2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)最新文献_第5页

To me, to you: Towards Secure PLC Programming through a Community-Driven Open-Source Initiative 致我，致你:通过社区驱动的开源计划实现安全的PLC编程

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-07-01 DOI: 10.1109/EuroSPW59978.2023.00045

R. Derbyshire, Sam Maesschalck, Alex Staves, B. Green, David Hutchison

{"title":"To me, to you: Towards Secure PLC Programming through a Community-Driven Open-Source Initiative","authors":"R. Derbyshire, Sam Maesschalck, Alex Staves, B. Green, David Hutchison","doi":"10.1109/EuroSPW59978.2023.00045","DOIUrl":"https://doi.org/10.1109/EuroSPW59978.2023.00045","url":null,"abstract":"Over the last decade, industrial control systems (ICS) have experienced an increasing frequency of cyber attacks. At the heart of these systems are programmable logic controller (PLC), responsible for the monitoring, control, and automation of physical operational processes. As an increasing number of adversaries are attaining the capability to gain a foothold in ICS environments, with the goal of operational process manipulation, PLCs are becoming a primary target. Unlike conventional IT software, PLCs are programmed via unique industrial languages and the notion of secure PLC programming practices is in its infancy. This has led to vulnerabilities within the very logic PLCs use to interact with the physical world, notably in code provided by vendors, which is proprietary and unable to be viewed or edited to implement secure programming practices. These vulnerabilities then affords adversaries an attack surface to achieve their goals. In this positional paper, a conceptual framework is introduced positing the notion of a communitydriven hub. This hub incorporates a set of processes that draw from existing literature, to provide secure, verified, open-source PLC code. The goal of which is to not only provide PLC programmers with a convenient alternative to vulnerable vendor provided libraries, but increase the awareness and importance of secure PLC programming practices.","PeriodicalId":220415,"journal":{"name":"2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131360072","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

An Analysis of Requirements and Privacy Threats in Mobile Data Donations 移动数据捐赠的需求与隐私威胁分析

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-07-01 DOI: 10.1109/EuroSPW59978.2023.00015

Leonie Reichert

引用次数: 0

TimeInspector: A Static Analysis Approach for Detecting Timing Attacks TimeInspector:用于检测定时攻击的静态分析方法

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-07-01 DOI: 10.1109/EuroSPW59978.2023.00037

Fatih Durmaz, Nureddin Kamadan, Melih Öz, M. Unal, Arsalan Javeed, Cemal Yilmaz, E. Savaş

引用次数: 0

How Cryptocurrency Exchange Interruptions Create Arbitrage Opportunities 加密货币交易中断如何创造套利机会

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-07-01 DOI: 10.1109/EuroSPW59978.2023.00028

Andrew Morin, T. Moore

引用次数: 0

Applying Neutralisation Theory to Better Understand Ransomware Offenders 应用中和理论更好地了解勒索软件罪犯

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-07-01 DOI: 10.1109/EuroSPW59978.2023.00025

L. Connolly, H. Borrion, B. Arief, Sanna Kaddoura

{"title":"Applying Neutralisation Theory to Better Understand Ransomware Offenders","authors":"L. Connolly, H. Borrion, B. Arief, Sanna Kaddoura","doi":"10.1109/EuroSPW59978.2023.00025","DOIUrl":"https://doi.org/10.1109/EuroSPW59978.2023.00025","url":null,"abstract":"The work presented in this paper investigates the crime of ransomware from the perspective of neutralisation theory. In particular, this research-in-progress paper aims to explore the feasibility of using neutralisation theory to better understand one of the key stakeholders in ransomware operations: the offenders. Individuals (including offenders) may employ techniques of neutralisation in order to justify their rule-breaking acts, and to diminish both the perceived consequences of their acts and the feeling of guilt. The focus of this work is on highly organised ransomware groups that not only conduct cyber attacks but also operate Ransomware-as-a-Service (RaaS) businesses. Secondary data was used in this research, including media interviews with alleged ransomware offenders. Data analysis is currently ongoing, but preliminary results show that ransomware offenders mainly use six neutralisation techniques to minimise the perceived impact and/or guilty feeling of their actions. These six neutralisation techniques are (1) denial of victim, (2) denial of injury, (3) claim of benefits, (4) claim of entitlement, (5) defence of necessity, and (6) claim of relative acceptability. The findings from this work can shed some light on the ransomware offending pathways, which in turn can be utilised to devise more effective countermeasures for combatting ransomware crime.","PeriodicalId":220415,"journal":{"name":"2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"23 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126606585","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Temporal Analysis of Distribution Shifts in Malware Classification for Digital Forensics 数字取证中恶意软件分类分布变化的时间分析

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-07-01 DOI: 10.1109/EuroSPW59978.2023.00054

Francesco Zola, J. L. Bruse, M. Galar

{"title":"Temporal Analysis of Distribution Shifts in Malware Classification for Digital Forensics","authors":"Francesco Zola, J. L. Bruse, M. Galar","doi":"10.1109/EuroSPW59978.2023.00054","DOIUrl":"https://doi.org/10.1109/EuroSPW59978.2023.00054","url":null,"abstract":"In recent years, malware diversity and complexity have increased substantially, so the detection and classification of malware families have become one of the key objectives of information security. Machine learning (ML)-based approaches have been proposed to tackle this problem. However, most of these approaches focus on achieving high classification performance scores in static scenarios, without taking into account a key feature of malware: it is constantly evolving. This leads to ML models being outdated and performing poorly after only a few months, leaving stakeholders exposed to potential security risks. With this work, our aim is to highlight the issues that may arise when applying ML-based classification to malware data. We propose a three-step approach to carry out a forensics exploration of model failures. In particular, in the first step, we evaluate and compare the concept drift generated by models trained using a rolling windows approach for selecting the training dataset. In the second step, we evaluate model drift based on the amount of temporal information used in the training dataset. Finally, we perform an in-depth misclassification and feature analysis to emphasize the interpretation of the results and to highlight drift causes. We conclude that caution is warranted when training ML models for malware analysis, as concept drift and clear performance drops were observed even for models trained on larger datasets. Based on our results, it may be more beneficial to train models on fewer but recent data and re-train them after a few months in order to maintain performance.","PeriodicalId":220415,"journal":{"name":"2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"13 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127244703","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Fake it till you Detect it: Continual Anomaly Detection in Multivariate Time-Series using Generative AI 假装它直到你发现它:使用生成人工智能在多元时间序列中持续异常检测

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-07-01 DOI: 10.1109/eurospw59978.2023.00068

Gastón García González, P. Casas, Alicia Fernández

{"title":"Fake it till you Detect it: Continual Anomaly Detection in Multivariate Time-Series using Generative AI","authors":"Gastón García González, P. Casas, Alicia Fernández","doi":"10.1109/eurospw59978.2023.00068","DOIUrl":"https://doi.org/10.1109/eurospw59978.2023.00068","url":null,"abstract":"Anomaly detection in Multivariate Time-Series (MTS) data plays an important role in multiple domains, especially in cybersecurity, for the detection of unknown attacks. DC- VAE is a recent approach we have proposed for anomaly detection in network measurement multivariate data, which uses Variational Auto Encoders (VAEs) and Dilated Convolutional Neural Networks (DCNNs) to model complex and high-dimensional MTS data. However, detecting anomalies using VAEs can result in performance degradation and even catastrophic forgetting when trained on dynamic and evolving network measurements, particularly in the event of concept drifts. We extend DC- VAE to a continual learning setup, leveraging the generative AI properties of the underlying models to deal with continually evolving data. We introduce GenDeX, an approach to Generative AI-based anomaly detection which compresses the patterns extracted from past measurements into a generative model that can synthesize MTS data out of input Gaussian noise, mimicking the characteristics of the MTS data used for training. GenDeX relies on a Deep Generative Replay paradigm to realize continual learning, combining synthesized past MTS measurements with new observations to update the detection model. Using a large-scale, multi-dimensional network monitoring dataset collected from an operational mobile Internet Service Provider (ISP), we showcase the functionality of DC-VAE in the event of concept drifts, and study in-depth its generative characteristics, assessing GenDeX synthetically generated MTS examples. GenDeX enables DC- VAE adapting to continually evolving data, overcoming the limitations of catastrophic forgetting.","PeriodicalId":220415,"journal":{"name":"2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116808402","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Divided We Hack: Exploring the Degree of Sino-Russian Coordination in Cyberspace During the Ukraine War 分裂我们黑客:探讨在乌克兰战争中中俄在网络空间的协调程度

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-07-01 DOI: 10.1109/EuroSPW59978.2023.00074

F. Ferazza, Cosimo Melella, Konstantinos Mersinas, A. Calcara

{"title":"Divided We Hack: Exploring the Degree of Sino-Russian Coordination in Cyberspace During the Ukraine War","authors":"F. Ferazza, Cosimo Melella, Konstantinos Mersinas, A. Calcara","doi":"10.1109/EuroSPW59978.2023.00074","DOIUrl":"https://doi.org/10.1109/EuroSPW59978.2023.00074","url":null,"abstract":"China and Russia are arguably NATO’s main strategic competitors and potential adversaries. Since 2017, Beijing and Moscow have conducted cyber-espionage operations against NATO members, and the two countries have also reportedly displayed more coordination in the cyber domain. These concerns have become more pressing since the outbreak of war in Ukraine, where multiple sources have shown alleged evidence of Chinese and Russian cyber-operations coordination. While it is commonly accepted that China and Russia cooperate at the strategic level in the cyber domain, this article aims at better understanding whether these two nation-states are also coordinating their affiliated cyber threat groups. We investigate this, drawing on multiple open-access data and sources. Specifically, we empirically examine the activity of three Chinese groups, Mustang Panda, Scarab and Judgment Panda, to assess the presence and degree of coordination with their Russian counterparts. Our analysis shows that, as far as the examined groups are concerned, there was no coordination between Russian and Chinese campaigns, and the latter group sometimes even targeted sensitive Russian civilian and military infrastructures.","PeriodicalId":220415,"journal":{"name":"2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"408 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114938066","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

From Tactics to Techniques: A Systematic Attack Modeling for Advanced Persistent Threats in Industrial Control Systems 从战术到技术:工业控制系统中高级持续性威胁的系统攻击建模

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-07-01 DOI: 10.1109/EuroSPW59978.2023.00042

Yunhe Yang, Mu Zhang

{"title":"From Tactics to Techniques: A Systematic Attack Modeling for Advanced Persistent Threats in Industrial Control Systems","authors":"Yunhe Yang, Mu Zhang","doi":"10.1109/EuroSPW59978.2023.00042","DOIUrl":"https://doi.org/10.1109/EuroSPW59978.2023.00042","url":null,"abstract":"Advanced Persistent Threats (APTs) targeting Industrial Control Systems (ICS) have emerged as a significant challenge in the cybersecurity landscape. These sophisticated attacks can lead to catastrophic consequences on critical infrastructure and services. This paper presents an innovative attack model for ICS-APT attacks designed to provide adequate defense against real-world threats. By examining and analyzing real-world APT attacks against ICS, we identify common and unique characteristics across different attacks, bridging the gap between high-level features and low-level behaviors. We further demonstrate the effectiveness of our proposed model by simulating a false data injection attack on a realistic ICS testbed, utilizing the identified Tactics, Techniques, and Procedures (TTPs) and stages of an APT attack. This simulation enables us to validate the model’s accuracy and identify potential challenges in mitigating such complex threats. Our proposed model leverages this systematic understanding of attacker behavior, allowing for accurate characterization of attack patterns. It empowers analysts with the tools and insights needed to counteract and mitigate the risk posed by ICS-APT attacks, contributing to the protection of critical infrastructure and enhancing cybersecurity resilience in the face of evolving threats.","PeriodicalId":220415,"journal":{"name":"2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125606015","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A Hybrid Solution for Constrained Devices to Detect Microarchitectural Attacks 约束设备检测微架构攻击的混合解决方案

2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) Pub Date : 2023-07-01 DOI: 10.1109/EuroSPW59978.2023.00033

Nikolaos Foivos Polychronou, Pierre-Henri Thevenon, Maxime Puys, V. Beroulle

{"title":"A Hybrid Solution for Constrained Devices to Detect Microarchitectural Attacks","authors":"Nikolaos Foivos Polychronou, Pierre-Henri Thevenon, Maxime Puys, V. Beroulle","doi":"10.1109/EuroSPW59978.2023.00033","DOIUrl":"https://doi.org/10.1109/EuroSPW59978.2023.00033","url":null,"abstract":"We are seeing an increase in cybersecurity attacks on resource-constrained systems such as the Internet of Things (IoT) and Industrial IoT (I-IoT) devices. Recently, a new category of attacks has emerged called microarchitectural attacks. It targets hardware units of the system such as the processor or memory and is often complicated if not impossible to remediate since it imposes modifying the hardware. In default of remediation, some solutions propose to detect these attacks. Yet, most of them are not suitable for embedded systems since they are based on complex machine learning algorithms.In this paper, we propose an edge-computing security solution for attack detection that uses a local-remote machine learning implementation to find an equilibrium between accuracy and decision-making latency while addressing the memory, performance, and communication bandwidth constraints of resource-constrained systems. We demonstrate effectiveness in the detection of multiple microarchitectural attacks such as Row hammer or cache attacks on an embedded device with an accuracy of 98.75% and a FPR near 0%. To limit the overhead on the communication bus, the proposed solution allows to locally classify as trusted 99% of the samples during normal operation and thus filtering them out.","PeriodicalId":220415,"journal":{"name":"2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)","volume":"421 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123580216","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0