Search

In the rapidly evolving IT industry, containerization has introduced new security challenges including cloud data breaches. DL-HIDS explores the application of Deep Learning (DL) techniques for detecting such attacks. Various system call-based features, including the sequence, frequency, and metadata of system calls, as well as images, derived from these calls were explored. While using images as features is effective for DL models, determining the optimal image feature size can be challenging and requires extensive experimentation. The existing approach uses pre-trained Convolutional Neural Networks (CNNs) that incorporate system call parameters with metadata that are redundant resulting in a low detection rate. To address these limitations, we employ a deep CNN that takes images generated from system call logs as input. Our experimentation involves varying image size, system call parameters, and CNN architecture using the Leipzig Intrusion Detection DataSet-2019 dataset containing recent containerized cloud environment attack data. Our results demonstrate improvement over state-of-the-art methods toward accuracy, precision, recall, F1 score, and false-positive rate. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) is becoming an essential aspect of digital healthcare information; the goal is to monitor various health parameters regularly to make healthcare management more efficient and convenient. Gateway devices can broadcast/multicast messages securely to sensors or intended recipients to guarantee the confidentiality of medical readings in the healthcare environment utilizing IoT sensors. In this context, designing and executing a key management framework is critical for the healthcare environment, and working with limited computing and processing capacities is also challenging. The literature on IoT key management is inclined toward centralized solutions, provides solutions with heavy computation and communication costs, and partially addresses resource-constrained devices that guarantee forward and backward secrecy in the healthcare domain. This paper constructs a group key management scheme with node joining and leaving scenarios to provide forward and backward secrecy focusing on lightweight computation. We use the concept of one-way accumulation for secret message exchange by combining elliptic curve cryptography. We designed a scheme that refreshed the established group key as the group's size grows or shrinks, and the approach also applies to classical ciphers conveniently for the number of message exchanges for healthcare nodes. To demonstrate innovation in our method, we mathematically proved the soundness of our session key management scheme for the network model, and simulation findings show that the method is feasible as the processing and communication costs are reduced compared to related schemes. [ABSTRACT FROM AUTHOR]

Along with significant benefits to the end-users, the Internet-of-Things (IoT) technology also brings unprecedented security challenges. IoT requires many embedded and resource-constrained devices that are usually deployed in an insecure and remote environment. This is where a White-box (WB) attack paradigm, where the attacker has complete control over the execution environment, comes into the picture. Accordingly, the possible capture of these devices makes the entire built-in cryptosystem visible to the adversary. Thus, the adversary gains complete control over the system and can potentially hinder the used cryptographic implementation. A White-box cryptographic (WBC) encryption scheme is employed to counter such WB attacks. Accordingly, we provide a scheme for hiding the private key used in the Elliptic curve encryption scheme considering the WB attack context. Precisely, we use Residue Number System (RNS)-based lookup tables to hide the private key. To show the practicality of the proposed scheme, we deploy it over a widely adopted Message Queuing Telemetry Transport for Sensor Networks (MQTT-SN) protocol. Further, we discuss the WB security goals and analyze the security and performance of the proposed scheme using the Cooja simulator. We demonstrate the feasibility of the proposed approach by comparing it with the traditional Elliptic curve encryption scheme over parameters like end-to-end delay, network throughput, average power consumption, and computational time. The obtained simulation results show that the proposed scheme provides a consistent computational cost and network efficiency, which is practical in deployments demanding a higher level of security. [ABSTRACT FROM AUTHOR]

Internet of things (IoT) is renowned for being a massive revolution led by business leaders and researchers. Routing protocol for low-power and lossy network (RPL) is a standardized protocol that serves the routing need of the IPv6-based low-power and lossy networks, which are the significant enablers of the IoT technology. Despite its many outstanding features, RPL offers very low protection against different routing attacks. In this respect, we mainly emphasize on the sybil attack. Specifically, we focus on three different types of sybil attack on a realistic smart home network topology. Considering the involvement of resource-constraint devices, we propose and evaluate a novel decentralized countermeasure against these attacks. The proposed countermeasure is based on a hybrid approach that involves the use of the geographical location of the nodes and a trust value-based parent selection procedure. Along with this, we use specially configured monitoring nodes that are responsible for the detection of the malicious attacker node(s). Further, we use RPL's multi-instance property to integrate the proposed decentralized architecture into the exiting RPL protocol. We implement the proposed countermeasure in Cooja, the Contiki operating system-based network simulator. The results obtained through our experiments validate the practicality of the proposed countermeasure. [ABSTRACT FROM AUTHOR]