Visible to the public Biblio

Filters: Keyword is security assessment  [Clear All Filters]
2023-07-28
Ksibi, Sondes, JAIDI, Faouzi, BOUHOULA, Adel.  2022.  A User-Centric Fuzzy AHP-based Method for Medical Devices Security Assessment. 2022 15th International Conference on Security of Information and Networks (SIN). :01—07.

One of the most challenging issues facing Internet of Medical Things (IoMT) cyber defense is the complexity of their ecosystem coupled with the development of cyber-attacks. Medical equipments lack built-in security and are increasingly becoming connected. Moving beyond traditional security solutions becomes a necessity to protect patients and organizations. In order to effectively deal with the security risks of networked medical devices in such a complex and heterogeneous system, we need to measure security risks and prioritize mitigation actions. In this context, we propose a Fuzzy AHP-based method to assess security attributes of connected medical devices and compare different device models against a selected profile with regards to the user requirements. The proposal aims to empower user security awareness to make well-educated decisions.

2023-07-21
Su, Xiangjing, Zhu, Zheng, Xiao, Shiqu, Fu, Yang, Wu, Yi.  2022.  Deep Neural Network Based Efficient Data Fusion Model for False Data Detection in Power System. 2022 IEEE 6th Conference on Energy Internet and Energy System Integration (EI2). :1462—1466.
Cyberattack on power system brings new challenges on the development of modern power system. Hackers may implement false data injection attack (FDIA) to cause unstable operating conditions of the power system. However, data from different power internet of things usually contains a lot of redundancy, making it difficult for current efficient discriminant model to precisely identify FDIA. To address this problem, we propose a deep learning network-based data fusion model to handle features from measurement data in power system. Proposed model includes a data enrichment module and a data fusion module. We firstly employ feature engineering technique to enrich features from power system operation in time dimension. Subsequently, a long short-term memory based autoencoder (LSTM-AE) is designed to efficiently avoid feature space explosion problem during data enriching process. Extensive experiments are performed on several classical attack detection models over the load data set from IEEE 14-bus system and simulation results demonstrate that fused data from proposed model shows higher detection accuracy with respect to the raw data.
2023-04-28
Hao, Wei, Shen, Chuanbao, Yang, Xing, Wang, Chao.  2022.  Intelligent Penetration and Attack Simulation System Based on Attack Chain. 2022 15th International Symposium on Computational Intelligence and Design (ISCID). :204–207.
Vulnerability assessment is an important process for network security. However, most commonly used vulnerability assessment methods still rely on expert experience or rule-based automated scripts, which are difficult to meet the security requirements of increasingly complex network environment. In recent years, although scientists and engineers have made great progress on artificial intelligence in both theory and practice, it is a challenging to manufacture a mature high-quality intelligent products in the field of network security, especially in penetration testing based vulnerability assessment for enterprises. Therefore, in order to realize the intelligent penetration testing, Vul.AI with its rich experience in cyber attack and defense for many years has designed and developed a set of intelligent penetration and attack simulation system Ai.Scan, which is based on attack chain, knowledge graph and related evaluation algorithms. In this paper, the realization principle, main functions and application scenarios of Ai.Scan are introduced in detail.
ISSN: 2473-3547
2023-03-31
Hu, Zhiyuan, Shi, Linghang, Chen, Huijun, Li, Chao, Lu, Jinghui.  2022.  Security Assessment of Android-Based Mobile Terminals. 2022 25th International Symposium on Wireless Personal Multimedia Communications (WPMC). :279–284.
Mobile terminals especially smartphones are changing people's work and life style. For example, mobile payments are experiencing rapid growth as consumers use mobile terminals as part of lifestyles. However, security is a big challenge for mobile application services. In order to reduce security risks, mobile terminal security assessment should be conducted before providing application services. An approach of comprehensive security assessment is proposed in this paper by defining security metrics with the corresponding scores and determining the relative weights of security metrics based on the analytical hierarchy process (AHP). Overall security assessment of Android-based mobile terminals is implemented for mobile payment services with payment fraud detection accuracy of 89%, which shows that the proposed approach of security assessment is reasonable.
ISSN: 1882-5621
2022-12-09
He, Song, Shi, Xiaohong, Huang, Yan, Chen, Gong, Tang, Huihui.  2022.  Design of Information System Security Evaluation Management System based on Artificial Intelligence. 2022 IEEE 2nd International Conference on Electronic Technology, Communication and Information (ICETCI). :967—970.
In today's society, with the continuous development of artificial intelligence, artificial intelligence technology plays an increasingly important role in social and economic development, and hass become the fastest growing, most widely used and most influential high-tech in the world today one. However, at the same time, information technology has also brought threats to network security to the entire network world, which makes information systems also face huge and severe challenges, which will affect the stability and development of society to a certain extent. Therefore, comprehensive analysis and research on information system security is a very necessary and urgent task. Through the security assessment of the information system, we can discover the key hidden dangers and loopholes that are hidden in the information source or potentially threaten user data and confidential files, so as to effectively prevent these risks from occurring and provide effective solutions; at the same time To a certain extent, prevent virus invasion, malicious program attacks and network hackers' intrusive behaviors. This article adopts the experimental analysis method to explore how to apply the most practical, advanced and efficient artificial intelligence theory to the information system security assessment management, so as to further realize the optimal design of the information system security assessment management system, which will protect our country the information security has very important meaning and practical value. According to the research results, the function of the experimental test system is complete and available, and the security is good, which can meet the requirements of multi-user operation for security evaluation of the information system.
2022-08-26
Lv, Huiying, Zhang, Yuan, Li, Huan, Chang, Wenjun.  2021.  Security Assessment of Enterprise Networks Based on Analytic Network Process and Evidence Theory. 2021 3rd International Conference on Artificial Intelligence and Advanced Manufacture (AIAM). :305—313.

Network security has always been the most important of enterprise informatization construction and development, and the security assessment of network system is the basis for enterprises to make effective security defense strategies. Aiming at the relevance of security factors and subjectivity of evaluation results in the process of enterprise network system security assessment, a security assessment method combining Analytic Network Process and evidence theory is proposed. Firstly, we built a complete security assessment index system and network analysis structure model for enterprise network, and determined the converged security index weights by calculating hypermatrix, limit hypermatrix and stable limit hypermatrix; then, we used the evidence theory on data fusion of the evaluation opinions of multiple experts to eliminate the conflict between evidences. Finally, according to the principle of maximum membership degree, we realized the assessment of enterprise network security level using weighted average. The example analysis showed that the model not only weighed the correlation influence among the security indicators, but also effectively reduced the subjectivity of expert evaluation and the fuzziness and uncertainty in qualitative analysis, which verified the effectiveness of the model and method, and provided an important basis for network security management.

2021-10-12
El-Sobky, Mariam, Sarhan, Hisham, Abu-ElKheir, Mervat.  2020.  Security Assessment of the Contextual Multi-Armed Bandit - RL Algorithm for Link Adaptation. 2020 2nd Novel Intelligent and Leading Emerging Sciences Conference (NILES). :514–519.
Industry is increasingly adopting Reinforcement Learning algorithms (RL) in production without thoroughly analyzing their security features. In addition to the potential threats that may arise if the functionality of these algorithms is compromised while in operation. One of the well-known RL algorithms is the Contextual Multi-Armed Bandit (CMAB) algorithm. In this paper, we explore how the CMAB can be used to solve the Link Adaptation problem - a well-known problem in the telecommunication industry by learning the optimal transmission parameters that will maximize a communication link's throughput. We analyze the potential vulnerabilities of the algorithm and how they may adversely affect link parameters computation. Additionally, we present a provable security assessment for the Contextual Multi-Armed Bandit Reinforcement Learning (CMAB-RL) algorithm in a network simulated environment using Ray. This is by demonstrating CMAB security vulnerabilities theoretically and practically. Some security controls are proposed for CMAB agent and the surrounding environment. In order to fix those vulnerabilities and mitigate the risk. These controls can be applied to other RL agents in order to design more robust and secure RL agents.
2021-03-15
Bao, L., Wu, S., Yu, S., Huang, J..  2020.  Client-side Security Assessment and Security Protection Scheme for Smart TV Network. 2020 IEEE 6th International Conference on Computer and Communications (ICCC). :573—578.

TV networks are no longer just closed networks. They are increasingly carrying Internet services, integrating and interoperating with home IoT and the Internet. In addition, client devices are becoming intelligent. At the same time, they are facing more security risks. Security incidents such as attacks on TV systems are commonplace, and there are many incidents that cause negative effects. The security protection of TV networks mainly adopts security protection schemes similar to other networks, such as constructing a security perimeter; there are few security researches specifically carried out for client-side devices. This paper focuses on the mainstream architecture of the integration of HFC TV network and the Internet, and conducts a comprehensive security test and analysis for client-side devices including EOC cable bridge gateways and smart TV Set-Top-BoX. Results show that the TV network client devices have severe vulnerabilities such as command injection and system debugging interfaces. Attackers can obtain the system control of TV clients without authorization. In response to the results, we put forward systematic suggestions on the client security protection of smart TV networks in current days.

2021-02-16
Siu, J. Y., Panda, S. Kumar.  2020.  A Specification-Based Detection for Attacks in the Multi-Area System. IECON 2020 The 46th Annual Conference of the IEEE Industrial Electronics Society. :1526—1526.
In the past decade, cyber-attack events on the power grid have proven to be sophisticated and advanced. These attacks led to severe consequences on the grid operation, such as equipment damage or power outages. Hence, it is more critical than ever to develop tools for security assessment and detection of anomalies in the cyber-physical grid. For an extensive power grid, it is complex to analyze the causes of frequency deviations. Besides, if the system is compromised, attackers can leverage on the frequency deviation to bypass existing protection measures of the grid. This paper aims to develop a novel specification-based method to detect False Data Injection Attacks (FDIAs) in the multi-area system. Firstly, we describe the implementation of a three-area system model. Next, we assess the risk and devise several intrusion scenarios. Specifically, we inject false data into the frequency measurement and Automatic Generation Control (AGC) signals. We then develop a rule-based method to detect anomalies at the system-level. Our simulation results proves that the proposed algorithm can detect FDIAs in the system.
2020-12-17
Lagraa, S., Cailac, M., Rivera, S., Beck, F., State, R..  2019.  Real-Time Attack Detection on Robot Cameras: A Self-Driving Car Application. 2019 Third IEEE International Conference on Robotic Computing (IRC). :102—109.

The Robot Operating System (ROS) are being deployed for multiple life critical activities such as self-driving cars, drones, and industries. However, the security has been persistently neglected, especially the image flows incoming from camera robots. In this paper, we perform a structured security assessment of robot cameras using ROS. We points out a relevant number of security flaws that can be used to take over the flows incoming from the robot cameras. Furthermore, we propose an intrusion detection system to detect abnormal flows. Our defense approach is based on images comparisons and unsupervised anomaly detection method. We experiment our approach on robot cameras embedded on a self-driving car.

2020-10-06
Payne, Josh, Budhraja, Karan, Kundu, Ashish.  2019.  How Secure Is Your IoT Network? 2019 IEEE International Congress on Internet of Things (ICIOT). :181—188.

The proliferation of IoT devices in smart homes, hospitals, and enterprise networks is wide-spread and continuing to increase in a superlinear manner. The question is: how can one assess the security of an IoT network in a holistic manner? In this paper, we have explored two dimensions of security assessment- using vulnerability information and attack vectors of IoT devices and their underlying components (compositional security scores) and using SIEM logs captured from the communications and operations of such devices in a network (dynamic activity metrics). These measures are used to evaluate the security of IoT devices and the overall IoT network, demonstrating the effectiveness of attack circuits as practical tools for computing security metrics (exploitability, impact, and risk to confidentiality, integrity, and availability) of the network. We decided to approach threat modeling using attack graphs. To that end, we propose the notion of attack circuits, which are generated from input/output pairs constructed from CVEs using NLP, and an attack graph composed of these circuits. Our system provides insight into possible attack paths an adversary may utilize based on their exploitability, impact, or overall risk. We have performed experiments on IoT networks to demonstrate the efficacy of the proposed techniques.

2020-10-05
Wu, Songyang, Zhang, Yong, Chen, Xiao.  2018.  Security Assessment of Dynamic Networks with an Approach of Integrating Semantic Reasoning and Attack Graphs. 2018 IEEE 4th International Conference on Computer and Communications (ICCC). :1166–1174.
Because of the high-value data of an enterprise, sophisticated cyber-attacks targeted at enterprise networks have become prominent. Attack graphs are useful tools that facilitate a scalable security analysis of enterprise networks. However, the administrators face difficulties in effectively modelling security problems and making right decisions when constructing attack graphs as their risk assessment experience is often limited. In this paper, we propose an innovative method of security assessment through an ontology- and graph-based approach. An ontology is designed to represent security knowledge such as assets, vulnerabilities, attacks, countermeasures, and relationships between them in a common vocabulary. An efficient algorithm is proposed to generate an attack graph based on the inference ability of the security ontology. The proposed algorithm is evaluated with different sizes and topologies of test networks; the results show that our proposed algorithm facilitates a scalable security analysis of enterprise networks.
2020-07-20
Lekidis, Alexios, Barosan, Ion.  2019.  Model-based simulation and threat analysis of in-vehicle networks. 2019 15th IEEE International Workshop on Factory Communication Systems (WFCS). :1–8.
Automotive systems are currently undergoing a rapid evolution through the integration of the Internet of Things (IoT) and Software Defined Networking (SDN) technologies. The main focus of this evolution is to improve the driving experience, including automated controls, intelligent navigation and safety systems. Moreover, the extremely rapid pace that such technologies are brought into the vehicles, necessitates the presence of adequate testing of new features to avoid operational errors. Apart from testing though, IoT and SDN technologies also widen the threat landscape of cyber-security risks due to the amount of connectivity interfaces that are nowadays exposed in vehicles. In this paper we present a new method, based on OMNET++, for testing new in-vehicle features and assessing security risks through network simulation. The method is demonstrated through a case-study on a Toyota Prius, whose network data are analyzed for the detection of anomalies caused from security threats or operational errors.
2020-07-03
Viegas, P., Borges, D., Montezuma, P., Dinis, R., Silva, M. M..  2019.  Multi-beam Physical Security Scheme: Security Assessment and Impact of Array Impairments on Security and Quality of Service. 2019 PhotonIcs Electromagnetics Research Symposium - Spring (PIERS-Spring). :2368—2375.

Massive multiple-input multiple-output (mMIMO) with perfect channel state information (CSI) can lead array power gain increments proportional to the number of antennas. Despite this fact constrains on power amplification still exist due to envelope variations of high order constellation signals. These constrains can be overpassed by a transmitter with several amplification branches, with each one associated to a component signal that results from the decomposition of a multilevel constellation as a sum of several quasi constant envelope signals that are sent independently. When combined with antenna arrays at the end of each amplification branch the security improves due to the energy separation achieved by beamforming. However, to avoid distortion on the signal resulting from the combination of all components at channel level all the beams of signal components should be directed in same direction. In such conditions it is crucial to assess the impact of misalignments between beams associated to each user, which is the purpose of this work. The set of results presented here show the good tolerance against misalignments of these transmission structures.

2020-03-18
Nikoue, Jean Claude, Butakov, Sergey, Malik, Yasir.  2019.  Security Evaluation Methodology for Software Defined Network Solutions. 2019 International Conference on Platform Technology and Service (PlatCon). :1–6.

Software Defined Networking (SDN) has introduced both innovative opportunities and additional risks in the computer networking. Among disadvantages of SDNs one can mention their susceptibility to vulnerabilities associated with both virtualization and the traditional networking. Selecting a proper controller for an organization may not be a trivial task as there is a variety of SDN controllers on the market and each of them may come with its own pros and cons from the security point of view. This research proposes a comprehensive methodology for organizations to evaluate security-related features available in SDN controllers. The methodology can serve as a guideline in the decisions related to SDN choice. The proposed security assessment follows a structured approach to evaluate each layer of the SDN architecture and each metrics defined in presented research has been matched with the security controls defined in NIST 800-53. Through the tests on actual controllers the paper provides an example on how the proposed methodology can be used to evaluate existing SDN solutions.

2020-02-17
Papakonstantinou, Nikolaos, Linnosmaa, Joonas, Alanen, Jarmo, Bashir, Ahmed Z., O'Halloran, Bryan, Van Bossuyt, Douglas L..  2019.  Early Hybrid Safety and Security Risk Assessment Based on Interdisciplinary Dependency Models. 2019 Annual Reliability and Maintainability Symposium (RAMS). :1–7.
Safety and security of complex critical infrastructures are very important for economic, environmental and social reasons. The complexity of these systems introduces difficulties in the identification of safety and security risks that emerge from interdisciplinary interactions and dependencies. The discovery of safety and security design weaknesses late in the design process and during system operation can lead to increased costs, additional system complexity, delays and possibly undesirable compromises to address safety and security weaknesses.
2020-02-10
Tsai, I-Chun, Zhong, Yi, Liu, Fang-Ru, Feng, Jianhua.  2019.  A Novel Security Assessment Method Based on Linear Regression for Logic Locking. 2019 IEEE International Conference on Electron Devices and Solid-State Circuits (EDSSC). :1–3.
This paper presents a novel logic locking security assessment method based on linear regression, by means of modeling between the distribution probabilities of key-inputs and observable outputs. The algorithm reveals a weakness of the encrypted circuit since the assessment can revoke the key-inputs within several iterations. The experiment result shows that the proposed assessment can be applied to varies of encrypted combinational benchmark circuits, which exceeds 85% of correctness after revoking the encrypted key-inputs.
Gao, Jian, Bai, Huifeng, Wang, Dongshan, Wang, Licheng, Huo, Chao, Hou, Yingying.  2019.  Rapid Security Situation Prediction of Smart Grid Based on Markov Chain. 2019 IEEE 3rd Information Technology, Networking, Electronic and Automation Control Conference (ITNEC). :2386–2389.

Based on Markov chain analysis method, the situation prediction of smart grid security and stability can be judged in this paper. First component state transition probability matrix and component state prediction were defined. A fast derivation method of Markov state transition probability matrix using in system state prediction was proposed. The Matlab program using this method was compiled to analyze and obtain the future state probability distribution of grid system. As a comparison the system state distribution was simulated based on sequential Monte Carlo method, which was in good agreement with the state transition matrix, and the validity of the method was verified. Furthermore, the situation prediction of the six-node example was analyzed, which provided an effective prediction and analysis tool for the security situation.

2020-01-02
Alam, Md Jamshed, Kamrul, MD. Imtiaz, Zia Ur Rashid, S. M., Rashid, Syed Zahidur.  2018.  An Expert System Based on Belief Rule to Assess Bank Surveillance Security. 2018 International Conference on Innovations in Science, Engineering and Technology (ICISET). :451–454.
Surveillance is the monitoring of the behavior, activities or other changing information whereas security means the state of being protected from harmful activities. Nowadays proper surveillance security is considered as a challenging issue in the world and security has become a major concern from real life to virtual life. Tech-giants are implementing new solutions & techniques for better security assessment. This paper illustrates the design and implementation of a Belief Rule Based Expert System (BRBES) to overcome the uncertainty problems during bank security assessment. The proposed expert system has been developed based on generic Belief Rule Based (BRB) inference methodology using Evidential Reasoning algorithm (RIMER). Real-time security data has been taken from several banks of Bangladesh in conjunction with the expert's opinion to construct the knowledge base. This expert system provides more reliable and effective result under uncertainties which is better than any other traditional expert's prediction. Real life case studies were used for the validation of this system. Also, the outcome is compared with the real-life security system. Furthermore, the architectural design, implementation and utilization of an expert system to assess bank security under uncertainty are also discussed in this paper.
2019-12-30
Olalia, Jr., Romulo L., Sison, Ariel M., Medina, Ruji P..  2018.  Security Assessment of Brute-Force Attack to Subset Sum-Based Verifiable Secret Sharing Scheme. Proceedings of the 4th International Conference on Industrial and Business Engineering. :244-249.

The integration of subset sum in the verifiable secret sharing scheme provides added security measure for a multiparty computation such as immediate identification of and removal of an imposter, avoidance or discourages man-in-the-middle attack and lattice-based attack, and lessens dealer's burden on processing monitoring the integrity of shareholders. This study focuses on the security assessment of a brute-force attack on the subset sum-based verifiable secret sharing scheme. With the simulation done using a generator of all possible fixed-length partition (which is k=3 as the least possible) summing up to the sum of the original subset generated by the dealer, it shows that it will already took 11,408 years to brute-force all possible values even on a small 32-bit-length value and 3.8455 years for a 128-bit length value thus proving that the resiliency on brute attack on the subset sum based VSSS can be discounted despite simplicity of the implementation. Zero knowledge on the number of threshold will also multiply to the impossibility of the brute force attack.

2019-10-23
Ali, Abdullah Ahmed, Zamri Murah, Mohd.  2018.  Security Assessment of Libyan Government Websites. 2018 Cyber Resilience Conference (CRC). :1-4.

Many governments organizations in Libya have started transferring traditional government services to e-government. These e-services will benefit a wide range of public. However, deployment of e-government bring many new security issues. Attackers would take advantages of vulnerabilities in these e-services and would conduct cyber attacks that would result in data loss, services interruptions, privacy loss, financial loss, and other significant loss. The number of vulnerabilities in e-services have increase due to the complexity of the e-services system, a lack of secure programming practices, miss-configuration of systems and web applications vulnerabilities, or not staying up-to-date with security patches. Unfortunately, there is a lack of study being done to assess the current security level of Libyan government websites. Therefore, this study aims to assess the current security of 16 Libyan government websites using penetration testing framework. In this assessment, no exploits were committed or tried on the websites. In penetration testing framework (pen test), there are four main phases: Reconnaissance, Scanning, Enumeration, Vulnerability Assessment and, SSL encryption evaluation. The aim of a security assessment is to discover vulnerabilities that could be exploited by attackers. We also conducted a Content Analysis phase for all websites. In this phase, we searched for security and privacy policies implementation information on the government websites. The aim is to determine whether the websites are aware of current accepted standard for security and privacy. From our security assessment results of 16 Libyan government websites, we compared the websites based on the number of vulnerabilities found and the level of security policies. We only found 9 websites with high and medium vulnerabilities. Many of these vulnerabilities are due to outdated software and systems, miss-configuration of systems and not applying the latest security patches. These vulnerabilities could be used by cyber hackers to attack the systems and caused damages to the systems. Also, we found 5 websites didn't implement any SSL encryption for data transactions. Lastly, only 2 websites have published security and privacy policies on their websites. This seems to indicate that these websites were not concerned with current standard in security and privacy. Finally, we classify the 16 websites into 4 safety categories: highly unsafe, unsafe, somewhat unsafe and safe. We found only 1 website with a highly unsafe ranking. Based on our finding, we concluded that the security level of the Libyan government websites are adequate, but can be further improved. However, immediate actions need to be taken to mitigate possible cyber attacks by fixing the vulnerabilities and implementing SSL encryption. Also, the websites need to publish their security and privacy policy so the users could trust their websites.

2019-10-02
Zhang, Y., Eisele, S., Dubey, A., Laszka, A., Srivastava, A. K..  2019.  Cyber-Physical Simulation Platform for Security Assessment of Transactive Energy Systems. 2019 7th Workshop on Modeling and Simulation of Cyber-Physical Energy Systems (MSCPES). :1–6.
Transactive energy systems (TES) are emerging as a transformative solution for the problems that distribution system operators face due to an increase in the use of distributed energy resources and rapid growth in scalability of managing active distribution system (ADS). On the one hand, these changes pose a decentralized power system control problem, requiring strategic control to maintain reliability and resiliency for the community and for the utility. On the other hand, they require robust financial markets while allowing participation from diverse prosumers. To support the computing and flexibility requirements of TES while preserving privacy and security, distributed software platforms are required. In this paper, we enable the study and analysis of security concerns by developing Transactive Energy Security Simulation Testbed (TESST), a TES testbed for simulating various cyber attacks. In this work, the testbed is used for TES simulation with centralized clearing market, highlighting weaknesses in a centralized system. Additionally, we present a blockchain enabled decentralized market solution supported by distributed computing for TES, which on one hand can alleviate some of the problems that we identify, but on the other hand, may introduce newer issues. Future study of these differing paradigms is necessary and will continue as we develop our security simulation testbed.
2019-07-01
Arabsorkhi, A., Ghaffari, F..  2018.  Security Metrics: Principles and Security Assessment Methods. 2018 9th International Symposium on Telecommunications (IST). :305–310.

Nowadays, Information Technology is one of the important parts of human life and also of organizations. Organizations face problems such as IT problems. To solve these problems, they have to improve their security sections. Thus there is a need for security assessments within organizations to ensure security conditions. The use of security standards and general metric can be useful for measuring the safety of an organization; however, it should be noted that the general metric which are applied to businesses in general cannot be effective in this particular situation. Thus it's important to select metric standards for different businesses to improve both cost and organizational security. The selection of suitable security measures lies in the use of an efficient way to identify them. Due to the numerous complexities of these metric and the extent to which they are defined, in this paper that is based on comparative study and the benchmarking method, taxonomy for security measures is considered to be helpful for a business to choose metric tailored to their needs and conditions.

2019-03-11
Habib, S. M., Alexopoulos, N., Islam, M. M., Heider, J., Marsh, S., Müehlhäeuser, M..  2018.  Trust4App: Automating Trustworthiness Assessment of Mobile Applications. 2018 17th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/ 12th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE). :124–135.

Smartphones have become ubiquitous in our everyday lives, providing diverse functionalities via millions of applications (apps) that are readily available. To achieve these functionalities, apps need to access and utilize potentially sensitive data, stored in the user's device. This can pose a serious threat to users' security and privacy, when considering malicious or underskilled developers. While application marketplaces, like Google Play store and Apple App store, provide factors like ratings, user reviews, and number of downloads to distinguish benign from risky apps, studies have shown that these metrics are not adequately effective. The security and privacy health of an application should also be considered to generate a more reliable and transparent trustworthiness score. In order to automate the trustworthiness assessment of mobile applications, we introduce the Trust4App framework, which not only considers the publicly available factors mentioned above, but also takes into account the Security and Privacy (S&P) health of an application. Additionally, it considers the S&P posture of a user, and provides an holistic personalized trustworthiness score. While existing automatic trustworthiness frameworks only consider trustworthiness indicators (e.g. permission usage, privacy leaks) individually, Trust4App is, to the best of our knowledge, the first framework to combine these indicators. We also implement a proof-of-concept realization of our framework and demonstrate that Trust4App provides a more comprehensive, intuitive and actionable trustworthiness assessment compared to existing approaches.

2018-11-14
Xi, Z., Chen, L., Chen, M., Dai, Z., Li, Y..  2018.  Power Mobile Terminal Security Assessment Based on Weights Self-Learning. 2018 10th International Conference on Communication Software and Networks (ICCSN). :502–505.

At present, mobile terminals are widely used in power system and easy to be the target or springboard to attack the power system. It is necessary to have security assessment of power mobile terminal system to enable early warning of potential risks. In the context, this paper builds the security assessment system against to power mobile terminals, with features from security assessment system of general mobile terminals and power application scenarios. Compared with the existing methods, this paper introduces machine learning to the Rank Correlation Analysis method, which relies on expert experience, and uses objective experimental data to optimize the weight parameters of the indicators. From experiments, this paper proves that weights self-learning method can be used to evaluate the security of power mobile terminal system and improve credibility of the result.