首页 > 最新文献

EAI Endorsed Trans. Security Safety最新文献

英文 中文
Toward A Network-Assisted Approach for Effective Ransomware Detection 一种有效的勒索软件检测的网络辅助方法
Pub Date : 2018-07-13 DOI: 10.4108/eai.28-1-2021.168506
Tianrou Xia, Yuanyi Sun, Sencun Zhu, Z. Rasheed, K. Shafique
Ransomware is a kind of malware using cryptographic mechanisms to prevent victims from normal use of their computers. As a result, victims lose the access to their files and desktops unless they pay the ransom to the attackers. By the end of 2019, ransomware attack had caused more than 10 billion dollars of financial loss to enterprises and individuals. In this work, we propose Network-Assisted Approach (NAA), which contains effective local detection and network-level detection mechanisms, to help users determine whether a machine has been infected by ransomware. To evaluate its performance, we built 100 containers in Docker to simulate network scenarios. A hybrid ransomware sample which is close to real-world ransomware is deployed on stimulative infected machines. The experiment results show that our network-level detection mechanisms are separately applicable to WAN and LAN environments for ransomware detection.
勒索软件是一种利用加密机制阻止受害者正常使用计算机的恶意软件。因此,受害者将无法访问他们的文件和桌面,除非他们向攻击者支付赎金。截至2019年底,勒索软件攻击已给企业和个人造成超过100亿美元的经济损失。在这项工作中,我们提出了网络辅助方法(NAA),它包含有效的本地检测和网络级检测机制,以帮助用户确定机器是否被勒索软件感染。为了评估其性能,我们在Docker中构建了100个容器来模拟网络场景。混合勒索软件样本,这是接近真实世界的勒索软件部署在刺激感染的机器。实验结果表明,我们的网络级检测机制分别适用于广域网和局域网环境下的勒索软件检测。
{"title":"Toward A Network-Assisted Approach for Effective Ransomware Detection","authors":"Tianrou Xia, Yuanyi Sun, Sencun Zhu, Z. Rasheed, K. Shafique","doi":"10.4108/eai.28-1-2021.168506","DOIUrl":"https://doi.org/10.4108/eai.28-1-2021.168506","url":null,"abstract":"Ransomware is a kind of malware using cryptographic mechanisms to prevent victims from normal use of their computers. As a result, victims lose the access to their files and desktops unless they pay the ransom to the attackers. By the end of 2019, ransomware attack had caused more than 10 billion dollars of financial loss to enterprises and individuals. In this work, we propose Network-Assisted Approach (NAA), which contains effective local detection and network-level detection mechanisms, to help users determine whether a machine has been infected by ransomware. To evaluate its performance, we built 100 containers in Docker to simulate network scenarios. A hybrid ransomware sample which is close to real-world ransomware is deployed on stimulative infected machines. The experiment results show that our network-level detection mechanisms are separately applicable to WAN and LAN environments for ransomware detection.","PeriodicalId":335727,"journal":{"name":"EAI Endorsed Trans. Security Safety","volume":"382 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-07-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126842296","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Authenticating Video Feeds using Electric Network Frequency Estimation at the Edge 基于边缘网络频率估计的视频馈送认证
Pub Date : 2018-07-13 DOI: 10.4108/eai.4-2-2021.168648
Deeraj Nagothu, Yu Chen, Alexander J. Aved, E. Blasch
Large scale Internet of Video Things (IoVT) supports situation awareness for smart cities; however, the rapid development in artificial intelligence (AI) technologies enables fake video/audio streams and doctored images to fool smart city security operators. Authenticating visual/audio feeds becomes essential for safety and security, from which an Electric Network Frequency (ENF) signal collected from the power grid is a prominent authentication mechanism. This paper proposes an ENF-based Video Authentication method using steady Superpixels (EVAS). Video superpixels group the pixels with uniform intensities and textures to eliminate the impacts from the fluctuations in the ENF estimation. An extensive experimental study validated the effectiveness of the EVAS system. Aiming at the environments with interconnected surveillance camera systems at the edge powered by an electricity grid, the proposed EVAS system achieved the design goal of detecting dissimilarities in the image sequences. Received on 14 December 2020; accepted on 26 January 2021; published on 04 February 2021
大规模视频物联网(IoVT)支持智慧城市的态势感知;然而,人工智能(AI)技术的快速发展使得虚假的视频/音频流和篡改的图像能够欺骗智慧城市安全运营商。对视频/音频馈电进行身份验证对于安全至关重要,从电网收集的电网频率(ENF)信号是一种重要的身份验证机制。提出了一种基于enf的稳定超像素(EVAS)视频认证方法。视频超像素将具有均匀强度和纹理的像素分组,以消除ENF估计波动的影响。一项广泛的实验研究验证了EVAS系统的有效性。针对电网供电的边缘监控摄像机系统相互连接的环境,提出的EVAS系统实现了图像序列不相似点检测的设计目标。2020年12月14日收到;2021年1月26日接受;于2021年2月4日发布
{"title":"Authenticating Video Feeds using Electric Network Frequency Estimation at the Edge","authors":"Deeraj Nagothu, Yu Chen, Alexander J. Aved, E. Blasch","doi":"10.4108/eai.4-2-2021.168648","DOIUrl":"https://doi.org/10.4108/eai.4-2-2021.168648","url":null,"abstract":"Large scale Internet of Video Things (IoVT) supports situation awareness for smart cities; however, the rapid development in artificial intelligence (AI) technologies enables fake video/audio streams and doctored images to fool smart city security operators. Authenticating visual/audio feeds becomes essential for safety and security, from which an Electric Network Frequency (ENF) signal collected from the power grid is a prominent authentication mechanism. This paper proposes an ENF-based Video Authentication method using steady Superpixels (EVAS). Video superpixels group the pixels with uniform intensities and textures to eliminate the impacts from the fluctuations in the ENF estimation. An extensive experimental study validated the effectiveness of the EVAS system. Aiming at the environments with interconnected surveillance camera systems at the edge powered by an electricity grid, the proposed EVAS system achieved the design goal of detecting dissimilarities in the image sequences. Received on 14 December 2020; accepted on 26 January 2021; published on 04 February 2021","PeriodicalId":335727,"journal":{"name":"EAI Endorsed Trans. Security Safety","volume":"62 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-07-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121958236","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 21
A Comprehensive Survey on Intrusion Detection based Machine Learning for IoT Networks 物联网网络中基于入侵检测的机器学习研究综述
Pub Date : 2018-07-13 DOI: 10.4108/eai.6-10-2021.171246
Hela Mliki, A. Kaceam, L. Chaari
The Internet of things (IoT) is a new ubiquitous technology that relies on heterogeneous devices and protocols. The IoT technologies are expected to o ff er a new level of connectivity thanks to its smart devices able to enhance everyday tasks and facilitate smart decisions based on sensed data. The IoT could collect sensitive data and should be able to face attacks and privacy issues. The IoT security issue is a hot topic of research and industrial concern. Indeed, threats against IoT devices and services could cause security breaches and data leakage. Aiming to identify attempts to abuse the IoT systems and mitigate malicious events, this paper studied the Intrusion Detection Systems (IDS) based on Machine Learning (ML) techniques. The ML approach could provide good tools to detect novel intrusion activities in a timely manner. This paper, therefore, highlighted the related issues to develop secured and e ffi cient IoT services. It tried to allow a comprehensive review of IoT features and design. It mainly focused on intrusion detection based on the machine learning schema and built a taxonomy of di ff erent IoT attacks and threats. This paper also compared between the di ff erent intrusion detection techniques and established a taxonomy of machine leaning methods for intrusion detection solutions.
物联网(IoT)是一种新的无处不在的技术,它依赖于异构设备和协议。由于其智能设备能够增强日常任务并促进基于感知数据的智能决策,物联网技术有望提供新的连接水平。物联网可以收集敏感数据,应该能够面对攻击和隐私问题。物联网安全问题是研究和业界关注的热点问题。事实上,对物联网设备和服务的威胁可能会导致安全漏洞和数据泄露。为了识别滥用物联网系统的企图并减轻恶意事件,本文研究了基于机器学习技术的入侵检测系统(IDS)。机器学习方法可以为及时检测新的入侵活动提供良好的工具。因此,本文强调了开发安全高效的物联网服务的相关问题。它试图全面回顾物联网的功能和设计。它主要关注基于机器学习模式的入侵检测,并构建了不同物联网攻击和威胁的分类。本文还比较了不同的入侵检测技术,并建立了入侵检测解决方案的机器学习方法分类。2021年2月4日收到;2021年9月24日接受;出版于2021年10月6日
{"title":"A Comprehensive Survey on Intrusion Detection based Machine Learning for IoT Networks","authors":"Hela Mliki, A. Kaceam, L. Chaari","doi":"10.4108/eai.6-10-2021.171246","DOIUrl":"https://doi.org/10.4108/eai.6-10-2021.171246","url":null,"abstract":"The Internet of things (IoT) is a new ubiquitous technology that relies on heterogeneous devices and protocols. The IoT technologies are expected to o ff er a new level of connectivity thanks to its smart devices able to enhance everyday tasks and facilitate smart decisions based on sensed data. The IoT could collect sensitive data and should be able to face attacks and privacy issues. The IoT security issue is a hot topic of research and industrial concern. Indeed, threats against IoT devices and services could cause security breaches and data leakage. Aiming to identify attempts to abuse the IoT systems and mitigate malicious events, this paper studied the Intrusion Detection Systems (IDS) based on Machine Learning (ML) techniques. The ML approach could provide good tools to detect novel intrusion activities in a timely manner. This paper, therefore, highlighted the related issues to develop secured and e ffi cient IoT services. It tried to allow a comprehensive review of IoT features and design. It mainly focused on intrusion detection based on the machine learning schema and built a taxonomy of di ff erent IoT attacks and threats. This paper also compared between the di ff erent intrusion detection techniques and established a taxonomy of machine leaning methods for intrusion detection solutions.","PeriodicalId":335727,"journal":{"name":"EAI Endorsed Trans. Security Safety","volume":"3 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-07-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133899472","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 6
Binary Code Similarity Detection through LSTM and Siamese Neural Network 基于LSTM和Siamese神经网络的二进制码相似度检测
Pub Date : 2018-07-13 DOI: 10.4108/eai.14-9-2021.170956
Zhengping Luo, Tao Hou, Xiangrong Zhou, Hui Zeng, Zhuo Lu
.
{"title":"Binary Code Similarity Detection through LSTM and Siamese Neural Network","authors":"Zhengping Luo, Tao Hou, Xiangrong Zhou, Hui Zeng, Zhuo Lu","doi":"10.4108/eai.14-9-2021.170956","DOIUrl":"https://doi.org/10.4108/eai.14-9-2021.170956","url":null,"abstract":".","PeriodicalId":335727,"journal":{"name":"EAI Endorsed Trans. Security Safety","volume":"26 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-07-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128113453","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Mapping of the Security Requirements of GDPR and NISD GDPR与NISD安全需求的对应关系
Pub Date : 2018-07-13 DOI: 10.4108/eai.30-6-2020.166283
Najm-u Saqib, Vasileios Germanos, W. Zeng, L. Maglaras
Privacy and information security have consistently been a priority for the European Union lawmaker. This paper investigates the security requirements of the General Data Protection Regulation (GDPR) and the Directive on security of network and information systems (NISD). This investigation incorporates what is unique about the NISD; how it overlaps with existing frameworks; and how security requirements in the GDPR influence the NISD. This mapping of requirements can help businesses and organizations to distinguish possible difficulties that may experience while conforming to GDPR and NISD, and help them create a consistent cybersecurity framework and structure new security plans. Received on 06 July 2020; accepted on 31 August 2020; published on 03 September 2020
隐私和信息安全一直是欧盟立法者优先考虑的问题。本文研究了《通用数据保护条例》(GDPR)和《网络与信息系统安全指令》(NISD)的安全要求。这项调查包含了NISD的独特之处;它如何与现有框架重叠;以及GDPR中的安全要求如何影响NISD。这种需求映射可以帮助企业和组织区分在符合GDPR和NISD时可能遇到的困难,并帮助他们创建一致的网络安全框架并构建新的安全计划。2020年7月6日收到;2020年8月31日接受;发布于2020年9月3日
{"title":"Mapping of the Security Requirements of GDPR and NISD","authors":"Najm-u Saqib, Vasileios Germanos, W. Zeng, L. Maglaras","doi":"10.4108/eai.30-6-2020.166283","DOIUrl":"https://doi.org/10.4108/eai.30-6-2020.166283","url":null,"abstract":"Privacy and information security have consistently been a priority for the European Union lawmaker. This paper investigates the security requirements of the General Data Protection Regulation (GDPR) and the Directive on security of network and information systems (NISD). This investigation incorporates what is unique about the NISD; how it overlaps with existing frameworks; and how security requirements in the GDPR influence the NISD. This mapping of requirements can help businesses and organizations to distinguish possible difficulties that may experience while conforming to GDPR and NISD, and help them create a consistent cybersecurity framework and structure new security plans. Received on 06 July 2020; accepted on 31 August 2020; published on 03 September 2020","PeriodicalId":335727,"journal":{"name":"EAI Endorsed Trans. Security Safety","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-07-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126062091","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Caching Techniques for Security Metadata in Integrity-Protected Fabric-Attached Memories 完整性保护结构附加存储器中安全元数据的缓存技术
Pub Date : 2018-07-13 DOI: 10.4108/eai.13-7-2018.165516
Mazen Alwadi, Amro Awad
The constant need for larger memories and the diversity of workloads have drove the system vendors away from the conventional processor-centric architecture into a memory-centric architecture. Memorycentric architecture, allows multiple computing nodes to connect to a huge shared memory pool and access it directly. To improve the performance, each node uses a small local memory to cache the data. These architectures introduce several problems when memory encryption and integrity verification are implemented. For instance, using a single integrity tree to protect both memories can introduce unnecessary overheads. Therefore, we propose Split-Tree, which implements a separate integrity tree for each memory. Later, we analyze the system performance, and the security metadata caches behavior when separate trees are used. We use the gathered insights to improve the security metadata caching for the separate trees and ultimately improve the system performance. Received on 16 June 2020; accepted on 07 July 2020; published on 11 August 2020
对更大内存的持续需求和工作负载的多样性促使系统供应商从传统的以处理器为中心的体系结构转向以内存为中心的体系结构。以内存为中心的架构,允许多个计算节点连接到一个巨大的共享内存池并直接访问它。为了提高性能,每个节点使用一小块本地内存来缓存数据。这些架构在实现内存加密和完整性验证时引入了几个问题。例如,使用单个完整性树来保护两个内存可能会带来不必要的开销。因此,我们提出了Split-Tree,它为每个内存实现了单独的完整性树。随后,我们分析了系统性能,以及使用分离树时的安全元数据缓存行为。我们使用收集到的见解来改进单独树的安全元数据缓存,并最终提高系统性能。2020年6月16日收到;2020年7月7日验收;发布于2020年8月11日
{"title":"Caching Techniques for Security Metadata in Integrity-Protected Fabric-Attached Memories","authors":"Mazen Alwadi, Amro Awad","doi":"10.4108/eai.13-7-2018.165516","DOIUrl":"https://doi.org/10.4108/eai.13-7-2018.165516","url":null,"abstract":"The constant need for larger memories and the diversity of workloads have drove the system vendors away from the conventional processor-centric architecture into a memory-centric architecture. Memorycentric architecture, allows multiple computing nodes to connect to a huge shared memory pool and access it directly. To improve the performance, each node uses a small local memory to cache the data. These architectures introduce several problems when memory encryption and integrity verification are implemented. For instance, using a single integrity tree to protect both memories can introduce unnecessary overheads. Therefore, we propose Split-Tree, which implements a separate integrity tree for each memory. Later, we analyze the system performance, and the security metadata caches behavior when separate trees are used. We use the gathered insights to improve the security metadata caching for the separate trees and ultimately improve the system performance. Received on 16 June 2020; accepted on 07 July 2020; published on 11 August 2020","PeriodicalId":335727,"journal":{"name":"EAI Endorsed Trans. Security Safety","volume":"62 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-07-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133263141","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
The performance analysis of public key cryptography-based authentication 基于公钥加密的认证性能分析
Pub Date : 2018-05-15 DOI: 10.4108/eai.15-5-2018.154770
Kaiqi Xiong
Several Kerberos-based authentication techniques using public-key cryptography have been proposed. Publickey cryptography can be used to eliminate a single point failure problem in the Key Distribution Center (KDC) and achieve better scalability. Public Key Cryptography for Cross-Realm Authentication in Kerberos (PKCROSS) and Public Key Utilizing Tickets for Application Servers (PKTAPP, a.k.a. KX.509/KCA) are considered two notable techniques. The latter was suggested to improve the former, but their actual computational and communication times have been poorly understood. This paper first presents a thorough performance evaluation of the two protocols based on analytical analysis and queueing network models. As shown, PKTAPP does not scale better than PKCROSS. Then, this paper gives a new public key cryptographybased group authentication technique. We show that the new technique can achieve better scalability than PKCORSS and PKTAPP and our performance methodology is effective. Received on 12 January 2018; accepted on 16 January 2018; published on 15 May 2018
已经提出了几种使用公钥加密的基于kerberos的身份验证技术。公共密钥加密可用于消除密钥分发中心(KDC)中的单点故障问题,并实现更好的可伸缩性。Kerberos跨领域认证公钥加密(PKCROSS)和应用程序服务器公钥票证利用(PKTAPP,又名KX.509/KCA)被认为是两种值得注意的技术。后者被认为是对前者的改进,但人们对它们的实际计算和通信时间知之甚少。本文首先基于分析分析和排队网络模型对这两种协议进行了全面的性能评估。如图所示,PKTAPP的可伸缩性并不比PKCROSS好。在此基础上,提出了一种新的基于公钥密码的组认证技术。实验结果表明,新技术比PKCORSS和PKTAPP具有更好的可扩展性,性能方法是有效的。2018年1月12日收到;2018年1月16日接受;发布于2018年5月15日
{"title":"The performance analysis of public key cryptography-based authentication","authors":"Kaiqi Xiong","doi":"10.4108/eai.15-5-2018.154770","DOIUrl":"https://doi.org/10.4108/eai.15-5-2018.154770","url":null,"abstract":"Several Kerberos-based authentication techniques using public-key cryptography have been proposed. Publickey cryptography can be used to eliminate a single point failure problem in the Key Distribution Center (KDC) and achieve better scalability. Public Key Cryptography for Cross-Realm Authentication in Kerberos (PKCROSS) and Public Key Utilizing Tickets for Application Servers (PKTAPP, a.k.a. KX.509/KCA) are considered two notable techniques. The latter was suggested to improve the former, but their actual computational and communication times have been poorly understood. This paper first presents a thorough performance evaluation of the two protocols based on analytical analysis and queueing network models. As shown, PKTAPP does not scale better than PKCROSS. Then, this paper gives a new public key cryptographybased group authentication technique. We show that the new technique can achieve better scalability than PKCORSS and PKTAPP and our performance methodology is effective. Received on 12 January 2018; accepted on 16 January 2018; published on 15 May 2018","PeriodicalId":335727,"journal":{"name":"EAI Endorsed Trans. Security Safety","volume":"63 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-05-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128541370","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
NIS directive: The case of Greece 国情院指令:希腊的情况
Pub Date : 2018-05-15 DOI: 10.4108/eai.15-5-2018.154769
L. Maglaras, G. Drivas, Kleanthis Noou, Stylianos Rallis
The directive on security of network and information systems (NIS directive) is one of the latest steps that the EU has taken in order to strengthen security of its systems. The directive describes specific steps that each member state should follow. Greece that has recently published its cyber security strategy is moving towards the implementation of the NIS directive. The road ahead is long and a cooperation in both technical and strategic level is needed. This article describes the roadmap of the implementation of the NIS directive in Greece, the milestones, the problems and possible solutions.
网络和信息系统安全指令(NIS指令)是欧盟为加强其系统安全而采取的最新措施之一。该指令描述了每个成员国应该遵循的具体步骤。最近公布了网络安全战略的希腊正在朝着实施NIS指令的方向迈进。前面的路还很长,需要技术和战略层面的合作。本文描述了在希腊实施NIS指令的路线图、里程碑、问题和可能的解决方案。
{"title":"NIS directive: The case of Greece","authors":"L. Maglaras, G. Drivas, Kleanthis Noou, Stylianos Rallis","doi":"10.4108/eai.15-5-2018.154769","DOIUrl":"https://doi.org/10.4108/eai.15-5-2018.154769","url":null,"abstract":"The directive on security of network and information systems (NIS directive) is one of the latest steps that the EU has taken in order to strengthen security of its systems. The directive describes specific steps that each member state should follow. Greece that has recently published its cyber security strategy is moving towards the implementation of the NIS directive. The road ahead is long and a cooperation in both technical and strategic level is needed. This article describes the roadmap of the implementation of the NIS directive in Greece, the milestones, the problems and possible solutions.","PeriodicalId":335727,"journal":{"name":"EAI Endorsed Trans. Security Safety","volume":"115 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-05-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133652494","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 16
Human-centered strategies for cyber-physical systems security 以人为中心的网络物理系统安全策略
Pub Date : 2018-05-15 DOI: 10.4108/eai.15-5-2018.154773
Ebrima N. Ceesay, K. Myers, P. Watters
Human error contributes to information system losses. Exposure to significant risk will continue and is not effectively addressed with conventional training. Broader strategy that addresses the social system is recommended. Such strategies have been successfully developed in industrial settings to deal with workplace hazards that are functionally similar to cyber loss. Four of these strategies are reviewed and found to be relevant to the needs of the IT-enabled organization in mitigating cyber security risks. These strategies are not consistent with each other or uniformly applicable, however, and would need to be adapted to contemporary knowledge work settings and used cautiously. Long-term institutionalization and development of organizational practices pose further challenges. While a holistic, sociotechnical systems (STS) approach to cyber security requires significant effort, IT-enabled organizations, as industrial organizations before them, will realize the effort is justified.
人为错误会造成信息系统的损失。暴露于重大风险将继续存在,并不能通过传统培训有效解决。建议采取更广泛的战略来解决社会制度问题。这种策略已经在工业环境中成功地开发出来,以处理在功能上类似于网络损失的工作场所危害。对其中的四种策略进行了审查,发现它们与支持it的组织在减轻网络安全风险方面的需求相关。然而,这些策略并不相互一致或统一适用,需要适应当代知识工作环境并谨慎使用。组织实践的长期制度化和发展构成了进一步的挑战。虽然整体的社会技术系统(STS)网络安全方法需要大量的努力,但it支持的组织,就像他们之前的工业组织一样,将意识到这种努力是合理的。
{"title":"Human-centered strategies for cyber-physical systems security","authors":"Ebrima N. Ceesay, K. Myers, P. Watters","doi":"10.4108/eai.15-5-2018.154773","DOIUrl":"https://doi.org/10.4108/eai.15-5-2018.154773","url":null,"abstract":"Human error contributes to information system losses. Exposure to significant risk will continue and is not effectively addressed with conventional training. Broader strategy that addresses the social system is recommended. Such strategies have been successfully developed in industrial settings to deal with workplace hazards that are functionally similar to cyber loss. Four of these strategies are reviewed and found to be relevant to the needs of the IT-enabled organization in mitigating cyber security risks. These strategies are not consistent with each other or uniformly applicable, however, and would need to be adapted to contemporary knowledge work settings and used cautiously. Long-term institutionalization and development of organizational practices pose further challenges. While a holistic, sociotechnical systems (STS) approach to cyber security requires significant effort, IT-enabled organizations, as industrial organizations before them, will realize the effort is justified.","PeriodicalId":335727,"journal":{"name":"EAI Endorsed Trans. Security Safety","volume":"184 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-05-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115218021","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
Improving Network Intrusion Detection Classifiers by Non-payload-Based Exploit-Independent Obfuscations: An Adversarial Approach 基于非有效负载的攻击无关混淆改进网络入侵检测分类器:一种对抗方法
Pub Date : 2018-05-07 DOI: 10.4108/eai.10-1-2019.156245
I. Homoliak, Martin Teknos, Martín Ochoa, Dominik Breitenbacher, S. Hosseini, P. Hanáček
Machine-learning based intrusion detection classifiers are able to detect unknown attacks, but at the same time, they may be susceptible to evasion by obfuscation techniques. An adversary intruder which possesses a crucial knowledge about a protection system can easily bypass the detection module. The main objective of our work is to improve the performance capabilities of intrusion detection classifiers against such adversaries. To this end, we firstly propose several obfuscation techniques of remote attacks that are based on the modification of various properties of network connections; then we conduct a set of comprehensive experiments to evaluate the effectiveness of intrusion detection classifiers against obfuscated attacks. We instantiate our approach by means of a tool, based on NetEm and Metasploit, which implements our obfuscation operators on any TCP communication. This allows us to generate modified network traffic for machine learning experiments employing features for assessing network statistics and behavior of TCP connections. We perform the evaluation of five classifiers: Gaussian Naive Bayes, Gaussian Naive Bayes with kernel density estimation, Logistic Regression, Decision Tree, and Support Vector Machines. Our experiments confirm the assumption that it is possible to evade the intrusion detection capability of all classifiers trained without prior knowledge about obfuscated attacks, causing an exacerbation of the TPR ranging from 7.8% to 66.8%. Further, when widening the training knowledge of the classifiers by a subset of obfuscated attacks, we achieve a significant improvement of the TPR by 4.21% - 73.3%, while the FPR is deteriorated only slightly (0.1% - 1.48%). Finally, we test the capability of an obfuscations-aware classifier to detect unknown obfuscated attacks, where we achieve over 90% detection rate on average for most of the obfuscations.
基于机器学习的入侵检测分类器能够检测到未知的攻击,但同时也容易被混淆技术规避。拥有保护系统的关键知识的敌方入侵者可以很容易地绕过检测模块。我们工作的主要目标是提高入侵检测分类器对抗此类对手的性能。为此,我们首先提出了几种基于修改网络连接的各种属性的远程攻击混淆技术;然后,我们进行了一组全面的实验来评估入侵检测分类器对混淆攻击的有效性。我们通过一个基于NetEm和Metasploit的工具来实例化我们的方法,该工具在任何TCP通信上实现了我们的混淆操作符。这允许我们为机器学习实验生成修改的网络流量,使用特征来评估网络统计和TCP连接的行为。我们对五种分类器进行了评估:高斯朴素贝叶斯,高斯朴素贝叶斯与核密度估计,逻辑回归,决策树和支持向量机。我们的实验证实了这样的假设,即在没有关于混淆攻击的先验知识的情况下,可以逃避所有分类器的入侵检测能力,从而导致TPR的恶化,范围从7.8%到66.8%。此外,当通过混淆攻击子集扩大分类器的训练知识时,我们实现了TPR的显着提高,提高幅度为4.21% - 73.3%,而FPR仅略有下降(0.1% - 1.48%)。最后,我们测试了识别混淆的分类器检测未知混淆攻击的能力,其中我们对大多数混淆的平均检测率达到90%以上。
{"title":"Improving Network Intrusion Detection Classifiers by Non-payload-Based Exploit-Independent Obfuscations: An Adversarial Approach","authors":"I. Homoliak, Martin Teknos, Martín Ochoa, Dominik Breitenbacher, S. Hosseini, P. Hanáček","doi":"10.4108/eai.10-1-2019.156245","DOIUrl":"https://doi.org/10.4108/eai.10-1-2019.156245","url":null,"abstract":"Machine-learning based intrusion detection classifiers are able to detect unknown attacks, but at the same time, they may be susceptible to evasion by obfuscation techniques. An adversary intruder which possesses a crucial knowledge about a protection system can easily bypass the detection module. The main objective of our work is to improve the performance capabilities of intrusion detection classifiers against such adversaries. To this end, we firstly propose several obfuscation techniques of remote attacks that are based on the modification of various properties of network connections; then we conduct a set of comprehensive experiments to evaluate the effectiveness of intrusion detection classifiers against obfuscated attacks. We instantiate our approach by means of a tool, based on NetEm and Metasploit, which implements our obfuscation operators on any TCP communication. This allows us to generate modified network traffic for machine learning experiments employing features for assessing network statistics and behavior of TCP connections. We perform the evaluation of five classifiers: Gaussian Naive Bayes, Gaussian Naive Bayes with kernel density estimation, Logistic Regression, Decision Tree, and Support Vector Machines. Our experiments confirm the assumption that it is possible to evade the intrusion detection capability of all classifiers trained without prior knowledge about obfuscated attacks, causing an exacerbation of the TPR ranging from 7.8% to 66.8%. Further, when widening the training knowledge of the classifiers by a subset of obfuscated attacks, we achieve a significant improvement of the TPR by 4.21% - 73.3%, while the FPR is deteriorated only slightly (0.1% - 1.48%). Finally, we test the capability of an obfuscations-aware classifier to detect unknown obfuscated attacks, where we achieve over 90% detection rate on average for most of the obfuscations.","PeriodicalId":335727,"journal":{"name":"EAI Endorsed Trans. Security Safety","volume":"100 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-05-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122314164","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 26
期刊
EAI Endorsed Trans. Security Safety
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:604180095
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1