Proceedings of the 15th International Conference on Availability, Reliability and Security最新文献

Dynamic risk management architecture based on heterogeneous data sources for enhancing the cyber situational awareness in organizations 基于异构数据源增强组织网络态势感知的动态风险管理体系结构

Proceedings of the 15th International Conference on Availability, Reliability and Security Pub Date : 2020-08-25 DOI: 10.1145/3407023.3409224

X. Larriva-Novo, Mario Vega-Barbas, V. Villagrá, Diego Rivera, Mario Sanz Rodrigo, M. Álvarez-Campana

{"title":"Dynamic risk management architecture based on heterogeneous data sources for enhancing the cyber situational awareness in organizations","authors":"X. Larriva-Novo, Mario Vega-Barbas, V. Villagrá, Diego Rivera, Mario Sanz Rodrigo, M. Álvarez-Campana","doi":"10.1145/3407023.3409224","DOIUrl":"https://doi.org/10.1145/3407023.3409224","url":null,"abstract":"Traditional static risk assessment and management are currently not enough in most of the scenarios where the cybersecurity context of an organization varies dynamically. New threats that may affect to the organization can appear, suspicious activity is detected, etc. These changes are not taken into account by a static risk assessment as it is carried out unresponsively to these sudden changes in the context. This paper proposes a dynamic risk management system with the capability of reacting to those rapid changes in the context of the organization. This system is responsible for collecting multiple data from different types of sensors (presence, environmental, wifi, Bluetooth, network anomaly, work climate, etc.) and detecting anomalies in such data using correlation techniques. This architecture also counts with a prediction module that mathematically models the attacks, using Hidden Markov Models and Bayesian networks, and tries to estimate the next step of the attacker. Also, it is capable of automatically inferring the best response action in order to deploy the proper countermeasures against the attack.","PeriodicalId":121225,"journal":{"name":"Proceedings of the 15th International Conference on Availability, Reliability and Security","volume":"13 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-08-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123717263","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Evaluation methodology for mission-centric cyber situational awareness capabilities 以任务为中心的网络态势感知能力评估方法

Proceedings of the 15th International Conference on Availability, Reliability and Security Pub Date : 2020-08-25 DOI: 10.1145/3407023.3409223

David Sandoval Rodríguez-Bermejo, Roumen Daton Medenou, Gerardo Ramis Pasqual De Riquelme, J. M. Vidal, Francesco Torelli, S. Sánchez

{"title":"Evaluation methodology for mission-centric cyber situational awareness capabilities","authors":"David Sandoval Rodríguez-Bermejo, Roumen Daton Medenou, Gerardo Ramis Pasqual De Riquelme, J. M. Vidal, Francesco Torelli, S. Sánchez","doi":"10.1145/3407023.3409223","DOIUrl":"https://doi.org/10.1145/3407023.3409223","url":null,"abstract":"The emerging need for cyber defence capabilities able to bring closer cyberspace supremacy in joint military operations has led defence practitioners to begin a cyber race where academy, researchers, industry and military organizations work together. Because of the higher maturity of civilian technologies for cybersecurity, this often involves adapting capabilities not initially intended for military use to new dual-use requirements, where concepts like operations, missions or Courses of Action (CoAs) shall be presented and aligned with the military doctrine. One of the main 'battle horses' in this transformation is to develop supporting systems able to facilitate the mission-centric acquisition of Cyber Situational Awareness (CSA), where the observations in the cyberspace shall be properly correlated, propagated and understood in the scope of planned/ongoing mission. But despite these CSA needs, there is a wide methodological gap in the lack of suitable validation and verification frameworks, which not only relies on the raising need for capabilities able to verify if the existing solutions meet the requirements to operate on military actions, but also to support the thorough development life-cycle of brand new cyber defence technologies. In these grounds, this research introduces a novel evaluation framework able to guide the evaluation of CSA related tools, for which three core validation concepts are discussed: software, operational and application tests. They cover from the day-to-day implementation of the new capabilities, to their ability of facilitating that human decision-makers acquire a joint operational picture.","PeriodicalId":121225,"journal":{"name":"Proceedings of the 15th International Conference on Availability, Reliability and Security","volume":"61 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-08-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126599853","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 7

DoH Insight: detecting DNS over HTTPS by machine learning DoH Insight:通过机器学习检测HTTPS上的DNS

Proceedings of the 15th International Conference on Availability, Reliability and Security Pub Date : 2020-08-25 DOI: 10.1145/3407023.3409192

Dmitrii Vekshin, Karel Hynek, T. Čejka

引用次数: 44

PaperW8

Proceedings of the 15th International Conference on Availability, Reliability and Security Pub Date : 2020-08-25 DOI: 10.1145/3407023.3407044

Calvin Brierley, Jamie Pont, B. Arief, D. Barnes, J. Hernandez-Castro

{"title":"PaperW8","authors":"Calvin Brierley, Jamie Pont, B. Arief, D. Barnes, J. Hernandez-Castro","doi":"10.1145/3407023.3407044","DOIUrl":"https://doi.org/10.1145/3407023.3407044","url":null,"abstract":"Internet of Things (IoT) devices are used in many facets of modern life, from smart homes to smart cities, including Internet-enabled healthcare systems and industrial control systems. The prevalence and ubiquity of IoT devices makes them extremely attractive targets for malicious actors, in particular for taking control of vulnerable devices and demand ransom from their owners. The aim of this paper is twofold: to investigate the viability of a ransomware-type attack being carried out on IoT devices; and to explore what damage can be inflicted upon devices after they have been compromised. To test whether ransomware is a viable method for attacking IoT devices, we developed our own proof of concept malware for Linux-based IoT devices dubbed \"PaperW8\". We looked at feasible ways for infecting IoT devices, as well as potential methods for gaining control and applying persistent changes to the target device. We successfully created a proof of concept ransomware, which we tested against six vulnerable IoT devices of various brands and functions, some of which are known to have been targeted in the past but are still widely in use today. Developing this proof of concept tool allowed us to identify the main requirements for a successful ransomware attack against IoT devices. We also determined some limitations of IoT devices that may discourage attackers from developing IoT-specific ransomware, while highlighting workarounds that more determined attackers may use to overcome these obstacles. This paper has demonstrated that IoT ransomware is a credible threat. We implemented a proof of concept tool that can compromise many IoT devices of varying types. We envisage that this work can be used to assist current and future IoT developers to improve the security of their devices, and also to help security researchers in implementing more effective ransomware countermeasures, including for IoT devices.","PeriodicalId":121225,"journal":{"name":"Proceedings of the 15th International Conference on Availability, Reliability and Security","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-08-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114914562","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 9

Exploiting minification for data hiding purposes 利用最小化来实现数据隐藏目的

Proceedings of the 15th International Conference on Availability, Reliability and Security Pub Date : 2020-08-25 DOI: 10.1145/3407023.3409209

Paweł Rajba, W. Mazurczyk

引用次数: 3

Template-based Android inter process communication fuzzing 基于模板的Android进程间通信模糊测试

Proceedings of the 15th International Conference on Availability, Reliability and Security Pub Date : 2020-08-25 DOI: 10.1145/3407023.3407052

Anatoli Kalysch, M. Deutel, Tilo Müller

{"title":"Template-based Android inter process communication fuzzing","authors":"Anatoli Kalysch, M. Deutel, Tilo Müller","doi":"10.1145/3407023.3407052","DOIUrl":"https://doi.org/10.1145/3407023.3407052","url":null,"abstract":"Fuzzing is a test method in vulnerability assessments that calls the interfaces of a program in order to find bugs in its input processing. Automatically generated inputs, based on a set of templates and randomness, are sent to a program at a high rate, collecting crashes for later investigation. We apply fuzz testing to the inter process communication (IPC) on Android in order to find bugs in the mechanisms how Android apps communicate with each other. The sandboxing principle on Android usually ensures that apps can only communicate to other apps via programmatic interfaces. Unlike traditional operating systems, two Android apps running in the same user context are not able to access the data of each other (security) or quit the other app (safety). Our IPC fuzzer for Android detects the structure of data sent within Intents between apps by disassembling and analyzing an app's bytecode. It relies on multiple mutation engines for input generation and supports post-mortem analysis for a detailed insight into crashes. We tested 1488 popular apps from the Google Play-Store, enabling us to crash 450 apps with intents that could be sent from any unprivileged app on the same device, thus undermining the safety guarantees given by Android. We show that any installed app on a device could easily crash a series of other apps, effectively rendering them useless. Even worse, we discovered flaws in popular frameworks like Unity, the Google Services API, and the Adjust SDK. Comparing our implementation to previous research shows improvements in the depth and diversity of our detected crashes.","PeriodicalId":121225,"journal":{"name":"Proceedings of the 15th International Conference on Availability, Reliability and Security","volume":"106 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-08-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122433411","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 4

Feasibility study of a camera-based PUF in a realistic scenario 基于摄像机的PUF在现实场景中的可行性研究

Proceedings of the 15th International Conference on Availability, Reliability and Security Pub Date : 2020-08-25 DOI: 10.1145/3407023.3407047

Kazuhide Fukushima, Thomas Perianin, Victor Dyseryn, S. Kiyomoto, S. Guilley, A. Facon

引用次数: 0

Clust-IT: clustering-based intrusion detection in IoT environments 集群it:物联网环境中基于集群的入侵检测

Proceedings of the 15th International Conference on Availability, Reliability and Security Pub Date : 2020-08-25 DOI: 10.1145/3407023.3409201

Robert P. Markiewicz, D. Sgandurra

引用次数: 4

Anonymization of geosocial network data by the (k, l)-degree method with location entropy edge selection 基于位置熵边选择的(k, l)度方法对地理社交网络数据的匿名化

Proceedings of the 15th International Conference on Availability, Reliability and Security Pub Date : 2020-08-25 DOI: 10.1145/3407023.3409184

Jana Medková

{"title":"Anonymization of geosocial network data by the (k, l)-degree method with location entropy edge selection","authors":"Jana Medková","doi":"10.1145/3407023.3409184","DOIUrl":"https://doi.org/10.1145/3407023.3409184","url":null,"abstract":"Geosocial networks (GSNs) have become an important branch of location-based services since sharing information among friends is the additional feature to provide information based on the user's current location. The growing popularity of location-based services contribute to the development of highly customized and flexible utilities. However, providing customized services relates to collecting and storing a large amount of users' information. In this paper, we focus on the privacy-preserving concern in publishing GSN datasets. We introduce a new (k, l)-degree anonymization method to prevent the re-identification attack in the published GSN dataset. The presented method anonymizes users' social relationships as well as location-based information in GSN. We propose the new (k, l)-degree anonymization algorithm which modifies the network structure with a sequence of edge editing operations. GSN is newly represented by the combination of social network describing social ties between users and affiliation network linking users with their checked-in locations. Furthermore, we innovatively use the location entropy metric in the proposed GSN anonymization method. The location entropy measures the importance of the visited locations in the edge selection procedure of the (k, l)-degree anonymization algorithm. We explore the usability of the algorithm by running experiments on real-world geosocial network datasets, Gowalla and Brightkite.","PeriodicalId":121225,"journal":{"name":"Proceedings of the 15th International Conference on Availability, Reliability and Security","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-08-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129640095","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Real-time stream processing tool for detecting suspicious network patterns using machine learning 实时流处理工具，用于检测可疑的网络模式使用机器学习

Proceedings of the 15th International Conference on Availability, Reliability and Security Pub Date : 2020-08-25 DOI: 10.1145/3407023.3409189

Mikołaj Komisarek, M. Choraś, R. Kozik, M. Pawlicki

引用次数: 8