on, pp. 319, 324, 19-21 Nov. 2014. doi: 10.1109/CINTI.2014.7028696
Abstract: Distributed Denial of Service (DDoS) attacks are becoming a very versatile weapon. Unfortunately, they are becoming very popular amongst cyber criminals, and they are also getting cheaper. As the interest grows for such weapons on the black market, their scale reaches unimaginable proportions. As is the case of the Spamhaus attack, which was mitigated by CloudFlare through null-routing techniques. This paper presents a way of mitigating DDoS attacks in a Software Defined Network (SDN) environment, by assessing risk through the means of a cyber-defense system based on neural networks and the biological danger theory. In addition to mitigating attacks the demo platform can also perform full packet capture in the SDN, if the central command component deems it necessary. These packet captures can be used later for forensic analysis and identification of the attacker.
Keywords: computer network security; digital forensics; neural nets; risk management; software defined networking; CloudFlare; DDoS attack mitigation; DDoS resiliency; SDN environment; Spamhaus attack; attacker identification; biological danger theory; cyber criminals; cyber-defense system; distributed denial of service attacks; forensic analysis; full packet capture; intelligent risk assessment; neural networks; null-routing technique; software defined network; Computer crime; Control systems; Delays; Monitoring; Neural networks; Servers (ID#: 15-5332)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=7028696&isnumber=7028644

 

Barreto, C.; Giraldo, J.; Cardenas, A.A.; Mojica-Nava, E.; Quijano, N., "Control Systems for the Power Grid and Their Resiliency to Attacks," Security & Privacy, IEEE, vol. 12, no. 6, pp. 15, 23, Nov.-Dec. 2014. doi: 10.1109/MSP.2014.111
Abstract: Most government, industry, and academic efforts to protect the power grid have focused on information security mechanisms for preventing and detecting attacks. In addition to these mechanisms, control engineering can help improve power grid security.
Keywords: power grids; power system control; power system security; attack detection; attack prevention; control engineering; control systems; information security mechanisms; power grid security; Computer security; Control systems; Energy management; Power grids; Resilience; Smart grids; control systems; cyber-physical systems; power grid; resiliency; security; smart grid (ID#: 15-5333)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=7006441&isnumber=7006395

 

Ali, S.S.; Sinanoglu, O.; Karri, R., "AES Design Space Exploration New Line For Scan Attack Resiliency," Very Large Scale Integration (VLSI-SoC), 2014 22nd International Conference on, pp. 1, 6, 6-8 Oct. 2014. doi: 10.1109/VLSI-SoC.2014.7004193
Abstract: Crypto-chips are vulnerable to side-channel attacks. Scan attack is one such side-channel attack which uses the scan-based DFT test infrastructure to leak the secret information of the crypto-chip. In the presence of scan, an attacker can run the chip in normal mode, and then by switching to the test mode, retrieve the intermediate results of the crypto-chip. Using only a few input-output pairs one can retrieve the entire secret key. Almost all the scan attacks on AES crypto-chip use the same iterative 128-bit AES design where the round register is placed exactly after the round operation. However, the attack potency may vary depending on the design of AES. In this work, we consider various designs of AES. We shed light on the impact of design style on the scan attack. We also consider response compaction in our analysis. We show that certain design decisions deliver inherent resistance to scan attack.
Keywords: cryptography; design for testability; AES design space exploration; DFT test infrastructure; advanced encryption standard; cryptochips; design style; input-output pairs; normal mode; response compaction; round operation; round register; scan attack resiliency; secret key; side-channel attacks; test mode; word length 128 bit; Ciphers; Clocks; Computer architecture; Encryption; Hamming distance; Microprocessors; Registers; AES Scan Chain; Scan Attack; Scan-based DFT; Security; Testability (ID#: 15-5334)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=7004193&isnumber=7004150

 

Vadari, Mani, "Dynamic Microgrids - A Potential Solution For Enhanced Resiliency In Distribution Systems," Test Conference (ITC), 2014 IEEE International, pp. 1, 1, 20-23 Oct. 2014. doi: 10.1109/TEST.2014.7035285
Abstract: Of late, microgrids are getting a lot of attention, not just to support national security at military bases, but also to provide more resilient power supplies at other types of facilities, to allow for increased penetration of renewables, and other reasons. College campuses, military bases, and even corporate campuses are exploring microgrid options. This has spurred creation of new technologies and control mechanisms that allow these systems to operate in a grid-connected mode and also independently for extended periods of time. In this presentation, we propose a radical new concept: a top-down breakup of the distribution grid into an interconnected set of microgrids. Such an architecture would dramatically change how utilities address storm response while also delivering utilities' other mandates. We call this the “dynamic microgrid”, a new concept that will move the microgrid from its present niche to a mainstream position. Dynamic microgrids have the potential to be a key element of the ultimate self-healing grid - the Holy Grail of the smart grid. They'd allow the grid to divide itself into smaller self-sustaining grids, which can then be stitched back to form the regular distribution grid.
Keywords:  (not provided) (ID#: 15-5335)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=7035285&isnumber=7035243

 

Atighetchi, M.; Adler, A., "A Framework For Resilient Remote Monitoring," Resilient Control Systems (ISRCS), 2014 7th International Symposium on, pp. 1, 8, 19-21 Aug. 2014. doi: 10.1109/ISRCS.2014.6900090
Abstract: Today's activities in cyber space are more connected than ever before, driven by the ability to dynamically interact and share information with a changing set of partners over a wide variety of networks. To support dynamic sharing, computer systems and network are stood up on a continuous basis to support changing mission critical functionality. However, configuration of these systems remains a manual activity, with misconfigurations staying undetected for extended periods, unneeded systems remaining in place long after they are needed, and systems not getting updated to include the latest protections against vulnerabilities. This environment provides a rich environment for targeted cyber attacks that remain undetected for weeks to months and pose a serious national security threat. To counter this threat, technologies have started to emerge to provide continuous monitoring across any network-attached device for the purpose of increasing resiliency by virtue of identifying and then mitigating targeted attacks. For these technologies to be effective, it is of utmost importance to avoid any inadvertent increase in the attack surface of the monitored system. This paper describes the security architecture of Gestalt, a next-generation cyber information management platform that aims to increase resiliency by providing ready and secure access to granular cyber event data available across a network. Gestalt's federated monitoring architecture is based on the principles of strong isolation, least-privilege policies, defense-in-depth, crypto-strong authentication and encryption, and self-regeneration. Remote monitoring functionality is achieved through an orchestrated workflow across a distributed set of components, linked via a specialized secure communication protocol, that together enable unified access to cyber observables in a secure and resilient way.
Keywords: Web services; information management; security of data; Gestalt platform; attack identification; attack mitigation; communication protocol; computer networks; computer systems; cyber attacks; cyber observables; cyber space; granular cyber event data; mission critical functionality; national security threat; network-attached device; next-generation cyber information management platform; remote monitoring functionality ;resilient remote monitoring; Bridges; Firewalls (computing); Monitoring; Protocols; Servers; XML; cyber security; federated access; middleware; semantic web (ID#: 15-5336)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6900090&isnumber=6900080

 

Tunc, C.; Fargo, F.; Al-Nashif, Y.; Hariri, S.; Hughes, J., "Autonomic Resilient Cloud Management (ARCM) Design and Evaluation," Cloud and Autonomic Computing (ICCAC), 2014 International Conference on, pp. 44, 49, 8-12 Sept. 2014. doi: 10.1109/ICCAC.2014.35
Abstract: Cloud Computing is emerging as a new paradigm that aims delivering computing as a utility. For the cloud computing paradigm to be fully adopted and effectively used, it is critical that the security mechanisms are robust and resilient to faults and attacks. Securing cloud systems is extremely complex due to the many interdependent tasks such as application layer firewalls, alert monitoring and analysis, source code analysis, and user identity management. It is strongly believed that we cannot build cloud services that are immune to attacks. Resiliency to attacks is becoming an important approach to address cyber-attacks and mitigate their impacts. Resiliency for mission critical systems is demanded higher. In this paper, we present a methodology to develop an Autonomic Resilient Cloud Management (ARCM) based on moving target defense, cloud service Behavior Obfuscation (BO), and autonomic computing. By continuously and randomly changing the cloud execution environments and platform types, it will be difficult especially for insider attackers to figure out the current execution environment and their existing vulnerabilities, thus allowing the system to evade attacks. We show how to apply the ARCM to one class of applications, Map/Reduce, and evaluate its performance and overhead.
Keywords: cloud computing; security of data; software fault tolerance; ARCM; BO; autonomic resilient cloud management; cloud computing; cloud service behavior obfuscation; cloud system security; moving target defense; Cloud computing; Conferences; Autonomic Resilient Cloud Management; behavior obfuscation; resiliency (ID#: 15-5337)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=7024043&isnumber=7024029

 

Xin Chen; Jin-Hee Cho; Sencun Zhu, "Globaltrust: An Attack-Resilient Reputation System for Tactical Networks," Sensing, Communication, and Networking (SECON), 2014 Eleventh Annual IEEE International Conference on, pp. 275, 283, June 30 2014-July 3 2014. doi: 10.1109/SAHCN.2014.6990363
Abstract: In a military tactical network where a trust authority (e.g., a commander) makes a decision during a mission, assessing the trustworthiness of participating entities accurately is critical to mission success. In this work, we propose a trust-based reputation management scheme, called GlobalTrust, for minimizing false decisions on the reputation of nodes in the network. In the proposed scheme, nodes may be compromised and provide incorrect opinions to the trust authority, who conducts reputation evaluation towards all nodes based on the provided opinions. GlobalTrust achieves three goals: (1) maintaining a consistent global view towards each node; (2) obtaining high resiliency against various attack patterns; and (3) attaining highly accurate reputation values of nodes. Through extensive simulations comparing GlobalTrust with other existing schemes, we show that GlobalTrust minimizes false decisions while maintaining high resilience against various attack behaviors. Specifically, under various attacks, GlobalTrust can achieve a highly accurate consistent view on nodes' reputations even when the number of malicious nodes is up to 40% of all participating nodes.
Keywords: military communication; telecommunication security; GlobalTrust; attack-resilient reputation system; false decisions; malicious nodes; military tactical network; tactical networks; trust authority; trust-based reputation management; Conferences; Peer-to-peer computing; Protocols; Security; Sensors; Sparse matrices; Vectors; Reputation; Security; Tactical networks; Trust (ID#: 15-5338)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6990363&isnumber=6990316

 

Jie He; Yuexiang Yang; Xiaolei Wang; Chuan Tang; Yingzhi Zeng, "PeerDigger: Digging Stealthy P2P Hosts through Traffic Analysis in Real-Time," Computational Science and Engineering (CSE), 2014 IEEE 17th International Conference on, pp. 1528, 1535, 19-21 Dec. 2014. doi: 10.1109/CSE.2014.283
Abstract: P2P technology has been widely applied in many areas due to its excellent properties. Some botnets also shift towards the decentralized architectures, since they provide a better resiliency against detection and takedown efforts. Besides, modern P2P bots tend to run on compromised hosts in a stealthy way, which renders most existing approaches ineffective. In addition, few approaches address the problem of real-time detection. However, it is important to detect bots as soon as possible in order to minimize their harm. In this paper, we propose Peer Digger, a novel real-time system capable of detecting stealthy P2P bots. Peer Digger first detects all P2P hosts base on several basic properties of flow records, and then distinguishes P2P bots from benign P2P hosts by analyzing their network behavior patterns. The experimental results demonstrate that our system is able to identity P2P bots with an average TPR of 98.07% and an average FPR of 1.5% within 4 minutes.
Keywords: computer network security; invasive software; peer-to-peer computing; real-time systems; telecommunication traffic;FPR;P2P host detection; P2P technology; PeerDigger; TPR; decentralized architectures; network behavior pattern analysis; real-time detection; stealthy P2P bot detection; Feature extraction; IP networks; Monitoring; Peer-to-peer computing; Real-time systems; Storms; Vectors; P2P network; bot detection; real-time; traffic analysis (ID#: 15-5339)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=7023794&isnumber=7023510

 

Wijayasekara, D.; Linda, O.; Manic, M.; Rieger, C., "FN-DFE: Fuzzy-Neural Data Fusion Engine for Enhanced Resilient State-Awareness of Hybrid Energy Systems," Cybernetics, IEEE Transactions on, vol. 44, no. 11, pp. 2065, 2075, Nov. 2014. doi: 10.1109/TCYB.2014.2323891
Abstract: Resiliency and improved state-awareness of modern critical infrastructures, such as energy production and industrial systems, is becoming increasingly important. As control systems become increasingly complex, the number of inputs and outputs increase. Therefore, in order to maintain sufficient levels of state-awareness, a robust system state monitoring must be implemented that correctly identifies system behavior even when one or more sensors are faulty. Furthermore, as intelligent cyber adversaries become more capable, incorrect values may be fed to the operators. To address these needs, this paper proposes a fuzzyneural data fusion engine (FN-DFE) for resilient state-awareness of control systems. The designed FN-DFE is composed of a three-layered system consisting of: 1) traditional threshold based alarms; 2) anomalous behavior detector using self-organizing fuzzy logic system; and 3) artificial neural network-based system modeling and prediction. The improved control system state awareness is achieved via fusing input data from multiple sources and combining them into robust anomaly indicators. In addition, the neural network-based signal predictions are used to augment the resiliency of the system and provide coherent state-awareness despite temporary unavailability of sensory data. The proposed system was integrated and tested with a model of the Idaho National Laboratory's hybrid energy system facility known as HYTEST. Experiment results demonstrate that the proposed FNDFE provides timely plant performance monitoring and anomaly detection capabilities. It was shown that the system is capable of identifying intrusive behavior significantly earlier than conventional threshold-based alarm systems.
Keywords: control engineering computing; fuzzy neural nets; power engineering computing; power system control; security of data; sensor fusion; FN-DFE engine; HYTEST facility; Idaho National Laboratory; anomalous behavior detector; artificial neural network-based system; control system state-awareness; control systems; critical infrastructure; energy production system; enhanced resilient state-awareness; fuzzy-neural data fusion engine; hybrid energy systems; industrial system; intelligent cyber adversaries; neural network-based signal predictions; self-organizing fuzzy logic system; system modeling; system prediction; system state monitoring; threshold based alarms; threshold-based alarm systems; Artificial neural networks; Control systems; Monitoring; Robustness; Sensor systems; Vectors; Artificial neural networks; data fusion; fuzzy logic systems; resilient control systems; state-awareness (ID#: 15-5340)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6823672&isnumber=6922172

 

Junjie Zhang; Perdisci, R.; Wenke Lee; Xiapu Luo; Sarfraz, U., "Building a Scalable System for Stealthy P2P-Botnet Detection," Information Forensics and Security, IEEE Transactions on, vol. 9, no.1, pp. 27,38, Jan. 2014. doi: 10.1109/TIFS.2013.2290197
Abstract: Peer-to-peer (P2P) botnets have recently been adopted by botmasters for their resiliency against take-down efforts. Besides being harder to take down, modern botnets tend to be stealthier in the way they perform malicious activities, making current detection approaches ineffective. In addition, the rapidly growing volume of network traffic calls for high scalability of detection systems. In this paper, we propose a novel scalable botnet detection system capable of detecting stealthy P2P botnets. Our system first identifies all hosts that are likely engaged in P2P communications. It then derives statistical fingerprints to profile P2P traffic and further distinguish between P2P botnet traffic and legitimate P2P traffic. The parallelized computation with bounded complexity makes scalability a built-in feature of our system. Extensive evaluation has demonstrated both high detection accuracy and great scalability of the proposed system.
Keywords: computer network security; peer-to-peer computing; telecommunication traffic; P2P botnet traffic;P2P communications; detection systems; malicious activities; network traffic; peer-to-peer botnets; scalable system; statistical fingerprints; stealthy P2P botnet detection; Educational institutions; Electronic mail; Feature extraction; Monitoring; Overlay networks; Peer-to-peer computing; Scalability; Botnet; P2P; intrusion detection; network security (ID#: 15-5341)
URL: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6661360&isnumber=6684617

Note:

Articles listed on these pages have been found on publicly available internet pages and are cited with links to those pages. Some of the information included herein has been reprinted with permission from the authors or data repositories. Direct any requests via Email to news@scienceofsecurity.net for removal of the links or modifications to specific citations. Please include the ID# of the specific citation in your correspondence.