Search

Long Range (LoRa) networks provide long range, cost-effective and energy-efficient communications by utilising the free unlicensed ISM band, which makes them appealing for Internet of Things (IoT) applications. However, in high density networks, reliable performance might be hard to achieve due to the nodes’ random-access method. Furthermore, the duty cycle restrictions that are imposed on nodes and gateways transmissions can limit the scalability of the network. More importantly, the duty cycle restrictions that are imposed on the downlink communication from the server to nodes can impose further challenges. Consequently, the server in high density networks might not be able to communicate with all network nodes due to its limited duty cycle. Besides, the server might not be able to send individual controlling packets from server to nodes. One way to mitigate such a limit is to allow nodes autonomously determine their transmission parameters without the need for any downlink transmission from the server. Thus, this paper presents the Sector-Based Time Slotted SBTS-LoRa MAC protocol that allows nodes to determine their transmission parameters autonomously based on their location to the gateway. SBTS-LoRa is targeting large scale networks. Simulation results show that our proposed protocol significantly enhances the scalability and outperforms its counterparts by maximizing throughput without compromising the energy efficiency. Specifically, the average throughput for dense networks was enhanced 14 times compared to the Adaptive Data Rate ADRLoRaWAN.

Internet of Things (IoT) is fast growing. Non-PC devices under the umbrella of IoT have been increasingly applied in various fields and will soon account for a significant share of total Internet traffic. However, the security and privacy of IoT and its devices have been challenged by malware, particularly polymorphic worms that rapidly self-propagate once being launched and vary their appearance over each infection to escape from the detection of signature-based intrusion detection systems. It is well recognized that polymorphic worms are one of the most intrusive threats to IoT security. To build an effective, strong defense for IoT networks against polymorphic worms, this research proposes a machine intelligent system, termed Gram-Restricted Boltzmann Machine (Gram-RBM), which automatically generates generic fingerprints/signatures for the polymorphic worm. Two augmented N-gram based methods are designed and applied in derivation of polymorphic wormsequences, also known as fingerprints/signatures. These derived sequences are then optimized using the Gaussian-Bernoulli RBM dimension reduction algorithm. The results, gained from the experiments involved three different types of polymorphicworms, show that the system generates accurate fingerprints/signatures even under "noisy" conditions and outperforms related methods in terms of accuracy and efficiency.

Vehicular computation offloading is a well-received strategy to execute delay-sensitive and/or compute-intensive tasks of legacy vehicles. The response time of vehicular computation offloading can be shortened by using mobile edge computing that offers strong computing power, driving these computation tasks closer to end users. However, the quality of communication is hard to guarantee due to the obstruction of dense buildings or lack of infrastructure in some zones. Unmanned Aerial Vehicles (UAVs), therefore, have become one of the means to establish communication links for the two ends owing to its characteristics of ignoring terrain and flexible deployment. To make a sensible decision of computation offloading, nevertheless vehicles need to gather offloading-related global information, in which Software-Defined Networking (SDN) has shown its advances in data collection and centralized management. In this paper, thus, we propose an SDN-enabled UAV-assisted vehicular computation offloading optimization framework to minimize the system cost of vehicle computing tasks. In our framework, the UAV and the Mobile Edge Computing (MEC) server can work on behalf of the vehicle users to execute the delay-sensitive and compute-intensive tasks. The UAV, in a meanwhile, can also be deployed as a relay node to assist in forwarding computation tasks to the MEC server. We formulate the offloading decision-making problem as a multi-players computation offloading sequential game, and design the UAV-assisted Vehicular Computation Cost Optimization (UVCO) algorithm to solve this problem. Simulation results demonstrate that our proposed algorithm can make the offloading decision to minimize the Average System Cost (ASC).

To provide efficient networking services at the edge of Internet-of-Vehicles (IoV), Software-Defined Vehicular Network (SDVN) has been a promising technology to enable intelligent data exchange without giving additional duties to the resource constrained vehicles. Compared with conventional centralized SDVNs, hybrid SDVNs combine the centralized control of SDVNs and self-organized distributed routing of Vehicular Ad-hoc NETworks (VANETs) to mitigate the burden on the central controller caused by the frequent uplink and downlink transmissions. Although a wide variety of routing protocols have been developed, existing protocols are designed for specific scenarios without considering flexibility and adaptivity in dynamic vehicular networks. To address this problem, we propose an efficient online sequential learning-based adaptive routing scheme, namely, Penicillium reproduction-based Online Learning Adaptive Routing scheme (POLAR) for hybrid SDVNs. By utilizing the computational power of edge servers, this scheme can dynamically select a routing strategy for a specific traffic scenario by learning the pattern from network traffic. Firstly, this paper applies Geohash to divide the large geographical area into multiple grids, which facilitates the collection and processing of real-time traffic data for regional management in controller. Secondly, a new Penicillium Reproduction Algorithm (PRA) with outstanding optimization capabilities is designed to improve the learning effectiveness of Online Sequential Extreme Learning Machine (OS-ELM). Finally, POLAR is deployed in control plane to generate decision-making model (i.e., routing policy). Based on the real-time featured data, this scheme can choose the optimal routing strategy for a specific area. Extensive simulation results show that POLAR is superior to a single traditional routing protocol in terms of packet delivery ratio and latency.

Utilising the mobilisation of a sink node in a wireless sensor network to combat the energy hole, or hotspot issue, is well referenced. However, another issue, that of energy spikes may remain. With the mobile sink node potentially communicating with some nodes more than others. In this study we propose the Mobility Aware Duty Cycling and Dynamic Preambling Algorithm (MADCaDPAL). This algorithm utilises an existing solution where a communication threshold is built between a mobile sink node using predictable mobility and static nodes on its path. MADCaDPAL bases decisions relating to node sleep function, moving to clear channel assessment and the subsequent sending of preambles on the relation between the threshold built by the static node and the position of the mobile sink node. MADCaDPAL achieves a reduction in average energy consumption of up to 80%, this when used in conjunction with a lightweight carrier-sense multiple access based MAC implementation. Maximum energy consumption amongst individual nodes is also brought closer to the average, reducing energy spikes and subsequently improving network lifetime. Additionally, frame delivery to the sink is improved overall.

This article models the multihop data-routing in vehicular ad-hoc networks as multiple criteria decision making (MCDM) in four steps. First, the criteria that have impact on the performance of the network layer are captured and transformed into fuzzy sets. Second, the fuzzy sets are characterized by fuzzy membership functions (FMFs), which are interpolated (curve fitting) based on the data collected from massive experimental simulations. Third, the analytical hierarchy process (AHP) is exploited to identify the relationships among the criteria. Fourth, multiple fuzzy rules are determined and the Takagi–Sugeno–Kang (TSK) inference system is employed to infer and aggregate the final forwarding decision. Through integrating techniques of MCDM, FMF, AHP, and TSK, we design a distributed and opportunistic data routing protocol, namely, vehicular environment fuzzy router which targets vehicle-to-vehicle (V2V) communication and runs in two main processes—road segment selection (RSS) and relay vehicle selection (RVS). RSS is intended to select multiple successive junctions through which the packets should travel from the source to the destination, while RVS process is intended to select relay vehicles within the selected road segment. The experimental results show that our protocol performs and scales well with both network size and density, considering the combined problem of end-to-end packet delivery ratio and end-to-end latency.

Software-defined vehicular networks (SDVN) is a promising technology to overcome the limitations of current vehicular networking. However, existing vehicular routing schemes are not equipped to handle communication in SDVNs. In addition, routing schemes in SDVNs, in general, has been lightly addressed in the literature to well compute the flow tables. To fill this gap, this article explores the potential of SDVNs from the aspect of routing and studies the design principles of routing schemes in SDVNs and classifies the current routing solutions based on different criteria. SDVN routing schemes are then compared through comprehensive analysis, and key open issues and opportunities for future research directions are discussed.

In this paper, we consider the issue of the secure transmissions for the cognitive radio-based Internet of Medical Things (IoMT) with wireless energy harvesting. In these systems, a primary transmitter (PT) will transmit its sensitive medical information to a primary receiver (PR) by a multi-antenna-based secondary transmitter (ST), where we consider that a potential eavesdropper may listen to the PT’s sensitive information. Meanwhile, the ST also transmits its own information concurrently by utilizing spectrum sharing. We aim to propose a novel scheme for jointly designing the optimal parameters, i.e., energy harvesting (EH) time ratio and secure beamforming vectors, for maximizing the primary secrecy transmission rate while guaranteeing secondary transmission requirement. For solving the nonconvex optimization problem, we transfer the problem into convex optimization form by adopting the semidefinite relaxation (SDR) method and Charnes–Cooper transformation technique. Then, the optimal secure beamforming vectors and energy harvesting duration can be obtained easily by utilizing the CVX tools. According to the simulation results of secrecy transmission rate, i.e., secrecy capacity, we can observe that the proposed protocol for the considered system model can effectively promote the primary secrecy transmission rate when compared with traditional zero-forcing (ZF) scheme, while ensuring the transmission rate of the secondary system.

Port Knocking is a method for authenticating clients through a closed stance firewall, and authorising their requested actions, enabling severs to offer services to authenticated clients, without opening ports on the firewall. Advances in port knocking have resulted in an increase in complexity in design, preventing port knocking solutions from realising their potential. This paper proposes a novel port knocking solution, named Crucible, which is a secure method of authentication, with high usability and features of stealth, allowing servers and services to remain hidden and protected. Crucible is a stateless solution, only requiring the client memorise a command, the server's IP and a chosen password. The solution is forwarded as a method for protecting servers against attacks ranging from port scans, to zero-day exploitation. To act as a random oracle for both client and server, cryptographic hashes were generated through chaotic systems., J. Nonlinear Dyn (2020)

The Next Generation 5G Networks can greatly benefit from the synergy between virtualization paradigms, such as the Network Function Virtualization (NFV), and service provisioning platforms such as the IP Multimedia Subsystem (IMS). The NFV concept is evolving towards a lightweight solution based on containers that, by contrast to classic virtual machines, do not carry a whole operating system and result in more efficient and scalable deployments. On the other hand, IMS has become an integral part of the 5G core network, for instance, to provide advanced services like Voice over LTE (VoLTE). In this paper we combine these virtualization and service provisioning concepts, deriving a containerized IMS infrastructure, dubbed cIMS, providing its assessment through statistical characterization and experimental measurements. Specifically, we: $\textit {i)}$ model cIMS through the queueing networks methodology to characterize the utilization of virtual resources under constrained conditions; $\textit {ii)}$ draw an extended version of the Pollaczek-Khinchin formula, which is useful to deal with bulk arrivals; $\textit {iii)}$ afford an optimization problem focused at maximizing the whole cIMS performance in the presence of capacity constraints, thus providing new means for the service provider to manage service level agreements (SLAs); $\textit {iv)}$ evaluate a range of cIMS scenarios, considering different queuing disciplines including also multiple job classes. An experimental testbed based on the open source platform Clearwater has been deployed to derive some realistic values of key parameters (e.g., arrival and service times).

The Internet of Things (IoT) has the potential to transform communities around the globe into smart cities. The massive deployment of sensor-embedded devices in the smart cities generates voluminous amounts of data that need to be stored and processed in an efficient manner. Long-haul data transmission to the remote cloud data centers leads to higher delay and bandwidth consumption. In smart cities, the delay-sensitive applications have stringent requirements in term of response time. To reduce latency and bandwidth consumption, edge computing plays a pivotal role. The resource-constrained smart devices at the network core need to offload computationally complex tasks to the edge devices located in their vicinity and have relatively higher resources. In this paper, we propose an end-to-end encryption framework, SmartEdge, for a smart city application by executing computationally complex tasks at the network edge and cloud data centers. Using a lightweight symmetric encryption technique, we establish a secure connection among the smart core devices for multimedia streaming towards the registered and verified edge devices. Upon receiving the data, the edge devices encrypts the multimedia streams, encodes them, and broadcast to the cloud data centers. Prior to the broadcasting, each edge device establishes a secured connection with a data center that relies on the combination of symmetric and asymmetric encryption techniques. In SmartEdge, the execution of a lightweight encryption technique at the resource-constrained smart devices, and relatively complex encryption techniques at the network edge and cloud data centers reduce the resource utilization of the entire network. The proposed framework reduces the response time, security overhead, computational and communication costs, and has a lower end-to-end encryption delay for participating entities. Moreover, the proposed scheme is highly resilient against various adversarial attacks.

The increasing use of encrypted data within file storage and in network communications leaves investigators with many challenges. One of the most challenging is the Tor protocol, as its main focus is to protect the privacy of the user, in both its local footprint within a host and over a network connection. The Tor browser, though, can leave behind digital artefacts which can be used by an investigator. This paper outlines an experimental methodology and provides results for evidence trails which can be used within real-life investigations.

Highlights• This study presents the complete and slotted interference graph model. • The service uses the complete interference graph to evaluate the network. • Slotted interference graphs are used to reschedule problematic connections. • Real-world experiments confirm the validity of both methods.AbstractWith billions of connected devices in the near future, the major challenge is to develop networks to build an Industrial Internet of Things which is scalable, energy-efficient, reliable and affordable. To this end, low-power wireless personal area networks (LP-WPAN) provide a solution at minimum costs. However, to ensure continuous performance verification, LP-WPAN requires a centrally monitored and controlled service. This work proposes such an edge service, i.e. network monitoring and optimal reconfiguration of scheduled LP-WPANs. The approach is based on a transformation of the schedule into a new model, interference graphs. The interference graphs allow to design evaluation and rescheduling recommender methods to monitor and reconfigure the schedule. An experimental setup was developed to test and validate the approach. The results show that the model and methods provide an accurate representation of the behavior of the network, and that the new rescheduling recommender greatly improves the network's performance, compared to random rescheduling.

Nature-inspired computing (NIC) has been widely studied for many optimization scenarios. However, miscellaneous solution space of real-world problem causes it is challenging to guarantee the global optimum. Besides, cumbersome structure and complex parameters setting-up make the existed algorithms hard for most users who are not specializing in NIC, to understand and use. To alleviate these limitations, this paper devises a succinct and efficient optimization algorithm called Nomad Algorithm (NA). It is inspired by the migratory behaviour of nomadic tribes on the prairie. Extensive experiments are implemented with respects to accuracy, rate, stability, and cost of optimization. Mathematical proof is given to guarantee the global convergence, and the nonparametric tests are conducted to confirm the significance of experiment results. The statistical results of optimization accuracy denote NA outperforms its rivals for most cases (23/28) by orders of magnitude significantly. It is considered as a promising optimizer with excellent efficiency and adaptability.

In recent years, there has been a massive increase in the amount of Internet of Things (IoT) devices as well as the data generated by such devices. The participating devices in IoT networks can be problematic due to their resource-constrained nature, and integrating security on these devices is often overlooked. This has resulted in attackers having an increased incentive to target IoT devices. As the number of attacks possible on a network increases, it becomes more difficult for traditional intrusion detection systems (IDS) to cope with these attacks efficiently. In this paper, we highlight several machine learning (ML) methods such as k-nearest neighbour (KNN), support vector machine (SVM), decision tree (DT), naive Bayes (NB), random forest (RF), artificial neural network (ANN), and logistic regression (LR) that can be used in IDS. In this work, ML algorithms are compared for both binary and multi-class classification on Bot-IoT dataset. Based on several parameters such as accuracy, precision, recall, F1 score, and log loss, we experimentally compared the aforementioned ML algorithms. In the case of HTTP distributed denial-of-service (DDoS) attack, the accuracy of RF is 99%. Furthermore, other simulation results-based precision, recall, F1 score, and log loss metric reveal that RF outperforms on all types of attacks in binary classification. However, in multi-class classification, KNN outperforms other ML algorithms with an accuracy of 99%, which is 4% higher than RF.

The threat from ransomware continues to grow both in the number of affected victims as well as the cost incurred by the people and organisations impacted in a successful attack. In the majority of cases, once a victim has been attacked there remain only two courses of action open to them; either pay the ransom or lose their data. One common behaviour shared between all crypto ransomware strains is that at some point during their execution they will attempt to encrypt the users’ files. This paper demonstrates a technique that can identify when these encrypted files are being generated and is independent of the strain of the ransomware. An enhanced mixed file ransomware data set of more than 130,000 files was developed based on the govdocs1(Garfinkel, 2020) corpus. This data set was enriched to contain examples of files that reflect the more modern Microsoft file formats, as well as examples of high entropy file formats such as compressed files and archives. The data set also contained eight different sets of files that were generated as the result of different real-world high profile ransomware attacks such as WannaCry, Ryuk, Phobos, Sodinokibi and NetWalker. Previous research Penrose et al. (2013); Zhao et al. (2011) has highlighted the difficulty in differentiating between compressed and encrypted files using Shannon entropy as both file types exhibit similar values. One of the experiments described in this paper shows a unique characteristic for the Shannon entropy of encrypted file header fragments. This characteristic was used to differentiate between encrypted files and other high entropy files such as archives. This discovery was leveraged in the development of a file classification model that used the differential area between the entropy curve of a file under analysis and one generated from random data. When comparing the entropy plot values of a file under analysis against one generated by a file containing purely random numbers, the greater the correlation of the plots is, the higher the confidence that the file under analysis contains encrypted data. The experiments demonstrate a high degree of confidence in the accuracy of the model achieving a success rate of more than 99.96% when examining only the first 192 bytes of a file, using a mixed data set of more than 80,000 files. This technique successfully addresses the problem of using file entropy to differentiate compressed and archived files from files encrypted by ransomware in a timely manner.

Electronic health record (EHR) management systems require the adoption of effective technologies when health information is being exchanged. Current management approaches often face risks that may expose medical record storage solutions to common security attack vectors. However, healthcare-oriented blockchain solutions can provide a decentralized, anonymous and secure EHR handling approach. This paper presents PREHEALTH, a privacy-preserving EHR management solution that uses distributed ledger technology and an Identity Mixer (Idemix). The paper describes a proof-of-concept implementation that uses the Hyperledger Fabric&rsquo, s permissioned blockchain framework. The proposed solution is able to store patient records effectively whilst providing anonymity and unlinkability. Experimental performance evaluation results demonstrate the scheme&rsquo, s efficiency and feasibility for real-world scale deployment.

Organizations’ own personnel now have a greater ability than ever before to misuse their access to critical organizational assets. Insider threat detection is a key component in identifying rare anomalies in context, which is a growing concern for many organizations. Existing perimeter security mechanisms are proving to be ineffective against insider threats. As a prospective filter for the human analysts, a new deep learning based insider threat detection method that uses the Dempster-Shafer theory is proposed to handle both accidental as well as intentional insider threats via organization’s channels of communication in real time. The long short-term memory (LSTM) architecture together with multi-head attention mechanism is applied in this work to detect anomalous network behavior patterns. Furthermore, belief is updated with Dempster’s conditional rule and utilized to fuse evidence to achieve enhanced prediction. The CERT Insider Threat Dataset v6.2 is used to train the behavior model. Through performance evaluation, our proposed method is proven to be effective as an insider threat detection technique.

In RPL routing protocol, the destination advertisement object (DAO) control messages are announced by the child nodes to their parents to build downward routes. A malicious insider node can exploit this feature to send fake DAOs to its parents periodically, triggering those parents, in turn, to forward the fake messages upward to the root node. In this letter, we show how this behavior can have a detrimental side effect on the performance of the network, increasing power consumption, latency, and reducing reliability. To address this problem, a new scheme is introduced to mitigate significantly the effect of the DAO attack on network performance.

Edge computing paradigm has attracted many interests in the last few years as a valid alternative to the standard cloud-based approaches to reduce the interaction timing and the huge amount of data coming from Internet of Things (IoT) devices toward the Internet. In the next future, Edge-based approaches will be essential to support time-dependent applications in the Industry 4.0 context; thus, the paper proposes BodyEdge , a novel architecture well suited for human-centric applications, in the context of the emerging healthcare industry. It consists of a tiny mobile client module and a performing edge gateway supporting multiradio and multitechnology communication to collect and locally process data coming from different scenarios; moreover, it also exploits the facilities made available from both private and public cloud platforms to guarantee a high flexibility, robustness, and adaptive service level. The advantages of the designed software platform have been evaluated in terms of reduced transmitted data and processing time through a real implementation on different hardware platforms. The conducted study also highlighted the network conditions (data load and processing delay) in which BodyEdge is a valid and inexpensive solution for healthcare application scenarios.

Purpose The study uses cyberattacks announcements on 96 firms that are listed on S&P 500 over the period from January 03, 2013, to December 29, 2017. Design/methodology/approach The empirical analysis was performed in two ways: cross-section and industry level. The authors use statistical tests that account for the effects of cross-section correlation in returns, returns series correlation, volatility changes and skewness in the returns. Findings These imply that studying the cumulative effects of cyberattacks on prices of listed firms without grouping them into the various sectors may be non-informative; financial sector firms tend to react cumulatively to cyberattacks over a three-day period than other sectors; and technology firms tend to be less reactive to the announcement of a data breach. Such firms may possibly have the necessary tools and techniques to address large-scale cyberattacks. Research limitations/implications For cross-section analysis, the outcome shows that the market does not significantly react to cyberattacks for all the event windows, except [−30, 30], while for the sector-level analysis, the analysis offers two main results. Practical implications First, while there is a firm reaction to cyberattacks for long event window for retail sector, there is no evidence of a cumulative firm reaction to cyberattacks for both short and long event windows for the industrial, information technology and health sectors. Second, the firms in the financial sector, there is a strong evidence of cumulative reaction to cyberattacks for [−1, 1] for the financial industry, and the reactions disappear for relatively longer event windows. Social implications These imply that studying the cumulative effects of cyberattacks on prices of listed firms without grouping them into the various sectors may be non-informative, the financial sector firms tend to react cumulatively to cyberattacks over a three-day period than other sectors, technology firms tend to be less reactive to the announcement of a data breach, possibly such firms may have the necessary tools and techniques to address large-scale cyberattacks. Originality/value The work provides new insights into the effect of cyber security on stock prices.

One of the important features of routing protocol for low-power and lossy networks (RPLs) is objective function (OF). OF influences an IoT network in terms of routing strategies and network topology. On the contrary, detecting a combination of attacks against OFs is a cutting-edge technology that will become a necessity as next generation low-power wireless networks continue to be exploited as they grow rapidly. However, current literature lacks study on vulnerability analysis of OFs particularly in terms of combined attacks. Furthermore, machine learning is a promising solution for the global networks of IoT devices in terms of analysing their ever-growing generated data and predicting cyberattacks against such devices. Therefore, in this paper, we study the vulnerability analysis of two popular OFs of RPL to detect combined attacks against them using machine learning algorithms through different simulated scenarios. For this, we created a novel IoT dataset based on power and network metrics, which is deployed as part of an RPL IDS/IPS solution to enhance information security. Addressing the captured results, our machine learning approach is successful in detecting combined attacks against two popular OFs of RPL based on the power and network metrics in which MLP and RF algorithms are the most successful classifier deployment for single and ensemble models.

The hotspot issue in wireless sensor networks, with nodes nearest the sink node losing energy fastest and degrading network lifetime, is a well-referenced problem. Mobile sink nodes have been proposed as a solution to this. They do not completely remove the hotspot problem though, with nodes the sink passes most closely still expending more energy than others. This study proposes a lightweight algorithm, located in the media access control (MAC) layer of static nodes and utilising knowledge of predictable sink node mobility. This is in order to create a dynamic communication threshold between static nodes and the sink, within which static nodes awaken, lessening competition for sink communication between nodes. In utilising predictable mobility and factors already known to the static node, such as location and interference range, there is no need for energy-consuming messaging. Analysis and simulation results, tested on a lightweight implementation of a carrier-sense multiple-access-based MAC protocol, show a significant improvement in energy consumption in both controlled and random environments, with frame delivery improved to the point where sink speed is negated. This is when compared to the existing duty cycling approach.

The Internet of Things (IoT) is an emerging technology that aims to enable the interconnection of a large number of smart devices and heterogeneous networks. Ad hoc networks play an important role in the designing of IoT-enabled platforms due to their efficient, flexible, low-cost and dynamic infrastructures. These networks utilize the available resources efficiently to maintain the Quality of Service (QoS) in a multi-hop communication. However, in a multi-hop communication, the relay nodes can be malicious, thus requiring a secured and reliable data transmission. In this paper, we propose a QoS-aware secured communication scheme for IoT-based networks (QoS-IoT). In QoS-IoT, a Sybil attack detection mechanism is used for the identification of Sybil nodes and their forged identities in multi-hop communication. After Sybil nodes detection, an optimal contention window (CW) is selected for QoS provisioning, that is, to achieve per-flow fairness and efficient utilization of the available bandwidth. In a multi-hop communication, the medium access control (MAC) layer protocols do not perform well in terms of fairness and throughput, especially when the nodes generate a large amount of data. It is because the MAC layer has no capability of providing QoS to prioritized or forwarding flows. We evaluate the performance of QoS-IoT in terms of Sybil attack detection, fairness, throughput and buffer utilization. The simulation results show that the proposed scheme outperforms the existing schemes and significantly enhances the performance of the network with a large volume of data. Moreover, the proposed scheme is resilient against Sybil attack.

The Domain Name System (DNS) was created to resolve the IP addresses of web servers to easily remembered names. When it was initially created, security was not a major concern, nowadays, this lack of inherent security and trust has exposed the global DNS infrastructure to malicious actors. The passive DNS data collection process creates a database containing various DNS data elements, some of which are personal and need to be protected to preserve the privacy of the end users. To this end, we propose the use of distributed ledger technology. We use Hyperledger Fabric to create a permissioned blockchain, which only authorized entities can access. The proposed solution supports queries for storing and retrieving data from the blockchain ledger, allowing the use of the passive DNS database for further analysis, e.g., for the identification of malicious domain names. Additionally, it effectively protects the DNS personal data from unauthorized entities, including the administrators that can act as potential malicious insiders, and allows only the data owners to perform queries over these data. We evaluated our proposed solution by creating a proof-of-concept experimental setup that passively collects DNS data from a network and then uses the distributed ledger technology to store the data in an immutable ledger, thus providing a full historical overview of all the records.

Memory was captured from a system infected by ransomware and its contents was examined using live forensic tools, with the intent of identifying the symmetric encryption keys being used. NotPetya, Bad Rabbit and Phobos hybrid ransomware samples were tested during the investigation. If keys were discovered, the following two steps were also performed. Firstly, a timeline was manually created by combining data from multiple sources to illustrate the ransomware's behaviour as well as showing when the encryption keys were present in memory and how long they remained there. Secondly, an attempt was made to decrypt the files encrypted by the ransomware using the found keys. In all cases, the investigation was able to confirm that it was possible to identify the encryption keys used. A description of how these found keys were then used to successfully decrypt files that had been encrypted during the execution of the ransomware is also given. The resulting generated timelines provided a excellent way to visualise the behaviour of the ransomware and the encryption key management practices it employed, and from a forensic investigation and possible mitigation point of view, when the encryption keys are in memory., 11 pages, 10 figures

Decrypting and inspecting encrypted malicious communications may assist crime detection and prevention. Access to client or server memory enables the discovery of artefacts required for decrypting secure communications. This paper develops the MemDecrypt framework to investigate the discovery of encrypted artefacts in memory and applies the methodology to decrypting the secure communications of virtual machines. For Secure Shell, used for secure remote server management, file transfer, and tunnelling inter alia, MemDecrypt experiments rapidly yield AES-encrypted details for a live secure file transfer including remote user credentials, transmitted file name and file contents. Thus, MemDecrypt discovers cryptographic artefacts and quickly decrypts live SSH malicious communications including the detection and interception of data exfiltration of confidential data.

This paper examines the Ethereum network in the context of an investigation. The validation of data sources is achieved through different client software on both the Ropsten network and the live blockchain. New scenarios are also used test common patterns in order to track for start and end points for Ethereum and ERC20 tokens.

Current trends in interconnecting myriad smart objects to monetize on Internet of Things applications have led to high-density communications in wireless sensor networks. This aggravates the already over-congested unlicensed radio bands, calling for new mechanisms to improve spectrum management and energy efficiency, such as transmission power control. Existing protocols are based on simplistic heuristics that often approach interference problems (i.e., packet loss, delay and energy waste) by increasing power, leading to detrimental results. The scope of this work is to investigate how machine learning may be used to bring wireless nodes to the lowest possible transmission power level and, in turn, to respect the quality requirements of the overall network. Lowering transmission power has benefits in terms of both energy consumption and interference. We propose a protocol of transmission power control through a reinforcement learning process that we have set in a multi-agent system. The agents are independent learners using the same exploration strategy and reward structure, leading to an overall cooperative network. The simulation results show that the system converges to an equilibrium where each node transmits at the minimum power while respecting high packet reception ratio constraints. Consequently, the system benefits from low energy consumption and packet delay.

The Public Key Infrastructure (PKI) is crumbling, partially due to the lack of a strong understanding of how encryption actually works, but also due to weaknesses in its implementation. This paper outlines an Internet storage technique using secret sharing methods which could be used to overcome the problems inherent with PKI, while supporting new types of architectures incorporating such things as automated failover and break-glass data recovery. The paper outlines a novel architecture: SECRET, which supports a robust cloud-based infrastructure with in-built privacy and failover. In order to understand the performance overhead of SECRET, the paper outlines a range of experiments that investigate the overhead of this and other secret share methods.

Insider threats are a considerable problem within cyber security and it is often difficult to detect these threats using signature detection. Increasing machine learning can provide a solution, but these methods often fail to take into account changes of behaviour of users. This work builds on a published method of detecting insider threats and applies Hidden Markov method on a CERT data set (CERT r4.2) and analyses a number of distance vector methods (Damerau–Levenshtein Distance, Cosine Distance, and Jaccard Distance) in order to detect changes of behaviour, which are shown to have success in determining different insider threats.

Cloud computing offers various computational resources via convenient on-demand service provision. Currently, heterogeneous services and cloud resources are usually utilized and managed through diverse service portals. This significantly limits the effectiveness and efficiency for tasks implementation. Fundamentally, it is due to the lack of adequate specifications for service concepts, operations and interfaces from diverse cloud service models and types. This paper proposes a service management operation semantic description framework for comprehensive cloud service operation specification. Relying on ontological modelling techniques, cloud service operations are specified via entity classification, attribute assertion, relationship assertion and annotation assertion. Further, the proposed framework benefits from operation reasoning application. It enables intelligent assistances for multiple operation preparation and remote execution tasks. Based on the approach, a cloud service operation ontology and a unified service access and manipulation system prototype are implemented. Extensive experiments are conducted over different cloud service providers and for distinct service models. Obtained results demonstrate that the approach outperforms existing practices by facilitating reliable and effective service access, manipulation and interaction tasks.