Search

Digitization increases business opportunities and the risk of companies being victims of devastating cyberattacks. Therefore, managing risk exposure and cybersecurity strategies is essential for digitized companies that want to survive in competitive markets. However, understanding company-specific risks and quantifying their associated costs is not trivial. Current approaches fail to provide individualized and quantitative monetary estimations of cybersecurity impacts. Due to limited resources and technical expertise, SMEs and even large companies are affected and struggle to quantify their cyberattack exposure. Therefore, novel approaches must be placed to support the understanding of the financial loss due to cyberattacks. This article introduces the Real Cyber Value at Risk (RCVaR), an economical approach for estimating cybersecurity costs using real-world information from public cybersecurity reports. RCVaR identifies the most significant cyber risk factors from various sources and combines their quantitative results to estimate specific cyberattacks costs for companies. Furthermore, RCVaR extends current methods to achieve cost and risk estimations based on historical real-world data instead of only probability-based simulations. The evaluation of the approach on unseen data shows the accuracy and efficiency of the RCVaR in predicting and managing cyber risks. Thus, it shows that the RCVaR is a valuable addition to cybersecurity planning and risk management processes.

This work presents a Moving Target Defense (MTD) framework for the protection of network slices and virtual resources in a telco cloud environment. The preliminary implementation provides closed-loop security management of services with proactive MTD operations to reduce the success probability of attacks, and reactive MTD operations, empowered by a tampering detection and a traffic-based anomaly detection system. MTD strategies are adaptive and optimized with deep reinforcement learning (deep-RL) for balancing costs, security, and availability goals defined in a Multi-Objective Markov Decision Process (MOMDP).

Hospital infrastructures are always in evidence in periods of crisis, such as natural disasters or pandemic events, under stress. The recent COVID-19 pandemic exposed several inefficiencies in hospital systems over a relatively long period. Among these inefficiencies are human factors, such as how to manage staff during periods of high demand, and technical factors, including the management of Portable Medical Devices (PMD), such as mechanical ventilators, capnography monitors, infusion pumps, or pulse oximeters. These devices, which are vital for monitoring patients or performing different procedures, were found to have a high turnover during high-demand, resulting in inefficiencies and more pressure on medical teams. Thus, the work PMD-Track evaluates in detail two popular indoor tracking approaches concerning their accuracy, placement of beacons, and economic impacts. The key novelty of PMD-Track relies on using smartphones provided to hospital employees, replacing typical stationary gateways spread across a hospital, functioning as mobile gateways with a front-end that assists staff in locating PMDs. As employees approach tagged PMDs, their smartphone automatically updates the location of spotted PMDs in real-time, providing room-level localization data with up to 83% accuracy for fingerprinting and 35% for multilateration. In addition, fingerprinting is 45% cheaper than multilateration over the course of five years. Practical experiments were evaluated based on two locations in Z\"urich, Switzerland., Comment: 18 pages

The rapid expansion of the Internet of Things (IoT) and Edge Computing has presented challenges for centralized Machine and Deep Learning (ML/DL) methods due to the presence of distributed data silos that hold sensitive information. To address concerns regarding data privacy, collaborative and privacy-preserving ML/DL techniques like Federated Learning (FL) have emerged. However, ensuring data privacy and performance alone is insufficient since there is a growing need to establish trust in model predictions. Existing literature has proposed various approaches on trustworthy ML/DL (excluding data privacy), identifying robustness, fairness, explainability, and accountability as important pillars. Nevertheless, further research is required to identify trustworthiness pillars and evaluation metrics specifically relevant to FL models, as well as to develop solutions that can compute the trustworthiness level of FL models. This work examines the existing requirements for evaluating trustworthiness in FL and introduces a comprehensive taxonomy consisting of six pillars (privacy, robustness, fairness, explainability, accountability, and federation), along with over 30 metrics for computing the trustworthiness of FL models. Subsequently, an algorithm named FederatedTrust is designed based on the pillars and metrics identified in the taxonomy to compute the trustworthiness score of FL models. A prototype of FederatedTrust is implemented and integrated into the learning process of FederatedScope, a well-established FL framework. Finally, five experiments are conducted using different configurations of FederatedScope to demonstrate the utility of FederatedTrust in computing the trustworthiness of FL models. Three experiments employ the FEMNIST dataset, and two utilize the N-BaIoT dataset considering a real-world IoT security use case.

Telecommunication networks are shifting to multi-cloud environments. This trend is expected to shape the standardization and implementation of future networks. Thus, the protection of virtualized services has become more critical. One of the promising methods to secure virtual resources in that setting is Moving Target Defense (MTD). This paper presents the Network Topology Fuzzer (TopoFuzzer) module, enabling different MTD operations that change the topology of a 5G network. An emphasis is given to live re-instantiations and live migrations of running services and, consequently, security gains against Advanced Persistent Threats (APTs). This work utilizes a 5G testbed to evaluate the TopoFuzzer module and MTD operations on Virtual Network Functions (VNFs).

Ransomware has remained one of the most notorious threats in the cybersecurity field. Moving Target Defense (MTD) has been proposed as a novel paradigm for proactive defense. Although various approaches leverage MTD, few of them rely on the operating system and, specifically, the file system, thereby making them dependent on other computing devices. Furthermore, existing ransomware defense techniques merely replicate or detect attacks, without preventing them. Thus, this paper introduces the MTFS overlay file system and the design and implementation of three novel MTD techniques implemented on top of it. One delaying attackers, one trapping recursive directory traversal, and another one hiding file types. The effectiveness of the techniques are shown in two experiments. First, it is shown that the techniques can delay and mitigate ransomware on real IoT devices. Secondly, in a broader scope, the solution was confronted with 14 ransomware samples, highlighting that it can save 97% of the files.

Cybersecurity planning is challenging for digitized companies that want adequate protection without overspending money. Currently, the lack of investments and perverse economic incentives are the root cause of cyberattacks, which results in several economic impacts on companies worldwide. Therefore, cybersecurity planning has to consider technical and economic dimensions to help companies achieve a better cybersecurity strategy. This article introduces SECAdvisor, a tool to support cybersecurity planning using economic models. SECAdvisor allows to (a) understand the risks and valuation of different businesses' information, (b) calculate the optimal investment in cybersecurity for a company, (c) receive a recommendation of protections based on the budget available and demands, and (d) compare protection solutions in terms of cost-efficiency. Furthermore, evaluations on usability and real-world training activities performed using SECAdvisor are discussed., Comment: 12 pages, 7 figures, 2 tables, 9 equations

Cybersecurity solutions have shown promising performance when detecting ransomware samples that use fixed algorithms and encryption rates. However, due to the current explosion of Artificial Intelligence (AI), sooner than later, ransomware (and malware in general) will incorporate AI techniques to intelligently and dynamically adapt its encryption behavior to be undetected. It might result in ineffective and obsolete cybersecurity solutions, but the literature lacks AI-powered ransomware to verify it. Thus, this work proposes RansomAI, a Reinforcement Learning-based framework that can be integrated into existing ransomware samples to adapt their encryption behavior and stay stealthy while encrypting files. RansomAI presents an agent that learns the best encryption algorithm, rate, and duration that minimizes its detection (using a reward mechanism and a fingerprinting intelligent detection system) while maximizing its damage function. The proposed framework was validated in a ransomware, Ransomware-PoC, that infected a Raspberry Pi 4, acting as a crowdsensor. A pool of experiments with Deep Q-Learning and Isolation Forest (deployed on the agent and detection system, respectively) has demonstrated that RansomAI evades the detection of Ransomware-PoC affecting the Raspberry Pi 4 in a few minutes with >90% accuracy.

Cybercriminals are moving towards zero-day attacks affecting resource-constrained devices such as single-board computers (SBC). Assuming that perfect security is unrealistic, Moving Target Defense (MTD) is a promising approach to mitigate attacks by dynamically altering target attack surfaces. Still, selecting suitable MTD techniques for zero-day attacks is an open challenge. Reinforcement Learning (RL) could be an effective approach to optimize the MTD selection through trial and error, but the literature fails when i) evaluating the performance of RL and MTD solutions in real-world scenarios, ii) studying whether behavioral fingerprinting is suitable for representing SBC's states, and iii) calculating the consumption of resources in SBC. To improve these limitations, the work at hand proposes an online RL-based framework to learn the correct MTD mechanisms mitigating heterogeneous zero-day attacks in SBC. The framework considers behavioral fingerprinting to represent SBCs' states and RL to learn MTD techniques that mitigate each malicious state. It has been deployed on a real IoT crowdsensing scenario with a Raspberry Pi acting as a spectrum sensor. More in detail, the Raspberry Pi has been infected with different samples of command and control malware, rootkits, and ransomware to later select between four existing MTD techniques. A set of experiments demonstrated the suitability of the framework to learn proper MTD techniques mitigating all attacks (except a harmfulness rootkit) while consuming

Inverted perovskite solar cells still suffer from significant non-radiative recombination losses at the perovskite surface and across the perovskite/C60 interface, limiting the future development of perovskite-based single- and multi-junction photovoltaics. Therefore, more effective inter- or transport layers are urgently required. To tackle these recombination losses, we introduce ortho-carborane as an interlayer material that has a spherical molecular structure and a three-dimensional aromaticity. Based on a variety of experimental techniques, we show that ortho-carborane decorated with phenylamino groups effectively passivates the perovskite surface and essentially eliminates the non-radiative recombination loss across the perovskite/C60 interface with high thermal stability. We further demonstrate the potential of carborane as an electron transport material, facilitating electron extraction while blocking holes from the interface. The resulting inverted perovskite solar cells deliver a power conversion efficiency of over 23% with a low non-radiative voltage loss of 110 mV, and retain >97% of the initial efficiency after 400 h of maximum power point tracking. Overall, the designed carborane based interlayer simultaneously enables passivation, electron-transport and hole-blocking and paves the way toward more efficient and stable perovskite solar cells., Zweitveröffentlichungen der Universität Potsdam : Mathematisch-Naturwissenschaftliche Reihe; 1317

Malware affecting Internet of Things (IoT) devices is rapidly growing due to the relevance of this paradigm in real-world scenarios. Specialized literature has also detected a trend towards multi-purpose malware able to execute different malicious actions such as remote control, data leakage, encryption, or code hiding, among others. Protecting IoT devices against this kind of malware is challenging due to their well-known vulnerabilities and limitation in terms of CPU, memory, and storage. To improve it, the moving target defense (MTD) paradigm was proposed a decade ago and has shown promising results, but there is a lack of IoT MTD solutions dealing with multi-purpose malware. Thus, this work proposes four MTD mechanisms changing IoT devices' network, data, and runtime environment to mitigate multi-purpose malware. Furthermore, it presents a lightweight and IoT-oriented MTD framework to decide what, when, and how the MTD mechanisms are deployed. Finally, the efficiency and effectiveness of the framework and MTD mechanisms are evaluated in a real-world scenario with one IoT spectrum sensor affected by multi-purpose malware.

The Domain Name System (DNS) is a hierarchical, decentralized, and distributed database. A key mechanism that enables the DNS to be hierarchical and distributed isdelegation[7] of responsibility from parent to childzones—typically managed by different entities. RFC1034[12] states that authoritative nameserver (NS) records at both parent and child should be “consistent and remain so”, but we find inconsistencies for over 13M second-level domains. We classify the type of inconsistencies we observe, and the behavior of resolvers in the face of such inconsistencies, using RIPE Atlas to probe our experimental domain configured for different scenarios. Our results underline the risk such inconsistencies pose to the availability of misconfigured domains.

Integrated sensing and communication (ISAC) is a novel paradigm using crowdsensing spectrum sensors to help with the management of spectrum scarcity. However, well-known vulnerabilities of resource-constrained spectrum sensors and the possibility of being manipulated by users with physical access complicate their protection against spectrum sensing data falsification (SSDF) attacks. Most recent literature suggests using behavioral fingerprinting and Machine/Deep Learning (ML/DL) for improving similar cybersecurity issues. Nevertheless, the applicability of these techniques in resource-constrained devices, the impact of attacks affecting spectrum data integrity, and the performance and scalability of models suitable for heterogeneous sensors types are still open challenges. To improve limitations, this work presents seven SSDF attacks affecting spectrum sensors and introduces CyberSpec, an ML/DL-oriented framework using device behavioral fingerprinting to detect anomalies produced by SSDF attacks affecting resource-constrained spectrum sensors. CyberSpec has been implemented and validated in ElectroSense, a real crowdsensing RF monitoring platform where several configurations of the proposed SSDF attacks have been executed in different sensors. A pool of experiments with different unsupervised ML/DL-based models has demonstrated the suitability of CyberSpec detecting the previous attacks within an acceptable timeframe.

Federated learning (FL) allows participants to collaboratively train machine and deep learning models while protecting data privacy. However, the FL paradigm still presents drawbacks affecting its trustworthiness since malicious participants could launch adversarial attacks against the training process. Related work has studied the robustness of horizontal FL scenarios under different attacks. However, there is a lack of work evaluating the robustness of decentralized vertical FL and comparing it with horizontal FL architectures affected by adversarial attacks. Thus, this work proposes three decentralized FL architectures, one for horizontal and two for vertical scenarios, namely HoriChain, VertiChain, and VertiComb. These architectures present different neural networks and training protocols suitable for horizontal and vertical scenarios. Then, a decentralized, privacy-preserving, and federated use case with non-IID data to classify handwritten digits is deployed to evaluate the performance of the three architectures. Finally, a set of experiments computes and compares the robustness of the proposed architectures when they are affected by different data poisoning based on image watermarks and gradient poisoning adversarial attacks. The experiments show that even though particular configurations of both attacks can destroy the classification performance of the architectures, HoriChain is the most robust one.

Header bidding (HB) is a relatively new online advertising technology that allows a content publisher to conduct a client-side (i.e., from within the end-user's browser), real-time auction for selling ad slots on a web page. We developed a new browser extension for Chrome and Firefox to observe this in-browser auction process from the user's perspective. We use real end-user measurements from 393,400 HB auctions to (a) quantify the ad revenue from HB auctions, (b) estimate latency overheads when integrating with ad exchanges and discuss their implications for ad revenue, and (c) break down the time spent in soliciting bids from ad exchanges into various factors and highlight areas for improvement. For the users in our study, we find that HB increases ad revenue for web sites by 28backslash% compared to that in real-time bidding as reported in a prior work. We also find that the latency overheads in HB can be easily reduced or eliminated and outline a few solutions, and pitch the HB platform as an opportunity for privacy-preserving advertising.

Crowdsensing platforms allow sharing data, collected by devices of individuals, to achieve common objectives based on the analysis of shared information. Despite their benefits, these platforms also bring security threats that must be addressed to provide secure data and reliable services. In this context, device behavior fingerprinting becomes a key technique to detect and mitigate possible cyberattacks affecting resourceconstrained devices. This work presents the most relevant research questions in the field of behavior fingerprinting to identify devices and detect anomalies produced by cyberattacks. In addition, it also introduces the main goals and current status of two research projects dealing with such research questions.

In recent years, the interest grew in the Internet- of-Things (IoT) and Blockchain (BC) integration for additional trust and decentralization. This opened potentials in various use cases, such as supply chain tracing, smart cities, and recently IoT data marketplaces. Therefore, this paper presents the de- sign, implementation, and evaluation of the BC-based IoT data trading platform “ITrade". ITrade proposes a highly scalable microservice-based architecture based on clouds. ITrade enables end-to-end data streaming from IoT devices toward data buyers. The Smart Contract (SC)-oriented design of ITrade enables decentralized management of autonomous and distributed IoT data trading. ITrade evaluations attest its scalability as a reliable peer-to-peer data transmission platform.

In recent years, the interest growth in the Blockchains (BC) and Internet-of-Things (IoT) integration -- termed as BIoT -- for more trust via decentralization has led to great potentials in various use cases such as health care, supply chain tracking, and smart cities. A key element of BIoT ecosystems is the data transactions (TX) that include the data collected by IoT devices. BIoT applications face many challenges to comply with the European General Data Protection Regulation (GDPR) i.e., enabling users to hold on to their rights for deleting or modifying their data stored on publicly accessible and immutable BCs. In this regard, this paper identifies the requirements of BCs for being GDPR compliant in BIoT use cases. Accordingly, an on-chain solution is proposed that allows fine-grained modification (update and erasure) operations on TXs' data fields within a BC. The proposed solution is based on a cryptographic primitive called Chameleon Hashing. The novelty of this approach is manifold. BC users have the authority to update their data, which are addressed at the TX level with no side-effects on the block or chain. By performing and storing the data updates, all on-chain, traceability and verifiability of the BC are preserved. Moreover, the compatibility with TX aggregation mechanisms that allow the compression of the BC size is maintained., Comment: 10 pages, 3 figures

As commercial 5G roll-outs continue progressing, research efforts are shifting toward requirements, challenges, and critical enablers for prospective 6G networks. The introduction of Artificial Intelligence (AI) support in 5G will be further exploited, rendering AI a key enabler for providing automated network management and orchestration, while improving the network resilience against potential threat actors. Therefore, it is crucial to investigate smart security schemes in “Beyond 5G” networks. This paper presents a use case for the proactive and reactive defense of end-to-end network slices that relies on AI-based attack detection to apply Moving Target Defense (MTD) policies based on an innovative framework.

The cyber insurance market is still in its infancy but growing fast. Novel models and standards for this particular insurance market are essential due to the use of modern IT (Information Technology) and since insurance providers need to create suitable models for customers. In this work, a refreshing approach SaCI for the deployment and manage- ment of contract coverage is introduced. SaCI translates relevant infor- mation of a cyber insurance contract to Smart Contracts (SC) running on the Blockchain (BC). Thus, SaCI(i)allows for recording agreements in an immutable way,(ii)simplifies interactions between stakeholders (e.g., customers and insurers), and(iii)ensures a trustworthy and transparent process during the life-cycle of the contract. A case study is provided to show evidence of the feasibility of the approach, which is backed by a cost analysis and discussion regarding especially the application of BCs.

Distributed Denial-of-Service (DDoS) attacks are one of the biggest threats to the availability of Internet services. Behind these attacks are Botnets, such as Mirai, which exploits default and weak security credentials to take control of the host and spreads itself to other devices. This paper demonstrates a Mirai traffic analysis based on on DNS heavy-hitters streams and Mirai scanning patterns by simulating an attack and the extraction of traffic data. The Mirai Command-and-Control (CnC) traffic as well as its scanning traffic are analyzed in a local Testbed composed of six ASUS Tinker Board devices (Raspberry- Pi like devices) cluster nodes and a MikroTik’s RouterOS to route traffic in different internal networks. In addition to the analysis of traffic flow patterns a real-time mitigation is demonstrated in the experiments.

In Industry 4.0 (I4), the Industrial Internet of Things (I2oT) data streams are prone to significant data manipulation risks. The integration of Blockchains (BC) with I2oT may become a solution preventing from this problem. This paper provides a blockchain-agnostic Blockchain I2oT (BI2oT) architecture called BIIT that allows developing a broad range of BC applications fully integrating Internet of Things (IoT). The mechanisms introduced in BIIT aim at solutions that provide data reliability, limit the computational overhead, and enhance energy efficiency. BIIT is evaluated through real-world experimentation.

Data leaks and privacy scandals have been agrowing concern of the last decade. Most traditional, i.e.,centralized, online platforms require users to register withtheir personal data, thereby, potentially exposing the user’sidentity and data to be used for unintended purposes. Thiswork proposes TradeMap as an integrated architecture,designing and enabling an online end-to-end (e2e) tradingmarket place, while supporting anonymous managementfeatures. TradeMap addresses the Swiss Financial MarketSupervisory Authority (FINMA) regulations by designing aFINMA-complaint Know Your Customer (KYC) platform.Additionally, TradeMap is based on blockchains and employsEthereum Smart Contracts (SC). Thus, trust andanonymity between the market place and KYC systemrelies on zero knowledge proof-based SCs used for useridentification processes. With this management approachproposed, the user authentication is only verified withinthe KYC platform, providing a legally valid and fullyanonymous online trading platform.

Luxury goods such as sneakers and bags are in high demand. Many websites offer them at high discounts, which, in many cases, are simply cheap counterfeit versions of the original product. Online shop- pers, however, may be unaware they are buying a counterfeit product and end up being scammed and having to deal with financial losses, as has been widely reported by various news outlets. This work presents a multiyear effort of The Netherlands’.nlcountry-code top-level domain (ccTLD) in detecting and removing counterfeit online shops from the.nlDNS zone. We have developed two detection systems and partnered with registrars and a large credit card issuer, which ultimately led to more than 4,400 counterfeit online shops being taken down.

Part 4: Short Papers: Security, Intrusion Detection, and Configuration; International audience; With a vastly different header format, IPv6 introduces new vulnerabilities not possible in IPv4, potentially requiring new detection algorithms. While many attacks specific to IPv6 have proven to be possible and are described in the literature, no detection solutions for these attacks have been proposed. In this study we identify and characterise IPv6-specific attacks that can be detected using flow monitoring. By constructing flow-based signatures, detection can be performed using available technologies such as NetFlow and IPFIX. To validate our approach, we implemented these signatures in a prototype, monitoring two production networks and injecting attacks into the production traffic.