Research

Jump to: Review

8 pages, 959 KiB

Open AccessArticle

Application of Histogram-Based Outlier Scores to Detect Computer Network Anomalies

by Nerijus Paulauskas and Algirdas Baskys

Electronics 2019, 8(11), 1251; https://doi.org/10.3390/electronics8111251 - 01 Nov 2019

Cited by 12 | Viewed by 3997

Misuse activity in computer networks constantly creates new challenges and difficulties to ensure data confidentiality, integrity, and availability. The capability to identify and quickly stop the attacks is essential, as the undetected and successful attack may cause losses of critical resources. The anomaly-based [...] Read more.

Misuse activity in computer networks constantly creates new challenges and difficulties to ensure data confidentiality, integrity, and availability. The capability to identify and quickly stop the attacks is essential, as the undetected and successful attack may cause losses of critical resources. The anomaly-based intrusion detection system (IDS) is a valuable security tool that is capable of detecting new, previously unseen attacks. Anomaly-based IDS sends an alarm when it detects an event that deviates from the behavior characterized as normal. This paper analyses the use of the histogram-based outlier score (HBOS) to detect anomalies in the computer network. Experimental results of different histogram creation methods and the influence of the number of bins on the performance of anomaly detection are presented. Experiments were conducted using an NSL-KDD dataset. Full article

(This article belongs to the Special Issue State-of-the-Art of Cyber Security)

► Show Figures

Figure 1

28 pages, 2118 KiB

Open AccessArticle

The Application of a New Secure Software Development Life Cycle (S-SDLC) with Agile Methodologies

by Juan de Vicente Mohino, Javier Bermejo Higuera, Juan Ramón Bermejo Higuera and Juan Antonio Sicilia Montalvo

Electronics 2019, 8(11), 1218; https://doi.org/10.3390/electronics8111218 - 24 Oct 2019

Cited by 44 | Viewed by 22434

Abstract

The software development environment is focused on reaching functional products in the shortest period by making use of the least amount of resources possible. In this scenario, crucial elements such as software quality or software security are not considered at all, and in [...] Read more.

The software development environment is focused on reaching functional products in the shortest period by making use of the least amount of resources possible. In this scenario, crucial elements such as software quality or software security are not considered at all, and in most cases, the high value offered to the projects is not taken into account. Nowadays, agile models are booming. They are defined by the way they achieve the interaction and integration of everyone involved in the software life cycle, the advantages of the quick reaction to change, and the implementation of artifacts or deliverables which display the level of progress reached at any time. In this context, it seems clearly necessary to define a new software development model, which prioritizes security aspects at any phase of the software life cycle and takes advantage of the benefits of the agile models. The proposed methodology shows that if security is considered from the beginning, vulnerabilities are easily detected and solved during the time planned for the project, with no extra time nor costs for the client and it increases the possibilities of reaching success in terms of not only functionality but also quality. Full article

(This article belongs to the Special Issue State-of-the-Art of Cyber Security)

► Show Figures

Figure 1

19 pages, 321 KiB

Open AccessFeature PaperArticle

Model-Checking Speculation-Dependent Security Properties: Abstracting and Reducing Processor Models for Sound and Complete Verification

by Gianpiero Cabodi, Paolo Camurati, Fabrizio Finocchiaro and Danilo Vendraminetto

Electronics 2019, 8(9), 1057; https://doi.org/10.3390/electronics8091057 - 19 Sep 2019

Cited by 3 | Viewed by 3206

Abstract

Spectre and Meltdown attacks in modern microprocessors represent a new class of attacks that have been difficult to deal with. They underline vulnerabilities in hardware design that have been going unnoticed for years. This shows the weakness of the state-of-the-art verification process and [...] Read more.

Spectre and Meltdown attacks in modern microprocessors represent a new class of attacks that have been difficult to deal with. They underline vulnerabilities in hardware design that have been going unnoticed for years. This shows the weakness of the state-of-the-art verification process and design practices. These attacks are OS-independent, and they do not exploit any software vulnerabilities. Moreover, they violate all security assumptions ensured by standard security procedures, (e.g., address space isolation), and, as a result, every security mechanism built upon these guarantees. These vulnerabilities allow the attacker to retrieve leaked data without accessing the secret directly. Indeed, they make use of covert channels, which are mechanisms of hidden communication that convey sensitive information without any visible information flow between the malicious party and the victim. The root cause of this type of side-channel attacks lies within the speculative and out-of-order execution of modern high-performance microarchitectures. Since modern processors are hard to verify with standard formal verification techniques, we present a methodology that shows how to transform a realistic model of a speculative and out-of-order processor into an abstract one. Following related formal verification approaches, we simplify the model under consideration by abstraction and refinement steps. We also present an approach to formally verify the abstract model using a standard model checker. The theoretical flow, reliant on established formal verification results, is introduced and a sketch of proof is provided for soundness and correctness. Finally, we demonstrate the feasibility of our approach, by applying it on a pipelined DLX RISC-inspired processor architecture. We show preliminary experimental results to support our claim, performing Bounded Model-Checking with a state-of-the-art model checker. Full article

(This article belongs to the Special Issue State-of-the-Art of Cyber Security)

► Show Figures

Figure 1

21 pages, 881 KiB

Open AccessArticle

Multi-Point Collaborative Authentication Method Based on User Image Intelligent Collection in the Internet of Things

by Yunfa Li, Yifei Tu and Jiawa Lu

Electronics 2019, 8(9), 978; https://doi.org/10.3390/electronics8090978 - 02 Sep 2019

Cited by 3 | Viewed by 3427

Abstract

With the increasing demand for intelligent services of the Internet of Things (IoT), its security issues have attracted widespread attention recently. Since most of the existing identity authentication policies are based on a single authentication mode, they are highly likely to cause problems [...] Read more.

With the increasing demand for intelligent services of the Internet of Things (IoT), its security issues have attracted widespread attention recently. Since most of the existing identity authentication policies are based on a single authentication mode, they are highly likely to cause problems such as illegal operation and stealing of sensor information. In order to meet the needs of increasing IoT users for the security management of intelligent services, a multi-point collaborative authentication method based on user image intelligent collection for the security problems faced by IoT in identity authentication is proposed in the paper. This method firstly collects the identity of the legal user through the intelligent collection technology and then realizes the identity authentication of the unidentified user through the collaborative authentication between the local domain management machine, the back-end image management machine, and the cloud server. Compared with the traditional single identity authentication method, our method uses three-party collaborative authentication to avoid the problem of sensor information stealing easily caused by a single authentication method, which makes the user’s identity authentication more secure and effective. The security analysis shows that the method is able to resist multiple attacks and prevent the sensor information from being illegally operated and stolen, protecting the security of the sensor information. Full article

(This article belongs to the Special Issue State-of-the-Art of Cyber Security)

► Show Figures

Figure 1

36 pages, 1953 KiB

Open AccessArticle

Ransomware Detection System for Android Applications

by Samah Alsoghyer and Iman Almomani

Electronics 2019, 8(8), 868; https://doi.org/10.3390/electronics8080868 - 05 Aug 2019

Cited by 45 | Viewed by 10201

Abstract

Android ransomware is one of the most threatening attacks nowadays. Ransomware in general encrypts or locks the files on the victim’s device and requests a payment in order to recover them. The available technologies are not enough as new ransomwares employ a combination [...] Read more.

Android ransomware is one of the most threatening attacks nowadays. Ransomware in general encrypts or locks the files on the victim’s device and requests a payment in order to recover them. The available technologies are not enough as new ransomwares employ a combination of techniques to evade anti-virus detection. Moreover, the literature counts only a few studies that have proposed static and/or dynamic approaches to detect Android ransomware in particular. Additionally, there are plenty of open-source malware datasets; however, the research community is still lacking ransomware datasets. In this paper, the state-of-the-art of Android ransomware detection approaches were investigated. A deep comparative analysis was conducted which shed the key differences among the existing solutions. An application programming interface (API)-based ransomware detection system (API-RDS) was proposed to provide a static analysis paradigm for detecting Android ransomware apps. API-RDS focuses on examining API packages’ calls as leading indicator of ransomware activity to discriminate ransomware with high accuracy before it harms the user’s device. API packages’ calls of both benign and ransomware apps were thoroughly analyzed and compared. Significant API packages with corresponding methods were identified. The experimental results show that API-RDS outperformed other recent related approaches. API-RDS achieved 97% accuracy while reducing the complexity of the classification model by 26% due to features reduction. Moreover, this research designed a proactive mechanism based on a high quality unique ransomware dataset without duplicated samples. 2959 ransomware samples were collected, tested and reduced by almost 83% due to samples duplication. This research also contributes to constructing an up-to-date, unique dataset that covers the majority of existing Android ransomware families and recent clean apps that could be used as a labeled reference for research community. Full article

(This article belongs to the Special Issue State-of-the-Art of Cyber Security)

► Show Figures

Figure 1

14 pages, 2230 KiB

Open AccessArticle

Homomorphic Encryption and Network Coding in IoT Architectures: Advantages and Future Challenges

by Goiuri Peralta, Raul G. Cid-Fuentes, Josu Bilbao and Pedro M. Crespo

Electronics 2019, 8(8), 827; https://doi.org/10.3390/electronics8080827 - 25 Jul 2019

Cited by 37 | Viewed by 5673

Abstract

The introduction of the Internet of Things (IoT) is creating manifold new services and opportunities. This new technological trend enables the connection of a massive number of devices among them and with the Internet. The integration of IoT with cloud platforms also provides [...] Read more.

The introduction of the Internet of Things (IoT) is creating manifold new services and opportunities. This new technological trend enables the connection of a massive number of devices among them and with the Internet. The integration of IoT with cloud platforms also provides large storage and computing capabilities, enabling Big Data analytics and bidirectional communication between devices and users. Novel research directions are showing that Network Coding (NC) can increase the robustness and throughput of wireless networks, as well as that Homomorphic Encryption (HE) can be used to perform computations in the cloud while maintaining data privacy. In this paper, we overview the benefits of NC and HE along the entire vertical of cloud-based IoT architectures. By merging both technologies, the architecture may offer manifold advantages: First, it provides end-to-end data privacy, from end-devices to end-users. Second, sensitive data can be stored in public cloud platforms without concern about their privacy. In addition, clouds can perform advanced operations in a confidential manner, without the need to access actual data. Finally, latency can be reduced and the reliability of the system is increased. We show state-of-the-art works that demonstrate the role of both technologies in this type of architectures on a review basis. Furthermore, we describe the main characteristics of NC and HE and also discuss their benefits and limitations, as well as the emerging open challenges. Full article

(This article belongs to the Special Issue State-of-the-Art of Cyber Security)

► Show Figures

Figure 1

22 pages, 967 KiB

Open AccessArticle

Distributed E-Voting and E-Bidding Systems Based on Smart Contract

by Raylin Tso, Zi-Yuan Liu and Jen-Ho Hsiao

Electronics 2019, 8(4), 422; https://doi.org/10.3390/electronics8040422 - 11 Apr 2019

Cited by 45 | Viewed by 6361

Abstract

Traditional voting and bidding systems largely rely on paperwork and human resources throughout the voting process, which can incur high costs in terms of both time and money. Electronic voting and electronic bidding systems can be used to reduce costs, and many new [...] Read more.

Traditional voting and bidding systems largely rely on paperwork and human resources throughout the voting process, which can incur high costs in terms of both time and money. Electronic voting and electronic bidding systems can be used to reduce costs, and many new systems have been introduced. However, most systems require a powerful and trusted third party to guarantee system integrity and security. With developments in blockchain technology, research has begun to highlight the core concept of decentralization. In this study, we introduce the first decentralized electronic voting and bidding systems based on a blockchain and smart contract. We also use cryptographic techniques such as oblivious transfer and homomorphic encryptions to improve privacy protection. Our proposed systems allow voters and bidders to participate in the opening phase and improve participant anonymity, the privacy of data transmission, and data reliability and verifiability. Moreover, compared with other electronic voting and bidding systems, our systems are safer and more efficient. Full article

(This article belongs to the Special Issue State-of-the-Art of Cyber Security)

► Show Figures

Figure 1

Review

Jump to: Research

26 pages, 1257 KiB

Open AccessReview

Mitigating ARP Cache Poisoning Attack in Software-Defined Networking (SDN): A Survey

by Zawar Shah and Steve Cosgrove

Electronics 2019, 8(10), 1095; https://doi.org/10.3390/electronics8101095 - 28 Sep 2019

Cited by 15 | Viewed by 10213

Abstract

Address Resolution Protocol (ARP) is a widely used protocol that provides a mapping of Internet Protocol (IP) addresses to Media Access Control (MAC) addresses in local area networks. This protocol suffers from many spoofing attacks because of its stateless nature and lack of [...] Read more.

Address Resolution Protocol (ARP) is a widely used protocol that provides a mapping of Internet Protocol (IP) addresses to Media Access Control (MAC) addresses in local area networks. This protocol suffers from many spoofing attacks because of its stateless nature and lack of authentication. One such spoofing attack is the ARP Cache Poisoning attack, in which attackers poison the cache of hosts on the network by sending spoofed ARP requests and replies. Detection and mitigation of ARP Cache Poisoning attack is important as this attack can be used by attackers to further launch Denial of Service (DoS) and Man-In-The Middle (MITM) attacks. As with traditional networks, an ARP Cache Poisoning attack is also a serious concern in Software Defined Networking (SDN) and consequently, many solutions are proposed in the literature to mitigate this attack. In this paper, a detailed survey on various solutions to mitigate ARP Cache Poisoning attack in SDN is carried out. In this survey, various solutions are classified into three categories: Flow Graph based solutions; Traffic Patterns based solutions; IP-MAC Address Bindings based solutions. All these solutions are critically evaluated in terms of their working principles, advantages and shortcomings. Another important feature of this survey is to compare various solutions with respect to different performance metrics, e.g., attack detection time, ARP response time, calculation of delay at the Controller etc. In addition, future research directions are also presented in this survey that can be explored by other researchers to propose better solutions to mitigate the ARP Cache Poisoning attack in SDN. Full article

(This article belongs to the Special Issue State-of-the-Art of Cyber Security)

► Show Figures

Figure 1

Journal Menu

Journal Browser

State-of-the-Art of Cyber Security

Share This Special Issue

Special Issue Editor

Special Issue Information

Published Papers (8 papers)

Research

Review

Further Information

Guidelines

MDPI Initiatives

Follow MDPI