Search

Existing manufacturing systems are isolated from the outside world to protect their sites and systems. However, following the trend of the 4th Industrial Revolution, manufacturing systems have also increased the connectivity of various domains and the convergence of numerous technologies. These systems are referred to as smart manufacturing systems. However, this trend has increased the challenge of network anomaly detection methods, which are a major approach to network security in smart manufacturing. Existing methods define normality under the premise that network components are static, and network operation is periodic compared to the information technology environment. Therefore, comprehensive and volatile network environments require significant time, cost, and labor to define normality. Consequently, artificial intelligence (AI)-based anomaly detection studies have been actively conducted to solve this problem. However, such studies require manual analysis based on expert knowledge of each site during the preprocessing stage to extract the learning features from the collected network data. To solve the above problems, this study proposes a protocol reverse engineering method corresponding to the preprocessing stage of exiting AI studies. Through this method, existing AI-based anomaly detection studies can directly use the collected network data to learn normality without expert knowledge of the site. Furthermore, non-polling or reporting network operating environments that are rarely studied in the manufacturing security domain are targeted. Finally, we propose an anomaly detection method that uses an external signature, time information, the pattern of time intervals, and classified messages. Thus, the proposed method can detect anomalies in the encrypted contents of the manufacturing protocols.

Due to recent developments in IT technology, various IoT devices have been developed for use in various environments, such as card smart TVs, and smartphones Communication between IoT devices has become possible. Various IoT devices are found in homes and in daily life, and IoT technologies are being combined with vehicles, power, and wearables, amongst others. Although the usage of IoT devices has increased, the level of security technology applied to IoT devices is still insufficient. There is sensitive information stored inside IoT devices, such as personal information and usage history, so if security accidents happen, such as data leakage, it can be very damaging for users. Since research on data storage and acquisition in IoT devices is very important, in this paper we conducted a security analysis, from a forensic perspective, on IoT platform file systems used in various environments. The analysis was conducted on two mechanical platforms: Tizen (VDFS) and Linux (JFFS2 and UBIFS). Through file system metadata analysis, file system type, size, list of files and folders, deleted file information were obtained so that we could analyze file system structure with the obtained information. We also used the obtained information to check the recoverability of deleted data to investigate the recovery plan. In this study, we explain the characteristics of platforms used in various environments, and the characteristics of data stored in each platform. By analyzing the security issues of data stored during platform communications, we aimed to help in solving the problems affecting devices. In addition, we explain the analysis method for file system forensics so that it can be referred to in other platform forensics.

Recently, smart cities provide various services to citizens through the convergence of Information and Communications Technology and industries such as transportation, health care, and automobiles. Accordingly, the number of smart devices that use artificial intelligence technology to store the personal information of users to provide services efficiently is increasing. Smart devices can be used to acquire key evidence through digital forensics, which can also serve, as evidence in a court. In this study, we acquire and analyze user data stored in wearable devices by applying a data acquisition framework for smart devices. This study contributes to the acquisition of key evidence for investigations.

A cyber-physical infrastructure system (CPIS) is a system that controls and manages critical infrastructure such as smart manufacturing, water treatment facilities, power generation, and distribution facilities. Although these CPISs focus on the security of air-gapped network environments, strict isolation from the outside network is difficult to achieve, leading to various attacks. CPISs also comprise various devices and proprietary communication protocols that are used exclusively for each domain and site. Therefore, experts have to adopt a customized strategy to enhance security in CPIS networks after analyzing each domain, device, and protocol in advance. These methods require a significant amount of time, cost, and manpower; consequently, they are difficult to apply existing security methods in the real field. As a solution, a method is proposed herein that includes the following: 1) inferencing the CPIS protocol format and field semantics based on the characteristics of CPIS networks and protocols; 2) multilevel anomaly detection based on the meaning and values of each inferred field. The proposed method does not require knowledge of each site and protocol. In addition, the inference method can be used to analyze the payload field, including the state and measurement value, as well as the header field. Finally, we validate the proposed technique using an open-source CPIS network dataset including response injection, command injection, denial-of-service, and reconnaissance attacks. In addition, in the aspect of detection efficiency, the proposed technique exhibits comparable performance to that of existing knowledge-based anomaly detection methods.

Connections of cyber-physical system (CPS) components are gradually increasing owing to the introduction of the Industrial Internet of Things (IIoT). IIoT vulnerability analysis has become a major issue because complex skillful cyber-attacks on CPS systems exploit their zero-day vulnerabilities. However, current white box techniques for vulnerability analysis are difficult to use in real heterogeneous environments, where devices supplied by various manufacturers and diverse firmware versions are used. Therefore, we herein propose a novel protocol fuzzing test technique that can be applied in a heterogeneous environment. As seed configuration can significantly influence the test result in a black box test, we update the seed pool using test cases that travel different program paths compared to the seed. The input, output, and Delta times are used to determine if a new program area has been searched in the black box environment. We experimentally verified the effectiveness of the proposed.

The introduction of the cyber-physical system (CPS) into power systems has created a variety of communication requirements and functions that existing legacy systems do not support. To this end, the IEEE 1815.1 standard defines the mapping between existing distributed network protocol networks and IEC 61850 networks that reflect new requirements. However, advanced CPS cyberattacks have been reported, and in order to address cyberattacks, security research on new power systems that use network devices and heterogeneous communication is necessary. In this study, we propose an intrusion detection system for an IEEE 1815.1-based power system using CPS. We 1) analyze an IEEE 1815.1-based power system network and propose a suitable application method for an intrusion detection system, 2) suggest a bidirectional recurrent neural network-based anomaly detection system for an IEEE 1815.1-based network, and 3) demonstrate the verification of the proposed technique using various power system-specific attack data, including real power system using CPS network traffic, CPS malware behavior (CMB), false data injection (FDI), and disabling reassembly (DR) attacks. Proposed technique successfully detected five types of CMB attacks, three types of FDI and DR attacks.

Recently, the number of Internet of Things (IoT) devices, such as artificial intelligence (AI) speakers and smartwatches, using a Linux-based file system has increased. Moreover, these devices are connected to the Internet and generate vast amounts of data. To efficiently manage these generated data and improve the processing speed, the function is improved by updating the file system version or using new file systems, such as an Extended File System (XFS), B-tree file system (Btrfs), or Flash-Friendly File System (F2FS). However, in the process of updating the existing file system, the metadata structure may be changed or the analysis of the newly released file system may be insufficient, making it impossible for existing commercial tools to extract and restore deleted files. In an actual forensic investigation, when deleted files become unrecoverable, important clues may be missed, making it difficult to identify the culprit. Accordingly, a framework for extracting and recovering files based on The Sleuth Kit (TSK) is proposed by deriving the metadata changed in Ext4 file system journal checksum v3 and XFS file system v5. Thereafter, by comparing the accuracy and recovery rate of the proposed framework with existing commercial tools using the experimental dataset, we conclude that sustained research on file systems should be conducted from the perspective of forensics.

Various Internet of Things (IoT) devices, such as AI speakers, are being released with different functions to improve user convenience and better life. An AI speaker ecosystem is a cloud-based IoT system built around an AI speaker and IoT devices. In the near future, citizens in whole countries worldwide will be helped in real life when AI-equipped devices are deployed in their homes. Typically, because AI speakers are always operating, they can be used to provide vital evidence for digital forensics; however, privacy issues may arise. AI speakers have provided evidence of murders in the United States and Mexico and are being released without specific regulatory guidelines. In this study, we propose five digital forensic analysis methods for four AI speaker models from different manufacturers released in the Republic of Korea. The five proposed methods are applied to all the AI speaker models, and the results are presented in the Appendix. In particular, we developed a forensic tool for collecting user command history for NAVER Clova.

The proliferation of various connected platforms, including Internet of things, industrial control systems (ICSs), connected cars, and in-vehicle networks, has resulted in the simultaneous use of multiple protocols and devices. Chaotic situations caused by the usage of different protocols and various types of devices, such as heterogeneous networks, implemented differently by vendors renders the adoption of a flexible security solution difficult, such as recent deep learning-based intrusion detection system (IDS) studies. These studies optimized the deep learning model for their environment to improve performance, but the basic principle of the deep learning model used was not changed, so this can be called a next-generation IDS with a model that has little or no requirements. Some studies proposed IDS based on unsupervised learning technology that does not require labeled data. However, not using available assets, such as network packet data, is a waste of resources. If the security solution considers the role and importance of the devices constituting the network and the security area of the protocol standard by experts, the assets can be well used, but it will no longer be flexible. Most deep learning model-based IDS studies used recurrent neural network (RNN), which is a supervised learning model, because the characteristics of the RNN model, especially when the long-short term memory (LSTM) is incorporated, are better configured to reflect the flow of the packet data stream over time, and thus perform better than other supervised learning models such as convolutional neural network (CNN). However, if the input data induce the CNN&rsquo, s kernel to sufficiently reflect the network characteristics through proper preprocessing, it could perform better than other deep learning models in the network IDS. Hence, we propose the first preprocessing method, called &ldquo, direct&rdquo, for network IDS that can use the characteristics of the kernel by using the minimum protocol information, field size, and offset. In addition to direct, we propose two more preprocessing techniques called &ldquo, weighted&rdquo, and &ldquo, compressed&rdquo, Each requires additional network information, therefore, direct conversion was compared with related studies. Including direct, the proposed preprocessing methods are based on field-to-pixel philosophy, which can reflect the advantages of CNN by extracting the convolutional features of each pixel. Direct is the most intuitive method of applying field-to-pixel conversion to reflect an image&rsquo, s convolutional characteristics in the CNN. Weighted and compressed are conversion methods used to evaluate the direct method. Consequently, the IDS constructed using a CNN with the proposed direct preprocessing method demonstrated meaningful performance in the NSL-KDD dataset.

Document Information Language: English Accession Number: WOS:000524079100141, Two party authentication schemes can be good candidates for deployment in Internet of Things (IoT)-based systems, especially in systems involving fast moving vehicles. Internet of Vehicles (IoV) requires fast and secure device-to-device communication without interference of any third party during communication, and this task can be carried out after registration of vehicles with a trusted certificate issuing party. Recently, several authentication protocols were proposed to enable key agreement in two party settings. In this study, we analyze two recent protocols and show that both protocols are insecure against key compromise impersonation attack (KCIA) as well as both lack of user anonymity. Therefore, this paper proposes an improved protocol that does not only resist KCIA and related attacks, but also offers comparable computation and communication. The security of proposed protocol is tested under formal model as well as using well known Burrows-Abadi-Needham (BAN) logic along with a discussion on security features. While resisting the KCIA and related attacks, proposed protocol also provides comparable trade-of between security features and efficiency and completes a round of key agreement in just 13.42 ms, which makes it a promising candidate to be deployed in IoT environments., This Project was funded by the Deanship of Scientific Research (DSR), at King Abdulaziz University, Jeddah, under grant no. (RG-7-611-40). The authors, therefore, acknowledge with thanks DSR for technical and financial support. This research was supported by Energy Cloud R&D Program through the National Research Foundation of Korea(NRF) funded by the Ministry of Science, ICT (2019M3F2A1073386).

Document Information Language: English Accession Number: WOS:000527272900046, The on demand availability of resources in Cyber physical system (CPS) has emerged as a viable service providing platform to improve the resource usability and reducing the infrastructure costs. Nevertheless, the development recompenses can only be realized after avoiding security and privacy issues. A secure and reliable CPS can offer improved efficiency, usability and reliability along with autonomy. To secure such systems, in 2018 Challa a al. (2018) proposed a security system to extend an authenticated key agreement between a user and a cloud server via trusted authority; as an application, they also customized their system to work with autonomous smart meter and cloud server. Challa a al. then claimed the security of their proposed scheme through formal, informal and automated validations. However, this paper unveils the weaknesses of their scheme and shows that their scheme cannot facilitate in forming a session key between the user/smart meter and the cloud server. Precisely, in the presence of more than one registered users/smart meters, the latter in their scheme may never receive a response message because of a critical design error. Moreover, their scheme lacks the untraceable anonymity and the lack of request verification on cloud server side may also lead to replay and/or denial of services attack. The article then introduces an improved and secure authentication system free of correctness issues, to facilitate a key agreement between user and cloud server via trusted authority. As an application, the proposed system also works for smart meter and cloud server to reach a key agreement. Based on the hardness assumption of Elliptic Curve Decisional Diffi-Hellman Problem (ECDDHP), the formal Random oracle model proves the security of the proposed scheme. Moreover, the robustness of the scheme is explained through informal analysis. The proposed system while providing all known security features has slightly increased the computation and communication costs as compared with the scheme of Challa a al. The proposed scheme completes a cycle of authentication by exchanging 2080 bits in just 13.4066 ms.

In the era of Industry 4.0, information and communication technology (ICT) has been applied to various critical infrastructures, such as power plants, smart factories, and financial networks, to ensure and automate industrial systems. In particular, in the field of power control systems, ICT technology such as industrial internet of things (IoT) is applied for efficient remote measurement. Therefore, legacy systems that were previously operated as standalone now have contact points with the external networks. In this trend, security vulnerabilities from legacy ICT have been inherited by power control systems. Therefore, various security technologies are being researched and developed to cope with cyber vulnerabilities and threats. However, it is risky to apply novel security technologies that are not verified as secure, to power control systems, the availability of which must be guaranteed to provide electricity consistently. Thus, verifying the effectiveness and stability of new security technologies is necessary to apply the technologies to power control systems. In this paper, we analyze the configuration and characteristics of the power control systems network, which is an area where industrial IoT technology is applied. We also build a testbed environment that can verify the security technology and conduct experiments to confirm the security technology for the power control system and the suitability of the testbed. The proposed testbed will be able to stably incorporate new security technologies into the critical industrial infrastructure. Further, it is also expected that the security and stability of the system will be enhanced.

An industrial control system combined with IT is not a special thing; however, cyber security in this field does not mature. Therefore, vulnerability analysis techniques for protocols used in this field are clearly needed. In this paper, we propose a novel test case generation technique for a fuzzing test that can be used for various industrial control system protocols. The proposed fuzzing test is designed for generating a cross-field fuzzing test case because of field dependencies, a characteristic of industrial control system protocols. Additionally, we focus on multilayer testing because the weaknesses of lower layer protocols are inherited by upper layer protocols.

Although many studies have been conducted on digital forensics, their viewpoints keep changing, and new studies are continuously required on fields that have not been researched yet. This paper proposes a privacy protection measure by applying permanent deletion to the Internet-of-Things platform: a digital forensic technique regarding privacy protection that has been regarded as a cautious subject. In addition, we propose a file recovery method by analyzing a file allocation area in a UNIX file system, which has not been addressed, and identifying the clue for journal area using a magic number.

Through the active development of industrial internet of things (IIoT) technology, there has been a rapid increase in the number of different industrial wireless sensor networks (IWSNs). Accordingly, the security of IWSNs is also of importance, as many security problems related to IWSN protocols have been raised and various studies have been conducted to solve these problems. However, the provisioning process is the first step in introducing a new device into the IIoT network and a starting point for IIoT security. Therefore, leakage of security information in the provisioning process makes exposure of secret keys and all subsequent security measures meaningless. In addition, using the exploited secret keys, the attacker can send false command to the node or send false data to the network manager and it can cause serious damage to industrial infrastructure depending on the IWSN. Nevertheless, a security study on the provisioning process has not been actively carried out, resulting in a provisioning process without guaranteed security. Therefore, in this paper, we analyzed security issues of the provisioning process in IWSN by researching prominent IWSN standards, including ISA 100.11a, WirelessHART, and Zigbee, and also an ISA 100.11a-certified device and provisioning process-related studies. Then, we verified the security issues of the provisioning process through testing and analyzing the provisioning process using the ISA 100.11a standard-implemented devices and ISA 100.11a-certified devices. Finally, we discuss security considerations and the direction of future research on provisioning security for IWSN in the IIoT era.

In recent years, vehicles have become one of the most common examples in the area of ICT convergence applications and services [...]

IEC 61850, an international standard for communication networks, is becoming prevalent in the cyber-physical system (CPS) environment, especially with regard to the electrical grid. Recently, since cyber threats in the CPS environment have increased, security matters for individual protocols used in this environment are being discussed at length. However, there have not been many studies on the types of new security vulnerabilities and the security requirements that are required in a heterogeneous protocol environment based on IEC 61850. In this paper, we examine the electrical grid in Korea, and discuss security vulnerabilities, security requirements, and security architectures in such an environment. There are security concerns in the heterogeneous CPS environment based on IEC 61850.Two connections (IEC 61850-DNP3, IEC 61850-IEC 61970) are drawn from a case study.We classify the security vulnerabilities of the heterogeneous protocol environment.We present security requirements and architectures in the heterogeneous CPS environment.

Designed an authentication scheme for IoT based smart grid communication.Analyzed the scheme using automated tool ProVerif.The proposed scheme is more lightweight and secure than existing schemes. The Internet of Things (IoT) has plenty of applications including Smart Grid (SG). IoT enables smooth and efficient utilization of SG. It is assumed as the prevalent illustration of IoT at the moment. IP-based communication technologies are used for setting SG communication network, but they are challenged by huge volume of delay sensitive data and control information between consumers and utility providers. It is also challenged by numerous security attacks due to resource constraints in smart meters. Sundry schemes proposed for addressing these problems are inappropriate due to high communication, computation overhead and latency. In this paper, we propose a hybrid Diffie-Hellman based lightweight authentication scheme using AES and RSA for session key generation. To ensure message integrity, the advantages of hash based message authentication code are exploited. The scheme provides mutual authentication, thwarting replay and man-in-the-middle attacks and achieves message integrity, while reducing overall communication and computation overheads.

Because of the evolution of mobile devices such as smartphone, the necessity of mobile forensics is increasing. In spite of this necessity, the mobile forensics does not fully reflect the characteristic of the mobile device. For this reason, this paper analyzes the legal, institutional, and technical considerations for figuring out facing problems of mobile forensics. Trough this analysis, this study discuss the limits of screening seizure on the mobile device. Also, analyzes and verify the mobile forensic data acquisition methods and tools for ensuring the admissibility of mobile forensic evidence in digital investigation.

The rapid advancement in communication technologies enables remote users to acquire a number of online services. All such online services are provided remotely facilitating the users to freely move any where with out disruption of the services. In order to ensure seamless and secure services to the remote user such services espouse authentication protocols. A number of authentication protocols are readily available to achieve security and privacy in remote client server architecture. Most of these schemes are tailored for single server architecture. In such scenario, if a user wants to attain the services provided by more than one servers he has to register with each server. In recent times, multiserver authentication has got much attention, where a user can register once and then can acquire services provided by multiple servers. Very recently, Lu et al. proposed a biometric, smart card and password-based three factor authentication scheme usable for multiserver environments. Furthermore, Lu et al. identified their scheme to resist known attacks. However, the analysis in this paper ascertains that Lu et al.’s scheme is vulnerable to impersonation attack. An adversary registered to the system just after knowing the public identity of a user can impersonate himself as the latter. Then we propose an improvement over Lu et al.’s scheme. Our improvement is more robust than the existing schemes. The security of proposed scheme is substantiated formally along with informal security discussion, while same is also validated using a popular automated tool ProVerif. The analysis confirms that proposed scheme achieves mutual authentication and is robust against known attacks. In addition, the proposed scheme does not incur any extra computation as compared with Lu et al.’s scheme.

As ICT is incorporated into the existing electrical grid, security threats can also be unintentionally introduced to the Smart Grid, as has happened with conventional information and communication networks. To avoid this, a new security architecture design addressing the particular characteristics of ICT is required. This paper proposes a logical architecture considering the case of electric vehicle telecommunication, which is one of the core Smart Grid services and one closely related to actual users. Based on that architecture, we analyzed the security threats and the respective security measures required to respond to them. By analyzing the security techniques and algorithms applicable to the Smart Grid environment and applying them to address its security requirements and threats we proposed a new security architecture for Smart Grid.

The Internet of Things era is being replaced by the Internet of Everything (IoE) era, where everything can communicate with everything else. With the advent of the fourth industrial revolution and the IoE era, industrial control systems (ICSs) are transitioning into industrial IoE (IIoE). The ICS, which is no longer a closed network, suffers from various cybersecurity threats. Since the attack of Stuxnet in 2010, the malware used to attack critical infrastructure (CI) has become increasingly sophisticated. Furthermore, recent attacks have mimicked normal network traffic. Therefore, investigating intrusion detection systems is necessary to detect these advanced cyberattacks. However, detecting advanced attacks, such as false data injection, is difficult because the traditional detection methods focus only on the protocol header fields. Most studies have not considered low-performance field devices, which are vulnerable to threats. Therefore, we have classified the extended reference model RAMI 4.0, which is the new ICS reference model in the fourth industrial revolution, into two levels: an operative level and a product process management level. A fast and lightweight algorithm is required at the operative level because the low-performance devices communicate with each other in real time. In addition, efficient data processing is important because considerable amount of data is concentrated at the product process management level. Based on these characteristics, a payload-based abnormal behavior detection method, i.e., the autoencoder-based payload anomaly detection (APAD), is proposed for each level. APAD uses an autoencoder to distinguish between normal and abnormal behaviors in low-performance devices. Furthermore, traffic analysis and a considerable amount of time are required to apply a traditional detection method at the product process management level. However, the proposed method does not require long-time traffic analysis. It exhibits a higher detection rate compared with those exhibited by other methods based on verification using the open secure water treatment dataset called SWaT.

In this paper, we propose a neighbor stability-based VANET clustering (NSVC) that can efficiently deliver data in urban vehicular environments. The salient features of urban vehicles are their high mobility and unpredictable direction of movement, so vehicle-to-vehicle and vehicle-to-infrastructure (V2X) communication should take into consideration the frequent changes in the topology of vehicular ad hoc networks (VANETs). These technical challenges are addressed with NSVC by including a neighbor stability-based VANET clustering scheme and the corresponding supplementary transmission scheduling method. Thereby, NSVC supports fast cluster formation, minimizes the number of cluster head elections, and moreover guarantees the reliable delivery of data for emergency messages. The results of the simulation indicate that NSVC achieves better network performance when compared to existing approaches.

This research investigates the problem of area exploration using groups of unmanned aerial vehicles without service interruption under limited fuel constraints, where each group is assigned backup or search role depending on the situation. This paper presents an exhaustive search approach in finding a way to explore the search area with the least energy consumption. For this, the search length is divided into equal-sized intervals. The end points of these intervals can be designated as switch points where a search group goes back to the base to refuel and the backup group continues the job the returning group was doing before returning. This approach guarantees that the search operation is not interrupted by this switch operation for refueling. Since the exhaustive approach takes exponential time, a measure is proposed to determine the way to search the area that costs the least energy consumption for an allowed maximum execution time.