Search

Malware is often hidden in illegitimately cloned software. Android, with over two billions active devices, is one of the most affected platforms because code cloning is quite simple and there are several not controlled markets. Obfuscation is both a cause and a solution to this scenario: a cause because obfuscated malware is harder to detect, a solution because obfuscation of legitimate applications makes code cloning more difficult. A deeper understanding of the obfuscation techniques would lead to more effective and aware use. In the literature, there are few methods of obfuscation detection with limited accuracy. Manual reverse engineering is too time-consuming to achieve this purpose, we need faster and automated techniques. In this work, we propose several deep learning models that can detect and classify the presence of obfuscation in Android applications. In addition to classical ML methods, we leverage natural language processing or image recognition approaches, then with a hybrid model, we exploit the best of each approach. Tests over a large dataset, made using different obfuscation tools, showed improvements compared to previous obfuscation detection methods. We target four obfuscation classes: identifier renaming, string encryption, reflection and class encryption, achieving an average F-measure of 0.985. [ABSTRACT FROM AUTHOR]

Abstract: In-network data aggregation is favorable for wireless sensor networks (WSNs): It allows in-network data processing while reducing the network traffic and hence saving the sensors energy. However, due to the distributed and unattended nature of WSNs, several attacks aiming at compromising the authenticity of the collected data could be perpetrated. For example, an adversary could capture a node to create clones of the captured one. These clones disseminated through the network could provide malicious data to the aggregating node, thus poisoning/disrupting the aggregation process. In this paper we address the problem of detecting cloned nodes; a requirement to be fulfilled to provide authenticity of the data fusion process. First, we analyze the desirable properties a distributed clone detection protocol should meet. Specifically: It should avoid having a single point of failure; the load should be totally distributed across the nodes in the network; the position of the clones in the network should not influence the detection probability. We then show that current solutions do not meet the exposed requirements. Next, we propose the Information Fusion Based Clone Detection Protocol (ICD). ICD is a probabilistic, completely distributed protocol that efficiently detects clones. ICD combines two cryptographic mechanisms: The pseudo-random key pre-distribution, usually employed to secure node pairwise communications, with a sparing use of asymmetric crypto primitives. We show that ICD matches all the requirements above mentioned and compare its performance with current solutions in the literature; experimental results show that ICD has better performance than existing solutions for all the cost parameters considered: Number of messages sent, per sensor storage requirement, and signature verification. These savings allow to increase the network operating lifetime. Finally, note that ICD protocol could be used as an independent layer by any data aggregation mechanism. [Copyright &y& Elsevier]

Abstract Internet-of-Things (IoT) promises to provide services to the end users by connecting physical things around them through Internet. The conventional services build for web are primarily based on the pull technology, where the user actively engages with system to get the services. However, in IoT environment, the services are based on push-based, where information and value added services will be pushed towards the user. Unless, these push-based services are properly managed they would overwhelm the user with unnecessary information, thus, it will soon start annoying the user. In this paper, we propose a lightweight context-aware IoT service architecture namely LISA to support IoT push services in an efficient manner. In particular, LISA filter and forward the most important and relevant services to the users by understanding their context. To achieve its goals, LISA formulates a user model to resolve local decision making by using agents and available web services paradigm. The proposed user model describes the user in an abstract way by considering the context and profile information of the user. For evaluation, we simulate LISA by considering an IoT tourist guide system as a use case scenario, and we show the performance of the our user model concerning precision and recall metrics. The results of our preliminary experiments confirm that LISA successfully reduces the information provided to the user by selecting only the most relevant among those. The evaluation shows that LISA can extract services for a user by selecting from 15000 services with precision upto 0.3 and recall upto 0.8, and it can be further optimized by tuning the user-specific design settings. Additionally, our approach shows improvements in query processing time which also includes the query generation time. [ABSTRACT FROM AUTHOR]

In this paper, we present a behavioral biometric-based smartphone user authentication mechanism, namely, AnswerAuth , which relies on the very common users' behavior. Behavior, here, refers to the way a user slides the lock button on the screen, to unlock the phone, and brings the phone towards her ear. The authentication mechanism works with the biometric behavior based on the extracted features from the data recorded using the built-in smartphone sensors, i.e., accelerometer, gyroscope, gravity, magnetometer and touchscreen, while the user performed sliding and phone-lifting actions. We tested AnswerAuth on a dataset of 10,200 behavioral patterns collected from 85 users while they performed the unlocking actions, in sitting, standing , and walking postures, using six state-of-the-art conceptually different machine learning classifiers in two settings, i.e., with and without simultaneous feature selection and classification. Among all the chosen classifiers, Random Forest (RF) classifier proved to be the most consistent and accurate classifier on both full and reduced features and provided a True Acceptance Rate (TAR) as high as 99.35%. We prototype proof-of-the-concept Android app, based on our findings, and evaluate it in terms of security and usability. Security analysis of AnswerAuth confirms its robustness against the possible mimicry attacks. Similarly, the usability study based on Software Usability Scale (SUS) 1 1 https://www.usability.gov/how-to-and-tools/methods/system-usability-scale.html. questionnaire verifies the user-friendliness of the proposed scheme (SUS Score of 75.11). Experimental results prove AnswerAuth as a secure and usable authentication mechanism. [ABSTRACT FROM AUTHOR]

In recent years, the explosive growth of the Internet has led to an increment in the number of Distributed Denial of Service (DDoS) attacks. HTTP Flooding is a critical DDoS attack that targets HTTP servers to prohibit users from receiving HTTP services. Moreover, it saturates the link bandwidth and consumes network resources. Because the attack is launched at the application layer, it is difficult to defend against it using current countermeasures such as firewall or Intrusion Prevention System (IPS). In this paper, we propose SHFD , which leverages the Software-Defined Networking (SDN) paradigm to mitigate HTTP flooding attacks. We implement SHFD as a defender module on the SDN controller to detect and mitigate the attack in the first place. Experimental results gathered from Mininet confirm that SHFD brings a significant improvement of 13% in detection time and 29% in the number of blocked malicious flows compared to the state-of-the-art approaches. [Display omitted] • SHFD is proposed for mitigating slow and high rate HTTP flooding attacks in SDN-based networks. • Shannon's Entropy and Hellinger distance methods are used in SHFD to provide more accurate results. • Both slow/high rate HTTP flooding attack together with their side effects are explained in details. [ABSTRACT FROM AUTHOR]

Abstract In remote locations, the best way to establish a communication infrastructure is to deploy Peer-to-Peer (P2P) network over Mobile Ad-hoc Network (MANET). However, the node mobility and efficient cross-layer communication between the overlay and MANET routing protocols remains a challenge for reliable data transmission. In this paper, we propose a novel Mobility Aware Cross-layer Routing approach for Peer-to-Peer Networks (MACARON) over MANET. MACARON provides reliable communication and high lifetime routes to support efficient data transmission in the network. For this purpose, it uses cross-layer communications to share routing updates between MANET and overlay routing protocols. MACARON provides guaranteed routes with low path stretch by maintaining O ˜ (n) routing entries per node, where n is the number of nodes in the network. It provides scalability without using any landmark directory to store routing state, and it can effectively handle moderate mobility by using Last Encounter Routing (LER) protocol. [ABSTRACT FROM AUTHOR]

The event prediction task learns the dynamic changes of past events and infers the upcoming ones. This task helps people to understand how events evolve in our real world and make rapid, accurate, and efficient reactions in emergencies. The complex relation of events and entities (events participants) changes dynamically over time. The current solutions of event prediction have not fully exploited such event temporal dependency and entity relation dependency. In addition, an event may relate to a considerable number of entities. Among such related entities, only a few of them are the key participants in driving the evolution of the event. Previous works fail to emphasize such key entities and limit the non-related entities. In this paper, we introduce a novel gating and attention mechanism and propose a novel T emporal sp A tial dy N amic G raph m O del (TANGO) that is composed of a graph model (based on Graph Convolutional Network with gated and attention mechanisms) and a sequential model (based on Temporal Convolutional Network). TANGO is able to model the event temporal dependency and entity relation dependency simultaneously; learn the representation of events relations; control the aggregation of relational information among entities with varying degrees of mutual influence; support long effective historical sizes. We demonstrate the validity and effectiveness of our approach on three different datasets (i.e., ICEWS18, GDELT, and ICEWS14). The result shows almost 6.2% MRR improvement and 3.9% Hits@10 improvement over the previous state-of-the-art. [ABSTRACT FROM AUTHOR]

Recent Distributed Denial of Service (DDoS) attacks on cloud services demonstrate new attack effects, including collateral and economic losses. In this work, we show that DDoS mitigation methods may not provide the expected timely mitigation due to the heavy resource outage created by the attacks. We observe an important Operating System (OS) level “internal collateral damage”, in which the other critical services are also affected. We formulate the DDoS mitigation problem as an OS level resource management problem. We argue that providing extra resources to the victim’s server is only helpful if we can ensure the availability of other services. To achieve these goals, we propose a novel resource containment approach to enforce the victim’s resource limits. Our real-time experimental evaluations show that the proposed approach results in reduction in the attack reporting time and victim service downtime by providing isolated and timely resources to ensure availability of other critical services. [ABSTRACT FROM AUTHOR]

While encryption can prevent unauthorized access to a secret message, it does not provide undetectability of covert communications over the public network. Implementing a highly latent data exchange, especially with low eavesdropping/discovery probability, is challenging for practical scenarios, such as social and political movements in authoritarian regimes, military operations, and privacy preservation. Moreover, the current literature suffers from a low embedding capacity and monolingual applicability, limiting the amount of hiding secret data within short text messages using state-of-the-art algorithms, e.g., linguistic-based, structural-based, or coverless-based solutions. In this paper, we present a systematic covert communication technique called CovertSYS that enables a multilingual secure end-to-end conversation via messaging or social network platforms. The CovertSYS functions by encrypting a confidential message using a multi-factor authentication scheme and converting the encoded binary data into hidden Unicode symbols to be transmitted under cover of short text messages. We then conduct extensive experiments to confirm the security and validity of the proposed technique against state-of-the-art approaches. Our experimental results show that the CovertSYS provides a superior mean performance of 91.53% by improving the criteria scores: embedding capacity rate of 100%, imperceptibility rate of 76.4%, and distortion robustness rate of 98.2%. Finally, we discuss the practical implications of the proposed technique compared to the existing text steganography methods. [Display omitted] • Various evaluation criteria based on literature and practical scenario have been discussed. • Possible cyberattacks on covert communication systems have been described. • The CovertSYS has been implemented in an Android prototype software. • Experimental results show superior performance compared to existing related works. [ABSTRACT FROM AUTHOR]

In this paper, we show a deep learning model for bot detection, named as DeBot, for industrial network traffic. DeBot uses a novel Cascade Forward Back Propagation Neural Network (CFBPNN) model with a subset of features using the Correlation-based Feature Selection (CFS) technique. A time series-based Nonlinear Auto-regressive Network with eXogenous inputs (NARX) technique analyzes the factors having a higher impact on the target variable and predict the behavioral pattern. To the best of our knowledge, we pioneer the use of optimal feature selection and integration with the cascading model of deep learning in bot detection of IIoTs. We conduct a thorough set of experiments on five popular bot datasets: NF-UNSW-NB15, NF-ToN-IoT, NF-BoT-IoT, NF-CSE-CIC-IDS2018, and ToN-IoT-Windows. We compare CFBPNN with other existing neural network models. We observe that CFBPNN in DeBot shows 100% accuracy in all the datasets with subset evaluation and obtains optimum F1-score and zero precision. [Display omitted] • We address the multi-layered network model with IIoT features to enable bot attack detection. • Our DeBot model evaluates the subset with optimal features with high impact on attack class and predict the risk factor. • We pioneer the implementation of time series-based Nonlinear Auto-Regressive eXogenous (NARX) model to predict the risk in the specified time gap. • We introduce a new cascading model with recurrent feature to preserve the relationship between input and output variables. [ABSTRACT FROM AUTHOR]

Blockchain is an emerging decentralized and distributed technology. Along with the beneficial features of decentralization, transparency, and security the consensus algorithms of blockchains form key building blocks for this technology. Consensus protocol/algorithm helps to provide a decentralized decision making process. An efficient consensus algorithm is inclusive that engages all the participants to make their decision based on the conflicts of the blockchain networks. These consensus decisions lead to better quality outcomes of the blockchains and help to obtain the finality. Rigorous research is in process to upgrade or optimize the existing consensus protocols. The optimized or enhanced consensus protocols objectify to be suitable for Internet-of-Thing (IoT) as the current versions of the protocols are not suitable for the resource-constrained environments due their complexity, hard configurations, mining techniques, high resource consumption, and explicit security loophole. In this paper, we present a survey of consensus protocols with a purpose to identify and discuss the existence of various consensus protocols available in literature. We emphasize on the genesis of the consensus protocols, particularly for Proof-of-X, byzantine fault tolerance, Paxos, and RAFT; we also include Directed Acyclic Graph (DAG) orientation of some contemporary algorithms. We discuss the variants of these genesis protocols. Our survey analyzes the advantages, disadvantages, and their applicability in IoTs. We enlist the categorical use of consensus algorithms in blockchains and other applications. Finally, we present several research trends and open issues emphasizing for consensus protocols emphasizing on IoTs. Compared to the other surveys in the field, our present survey objectifies to provide a more thorough summary of the most relevant protocols and application issues; this survey helps the researchers and the application developers to obtain an insight on the current status of the consensus protocols' suitability to deliver the desired functionalities in IoTs. The notified disadvantages of each of the protocol provide future scope for the industries and academia. To the best of our knowledge, such a comprehensive and summarized survey of consensus protocols including DAG-based protocols is unavailable in the literature and thus, our contribution claims are significant. [ABSTRACT FROM AUTHOR]