Growing threats and increasingly also failures due to complexity may compromise the security and resilience of network and service infrastructures. Applications and services require security of data handling and we need new security architectures and scalable and interoperable security policies for this. There is a need to guarantee end-to-end security in data communications and storage, including identity management and authentication.

Moreover, we need technology to enable network security monitoring and tracing and to assess the trustworthiness of infrastructures and services. It must ensure the protection of personal data and privacy and to properly assign liability and risks, together with the appropriate governance models needed to do so. Furthermore this is applied to the settings of Public Safety in general.

Abdulaleem Z. M. Al-Othmani (University Kuala Lumpur (UniKL)
Andrew Crampton (Huddersfield University)
Arosha Bandara (The Open University)
Artemios G. Voyiatzis (SBA Research)
Giampaolo Bella (Università di Cataia)
Hamed Taherdoost (Hamta Business Solution Snd Bhd, Ahoora Ltd Management Consultation Group)
Heng Zhang (Western Sydney University)
John Yen (Pen-state University)
Kieran McLaughlin (Queens Belfast University)
Martin Boldt (Blekinge Institute of Technology)
Mohamed Amine Ferrag (Guelma University)
Shujun Li (University of Surrey)
Simona Bernardi (University of Zaragoza, Spain)
Sokratis Katsikas (University of Piraeus)
Steven Furnell (Plymouth University)
Thomas Brandstetter (Limes security)
Tiago J. Cruz (Coimbra University)
Simon Parkinson (University of Huddersfield)
Kaiqi Xiong (University of South Florida)

Sencun Zhu

Department of Computer Science and Engineering and College of Information Sciences and Technology at The Pennsylvania State University (PSU)

Online First
Recently Published
Most Popular

Spill the Beans: Extrospection of Internet of Things by Exploiting Denial of Service
Appears in:
sesa 18: e1

Authors:
Vinay Sachidananda, Suhas Bhairav, Yuval Elovici

Published:
8th Aug 2019

Abstract:
Internet of Things (IoT) exposes various vulnerabilities at different levels. One such exploitable vulnerability is Denial of Service (DoS). In this work, we focus on a large-scale extensive study of various forms of DoS and how it can be exploited in different protocols of IoT. We propose an atta…Internet of Things (IoT) exposes various vulnerabilities at different levels. One such exploitable vulnerability
is Denial of Service (DoS). In this work, we focus on a large-scale extensive study of various forms of DoS and how it can be exploited in different protocols of IoT. We propose an attack and defense framework called OWL which is tailored for IoT and that can perform various forms of DoS on IP, Bluetooth, and Zigbee devices. We consider various DoS vulnerabilities such as illegitimate packet injection, Bluetooth Low Energy (BLE) scanning attack, Zigbee frame counter-attack, etc., regarding IP, Bluetooth and Zigbee devices. To understand how resilient is IoT for DoS, we propose two new metrics to measure the Resilience and the Quality of Service (QoS) degradation in IoT. We have conducted large-scale experimentation with real IoT devices in our security IoT testbed. The experiments conducted are for DoS, Distributed Denial of Service (DDoS) by setting up Mirai and Permanent Denial of Service (PDoS) using BrickerBot on various IoT devices. We have also compared our framework with the existing state of the art tools.
more »

Privacy-Preserving Multi-Party Directory Services
Appears in:
sesa 19(19): e5

Authors:
Yuzhe Tang, Kai Li, Katchaguy Areekijseree, Shuigeng Zhou, Liting Hu

Published:
29th Jan 2019

Abstract:
In the era of big data, the data-processing pipeline becomes increasingly distributed among multiple sites. To connect data consumers with remote producers, a public directory service is essential. This is evidenced by adoption in emerging applications such as electronic healthcare. This work syst…In the era of big data, the data-processing pipeline becomes increasingly distributed among multiple sites. To connect data consumers with remote producers, a public directory service is essential. This is evidenced by adoption in emerging applications such as electronic healthcare.
This work systematically studies the privacy-preserving and security hardening of a public directory service.
First, we address the privacy preservation of serving a directory over the Internet. With Internet eavesdroppers
performing attacks with background knowledge, the directory service has to be privacy preserving, for the
compliance with data-protection laws (e.g., HiPAA). We propose techniques to adaptively inject noises to the
public directory in such a way that is aware of application-level data schema, effectively preserving privacy and achieving high search recall.
Second, we tackle the problem of securely constructing the directory among distrusting data producers.
For provable security, we model the directory construction problem by secure multi-party computations (MPC). For efficiency, we propose a pre-computation framework that minimizes the private computation and conducts aggressive pre-computation on public data. In addition, we tackle the systems-level efficiency by exploiting data-level parallelism on general-purpose graphics processing units (GPGPU). We apply the proposed scheme to real health-care scenarios for constructing patient-locator services in emerging Health Information Exchange (or HIE) networks.
For privacy evaluation, we conduct extensive analysis of our noise-injecting techniques against various
background-knowledge attacks. We conduct experiments on real-world datasets and demonstrate the low attack success rate for the protection effectiveness. For performance evaluation, we implement our MPC optimization techniques on open-source MPC software. Through experiments on local and geo-distributed settings, our performance results show that the proposed pre-computation achieves a speedup of more than an order of magnitude without security loss.
more »
Differentially Private High-Dimensional Data Publication via Markov Network
Appears in:
sesa 19(19): e4

Authors:
Wei Zhang, Jingwen Zhao, Fengqiong Wei, Yunfang Chen

Published:
29th Jan 2019

Abstract:
Differentially private data publication has recently received considerable attention. However, it faces some challenges in differentially private high-dimensional data publication, such as the complex attribute relationships, the high computational complexity and data sparsity. Therefore, we propo…Differentially private data publication has recently received considerable attention. However, it faces some challenges in differentially private high-dimensional data publication, such as the complex attribute relationships, the high computational
complexity and data sparsity. Therefore, we propose PrivMN, a novel method to publish high-dimensional data with differential privacy guarantee. We first use the Markov model to represent the mutual relationships between attributes to solve the problem that the direction of relationship between variables cannot be determined in practical application. We then take advantage of approximate inference to calculate the joint distribution of high-dimensional data under differential privacy to figure out the computational and spatial complexity of accurate reasoning. Extensive experiments on real datasets demonstrate that our solution makes the published high-dimensional synthetic datasets more efficient under the guarantee
of differential privacy.
more »
Forget the Myth of the Air Gap: Machine Learning for Reliable Intrusion Detection in SCADA Systems
Appears in:
sesa 19(19): e3

Authors:
Rocio Lopez Perez, Florian Adamsky, Ridha Soua, Thomas Engel

Published:
29th Jan 2019

Abstract:
Since Critical Infrastructures (CIs) use systems and equipment that are separated by long distances, Supervisory Control And Data Acquisition (SCADA) systems are used to monitor their behaviour and to send commands remotely. For a long time, operator of CIs applied the air gap principle, a security…Since Critical Infrastructures (CIs) use systems and equipment that are separated by long distances, Supervisory Control And Data Acquisition (SCADA) systems are used to monitor their behaviour and to send commands remotely. For a long time, operator of CIs applied the air gap principle, a security strategy that physically isolates the control network from other communication channels. True isolation, however, is difficult nowadays due to the massive spread of
connectivity: using open protocols and more connectivity opens new network attacks against CIs. To cope with this dilemma, sophisticated security measures are needed to address malicious intrusions, which are steadily increasing in number and
variety. However, traditional Intrusion Detection Systems (IDSs) cannot detect attacks that are not already present in their databases. To this end, we assess in this paper Machine Learning (ML) techniques for anomaly detection in SCADA systems
using a real data set collected from a gas pipeline system and provided by the Mississippi State University (MSU). The contribution of this paper is two-fold: 1) The evaluation of four techniques for missing data estimation and two techniques for data normalization, 2) The performances of Support Vector Machine (SVM), Random Forest (RF), Bidirectional Long
Short Term Memory (BLSTM) are assessed in terms of accuracy, precision, recall and F1 score for intrusion detection. Two cases are differentiated: binary and categorical classifications. Our experiments reveal that RF and BLSTM detect intrusions effectively, with an F1 score of respectively > 99% and > 96%.
more »
A Methodology for the Dynamic Design of Adaptive Log Management Infrastructures
Appears in:
sesa 19(19): e2

Authors:
V. Anastopoulos, S. Katsikas

Published:
29th Jan 2019

Abstract:
Organizations collect log data for various reasons, including security related ones. The multitude and diversity of the devices that generate log records increases, resulting to dispersed networks and large volumes of data. The design of a log management infrastructure is usually led by decisions t…Organizations collect log data for various reasons, including security related ones. The multitude and diversity of the devices that generate log records increases, resulting to dispersed networks and large volumes of data. The design of a log management infrastructure is usually led by decisions that are commonly based on industry best practices and experience, but fail to adapt to the evolving threat landscape. In this work a novel methodology for the design of a dynamic log management infrastructure is proposed. The proposed methodology leverages social network analysis to relate the infrastructure with the threat landscape, thus enabling it to evolve as threats evolve. The workings of the methodology are
demonstrated by means of its application for the design of the log management infrastructure of a real organization.
more »
Adaptive Noise Injection against Side-Channel Attacks on ARM Platform
Appears in:
sesa 19(19): e1

Authors:
Naiwei Liu, Wanyu Zang, Songqing Chen, Meng Yu, Ravi Sandhu

Published:
29th Jan 2019

Abstract:
In recent years, research efforts have been made to develop safe and secure environments for ARM platform. The new ARMv8 architecture brought in security features by design. However, there are still some security problems with ARMv8. For example, on Cortex-A series, there are risks that the system …In recent years, research efforts have been made to develop safe and secure environments for ARM platform. The new ARMv8 architecture brought in security features by design. However, there are still some security problems with ARMv8. For example, on Cortex-A series, there are risks that the system is vulnerable to sidechannel attacks. One major category of side-channel attacks utilizes cache memory to obtain a victim’s secret information. In the cache based side-channel attacks, an attacker measures a sequence of cache operations to obtain a victim’s memory access information, deriving more sensitive information. The success of such attacks highly depends on accurate information about the victim’s cache accesses. In this paper, we describe an innovative approach to defend against side-channel attack on Cortex-A series chips. We also considered
the side-channel attacks in the context of using TrustZone protection on ARM. Our adaptive noise injection can significantly reduce the bandwidth of side-channel while maintaining an affordable system overhead. The proposed defense mechanisms can be used on ARM Cortex-A architecture. Our experimental evaluation and theoretical analysis show the effectiveness and efficiency of our proposed defense.
more »
HProve: A Hypervisor Level Provenance System to Reconstruct Attack Story Caused by Kernel Malware
Appears in:
sesa 19(18): e5

Authors:
Chonghua Wang, Libo Yin, Jun Li, Xuehong Chen, Rongchao Yin, Xiaochun Yun, Yang Jiao, Zhiyu Hao

Published:
25th Jan 2019

Abstract:
Provenance of system subjects (e.g., processes) and objects (e.g., ﬁles) are very useful for many forensics tasks. In our analysis and comparison of existing Linux provenance tracing systems, we found that most systems assume the Linux kernel to be in the trust base, making these systems vulnerable…Provenance of system subjects (e.g., processes) and objects (e.g., ﬁles) are very useful for many forensics tasks. In our analysis and comparison of existing Linux provenance tracing systems, we found that most systems assume the Linux kernel to be in the trust base, making these systems vulnerable to kernel level malware. To address this problem, we present HProve, a hypervisor level provenance tracing system to reconstruct kernel malware attack story. It monitors the execution of kernel functions and sensitive objects, and correlates the system subjects and objects to form the causality dependencies for the attacks. We evaluated our prototype on 12 real world kernel malware samples, and the results show that it can correctly identify the provenance behaviors of the kernel malware with a minor performance overhead.
more »
Towards Scalability Trade-off and Security Issues in State-of-the-art Blockchain
Appears in:
sesa 19(18): e4

Author:
Debasis Gountia

Published:
25th Jan 2019

Abstract:
Blockchain is the latest technology developed in recent years for storing and sharing valuable information about transactions. This technology applies different methods for storing information that is unlike other existing traditional ways. Blockchain technology is an excellent example of maintaini…Blockchain is the latest technology developed in recent years for storing and sharing valuable information about transactions. This technology applies different methods for storing information that is unlike other existing traditional ways. Blockchain technology is an excellent example of maintaining privacy and security (in terms of immutability). As it does not need any control of central unit, it has tremendous impacts on many organizations involving from business to education and finance. This technology has a lot of attractive features that make it very popular from day to day in the domain of technology. But then also we have to pertain to the scalability and security challenges in this technology for more honorable and reliable in state-of-the-art Blockchain technology.
more »
A Machine Learning Based Approach for Mobile App Rating Manipulation Detection
Appears in:
sesa 19(18): e3

Authors:
Yang Song, Chen Wu, Sencun Zhu, Haining Wang

Published:
25th Jan 2019

Abstract:
In order to promote apps in mobile app stores, for malicious developers and users, manipulating average rating is a popular and feasible way. In this work, we propose a two-phase machine learning approach to detecting app rating manipulation attacks. In the ﬁrst learning phase, we generate feature …In order to promote apps in mobile app stores, for malicious developers and users, manipulating average rating is a popular and feasible way. In this work, we propose a two-phase machine learning approach to detecting app rating manipulation attacks. In the ﬁrst learning phase, we generate feature ranks for diﬀerent app stores and ﬁnd that top features match the characteristics of abused apps and malicious users. In the second learning phase, we choose top N features and train our models for each app store. With cross-validation, our training models achieve 85% f-score. We also use our training models to discover new suspicious apps from our data set and evaluate them with two criteria. Finally, we conduct some analysis based on the suspicious apps classiﬁed by our training models and some interesting results are discovered.
more »
Exploring the Privacy Bound for Diﬀerential Privacy: From Theory to Practice
Appears in:
sesa 19(18): e2

Authors:
Xianmang He, Yuan Hong, Yindong Chen

Published:
25th Jan 2019

Abstract:
Data privacy has attracted signiﬁcant interests in both database theory and security communities in the past few decades. Diﬀerential privacy has emerged as a new paradigm for rigorous privacy protection regardless of adversaries prior knowledge. However, the meaning of privacy bound ꞓ and how to s…Data privacy has attracted signiﬁcant interests in both database theory and security communities in the past few decades. Diﬀerential privacy has emerged as a new paradigm for rigorous privacy protection regardless of adversaries prior knowledge. However, the meaning of privacy bound ꞓ and how to select an appropriate ꞓ may still be unclear to the general data owners. More recently, some approaches have been proposed to derive the upper bounds of ꞓ for speciﬁed privacy risks. Unfortunately, these upper bounds suﬀer from some deﬁciencies (e.g., the bound relies on the data size, or might be too large), which greatly limits their applicability. To remedy this problem, we propose a novel approach that converts the privacy bound in diﬀerential privacy ꞓ to privacy risks understandable to generic users, and present an in-depth theoretical analysis for it. Finally, we have conducted experiments to demonstrate the eﬀectiveness of our model.
more »
Monitoring and Improving Managed Security Services inside a Security Operation Center
Appears in:
sesa 19(18): e1

Authors:
Mina Khalili, Mengyuan Zhang, Daniel Borbor, Lingyu Wang, Nicandro Scarabeo, Michel-Ange Zamor

Published:
25th Jan 2019

Abstract:
Monitoring and improving the performance of Security Operation Centers (SOC) are becoming crucial due to the emerging need of beneﬁting from Managed Security Services (MSS) rather than hiring in-house security experts. In this paper, by observing workﬂows of a real-world SOC, a system consisting of…Monitoring and improving the performance of Security Operation Centers (SOC) are becoming crucial due to the emerging need of beneﬁting from Managed Security Services (MSS) rather than hiring in-house security experts. In this paper, by observing workﬂows of a real-world SOC, a system consisting of three diﬀerent modules is designed for monitoring analysts’ activities, analysis performance measurement, and performing simulation scenarios. The system empowers managers to evaluate the SOC’s performance, which helps them to conform to Service Level Agreement (SLA) and see the need for improvement. Moreover, the designed system is strengthened by a background service module to provide feedback about anomalies or informative issues for security analysts. Three case studies have been conducted based on real data collected from the operational SOC, and simulation results have demonstrated the eﬀectiveness of the diﬀerent modules of the designed system in improving the SOC performance.
more »

Mouse Underlaying: Global Key and Mouse Listener Based on an Almost Invisible Window with Local Listeners and Sophisticated Focus
Appears in:
sesa 18(15): e5

Author:
Tim Niklas Witte

Downloads:
4713

Abstract:
Keyloggers are serious threats for computer users both private and commercial. If an attacker is capable of installing this malware on the victim’s machine then he or she is able to monitor keystrokes of a user. This keylog contains login information. As a consequence, protection and detection tech…Keyloggers are serious threats for computer users both private and commercial. If an attacker is capable of installing this malware on the victim’s machine then he or she is able to monitor keystrokes of a user. This keylog contains login information. As a consequence, protection and detection techniques against keyloggers become increasingly better. This article presents the method of Mouse Underlaying for creating a new kind of software based keyloggers. This method is implemented in Java for testing countermeasures concerning keylogger protection, virtual keyboard, signatures and behavior detection by anti-virus programs. Products of various manufacturers are used for demonstration purposes. All of them failed without an exception. In addition, the reasons why these products failed are analyzed, and moreover, measures against Mouse Underlaying are developed based on the demonstration results.
more »
A Deep Learning Approach for Network Intrusion Detection System
Appears in:
sesa 16(9): e2

Authors:
Ahmad Javaid, Quamar Niyaz, Weiqing Sun, Mansoor Alam

Downloads:
4311

Abstract:
A Network Intrusion Detection System (NIDS) helps system administrators to detect network security breaches in their organizations. However, many challenges arise while developing a flexible and efficient NIDS for unforeseen and unpredictable attacks. We propose a deep learning based approach for…A Network Intrusion Detection System (NIDS) helps system administrators to detect network security breaches in
their organizations. However, many challenges arise while
developing a flexible and efficient NIDS for unforeseen and unpredictable attacks. We propose a deep learning based approach for developing such an efficient and flexible NIDS.
We use Self-taught Learning (STL), a deep learning based technique, on NSL-KDD - a benchmark dataset for network
intrusion. We present the performance of our approach and compare it with a few previous work. Compared metrics include accuracy, precision, recall, and f-measure values.
more »
Threats, Countermeasures and Attribution of Cyber Attacks on Critical Infrastructures
Appears in:
sesa 18(16): e1

Authors:
Leandros Maglaras, Mohamed Amine Ferrag, Abdelouahid Derhab, Mithun Mukherjee, Helge Janicke, Stylianos Rallis

Downloads:
1899

Abstract:
As Critical National Infrastructures are becoming more vulnerable to cyber attacks, their protection becomes a signiﬁcant issue for any organization as well as a nation. Moreover, the ability to attribute is a vital element of avoiding impunity in cyberspace. In this article, we present main threat…As Critical National Infrastructures are becoming more vulnerable to cyber attacks, their protection becomes a signiﬁcant issue for any organization as well as a nation. Moreover, the ability to attribute is a vital element of avoiding impunity in cyberspace. In this article, we present main threats to critical infrastructures along with protective measures that one nation can take, and which are classiﬁed according to legal, technical, organizational, capacity building, and cooperation aspects. Finally we provide an overview of current methods and practices regarding cyber attribution and cyber peace keeping.
more »
A V2X Message Evaluation Methodology and Cross-Domain Modelling of Safety Applications in V2X-enabled E/E-Architectures
Appears in:
sesa 16(8): e1

Authors:
Harald Bucher, Marius-Florin Buciuman, Alexander Klimm, Oliver Sander, Jürgen Becker

Downloads:
1041

Abstract:
The introduction of Vehicular Ad-Hoc Networks (VANETs) enables great potential for improving road traffic flow and especially active safety applications such as cooperative adaptive cruise control (CACC). Such applications not only rely on continuous broadcast of vehicle state information (beacons)…The introduction of Vehicular Ad-Hoc Networks (VANETs) enables great potential for improving road traffic flow and especially active safety applications such as cooperative adaptive cruise control (CACC). Such applications not only rely on continuous broadcast of vehicle state information (beacons) of all vehicles, but also have strict real-time requirements. Regarding automotive E/E architectures this continuous broadcasting adds heavy internal E/E data traffic that needs to be processed in real-time by Electronic Control Units (ECUs).
In this work we address this issue by proposing a novel cluster-based message evaluation methodology to significantly reduce internal E/E network traffic by discarding irrelevant messages. The approach is only depending on information received over beacons. It combines a vehicle clustering strategy as well as network and vehicle state monitoring capabilities in order to correctly evaluate messages under real-time constraints. The proposed methodology is modeled inside an abstract ECU. It is evaluated by simulating a model-based CACC application under different traffic scenarios. It is shown that a significant reduction of messages is achievable, while still guaranteeing accident-free behavior of CACC.
more »
Reviewing the book “Principles of Cyber-physical Systems” from a security perspective
Appears in:
sesa 15(4): e6

Authors:
Minghui Zhu, Peng Liu

Downloads:
1023

Abstract:
This is a review of the book “Principles of Cyber-physical Systems” authored by Rajeev Alur and published by the MIT Press at 2015.This is a review of the book “Principles of Cyber-physical Systems” authored by Rajeev Alur and published by the MIT Press at 2015.
more »
ITFComp: A Compression Algorithm for ARM Architecture Instruction Trace Files
Appears in:
sesa 16(8): e2

Authors:
Mohammad Qasem, Lukas Pustina

Downloads:
758

Abstract:
Testing the performance of a new computational component is costly due to the need of prototyping different setups. Therefore, trace driven hardware simulations are used. Instruction Trace Files (ITFs) are files containing traces of executed instructions in a program's run and are used as an input …Testing the performance of a new computational component is costly due to the need of prototyping different setups. Therefore, trace driven hardware simulations are used. Instruction Trace Files (ITFs) are files containing traces of executed instructions in a program's run and are used as an input for hardware simulations. ITFs tend to be large in size, causing a storage challenge. Many trace reduction techniques exist to deal with the ITFs' storage challenge. In this paper we introduce ITFComp, a compression algorithm that combines general purpose compression methods with knowledge about ARM architecture ITFs' structure to reduce their size. ITFComp also works on compressing data memory addresses accessed by instructions within ITFs to further reduce an ITF size. Results show a reduction of 600 times on average when combined with LZMA compression algorithm. This reduction is 4 times better than when using LZMA alone, and 10 times better than when using DEFLATE. ITFComp introduces a negligible overhead in the decompression time (less than 1%).
more »
A Deep Learning Based DDoS Detection System in Software-Defined Networking (SDN)
Appears in:
sesa 17(12): e2

Authors:
Quamar Niyaz, Weiqing Sun, Ahmad Y. Javaid

Downloads:
731

Abstract:
Distributed Denial of Service (DDoS) is one of the most prevalent attacks that an organizational network infrastructure comes across nowadays. Poor network management, low-priced Internet subscriptions, and readily available attack tools can be attributed to their rise. The recently emerged softwar…Distributed Denial of Service (DDoS) is one of the most prevalent attacks that an organizational network infrastructure comes across nowadays. Poor network management, low-priced Internet subscriptions, and readily available attack tools can be attributed to their rise. The recently emerged software-defined networking (SDN) and deep learning (DL) concepts promise to revolutionize their respective domains. SDN keeps the global view of the entire managed the network from a single point, i.e., the controller, thus making the network management easier. DL-based approaches improve feature extraction/reduction from a high-dimensional dataset such as network traffic headers. This work proposes a deep learning based multi-vector DDoS detection system in an SDN environment. The detection system is implemented as a network application on top of the SDN controller and can monitor the managed network traÿc. Performance evaluation is based on different metrics by applying the system on traÿc traces collected from different scenarios. A high accuracy with low false-positive rate is observed in attack detection for the proposed system.
more »
Evaluation of Cryptography Usage in Android Applications
Appears in:
sesa 16(9): e4

Authors:
Alexia Chatzikonstantinou, Christoforos Ntantogian, Georgios Karopoulos, Christos Xenakis

Downloads:
569

Abstract:
Mobile application developers are using cryptography in their products to protect sensitive data like passwords, short messages, documents etc. In this paper, we study whether cryptography and related techniques are employed in a proper way, in order to protect these private data. To this end, we d…Mobile application developers are using cryptography in their products to protect sensitive data like passwords, short messages, documents etc. In this paper, we study whether cryptography and related techniques are employed in a proper way, in order to protect these private data. To this end, we downloaded 49 Android applications from the Google Play marketplace and performed static and dynamic analysis in an attempt to detect possible cryptographic misuses. The results showed that 87.8% of the applications present some kind of misuse, while for the rest of them no cryptography usage was detected during the analysis. Finally, we suggest countermeasures, mainly intended for developers, to alleviate the issues identified by the analysis.
more »
Network-based Analysis and Classiﬁcation of Malware using Behavioral Artifacts Ordering
Appears in:
sesa 18(16): e2

Authors:
Aziz Mohaisen, Omar Alrawi, Jeman Park, Joongheon Kim, DaeHun Nyang, Manar Mohaisen

Downloads:
533

Abstract:
Using runtime execution artifacts to identify malware and its associated “family” is an established technique in the security domain. Many papers in the literature rely on explicit features derived from network, ﬁle system, or registry interaction. While effective, the use of these ﬁne-granularity …Using runtime execution artifacts to identify malware and its associated “family” is an established technique in the security domain. Many papers in the literature rely on explicit features derived from network, ﬁle system, or registry interaction. While effective, the use of these ﬁne-granularity data points makes these techniques computationally expensive. Moreover, the signatures and heuristics are often circumvented by subsequent malware authors. In this work, we propose Chatter, a system that is concerned only with the order in which high-level system events take place. Individual events are mapped onto an alphabet and execution traces are captured via terse concatenations of those letters. Then, leveraging an analyst labeled corpus of malware, n-gram document classiﬁcation techniques are applied to produce a classiﬁer predicting malware family. This paper describes that technique and its proof-of-concept evaluation. In its prototype form only network events are considered and eleven malware families are used. We show the technique achieves 83%-94% accuracy in isolation and makes non-trivial performance improvements when integrated with a baseline classiﬁer of combined order features to reach an accuracy of up to 98.8%.
more »
Prevention of crime in B2C E-Commerce: How E-Retailers/Banks protect themselves from Criminal Activities
Appears in:
sesa 16(7): e4

Authors:
Najlaa AlMajed, Leandros A. Maglaras, Francois Siewe, Helge Janicke, Pooneh Bagheri Zadeh

Downloads:
515

Abstract:
Online shopping and banking institutes are a current trend in e-commerce, where online shopping and banking are frequently used over the Internet. With the fast growth of the technology and on-line practices, criminal activities also have grown dramatically. Customer trust in the security of online…Online shopping and banking institutes are a current trend in e-commerce, where online shopping and banking are frequently used over the Internet. With the fast growth of the technology and on-line practices, criminal activities also have grown dramatically. Customer trust in the security of online activities is extremely immportant for successful trading. Both buyers and sellers are vulnerable to online risks. With the current focus being on precautions that individual buyers and sellers should consider protecting themselves from criminal activities online, the issue of what e-commerce websites should do to minimize their customer's risk is apparently a neglected area in current literature. This research analyses deficiencies in online shopping and online banking websites, and identifies suitable procedures that e-commerce operators may apply to minimize the risk of criminal activities.
more »

Publisher: EAI
ISSN: 2032-9393
Number of Volumes: 6

Last Published: 29th Jan 2019