Biblio

The static and dynamic malware analysis are used by industrialists and academics to understand malware capabilities and threat level. The antimalware industries calculate malware threat levels using different techniques which involve human involvement and a large number of resources and analysts. As malware complexity, velocity and volume increase, it becomes impossible to allocate so many resources. Due to this reason, it is projected that the number of malware apps will continue to rise, and that more devices will be targeted in order to commit various sorts of cybercrime. It is therefore necessary to develop techniques that can calculate the damage or threat posed by malware automatically as soon as it is identified. In this way, early warnings about zero-day (unknown) malware can assist in allocating resources for carrying out a close analysis of it as soon as it is identified. In this paper, a fuzzy modelling approach is described for calculating the potential risk of malicious programs through static malware analysis.

In the traditional Internet of Vehicles, communication data is easily tampered with and easily leaked. In order to improve the trust evaluation mechanism of the Internet of Vehicles and establish a trust relationship between vehicles, a blockchain-based Internet of Vehicles trust evaluation (BBTE) scheme is proposed. First, the scheme uses the roadside unit RSU to calculate the trust value of vehicle nodes and maintain the generation, verification and storage of blocks, so as to realize distributed data storage and ensure that data cannot be tampered with. Secondly, an efficient trust evaluation method is designed. The method integrates four trust decision factors: initial trust, historical experience trust, recommendation trust and RSU observation trust to obtain the overall trust value of vehicle nodes. In addition, in the process of constructing the recommendation trust method, the recommendation trust is divided into three categories according to the interaction between the recommended vehicle node and the communicator, use CRITIC to obtain the optimal weights of three recommended trusts, and use CRITIC to obtain the optimal weights of four trust decision-making factors to obtain the final trust value. Finally, the NS3 simulation platform is used to verify the security and accuracy of the trust evaluation method, and to improve the identification accuracy and detection rate of malicious vehicle nodes. The experimental analysis shows that the scheme can effectively deal with the gray hole attack, slander attack and collusion attack of other vehicle nodes, improve the security of vehicle node communication interaction, and provide technical support for the basic application of Internet of Vehicles security.

In this work, we examine the following question: How can we improve the best data complexity among the impossible differential (ID) attacks on AES? One of the most efficient attacks on AES are ID attacks. We have seen that the Biham-Keller ID characteristics are frequently used in these ID attacks. We observe the following fact: The probability that a given pair with a wrong key produce an ID characteristic is closely correlated to the data usage negatively. So, we maximize this probability by exploiting a Biham-Keller ID characteristic in a different manner than the other attacks. As a result, we mount an ID attack on 7-round AES-192 and obtain the best data requirement among all the ID attacks on 7-round AES. We make use of only 2$^\textrm58$ chosen plaintexts.

Benchmark datasets are heavily depended upon by the research community to validate theoretical findings and track progression in the state-of-the-art. NIDS dataset creation presents numerous challenges on account of the volume, heterogeneity, and complexity of network traffic, making the process labor intensive, and thus, prone to error. This paper provides a critical review of CIC-IDS-2017 and CIC-CSE-IDS-2018, datasets which have seen extensive usage in the NIDS literature, and are currently considered primary benchmarking datasets for NIDS. We report a large number of previously undocumented errors throughout the dataset creation lifecycle, including in attack orchestration, feature generation, documentation, and labeling. The errors destabilize the results and challenge the findings of numerous publications that have relied on it as a benchmark. We demonstrate the implications of these errors through several experiments. We provide comprehensive documentation to summarize the discovery of these issues, as well as a fully-recreated dataset, with labeling logic that has been reverse-engineered, corrected, and made publicly available for the first time. We demonstrate the implications of dataset errors through a series of experiments. The findings serve to remind the research community of common pitfalls with dataset creation processes, and of the need to be vigilant when adopting new datasets. Lastly, we strongly recommend the release of labeling logic for any dataset released, to ensure full transparency.

A hash is a fixed-length output of some data that has been through a one-way function that cannot be reversed, called the hashing algorithm. Hashing algorithms are used to store secure information, such as passwords. They are stored as hashes after they have been through a hashing algorithm. Also, hashing algorithms are used to insure the checksum of certain data over the internet. This paper discusses how Ibn Omar's hashing algorithm will provide higher security for data than other hash functions used nowadays. Ibn Omar's hashing algorithm in produces an output of 1024 bits, four times as SHA256 and twice as SHA512. Ibn Omar's hashing algorithm reduces the vulnerability of a hash collision due to its size. Also, it would require enormous computational power to find a collision. There are eight salts per input. This hashing algorithm aims to provide high privacy and security for users.

As an emerging technology, IoT is rapidly revolutionizing the global communication network with billions of new devices deployed and connected with each other. Many of these devices collect and transfer a large amount of sensitive or mission critical data, making security a top priority. Compared to traditional Internet, IoT networks often operate in open and harsh environment, and may experience frequent delays, traffic loss and attacks; Meanwhile, IoT devices are often severally constrained in computational power, storage space, network bandwidth, and power supply, which prevent them from deploying traditional security schemes. Authentication is an important security mechanism that can be used to identify devices or users. Due to resource constrains of IoT networks, it is highly desirable for the authentication scheme to be lightweight while also being highly effective. In this paper, we developed and evaluated a hash-chain-based multi-node mutual authentication algorithm. Nodes on a network all share a common secret key and broadcast to other nodes in range. Each node may also add to the hash chain and rebroadcast, which will be used to authenticate all nodes in the network. This algorithm has a linear running time and complexity of O(n), a significant improvement from the O(nˆ2) running time and complexity of the traditional pairwise multi-node mutual authentication.

One of the most challenging issues facing Internet of Medical Things (IoMT) cyber defense is the complexity of their ecosystem coupled with the development of cyber-attacks. Medical equipments lack built-in security and are increasingly becoming connected. Moving beyond traditional security solutions becomes a necessity to protect patients and organizations. In order to effectively deal with the security risks of networked medical devices in such a complex and heterogeneous system, we need to measure security risks and prioritize mitigation actions. In this context, we propose a Fuzzy AHP-based method to assess security attributes of connected medical devices and compare different device models against a selected profile with regards to the user requirements. The proposal aims to empower user security awareness to make well-educated decisions.

The accelerated move toward adopting the Smart Grid paradigm has resulted in numerous drawbacks as far as security is concerned. Traditional power grids are becoming more vulnerable to cyberattacks as all the control decisions are generated based on the data the Smart Grid generates during its operation. This data can be tampered with or attacked in communication lines to mislead the control room in decision-making. The false data injection attack (FDIA) is one of the most severe cyberattacks on today’s cyber-physical power system, as it has the potential to cause significant physical and financial damage. However, detecting cyberattacks are incredibly challenging since they have no known patterns. In this paper, we launch a random FDIA on IEEE-39 bus system. Later, we propose a Bagging MLP-based autoencoder to detect the FDIAs in the power system and compare the result with a single ML model. The Bagging MLP-based autoencoder outperforms the Isolation forest while detecting FDIAs.

The suggested IsoQuadratic Exponentiation Randomized isocryptosystem design is the unique approach for public key encipher algorithm using IsoPartial Discrete Logarithm Problem and preservation of the recommended IsoQuadratic Exponentiation Randomized isocryptosystem be established against hardness of IsoPartial Discrete Logarithm Problem. Therewith, we demonstrated the possibility of an additional secured algorithm. The offered unique IsoQuadratic Exponentiation Randomized isocryptosystem is suitable for low bandwidth transmission, low storage and low numeration in cyberspace.

Modular exponentiation, especially for very large integers of hundreds or thousands of bits, is a commonly used function in popular cryptosystems such as RSA. The complexity of this algorithm is partly driven by the very large word sizes, which require many - often millions - of primitive operations in a CPU implementation, or a large amount of logic when accelerated by an ASIC. FPGAs, with their many embedded DSP resources have started to be used as well. In almost all cases, the calculations have required multiple - occasionally many - clock cycles to complete. Recently, blockchain algorithms have required very low-latency implementations of modular multiplications, motivating new implementations and approaches.In this paper we show nine different high performance modular exponentiation for 1024-bit operands, using a 1024-bit modular multiplication as it’s core. Rather than just showing a number of completed designs, our paper shows the evolution of architectures which lead to different resource mix options. This will allow the reader to apply the examples to different FPGA targets which may have differing ratios of logic, memory, and embedded DSP blocks. In one design, we show a 1024b modular multiplier requiring 83K ALMs and 2372 DSPs, with a delay of 21.21ns.

Modular exponentiation (ME) is a complex operation for several public-key cryptosystems (PKCs). Moreover, ME is expensive for resource-constrained devices in terms of computation time and energy consumption, especially when the exponent is large. ME is defined as the task of raising an integer x to power k and reducing the result modulo some integer n. Several methods to calculate ME have been proposed. In this paper, we present the efficient ME methods. We then implement the methods using different security levels of RSA keys on a Raspberry Pi. Finally, we give the fast ME method.

The vast proliferation of the connected devices makes the operation of the traditional networks so complex and drops the network performance, particularly, failure cases. In fact, a novel solution is proposed to enable the management of the network resources and services named software defined network (SDN). SDN splits the data plane and the control plane by centralizing all the control plane on one common platform. Further, SDN makes the control plane programmable by offering high flexibility for the network management and monitoring mostly in failure cases. However, the main challenge in SDN is security that is presented as the first barrier for its development. Security in SDN is presented at various levels and forms, particularly, the communication between the data plane and control plane that presents a weak point in SDN framework. In this article, we suggest a new security framework focused on the combination between the trust and awareness concepts (TAS-SDN) for a dynamic southbound communication SDN. Further, TAS-SDN uses trust levels to establish a secure communication between the control plane and data plane. As a result, we discuss the implementation and the performance of TAS-SDN which presents a promote security solution in terms of time execution, complexity and scalability for SDN.

With the development of technology, the invention of computers, the use of cyberspace created by information communication systems and networks, increasing the effectiveness of knowledge in all aspects and the gains it provides have increased further the importance of cyber security day by day. In parallel with the developments in cyber space, the need for cyber defense has emerged with active and passive defense approaches for cyber security against internal and external cyber-attacks of increasing type, severity and complexity. In this framework, proactive cyber defense and deterrence strategies have started to be implemented with new techniques and methods.

Current intrusion detection techniques cannot keep up with the increasing amount and complexity of cyber attacks. In fact, most of the traffic is encrypted and does not allow to apply deep packet inspection approaches. In recent years, Machine Learning techniques have been proposed for post-mortem detection of network attacks, and many datasets have been shared by research groups and organizations for training and validation. Differently from the vast related literature, in this paper we propose an early classification approach conducted on CSE-CIC-IDS2018 dataset, which contains both benign and malicious traffic, for the detection of malicious attacks before they could damage an organization. To this aim, we investigated a different set of features, and the sensitivity of performance of five classification algorithms to the number of observed packets. Results show that ML approaches relying on ten packets provide satisfactory results.

Large volumes of private data are gathered, processed, and stored on computers by governments, the military, organizations, financial institutions, colleges, and other enterprises. This data is then sent through networks to other computers. Urgent measures are required to safeguard sensitive personal and company data as well as national security due to the exponential development in number and complexity of cyber- attacks. The essay discusses the characteristics of the Internet and demonstrates how private and financial data can be transmitted over it while still being safeguarded. We show that robbery has spread throughout India and the rest of the world, endangering the global economy and security and giving rise to a variety of cyber-attacks.

In this paper, a data-driven security detection approach is proposed in a simple manner. The detector is designed to deal with false data injection attacks suffered by industrial cyber-physical systems with unknown model information. First, the attacks are modeled from the perspective of the generalized plant mismatch, rather than the operating data being tampered. Second, some subsystems are selected to reduce the design complexity of the detector, and based on them, an output estimator with iterative form is presented in a theoretical way. Then, a security detector is constructed based on the proposed estimator and its cost function. Finally, the effectiveness of the proposed approach is verified by simulations of a Western States Coordinated Council 9-bus power system.

With the increasing complexity of the driving environment, more and more attention has been paid to the research on improving the intelligentization of traffic control. Among them, the digital twin-based internet of vehicle can establish a mirror system on the cloud to improve the efficiency of communication between vehicles, provide warning and safety instructions for drivers, avoid driving potential dangers. To ensure the security and effectiveness of data sharing in traffic control, this paper proposes a secure and privacy-preserving scheme for digital twin-based traffic control. Specifically, in the data uploading phase, we employ a group signature with a time-bound keys technique to realize data source authentication with efficient members revocation and privacy protection, which can ensure that data can be securely stored on cloud service providers after it synchronizes to its twin. In the data sharing stage, we employ the secure and efficient attribute-based access control technique to provide flexible and efficient data sharing, in which the parameters of a specific sub-policy can be stored during the first decryption and reused in subsequent data access containing the same sub-policy, thus reducing the computing complexity. Finally, we analyze the security and efficiency of the scheme theoretically.

This paper investigates the problem of synthesizing sensor deception attackers against privacy in the context of supervisory control of discrete-event systems (DES). We consider a plant controlled by a supervisor, which is subject to sensor deception attacks. Specifically, we consider an active attacker that can tamper with the observations received by the supervisor. The privacy requirement of the supervisory control system is to maintain initial-state opacity, i.e., it does not want to reveal the fact that it was initiated from a secret state during its operation. On the other hand, the attacker aims to deceive the supervisor, by tampering with its observations, such that initial-state opacity is violated due to incorrect control actions. We investigate from the attacker’s point of view by presenting an effective approach for synthesizing sensor attack strategies threatening the privacy of the system. To this end, we propose the All Attack Structure (AAS) that records state estimates for both the supervisor and the attacker. This structure serves as a basis for synthesizing a sensor attack strategy. We also discuss how to simplify the synthesis complexity by leveraging the structural properties. A running academic example is provided to illustrate the synthesis procedure.

In today’s world, digital data are enormous due to technologies that advance data collection, storage, and analyses. As more data are shared or publicly available, privacy is of great concern. Having privacy means having control over your data. The first step towards privacy protection is to understand various aspects of privacy and have the ability to quantify them. Much work in structured data, however, has focused on approaches to transforming the original data into a more anonymous form (via generalization and suppression) while preserving the data integrity. Such anonymization techniques count data instances of each set of distinct attribute values of interest to signify the required anonymity to protect an individual’s identity or confidential data. While this serves the purpose, our research takes an alternative approach to provide quick privacy measures by way of anonymity especially when dealing with large-scale data. This paper presents a study of anonymity measures based on their relevant properties that impact privacy. Specifically, we identify three properties: uniformity, variety, and diversity, and formulate their measures. The paper provides illustrated examples to evaluate their validity and discusses the use of multi-aspects of anonymity and privacy measures.

Network attacks are becoming more intense and characterized by complexity and persistence. Mechanisms that ensure network resilience to faults and threats should be well provided. Different approaches have been proposed to network resilience; however, most of them rely on static policies, which is unsuitable for current complex network environments and real-time requirements. To address these issues, we present a Belief-Desire-Intention (BDI) based multi-agent resilience network controller coupled with blockchain. We first clarify the theory and platform of the BDI, then discuss how the BDI evaluates the network resilience. In addition, we present the architecture, workflow, and applications of the resilience network controller. Simulation results show that the resilience network controller can effectively detect and mitigate distributed denial of service attacks.

With the high-speed development of UHV power grid, the characteristics of power grid changed significantly, which puts forward new requirements for the safe operation of power grid and depend on Security and Stability Control System (SSCS) greatly. Based on the practical cases, this paper analyzes the principle of the abnormal criteria of the SSCS and its influence on the strategy of the SSCS, points out the necessity of the research on the locking strategy of the SSCS under the abnormal state. Taking the large-scale SSCS for an example, this paper analysis different control strategies of the stations in the different layered, and puts forward effective solutions to adapt different system functions. It greatly improved the effectiveness and reliability of the strategy of SSCS, and ensure the integrity of the system function. Comparing the different schemes, the principles of making the lock-strategy are proposed. It has reference significance for the design, development and implementation of large-scale SSCS.

Intelligent Virtual Agents (IVAs) have become ubiquitous in our daily lives, displaying increased complexity of form and function. Initial IVA development efforts provided basic functionality to suit users' needs, typically in work or educational settings, but are now present in numerous contexts in more realistic, complex forms. In this paper, we focus on personalization of embodied human intelligent virtual agents to assist individuals as part of physical training “exergames”.

The digital transformation brought on by 5G is redefining current models of end-to-end (E2E) connectivity and service reliability to include security-by-design principles necessary to enable 5G to achieve its promise. 5G trustworthiness highlights the importance of embedding security capabilities from the very beginning while the 5G architecture is being defined and standardized. Security requirements need to overlay and permeate through the different layers of 5G systems (physical, network, and application) as well as different parts of an E2E 5G architecture within a risk-management framework that takes into account the evolving security-threats landscape. 5G presents a typical use-case of wireless communication and computer networking convergence, where 5G fundamental building blocks include components such as Software Defined Networks (SDN), Network Functions Virtualization (NFV) and the edge cloud. This convergence extends many of the security challenges and opportunities applicable to SDN/NFV and cloud to 5G networks. Thus, 5G security needs to consider additional security requirements (compared to previous generations) such as SDN controller security, hypervisor security, orchestrator security, cloud security, edge security, etc. At the same time, 5G networks offer security improvement opportunities that should be considered. Here, 5G architectural flexibility, programmability and complexity can be harnessed to improve resilience and reliability. The working group scope fundamentally addresses the following: •5G security considerations need to overlay and permeate through the different layers of the 5G systems (physical, network, and application) as well as different parts of an E2E 5G architecture including a risk management framework that takes into account the evolving security threats landscape. •5G exemplifies a use-case of heterogeneous access and computer networking convergence, which extends a unique set of security challenges and opportunities (e.g., related to SDN/NFV and edge cloud, etc.) to 5G networks. Similarly, 5G networks by design offer potential security benefits and opportunities through harnessing the architecture flexibility, programmability and complexity to improve its resilience and reliability. •The IEEE FNI security WG's roadmap framework follows a taxonomic structure, differentiating the 5G functional pillars and corresponding cybersecurity risks. As part of cross collaboration, the security working group will also look into the security issues associated with other roadmap working groups within the IEEE Future Network Initiative.

A power amplifier(PA) is inherently nonlinear device and is used in a communication system widely. Due to the nonlinearity of PA, the communication system is hard to work well. Digital predistortion (DPD) is the way to solve this problem. Using Volterra function to fit the PA is what most DPD solutions do. However, when it comes to wideband signal, there is a deduction on the performance of the Volterra function. In this paper, we replace the Volterra function with B-spline function which performs better on fitting PA at wideband signal. And the other benefit is that the orthogonality of coding matrix A could be improved, enhancing the stability of computation. Additionally, we use compressive sampling to reduce the complexity of the function model.

This paper presents secure MatDot codes, a family of evaluation codes that support secure distributed matrix multiplication via a careful selection of evaluation points that exploit the properties of the dual code. We show that the secure MatDot codes provide security against the user by using locally recoverable codes. These new codes complement the recently studied discrete Fourier transform codes for distributed matrix multiplication schemes that also provide security against the user. There are scenarios where the associated costs are the same for both families and instances where the secure MatDot codes offer a lower cost. In addition, the secure MatDot code provides an alternative way to handle the matrix multiplication by identifying the fastest servers in advance. In this way, it can determine a product using fewer servers, specified in advance, than the MatDot codes which achieve the optimal recovery threshold for distributed matrix multiplication schemes.