Search

With the advent of mobile crowd sourcing (MCS) systems and its applications, the selection of the right crowd is gaining utmost importance. The increasing variability in the context of MCS tasks makes the selection of not only the capable but also the willing workers crucial for a high task completion rate. Most of the existing MCS selection frameworks rely primarily on reputation-based feedback mechanisms to assess the level of commitment of potential workers. Such frameworks select workers having high reputation scores but without any contextual awareness of the workers, at the time of selection, or the task. This may lead to an unfair selection of workers who will not perform the task. Hence, reputation on its own only gives an approximation of workers’ behaviors since it assumes that workers always behave consistently regardless of the situational context. However, following the concept of cross-situational consistency, where people tend to show similar behavior in similar situations and behave differently in disparate ones, this work proposes a novel recruitment system in MCS based on behavioral profiling. The proposed approach uses machine learning to predict the probability of the workers performing a given task, based on their learned behavioral models. Subsequently, a group-based selection mechanism, based on the genetic algorithm, uses these behavioral models in complementation with a reputation-based model to recruit a group of workers that maximizes the quality of recruitment of the tasks. Simulations based on a real-life dataset show that considering human behavior in varying situations improves the quality of recruitment achieved by the tasks and their completion confidence when compared with a benchmark that relies solely on reputation.

In this paper, we present a smart connected parking lots solution to automatically count and notify drivers about empty parking spots in major cities. As its name implies, the proposed smart IoT system has two operating phases: (i) continuous counting of empty spots in the monitored far-apart parking lots, and (ii) instantaneous driver notification through a lightweight MQTT mechanism. This notification system relies only on information collected from the pre-installed multimedia devices (no other apparatus installation or maintenance such as ground sensors is required). To validate the proper operation of our solution, we have implemented a small-scale version of it and assessed its performance while considering different classical and lightweight deep learning techniques (MobileNetV2, ResNet-50, YOLOv3, SSD-MobileNetV2, Tiny-YOLO, SqueezeDet, and SqueezeDet pruned with $$\ell _1$$ -norm). The experiments have confirmed the proper operation, efficiency, ease of deployment, and ease of extension of our system. They also confirmed that lightweight deep learning solutions are more adequate for small-sized resource-constrained embedded systems. They are more efficient in terms of inference time, size, resource consumption, and yield an accuracy that is close to that of classical solutions.

Cross-device federated learning (CDFL) systems enable fully decentralized training networks whereby each participating device can act as a model-owner and a model-producer. CDFL systems need to ensure fairness, trustworthiness, and high-quality model availability across all the participants in the underlying training networks. This article presents a blockchain-based framework, TrustFed, for CDFL systems to detect the model poisoning attacks, enable fair training settings, and maintain the participating devices’ reputation. TrustFed provides fairness by detecting and removing the attackers from the training distributions. It uses blockchain smart contracts to maintain participating devices’ reputations to compel the participants in bringing active and honest model contributions. We implemented the TrustFed using a Python-simulated federated learning framework, blockchain smart contracts, and statistical outlier detection techniques. We tested it over the large-scale industrial Internet of things dataset and multiple attack models. We found that TrustFed produces better results regarding multiple aspects compared with the conventional baseline approaches.

File carving is a powerful technique for both digital forensics investigations and data recovery. It offers the flexibility to recover data stored on digital media independent of the underlying file system. Thus, it can be used in the cases where we need to recover deleted files or when we have a corrupted, overwritten, or unknown file system. In this paper, we present a novel video file carving (VidCarve) framework to recover and reassemble fragmented video files into playable video files. VidCarve consists of four main components: identification and recovery, weight assignment, reassembly, and file construction. This paper focuses on the weight assignment and reassembly processes where the codec specification parameters of carved fragments were overwritten. We propose several weight assignment techniques to estimate the probability of adjacency between video fragments. Based on these weights, the reassembly algorithm recovers the video files by constructing their correct sequences. We provide experimental results for the proposed techniques of weight assignment and reassembly. We claim that the overall accuracy rate can produce forensically sound evidence and play a critical role in the process of digital evidence recovery in many criminal cases.

The loss or compromise of any safety critical industrial infrastructure can seriously impact the confidentiality, integrity, or delivery of essential services. Research has shown that such threats often come from malicious insiders. To identify these insiders, survey- and electrocardiogram-based approaches have been proposed; however, these approaches cannot effectively detect or predict any malicious insiders. Recently, electroencephalograms (EEGs) have been suggested as a potential alternative to detect these potential threats. Threat detection using EEG would be highly reliable as it overcomes the limitations of the previous methods. This study proposes a proof of concept for a system wherein a model trained using a deep learning algorithm is employed to evaluate EEG signals to detect insider threats. The algorithm can classify different mental states based on four category risk matrices. In particular, it analyses brainwave signals using long short-term memory (LSTM) designed to remember the previous mental states of each insider and compare them with the current brain state for associated risk-level classification. To evaluate the performance of the proposed system, we performed a comparative analysis using logistic regression (LR)—a predictive analysis technique used to describe the relationship between one dependent binary variable and one or more independent variables—on the same dataset. The experimental results obtained suggest that LSTM can achieve a classification accuracy of more than 80% compared to LR, which yields a classification accuracy of approximately 51%.

Traditional assurance solutions for software-based systems rely on static verification techniques and assume continuous availability of trusted third parties. With the advent of cloud computing, these solutions become ineffective since services/applications are flexible, dynamic, and change at runtime, at high rates. Although several assurance approaches have been defined, cloud requires a step-change moving current assurance techniques to fully embrace the cloud peculiarities. In this paper, we provide a rigorous and adaptive assurance technique based on certification, towards the definition of a transparent and trusted cloud ecosystem. It aims to increase the confidence of cloud customers that every piece of the cloud (from its infrastructure to hosted applications) behaves as expected and according to their requirements. We first present a test-based certification scheme proving non-functional properties of cloud-based services. The scheme is driven by non-functional requirements defined by the certification authority and by a model of the service under certification. We then define an automatic approach to verification of consistency between requirements and models, which is at the basis of the chain of trust supported by the certification scheme. We also present a continuous certificate life cycle management process including both certificate issuing and its adaptation to address contextual changes. Finally, we describe our certification framework and an experimental evaluation of its performance, quality, applicability, and practical usability in a real industrial scenario, which considers Engineering Ingegneria Informatica S.p.A. ENGpay online payment system.

Content-centric networking is emerging as a credible alternative to host-centric networking, especially in scenarios of large-scale content distribution and where privacy requirements are crucial. Recently, research on content-centric networking has focused on security aspects and proposed solutions aimed to protect the network from attacks targeting the content delivery protocols. Content-centric networks are based on the strong assumption of being able to access genuine content from genuine nodes, which is however unrealistic and could open the door to disruptive attacks. Network node misbehavior, either due to poisoning attacks or malfunctioning, can act as a persistent threat that goes unnoticed and causes dangerous consequences. In this paper, we propose a novel certification methodology for content-centric networks that improves transparency and increases trustworthiness of the network and its nodes. The proposed approach builds on behavioral analysis and implements a continuous certification process that collects evidence from the network nodes and verifies their non-functional properties using a rule-based inference model. Utility, performance, and soundness of our approach have been experimentally evaluated on a simulated Named Data Networking (NDN) network targeting properties availability, integrity, and non-repudiation.

Emerging technologies are facilitating our daily activities and drive the digital transformation. The Internet of Things (IoT) and 5G communications will provide a wide range of new applications and business opportunities, but with a wide and quite complex attack surface. Several users are not aware of the underlying threats and most of them do not possess the knowledge to set and operate the various digital assets securely. Therefore, cyber security training is becoming mandatory both for simple users and security experts. Cyber ranges constitute an advance training technique where trainees gain hands-on experiences on a safe virtual environment, which can be a realistic digital twin of an actual system. This paper presents the cyber ranges platform THREAT-ARREST. Its design is fully model-driven and offers all modern training features (i.e. emulation, simulation, serious games, and fabricated data). The platform has been evaluated under the smart energy, intelligent transportation, and healthcare domains.

We propose a security methodology for Machine Learning (ML) pipelines, supporting the definition of key security properties of ML assets, the identification of threats to them as well as the selection, test and verification of security controls. Our proposal is based on STRIDE, a widely used approach to threat modeling originally developed by Microsoft. We adapt STRIDE to the Artificial Intelligence domain by taking a security property-driven approach that also provides guidance in selecting the security controls needed to alleviate the identified threats. Our proposal is illustrated via an industrial case study.

This paper presents a new secure communication scheme for an Intelligent Public Transportation System (IPTS). The proposed scheme generates a cryptographic key and aims to share it among the ATSoI’s participant entities securely. It mitigates several cyber-threats such as; DoS attack, replay attack, Man-In-The-Middle Attack, and eavesdropping activities with more potential occurrences in such cooperative systems. Moreover, it relies on a nonce instead of a timestamp to avoid time synchronization problems. Thus, it provides mutual authentication, confidentiality, message integrity, the privacy of the entities’ IDs, and checking the entities’ availability. A formal verification tool (ProVerif) is used to validate the proposed protocol’s security robustness through two main steps. Firstly, coding of the proposed protocol using ProVerif syntax. Secondly, performing the analysis of the attack trace for the failure queries.

Process mining is an emerging discipline that aims to analyze business processes using event data logged by IT systems. In process mining, the focus is on how to effectively and efficiently predict the next process/trace to be activated among all the possible processes/traces that are available in the process schema (usually modeled as a graph). Most of the existing process mining techniques assume that there is a one-to-one mapping between process model activities and the events that are recorded during process execution. However, event logs and process model activities are at different level of granularity. In this paper, we present a machine-learning-based approach to map low-level event logs to high-level activities. With this work, we can bridge the abstraction levels when the high-level labels of the low-level events are not available. The proposed approach consists of two main phases: automatic labeling and machine-learning-based classification. In automatic labeling, a modified k-prototypes clustering approach has been used in order to obtain the labeled examples. Then, in the second phase, we trained different ML classifiers using the obtained labeled examples. Since, in real-life applications and systems, business processes are expressed according to the Business Process Model and Notation (BPMN) format, we improve our proposed framework by means of an innovative, flexible BPMN model translation methodology that acts at the first phase. We demonstrate the applicability of our proposed framework using two case studies with real-world event logs, and provide its experimental assessment and analysis.

Early detection of traffic events is essential for informing Traffic Centers, drivers and intelligent vehicles about incoming dangers or congestion. In this study, a framework based on the shapelets technique for automated incident detection is proposed. Using the shapelets time series classification technique, sub sequences of the time series are generated, which represent patterns of incidents/congestion as well as regular traffic situations. Using such shapelets, our framework is able to detect whether an incident is occurring or not. Application of this approach to real-life data of the London Orbital Motorway (M25) proved that our approach not only has the potential to improve the performance of the classification in terms of false alarm rates or/and accuracy but also provides the human expert with insightful interpretation of the decision made by the event detectors.

Multi-agent systems are automated form of software technology to enhance many applications in our life. However, this technology does not come along with embedded security features which hindering its widespread usage in commercial systems such as those that depend on location-based services. This paper aims to design, develop, test and evaluate an efficient security protocol for the multi-agent system to support the secrecy of user location. At first, we have developed a new architectural approach, inspired by the well-known Kerberos protocol, that can provide a secure service for the end users. It offers the most important security requirements in this field, namely; mutual authentication, confidentiality, integrity, and authorization. The proposed security protocol so-called Multi-Agent Security using Enhanced Kerberos has been verified and validated using a formal verification tool called ProVerif. Also, we provide a comparison with the original Kerberos protocol in terms of efficiency, which tilts the balance to our protocol.

The diffusion of service-based and cloud-based systems has created a scenario where software is often made available as services, offered as commodities over corporate networks or the global net. This scenario supports the definition of business processes as composite services, which are implemented via either static or runtime composition of offerings provided by different suppliers. Fast and accurate evaluation of services’ security properties becomes then a fundamental requirement and is nowadays part of the software development process. In this article, we show how the verification of security properties of composite services can be handled by test-based security certification and built to be effective and efficient in dynamic composition scenarios. Our approach builds on existing security certification schemes for monolithic services and extends them towards service compositions. It virtually certifies composite services, starting from certificates awarded to the component services. We describe three heuristic algorithms for generating runtime test-based evidence of the composite service holding the properties. These algorithms are compared with the corresponding exhaustive algorithm to evaluate their quality and performance. We also evaluate the proposed approach in a real-world industrial scenario, which considers ENGpay online payment system of Engineering Ingegneria Informatica S.p.A. The proposed industrial evaluation presents the utility and generality of the proposed approach by showing how certification results can be used as a basis to establish compliance to Payment Card Industry Data Security Standard.

Encoding methods affect the performance of process mining tasks but little work in the literature focused on quantifying their impact. In this paper, we compare 10 different encoding methods from three different families (trace replay and alignment, graph embeddings, and word embeddings) using measures to evaluate the overlaps in the feature space, the accuracy obtained, and the computational resources (time) consumed with a classification task. Across hundreds of event logs representing four variations of five scenarios and five anomalies, it was possible to identify the edge2vec method as the most accurate and effective in reducing class overlapping in the feature space.

Distributed Ledgers (DLs) like Blockchain have become a popular technique to build collective trust in digital records. The rationale is that any agent wishing to append a block to a DL needs to provide proof of holding some property/asset or having performed some costly activity. Thus, “poisoning” a DL with spurious content requires much more effort than poisoning a conventional shared data structure. Based on this idea, DLs are now being deployed as community stores of trusted transaction records, reputation values and even of trustworthy training data for Machine Learning (ML) models. Certainly, when injecting spurious or hostile content in a DL, a rational attacker has to consider whether the damageδcaused by a spurious blockBis worth the effortϵneeded to appendBto the DL; but practical experience has shown that being certain to disrupt a DL-supported application may be a powerful motivator for digital vandalism even when it is costly. In this paper, we put out an alternative idea: Reciprocally Useful Work (RUW), a novel DL update mechanism where any agent wishing to add a blockBto the ledger must first perform an activity that will improve the utility for the DL-supported application of some other agent's blockB′. We discuss in detail how to apply RUW to DLs storing training data for Machine Learning (ML) models, in order to show that reciprocity can play the role of a direct compensation of the potential disruption, which is measurable in term of the performance of the ML model trained on the DL content.

The opening of the unlicensed radio spectrum creates new opportunities and new challenges for communication technology that can be faced by Machine Learning techniques. In this work, we discuss the potential benefits and the challenges with reference to the recent research developments in this area. Applications go from channel estimation to Signal quality control, and from signal classification to action control. We survey Machine learning and Deep Learning algorithms with possible radio applications and highlight the corresponding challenges.

Screening baggage against potential threats has become one of the prime aviation security concerns all over the world, where manual detection of prohibited items is a time-consuming and hectic process. Many researchers have developed autonomous systems to recognize baggage threats using security X-ray scans. However, all of these frameworks are vulnerable against screening cluttered and concealed contraband items. Furthermore, to the best of our knowledge, no framework possesses the capacity to recognize baggage threats across multiple scanner specifications without an explicit retraining process. To overcome this, we present a novel meta-transfer learning-driven tensor-shot detector that decomposes the candidate scan into dual-energy tensors and employs a meta-one-shot classification backbone to recognize and localize the cluttered baggage threats. In addition, the proposed detection framework can be well-generalized to multiple scanner specifications due to its capacity to generate object proposals from the unified tensor maps rather than diversified raw scans. We have rigorously evaluated the proposed tensor-shot detector on the publicly available SIXray and GDXray datasets (containing a cumulative of 1,067,381 grayscale and colored baggage X-ray scans). On the SIXray dataset, the proposed framework achieved a mean average precision (mAP) of 0.6457, and on the GDXray dataset, it achieved the precision and F1 score of 0.9441 and 0.9598, respectively. Furthermore, it outperforms state-of-the-art frameworks by 8.03% in terms of mAP, 1.49% in terms of precision, and 0.573% in terms of F1 on the SIXray and GDXray dataset, respectively.

The Cybersecurity of organization is becoming quite alarming especially in National Critical Infrastructure (NCI) as to protect their sensitive information and other valuable assets. A lot of focus has been done in managing outside attacks of data in organizations. Including Cyber-Physical System (CPS), which is a complex mixture of physical and computer components typically monitored or controlled by computer-based algorithms. However, there has been need to safeguard insider’s behavior of breaching the expected code of conduct in maintaining the critical organizations’ data and assets. The technology is highly reliable as it cannot be easily fabricated. The analysis of the brainwave signal will be performed using an advanced deep learning algorithm called Long Short Term Memory Recurrent Neural Network (LSTM-RNN) classifier which will remember a previous mental states of each insider and compare it with new present brain state to classify the risk level associated. The brain wave is also analysed with Adaptive Machine learning Algorithm which combines several weak learners which is decision trees, to form a single strong learner. In this study, our targets is to increase the security of NCI by providing a significant proof of concept system to detect insider threats through fitness evaluation using EEG signals that gets analyzed using deep learning algorithm which will classify different mental states into four categories risk matrix.

In this paper, we propose a web-based microservice for programming FPGAs remotely in the cloud without requiring additional hardware or third party software. Docker and Docker-compose are used to implement a scalable, secure environment for FPGA design and operation. The paper further describes in detail the architectural design, user interface, tool flow, and hardware back-end of the FPGA cloud service. The Docker files are made publicly available at GitHub.

Cyber security is always a main concern for critical infrastructures and nation-wide safety and sustainability. Thus, advanced cyber ranges and security training is becoming imperative for the involved organizations. This paper presets a cyber security training platform, called THREAT-ARREST. The various platform modules can analyze an organization’s system, identify the most critical threats, and tailor a training program to its personnel needs. Then, different training programmes are created based on the trainee types (i.e. administrator, simple operator, etc.), providing several teaching procedures and accomplishing diverse learning goals. One of the main novelties of THREAT-ARREST is the modelling of these programmes along with the runtime monitoring, management, and evaluation operations. The platform is generic. Nevertheless, its applicability in a smart energy case study is detailed.

The massive adoption of Machine Learning (ML) has deeply changed the internal structure, the design and the operation of software systems. ML has shifted the focus from code to data, especially in application areas where it is easier to collect samples that embody correct solutions to individual instances of a problem, than to design and code a deterministic algorithm solving it for all instances. There is an increasing awareness of the need to verify key non-functional properties of ML-based software applications like fairness and privacy. However, the traditional approach trying to verify these properties by code inspection is pointless, since ML models’ behavior mostly depends on the data and parameters used to train them. Classic software certification techniques cannot solve the issue as well. The Artificial Intelligence (AI) community has been working on the idea of preventing undesired behavior by controlling a priori the ML models’ training sets and parameters. In this paper, we take a different, online approach to ML verification, where novel behavioral monitoring techniques based on statistical testing are used to support a dynamic certification framework enforcing the desired properties on black-box ML models in operation. Our aim is to deliver a novel framework suitable for practical certification of distributed ML-powered applications in heavily regulated domains like transport, energy, healthcare, even when the certifying authority is not privy to the model training. To achieve this goal, we rely on three key ideas:(i)use test suites to define desired non-functional properties of ML models,(ii)Use statistical monitoring of ML models’ behavior at inference time to check that the desired behavioral properties are achieved, and(iii)compose monitors’ outcome within dynamic, virtual certificates for composite software applications.

In the automatic credit card transaction classification there are two phases: in the Real-Time (RT) phase the system decides quickly, based on the bare transaction information, whether to authorize the transaction; in the subsequent Near-Real-Time (NRT) phase, the system enacts a slower ex-post evaluation, based on a larger information context. The classification rules in the NRT phase trigger alerts on suspicious transactions, which are transferred to human investigators for final assessment. The management criteria used to select the rules, to be kept operational in the NRT pool, are traditionally based mostly on the performance of individual rules, considered in isolation; this approach disregards the non-additivity of the rules (aggregating rules with high individual precision does not necessarily make a high-precision pool). In this work, we propose to apply, to the rule selection for the NRT phase, an approach which assigns a normalized score to the individual rule, quantifying the rule influence on the overall performance of the pool. As a score we propose to use a power-index developed within Coalitional Game Theory, the Shapley Value (SV), summarizing the performance in collaboration. Such score has two main applications: (1) it can be used, within the periodic rule assessment process, to support the decision of whether to keep or drop the rule from the pool; (2) it can be used to select the k top-ranked rules, so as to work with a more compact rule set. Using real-world credit card fraud data containing approximately 300 rules and 3 × 1 0 5 transactions records, we show that: (1) this score fares better – in granting the performance of the pool – than the one assessing the rules in isolation; (2) that the same performance of the whole pool can be achieved keeping only one tenth of the rules — the top-k SV-ranked rules. We observe that the latter application can be reframed in terms of Feature Selection (FS) task for a classifier: we show that our approach is comparable w.r.t benchmark FS algorithms, but argue that it presents an advantage for the management, consisting in the assignment of a normalized score to the individual rule. This is not the case for most FS algorithms, which only focus in yielding a high-performance feature-set solution.

Assuring anomaly-free business process executions is a key challenge for many organizations. Traditional techniques address this challenge using prior knowledge about anomalous cases that is seldom available in real-life. In this work, we propose the usage of word2vec encoding and One-Class Classification algorithms to detect anomalies by relying on normal behavior only. We investigated 6 different types of anomalies over 38 real and synthetics event logs, comparing the predictive performance of Support Vector Machine, One-Class Support Vector Machine, and Local Outlier Factor. Results show that our technique is viable for real-life scenarios, overcoming traditional machine learning for a wide variety of settings where only the normal behavior can be labeled.

Cyber ranges for training in threat scenarios are nowadays highly demanded in order to improve people ability to detect vulnerabilities and to react to cyber-threats. Among the other components, scenarios deployment requires a modeling language to express the (software and hardware) architecture of the underlying system, and an emulation platform.

Cloud computing proposes a paradigm shift where resources and services are allocated, provisioned, and accessed at runtime and on demand. New business opportunities emerge for service providers and their customers, at a price of an increased uncertainty on how their data are managed and their applications operate once stored/deployed in the cloud. This scenario calls for assurance solutions that formally assess the working of the cloud and its services/processes. Current assurance techniques increasingly rely on model-based verification, but fall short to provide sound checks on the validity and correctness of their assessment over time. The approach in this paper aims to close this gap catching unexpected behaviors emerging when a verified service is deployed in the target cloud. We focus on certification-based assurance techniques, which provide customers with verifiable and formal evidence on the behavior of cloud services/processes. We present a trustworthy cloud certification scheme based on the continuous verification of model correctness against real and synthetic service execution traces, according to time, probability, and configuration constraints, and attack flows. We test the effectiveness of our approach in a real scenario involving ATOS SA eHealth application deployed on top of open source IaaS OpenStack.

The Confidentiality-Availability-Integrity (CIA) triad is a time-honored warhorse of security analysis. Qualitative assessment of security requirements based on the CIA triad is an important step in many standard procedures for selecting and deploying security controls. However, little attention has been devoted to monitoring how the CIA triad is used in practice, and how reliable are experts assessment that make use of it. In this paper, a panel of 20 security experts was asked to use the CIA triad in 45 practical security scenarios involving UAV-to-ground transmission of control and information data. The experts responses were analyzed using Fleiss kappa, a specific statistics test for inter-rater reliability. Results show agreement to be low (from 13.8% to 20.1% depending on the scenario), but higher on scenarios where the experts majority estimates tight security to be needed. Low number of polled experts is found to affect inter-rater reliability negatively, however, increasing this number beyond ten does not provide additional reliability. A bias to give a specific rate could be identified with 14 out of the 20 experts. The six unbiased experts showed a higher inter-rater agreement. These findings suggest that (i) there is no guaranteed safety in numbers for recruiting security expert panels and (ii) expert selection for security rating processes should include verification of agreement level on toy problems for all subsets of the panel to highlight subsets showing high inter-rater agreement.

© 2017 Elsevier Ltd In today's competitive world, service providers need to be customer-focused and proactive in their marketing strategies to create consumer awareness of their services. Cloud computing provides an open and ubiquitous computing feature in which a large random number of consumers can interact with providers and request services. In such an environment, there is a need for intelligent and efficient methods that increase confidence in the successful achievement of business requirements. One such method is the Service Level Agreement (SLA), which is comprised of service objectives, business terms, service relations, obligations and the possible action to be taken in the case of SLA violation. Most of the emphasis in the literature has, until now, been on the formation of meaningful SLAs by service consumers, through which their requirements will be met. However, in an increasingly competitive market based on the cloud environment, service providers too need a framework that will form a viable SLA, predict possible SLA violations before they occur, and generate early warning alarms that flag a potential lack of resources. This is because when a provider and a consumer commit to an SLA, the service provider is bound to reserve the agreed amount of resources for the entire period of that agreement – whether the consumer uses them or not. It is therefore very important for cloud providers to accurately predict the likely resource usage for a particular consumer and to formulate an appropriate SLA before finalizing an agreement. This problem is more important for a small to medium cloud service provider which has limited resources that must be utilized in the best possible way to generate maximum revenue. A viable SLA in cloud computing is one that intelligently helps the service provider to determine the amount of resources to offer to a requesting consumer, and there are number of studies on SLA management in the literature. The aim of this paper is two-fold. First, it presents a comprehensive overview of existing state-of-the-art SLA management approaches in cloud computing, and their features and shortcomings in creating viable SLAs from the service provider's viewpoint. From a thorough analysis, we observe that the lack of a viable SLA management framework renders a service provider unable to make wise decisions in forming an SLA, which could lead to service violations and violation penalties. To fill this gap, our second contribution is the proposal of the Optimized Personalized Viable SLA (OPV-SLA) framework which assists a service provider to form a viable SLA and start managing SLA violation before an SLA is formed and executed. The framework also assists a service provider to make an optimal decision in service formation and allocate the appropriate amount of marginal resources. We demonstrate the applicability of our framework in forming viable SLAs through experiments. From the evaluative results, we observe that our framework helps a service provider to form viable SLAs and later to manage them to effectively minimize possible service violation and penalties.

Despite its immense benefits in terms of flexibility, resource consumption, and simplified management, cloud computing raises several concerns due to lack of trust and transparency. Like all computing paradigms based on outsourcing, the use of cloud computing is largely a matter of trust. There is an increasing pressure by cloud customers for solutions that would increase their confidence that a cloud service/application is behaving in a secure and correct manner. Cloud assurance techniques, developed to assess the trustworthiness of cloud services, can play a major role in building trust. In this paper, we start from the assumption that an opaque cloud does not fit security, and present a reliable evidence collection process and infrastructure extending existing assurance techniques towards the definition of a trustworthy cloud. The proposed process and infrastructure are applied to a case study on cloud certification showing their utility.

Mobile agents are smart programs that migrate from one platform to another to perform the user task. Mobile agents offer flexibility and performance enhancements to systems and service real-time applications. However, security in mobile agent systems is a great concern. In this paper, we propose a novel Broadcast based Secure Mobile Agent Protocol (BROSMAP) for distributed service applications that provides mutual authentication, authorization, accountability, nonrepudiation, integrity, and confidentiality. The proposed system also provides protection from man in the middle, replay, repudiation, and modification attacks. We proved the efficiency of the proposed protocol through formal verification with Scyther verification tool.

Process mining uses business event logs to understand the flow of activities, to identify anomalous cases and to enhance processes. Today, real-time process mining tools mainly deal with a single task at a time (process discovery, conformance checking, process enhancement or concept change detection). In this paper, we introduce an underlined layer overlapping with multiple online process mining tasks to smooth their integration. Following a case clustering approach, based on trace and time analysis, our proposal supports simultaneously?: process discovery, conformance checking, and concept drift detection. We evaluated our approach and compared it with other techniques using both real-life and synthetic data, obtaining promising results.

The Internet of Things (IoT) smart devices enable many applications, such as smart energy, traffic control, water management and environmental sensing in a smart city environment. It provides the end users (individuals and enterprises) the convenience and improved computational and communication capabilities between two devices. Yet the IoT technology is accompanied by security challenges that must be addressed in order to ensure the security and privacy of the network among multiple devices. This is done by using schemes and mechanisms which accommodate the heterogeneous nature of the IoT devices environment, and the resource-constrained nature of some of its components. There have been many efforts to develop authentication protocols such as TESLA protocol. TESLA is a source authentication protocol for the broadcast network. TESLA addresses these challenges, yet it suffers from limitations to its utility and security for IoT environments. The proposed protocol-based TESLA is designed to provide lower computation against a DoS attack. The proposed scheme is using a combination of Multilevel-µTESLA and Inf-TESLA protocols. The benefit of integration between two protocols is to reduce the delay between the sender and the receiver, allows continues authenticating of the message and increasing resistance to DoS attacks. We analysis and discuss in details out proposed protocol TLI- µTESLA.

This paper deals with the security matters in automotive by using the Blockchain technology and an innovative thinking skill which has been applied to develop the new prototype design from the initial idea. The Blockchain Governance Game and Fog Computing are adopted to build the new highly secure decentralized service architecture. These relatively new technologies make possible to design the Blockchain based on the automotive security. Although the paper is condensed and does not contain the details, it will be the good guideline for the direction of future research. The thinking skill called Systematic Innovation is the core to solve this problems in the proper Blockchain security network design and well demonstrated in this paper.

Nowadays, we see vehicles with different automation levels; from zero automation to fully automation vehicles. Leading car manufacturers such as Audi, Volkswagen, TESLA along with Google are becoming the lead in autonomous vehicles industry. Autonomous vehicles can have over 100 million lines of code in their modules with large number of messages being exchanged among vehicles. These vehicles have multiple connection points to the Internet. Bad code, misconfiguration and Internet exposure makes these vehicles vulnerable to different kind of malicious attacks. This paper presents a conceptual autonomous vehicle model to better understand the attack surface on autonomous vehicles. In addition, it presents real life scenarios of successful attacks on different models of vehicles. This paper introduces a conceptual model for autonomous vehicles as initial work for threat modeling of autonomous vehicles. In addition, it highlights some of the cyber security attacks on autonomous vehicles.

In this paper, we developed an online auction system based on Ethereum smart contracts. A smart contract is executable code that runs on top of the blockchain to facilitate, execute and enforce an agreement between untrusted parties without the involvement of a trusted third party. A decentralised auction guarantees greater transparency and avoids cheating auctioneers. Since in Ethereum computation is expensive as transactions are executed and verified by all the nodes on Ethereum network, we analysed our implementation in terms of cost and time efficiency, obtaining promising results.

Real-life event logs are typically much less structured and more complex than the predefined business activities they refer to. Most of the existing process mining techniques assume that there is a one-to-one mapping between process model activities and events recorded during process execution. Unfortunately, event logs and process model activities are defined at different levels of granularity. The challenges posed by this discrepancy can be addressed by means of log-lifting. In this work we develop a machine-learning-based framework aimed at bridging the abstraction level gap between logs and process models. The proposed framework operates of two main phases: log segmentation and machine-learning-based classification. The purpose of the segmentation phase is to identify the potential segment separators in a flow of low-level events, in which each segment corresponds to an unknown high-level activity. For this, we propose a segmentation algorithm based on maximum likelihood with n-gram analysis. In the second phase, event segments are mapped into their corresponding high-level activities using a supervised machine learning technique. Several machine learning classification methods are explored including ANNs, SVMs, and random forest. We demonstrate the applicability of our framework using a real-life event log provided by the SAP company. The results obtained show that a machine learning approach based on the random forest algorithm outperforms the other methods with an accuracy of 96.4%. The testing time was found to be around 0.01s, which makes the algorithm a good candidate for real-time deployment scenarios.

This paper introduces a framework for how to appropriately adopt and adjust Machine Learning (ML) techniques used to construct Electrocardiogram (ECG) based biometric authentication schemes. The proposed framework can help investigators and developers on ECG based biometric authentication mechanisms define the boundaries of required datasets and get training data with good quality. To determine the boundaries of datasets, use case analysis is adopted. Based on various application scenarios on ECG based authentication, three distinct use cases (or authentication categories) are developed. With more qualified training data given to corresponding machine learning schemes, the precision on ML-based ECG biometric authentication mechanisms is increased in consequence. ECG time slicing technique with the R-peak anchoring is utilized in this framework to acquire ML training data with good quality. In the proposed framework four new measure metrics are introduced to evaluate the quality of ML training and testing data. In addition, a Matlab toolbox, containing all proposed mechanisms, metrics and sample data with demonstrations using various ML techniques, is developed and made publicly available for further investigation. For developing ML-based ECG biometric authentication, the proposed framework can guide researchers to prepare the proper ML setups and the ML training datasets along with three identified user case scenarios. For researchers adopting ML techniques to design new schemes in other research domains, the proposed framework is still useful for generating ML-based training and testing datasets with good quality and utilizing new measure metrics., Comment: This paper has been published in the IEEE Access

Electronic voting is one of the most challenging cryptographic problems, since the developed system should guarantee strong and sometimes contrasting security properties. Blockchain technology can be of help providing for free some important guarantees such as the immutability and transparency of the votes using a distributed ledger. In this paper we propose a blockchain based e-voting system, which is lightweight, since it does not rely on strong cryptographic primitives, and efficient, since it improves over previous proposals in terms of both execution time and associated cost for the required infrastructure. We provide the description of a proof of concept system together with the cost and performance analysis.

The widespread diffusion of ubiquitous and smart devices is radically changing the environment surrounding the users and brought to the definition of a new ecosystem called Internet of Things (IoT). Users are connected anywhere anytime, and can continuously monitor and interact with the external environment. While devices are becoming more and more powerful and efficient (e.g., using protocols like zigbee, LTE, 5G), their security is still in its infancy. Such devices, as well as the edge network providing connectivity, become the target of security attacks without their owners being aware of the risks they are exposed to. In this paper we present IoT Security Checker, a solution for IoT security assessment coping with the most relevant IoT security issues. We also provide some preliminary analysis showing how the IoT Security Checker can be used for verifying the security of an IoT system.

The stateful public-key encryption scheme proposed by Bellare, Kohno and Shoup in 2006 significantly improves the efficiency of the encryption operation of ElGamal-like public-key encryption schemes. The basic idea of the stateful public-key encryption scheme is to reuse some random parameters in the encryption algorithm by maintaining a state to save the current random variable, which is used to generate the random parameters. This turns out to be highly effective in reducing heavy computations like exponentiation operations in the encryption process. Since its invention, several variants and extensions of the stateful public key encryption scheme have been proposed. This chapter provides an extensive survey of original stateful public-key encryption scheme and their extensions. Also, possible applications of stateful encryption schemes for building up lightweight asymmetric encryption primitives for the Internet of things (IoT) environment are discussed.

Cybersecurity is the second emergency in Europe just after the climate changes. Everyday most of the small, medium and big enterprises are under attack. This scenario requires, on one side, new security solutions protecting ICT systems against misbehaviors/malicious attacks and, on the other side, a continuous assurance process evaluating the system robustness against new threats. In this paper we present Moon Cloud, a Cloud PaaS solution providing customizable assurance based on compliance for ICT systems, including public and private cloud systems and IoT environments. We also present a concrete security assessment carried out in a real scenario.

Managing information quality has become important in cyber-physical systems dealing with big data. In this regard, different models have been proposed, mainly in flat peer-to-peer networks, in which exchanging information efficiently is a key aspect due to scarce resources. However, little research has been conducted on information quality metrics for cyber-physical scenarios. In this paper, we propose an information quality metric and show its application to an information fusion model. It is a “model-oriented quality metric” since it allows non-predefined variants on its configuration depending on the application domain. The model was tested on several simulations using open datasets. The results obtained in the performance of the model confirm the validity of the information quality metric, proposed in this paper, on which the model is based. The model may have a wide variety of applications such as mobile recommendation or decision making in critical environments (emergencies, war, and so on).

Accessing offshore cloud or remote computers via the Internet has become popular. However, in some countries, governmental agencies or organizations may suddenly block international communication links. Temporary blocks or more permanent barriers as China’s Golden Shield (GS) are known to introduce significant network latency or Quality of Service (QoS) degradation that may hinder offshore business. To avoid this, we propose a network virtualization method and tool based on recognizing step-wise increases of Round Trip Time (RTT) that are caused by intentionally blocking international communication links. Our method predicts and avoids intentional blocks or restriction as follows: (1) the onset of the restriction is predicted or recognized in the early stage, using differential calculus of RTT, (2) immediate switching to Virtual Private Network (VPN) bypass is automatically performed before serious increase in network latency is experienced by users. (3) Asymmetrically, non-differential threshold value and elapsed time are used to determine the end of restriction and switch back to the open (ordinary or public) Internet. Our method is validated by quantitative analysis on latency data corresponding to real GS blocks. Furthermore, 2–3 years’ successful usage of our tool in more than fifty offices confirms our method’s stable and dependable communication as well as its reasonable cost.

Public cloud users are increasingly interested in securing their data and network traffic by using outsourced encryption or decryption services (cryptography as a service). However, many concerns have been raised about trusting the outsourced service's memory with sensitive information like the user's cryptographic keys. This survey reviews techniques for securing data owners' cryptographic keys in a public cloud, preserving them from any inquisitive actions on the part of cotenants (fellow data owners, domain administrators, or other third parties) and the cloud provider itself. The aim is to provide readers with a comparative in-depth analysis of available techniques and point to open research problems.

The business potential of big data is leading to a data-driven economy , where low-cost and low-latency data analysis represents a major competitive advantage. The research community has proposed many technological solutions for big data, such as NoSQL databases, which are difficult to evaluate and compare via standard IT procurement procedures. In addition, lack of competences in big data domains make procurement of big data solutions a tedious and uncertain process, which might impair the success of a business. In this paper, we present a score-based benchmark for distributed databases, which supports adopters in selecting a solution that fits their needs. The proposed benchmark is independent from the configurations of the specific database and deployment environment, requires low effort on the part of end users, is extensible and can be applied to both SQL and NoSQL databases, can be used to evaluate databases according to different properties (e.g., performance, consistency), and can be integrated with existing benchmarks to reduce the burden of their execution. We experimentally evaluate our methodology to validate its effectiveness.

Inner-product encryption (IPE) is a well-known functional encryption primitive that allows decryption when the inner-product of the attribute vectors, upon which the encrypted data and the decryption key depend, is equal to zero. Using IPE, it is possible to define fine-grained access policies over encrypted data whose enforcement can be outsourced to the cloud where the data are stored. However, current IPE schemes do not support efficient access policy changes. In this paper, we propose an efficient inner-product proxy re-encryption (E-IPPRE) scheme that provides the proxy server with a transformation key, with which a ciphertext associated with an attribute vector can be transformed to a new ciphertext associated with a different attribute vector, providing a policy update mechanism with a performance suitable for many practical applications. We experimentally assess the efficiency of our protocol and show that it is selective attribute-secure against chosen-plaintext attacks in the standard model under the Asymmetric Decisional Bilinear Diffie-Hellman assumption.

Automatic traffic incident detection from sensors data is a long studied topic that has been advancing with the introduction of new algorithms and recently from machine learning. While the traffic incidents detection problem can be treated as a time series classification task, there are not many attempts in this area and further investigations should be conducted. Recently, the Shapelet Transform algorithm has been proposed as a promising solution for time series classification. In this paper, we study the usage of Shapelet Transform in the field of traffic event detection. We first prove the applicability of the algorithm for automatic incident detection where it provides comparable performance to other techniques. In addition, we show how the Shapelet Transform algorithm can help in improving the detection by guiding the expert input in a cognitive approach. We test our approach using a real data set produced from road sensors of the M25 London Circular road. Results show an improvement comparing to using Shapelet Transform solely.