{"title":"A Decentralized Resource Discovery Using Attribute Based Encryption for Internet of Things","authors":"M. Kamel, Yuping Yan, P. Ligeti, C. Reich","doi":"10.1109/CSNet50428.2020.9265463","DOIUrl":"https://doi.org/10.1109/CSNet50428.2020.9265463","url":null,"abstract":"The number of devices connected together in the Internet of Things (IoT) are growing and therefore the demand of an efficient and secure method for discovering the resources in IoT is increasing. In most of IoT schemes, the resources are discovered based on their properties (i.e. their location, types, etc.) and the clients are able to discover the resources that are registered in the network. This discovery ability can be restricted to a number of clients by encrypting the discoverable address. However, any client with the key can decrypt and access a private resource regardless of the attributes of the client. In this paper, a decentralized resource discovery model using Cipher Policy Attribute Based Encryption (CP-ABE) and Distributed Hash Table (DHT) is introduced that allows secure and private discovering of the resources in IoT network. We integrated the CP-ABE that allows clients only by users’ inherent attributes, to discover the resources in the network. Our proposed model provides a higher level of security for resource discovery by allowing the resources during registration in addition to their properties to define the attributes of the clients that are able to discover those resources. The model we proposed uses multi-authority ABE, which as a public key encryption can fit the decentralized environment.","PeriodicalId":234911,"journal":{"name":"2020 4th Cyber Security in Networking Conference (CSNet)","volume":"4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121346324","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Miel Verkerken, Laurens D’hooge, T. Wauters, B. Volckaert, F. Turck
{"title":"Unsupervised Machine Learning Techniques for Network Intrusion Detection on Modern Data","authors":"Miel Verkerken, Laurens D’hooge, T. Wauters, B. Volckaert, F. Turck","doi":"10.1109/CSNet50428.2020.9265461","DOIUrl":"https://doi.org/10.1109/CSNet50428.2020.9265461","url":null,"abstract":"The rapid growth of the internet, connecting billions of people and businesses, brings with it an increased risk of misuse. Handling this misuse requires adaptive techniques detecting known as well as unknown, zero-day, attacks. The latter proved most challenging in recent studies, where supervised machine learning techniques excelled at detecting known attacks, but failed to recognize unknown patterns. Therefore, this paper focuses on anomaly-based detection of malicious behavior on the network by using flow-based features. Four unsupervised methods are evaluated of which two employ a self-supervised learning approach. A realistic modern dataset, CIC-IDS-2017, containing multiple different attack types is used to evaluate the proposed models in terms of classification performance and computational complexity. The results show that an autoencoder, obtained from the field of deep-learning, yields the highest area under the Receiver Operating Characteristics (AUROC) of 0.978 while maintaining an acceptable computational complexity, followed by one-class support vector machine, isolation forest and principal components analysis.","PeriodicalId":234911,"journal":{"name":"2020 4th Cyber Security in Networking Conference (CSNet)","volume":"111 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115377812","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Karel Kuchar, R. Fujdiak, Petr Blazek, Zdenek Martinasek, E. Holasova
{"title":"Simplified Method for Fast and Efficient Incident Detection in Industrial Networks","authors":"Karel Kuchar, R. Fujdiak, Petr Blazek, Zdenek Martinasek, E. Holasova","doi":"10.1109/CSNet50428.2020.9265536","DOIUrl":"https://doi.org/10.1109/CSNet50428.2020.9265536","url":null,"abstract":"This article is focused on industrial networks and their security. An industrial network typically works with older devices that do not provide security at the level of today’s requirements. Even protocols often do not support security at a sufficient level. It is necessary to deal with these security issues due to digitization. It is therefore required to provide other techniques that will help with security. For this reason, it is possible to deploy additional elements that will provide additional security and ensure the monitoring of the network, such as the Intrusion Detection System. These systems recognize identified signatures and anomalies. Methods of detecting security incidents by detecting anomalies in network traffic are described. The proposed methods are focused on detecting DoS attacks in the industrial Modbus protocol and operations performed outside the standard interval in the Distributed Network Protocol 3. The functionality of the performed methods is tested in the IDS system Zeek.","PeriodicalId":234911,"journal":{"name":"2020 4th Cyber Security in Networking Conference (CSNet)","volume":"30 3 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127982800","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Cloud Assisted Privacy Preserving Using Homomorphic Encryption","authors":"Khalil Hariss, M. Chamoun, A. Samhat","doi":"10.1109/CSNet50428.2020.9265535","DOIUrl":"https://doi.org/10.1109/CSNet50428.2020.9265535","url":null,"abstract":"In this paper, privacy preserving at the cloud side is enabled by adopting Homomorphic Encryption (HE) as a major solution for protecting users’ sensitive data. As a Proof Of Concept (POC), we take the case of a university that is adopting the cloud as a practical method for storing and operating over its private data. The main contribution of this application is that different data are stored encrypted at the cloud side. Students’ data such as name, gender, date of birth, etc are encrypted using AES and hash functions. Students’ indexes and grades are encrypted homomorphically using our modified Domingo Ferrer (DF) encryption scheme [1]. The main importance of the usage of HE in this application is allowing the process over encrypted data at the cloud side such as computing encrypted students’ average. Different queries are sent from the university side to the cloud side, after operating and processing over encrypted data all results are shipped back encrypted to the university where the primitive data is recovered. Cloud infrastructure is created using Apache CloudStack and different encryption schemes are implemented under Python using SageMath library.","PeriodicalId":234911,"journal":{"name":"2020 4th Cyber Security in Networking Conference (CSNet)","volume":"19 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132780385","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Using Probabilistic Availability Measures for Predicting Targeted Attacks on Network Nodes","authors":"M. Pióro, M. Mycek, A. Tomaszewski","doi":"10.1109/CSNet50428.2020.9265459","DOIUrl":"https://doi.org/10.1109/CSNet50428.2020.9265459","url":null,"abstract":"This paper deals with targeted attacks on the nodes of a communication network. We present an optimization approach that may be useful for the network operator when deploying the so-called control nodes (called controllers) for resistance to attacks. A key element of our investigations is selecting an appropriate list of attacks that should be included in the optimization of controller placement. For this purpose, we propose innovative probabilistic network availability measures that could be used in planning the most dangerous attacks based on the attacker’s knowledge of the network. The operator can anticipate the set of such attacks and then incorporate them into optimizing the controller placement. In the paper, we discuss the proposed measures and present optimization problems appropriate for the deployment of controllers and attack planning. The numerical results illustrating our considerations are also included.","PeriodicalId":234911,"journal":{"name":"2020 4th Cyber Security in Networking Conference (CSNet)","volume":"9 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122413877","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Safe Traffic Adaptation Model in Wireless Mesh Networks","authors":"L. Khoukhi, R. Khatoun","doi":"10.1109/CSNet50428.2020.9265456","DOIUrl":"https://doi.org/10.1109/CSNet50428.2020.9265456","url":null,"abstract":"Wireless mesh networks (WMNs) are dynamically self-organized and self-configured technology ensuring efficient connection to Internet. Such networks suffer from many issues, like lack of performance efficiency when huge amount of traffic are injected inside the networks. To deal with such issues, we propose in this paper an adapted fuzzy framework; by monitoring the rate of change in queue length in addition to the current length of the queue, we are able to provide a measure of future queue state. Furthermore, by using explicit rate messages we can make node sources more responsive to unexpected changes in the network traffic load. The simulation results show the efficiency of the proposed model.","PeriodicalId":234911,"journal":{"name":"2020 4th Cyber Security in Networking Conference (CSNet)","volume":"3 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126249732","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Specific Anomaly Detection Method in Wireless Communication Networks","authors":"E. Holasova, R. Fujdiak, Karel Kuchar","doi":"10.1109/CSNet50428.2020.9265533","DOIUrl":"https://doi.org/10.1109/CSNet50428.2020.9265533","url":null,"abstract":"Wireless networks, especially the IEEE 802.11 standards family, are one of the main components of today’s communication. Addressing cybersecurity in these networks is crucial because of the ever-increasing number of attacks and newly discovered vulnerabilities. For this reason, the article deals with the vulnerability of security protocols used in IEEE 802.11. We concentrate on intrusion detection methods and detection of general security incidents. The presented results show that the methods may find application, among other things, in detection and prevention systems.","PeriodicalId":234911,"journal":{"name":"2020 4th Cyber Security in Networking Conference (CSNet)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129960456","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Anas Alsoliman, Abdulrahman Bin Rabiah, M. Levorato
{"title":"Privacy-Preserving Authentication Framework for UAS Traffic Management Systems","authors":"Anas Alsoliman, Abdulrahman Bin Rabiah, M. Levorato","doi":"10.1109/CSNet50428.2020.9265534","DOIUrl":"https://doi.org/10.1109/CSNet50428.2020.9265534","url":null,"abstract":"In 2015, the Federal Aviation Administration (FAA) has announced the integration of unmanned aerial vehicles (UAV) into the national airspace via a traffic management system – called UAS Traffic Management (UTM) – dedicated to Unmanned Aircraft Systems (UAS) to support advanced UAV operations such as autonomous and beyond visual line of sight (BVLOS) flight missions. The UTM incorporates an identification framework called Remote ID which mandates all UAS operators to continuously identify themselves while on flight. However, the current version of the framework lacks security features and its design has raised privacy concerns among UAS operators. This paper extends the Remote ID framework to include a Privacy-Preserving Authentication Framework that anonymously verifies the authenticity of flying UAVs. Moreover, the framework authenticates the UAV’s flight permissions without revealing neither the identity of its operator nor its entire flight path, while at the same time keeping any identifying information accessible to the authorities in case of a dispute. To satisfy the proposed security and privacy requirements, a UAV’s flight plan that is represented as a series of waypoints is transformed into localized UAV trajectories which create a set of contiguous flight zones, each with its own flight permission. This framework utilizes the Boneh–Gentry-Lynn–Shacham (BGLS) digital signature scheme to sign and transform each zone information into a flight permission and aggregate a set of signatures into a single signature along with additional attributes used to construct a Remote-ID message that anonymously authenticates flying UAVs.","PeriodicalId":234911,"journal":{"name":"2020 4th Cyber Security in Networking Conference (CSNet)","volume":"4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122743414","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Thi Quynh Nguyen, R. Laborde, A. Benzekri, Bruno Qu’hen
{"title":"Detecting abnormal DNS traffic using unsupervised machine learning","authors":"Thi Quynh Nguyen, R. Laborde, A. Benzekri, Bruno Qu’hen","doi":"10.1109/CSNet50428.2020.9265466","DOIUrl":"https://doi.org/10.1109/CSNet50428.2020.9265466","url":null,"abstract":"Nowadays, complex attacks like Advanced Persistent Threats (APTs) often use tunneling techniques to avoid being detected by security systems like Intrusion Detection System (IDS), Security Event Information Management (SIEMs) or firewalls. Companies try to identify these APTs by defining rules on their intrusion detection system, but it is a hard task that requires a lot of time and effort. In this study, we compare the performance of four unsupervised machine-learning algorithms: K-means, Gaussian Mixture Model (GMM), Density-Based Spatial Clustering of Applications with Noise (DBSCAN), and Local Outlier Factor (LOF) on the Boss of the SOC Dataset Version 1 (Botsv1) dataset of the Splunk project to detect malicious DNS traffics. Then we propose an approach that combines DBSCAN and K Nearest Neighbor (KNN) to achieve 100% detection rate and between 1.6% and 2.3% false-positive rate. A simple post-analysis consisting in ranking the IP addresses according to the number of requests or volume of bytes sent determines the infected machines.","PeriodicalId":234911,"journal":{"name":"2020 4th Cyber Security in Networking Conference (CSNet)","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125290443","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}