2021 IEEE International Conference on Cyber Security and Resilience (CSR)最新文献_第9页

Towards HybridgeCAN, a hybrid bridged CAN platform for automotive security testing 迈向HybridgeCAN，一个用于汽车安全测试的混合桥接CAN平台

2021 IEEE International Conference on Cyber Security and Resilience (CSR) Pub Date : 2021-07-26 DOI: 10.1109/CSR51186.2021.9527969

D. Granata, M. Rak, Giovanni Salzillo

{"title":"Towards HybridgeCAN, a hybrid bridged CAN platform for automotive security testing","authors":"D. Granata, M. Rak, Giovanni Salzillo","doi":"10.1109/CSR51186.2021.9527969","DOIUrl":"https://doi.org/10.1109/CSR51186.2021.9527969","url":null,"abstract":"Over the years, the automotive industry has experienced a great progress in the electronics and information technology. To offer an easier and safer driving experience, vehicles started to incorporate more and more complex electronic components, also known as Electronic Control Units (ECUs), whereas the communication between different control units is demanded to a single CAN-Bus network or to multiple on-board wired networks. However, the automotive protocols have been designed without consider any security measures. Thus, modern vehicles are exposed to multiple classes of threats and cyber-attacks. Today, the security evaluation of current automotive standards and implementations requires expensive emulation systems (e.g. hardware-in-the-loop simulations), or real vehicles to conduct accurate security-tests. This work presents HybridgeCAN, a low-cost computer-to-vehicle testbed to simulate vehicles control units and communications over a hybrid CAN Bus network. We introduce the challenges that need to be addressed and overcome to create a hybrid automotive test system, with a special focus on security testing.","PeriodicalId":253300,"journal":{"name":"2021 IEEE International Conference on Cyber Security and Resilience (CSR)","volume":"160 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-07-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133808529","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Resilient Boot 有弹性的引导

2021 IEEE International Conference on Cyber Security and Resilience (CSR) Pub Date : 2021-07-26 DOI: 10.1109/CSR51186.2021.9527940

Sergey Ostrikov

引用次数: 0

Software Vulnerabilities, Products and Exploits: A Statistical Relational Learning Approach 软件漏洞、产品和利用:一种统计关系学习方法

2021 IEEE International Conference on Cyber Security and Resilience (CSR) Pub Date : 2021-07-26 DOI: 10.1109/CSR51186.2021.9527984

Cainã Figueiredo, João Gabriel Lopes, R. Azevedo, Gerson Zaverucha, D. Menasché, Leandro Pfleger De Aguiar

{"title":"Software Vulnerabilities, Products and Exploits: A Statistical Relational Learning Approach","authors":"Cainã Figueiredo, João Gabriel Lopes, R. Azevedo, Gerson Zaverucha, D. Menasché, Leandro Pfleger De Aguiar","doi":"10.1109/CSR51186.2021.9527984","DOIUrl":"https://doi.org/10.1109/CSR51186.2021.9527984","url":null,"abstract":"Data on software vulnerabilities, products and exploits is typically collected from multiple non-structured sources. Valuable information, e.g., on which products are affected by which exploits, is conveyed by matching data from those sources, i.e., through their relations. In this paper, we leverage this simple albeit unexplored observation to introduce a statistical relational learning (SRL) approach for the analysis of vulnerabilities, products and exploits. In particular, we focus on the problem of determining the existence of an exploit for a given product, given information about the relations between products and vulnerabilities, and vulnerabilities and exploits, focusing on Industrial Control Systems (ICS), the National Vulnerability Database and ExploitDB. Using RDN-Boost, we were able to reach an AUC ROC of 0.83 and an AUC PR of 0.69 for the problem at hand. To reach that performance, we indicate that it is instrumental to include textual features, e.g., extracted from the description of vulnerabilities, as well as structured information, e.g., about product categories. In addition, using interpretable relational regression trees we report simple rules that shed insight on factors impacting the weaponization of ICS products.","PeriodicalId":253300,"journal":{"name":"2021 IEEE International Conference on Cyber Security and Resilience (CSR)","volume":"42 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-07-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124851884","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

On Security of Key Derivation Functions in Password-based Cryptography 基于密码的密码系统中密钥派生函数的安全性研究

2021 IEEE International Conference on Cyber Security and Resilience (CSR) Pub Date : 2021-07-26 DOI: 10.1109/CSR51186.2021.9527961

Gaurav Kodwani, Shashank Arora, P. Atrey

引用次数: 0

Data Exfiltration: Methods and Detection Countermeasures 数据泄露:方法与检测对策

2021 IEEE International Conference on Cyber Security and Resilience (CSR) Pub Date : 2021-07-26 DOI: 10.1109/CSR51186.2021.9527962

James King, G. Bendiab, N. Savage, S. Shiaeles

引用次数: 0

Act Proactively: An Intrusion Prediction Approach for Cyber Security 主动行动:一种网络安全入侵预测方法

2021 IEEE International Conference on Cyber Security and Resilience (CSR) Pub Date : 2021-07-26 DOI: 10.1109/CSR51186.2021.9527920

P. Panagiotidis, Christos Angelidis, Ioannis Karalis, Georges Spyropoulos, Angelos Liapis

引用次数: 0

Towards Resilient Artificial Intelligence: Survey and Research Issues 走向弹性人工智能:调查和研究问题

2021 IEEE International Conference on Cyber Security and Resilience (CSR) Pub Date : 2021-07-26 DOI: 10.1109/CSR51186.2021.9527986

Oliver Eigner, Sebastian Eresheim, Peter Kieseberg, Lukas Daniel Klausner, Martin Pirker, Torsten Priebe, S. Tjoa, F. Marulli, F. Mercaldo

引用次数: 12

SoK: Investigation of Security and Functional Safety in Industrial IoT SoK:工业物联网安全与功能安全研究

2021 IEEE International Conference on Cyber Security and Resilience (CSR) Pub Date : 2021-07-26 DOI: 10.1109/CSR51186.2021.9527921

E. Tomur, Utku Gülen, Elif Ustundag Soykan, M. Ersoy, Ferhat Karakoç, Leyli Karaçay, Pinar Çomak

{"title":"SoK: Investigation of Security and Functional Safety in Industrial IoT","authors":"E. Tomur, Utku Gülen, Elif Ustundag Soykan, M. Ersoy, Ferhat Karakoç, Leyli Karaçay, Pinar Çomak","doi":"10.1109/CSR51186.2021.9527921","DOIUrl":"https://doi.org/10.1109/CSR51186.2021.9527921","url":null,"abstract":"There has been an increasing popularity of industrial usage of Internet of Things (IoT) technologies in parallel to advancements in connectivity and automation. Security vulnerabilities in industrial systems, which are considered less likely to be exploited in conventional closed settings, have now started to be a major concern with Industrial IoT. One of the critical components of any industrial control system turning into a target for attackers is functional safety. This vital function is not originally designed to provide protection against malicious intentional parties but only accidents and errors. In this paper, we explore a generic IoT-based smart manufacturing use-case from a combined perspective of security and functional safety, which are indeed tightly correlated. Our main contribution is the presentation of a taxonomy of threats targeting directly the critical safety function in industrial IoT applications. Besides, based on this taxonomy, we identified particular attack scenarios that might have severe impact on physical assets like manufacturing equipment, even human life and cyber-assets like availability of Industrial IoT application. Finally, we recommend some solutions to mitigate such attacks based mainly on industry standards and advanced security features of mobile communication technologies.","PeriodicalId":253300,"journal":{"name":"2021 IEEE International Conference on Cyber Security and Resilience (CSR)","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-07-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121759912","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3

Towards anomaly detection in smart grids by combining Complex Events Processing and SNMP objects 结合复杂事件处理和SNMP对象实现智能电网异常检测

2021 IEEE International Conference on Cyber Security and Resilience (CSR) Pub Date : 2021-06-28 DOI: 10.1109/CSR51186.2021.9527928

M. Itria, Enrico Schiavone, Nicola Nostro

{"title":"Towards anomaly detection in smart grids by combining Complex Events Processing and SNMP objects","authors":"M. Itria, Enrico Schiavone, Nicola Nostro","doi":"10.1109/CSR51186.2021.9527928","DOIUrl":"https://doi.org/10.1109/CSR51186.2021.9527928","url":null,"abstract":"This paper describes the architecture and the fundamental methodology of an anomaly detector, which by continuously monitoring Simple Network Management Protocol data and by processing it as complex-events, is able to timely recognize patterns of faults and relevant cyber-attacks. This solution has been applied in the context of smart grids, and in particular as part of a security and resilience component of the Information and Communication Technologies (ICT) Gateway, a middleware-based architecture that correlates and fuses measurement data from different sources (e.g., Inverters, Smart Meters) to provide control coordination and to enable grid observability applications. The detector has been evaluated through experiments, where we selected some representative anomalies that can occur on the ICT side of the energy distribution infrastructure: non-malicious faults (indicated by patterns in the system resources usage), as well as effects of typical cyber-attacks directed to the smart grid infrastructure. The results show that the detection is promisingly fast and efficient.","PeriodicalId":253300,"journal":{"name":"2021 IEEE International Conference on Cyber Security and Resilience (CSR)","volume":"49 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-06-28","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115928300","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Machine learning on knowledge graphs for context-aware security monitoring 基于知识图的机器学习，用于上下文感知的安全监控

2021 IEEE International Conference on Cyber Security and Resilience (CSR) Pub Date : 2021-05-18 DOI: 10.1109/CSR51186.2021.9527927

J. Garrido, D. Dold, Johannes Frank

引用次数: 16