Search

Over the years, pervasive computing and communication technologies have enabled the emergence of new computing paradigms that have gained importance across a wide spectrum of domains. The three most notable that have witnessed significant advancements and have a solid track record of exponential growth in diverse applications are the Internet of Things (IoT), Cloud, and Mobile Computing. The ubiquity of these paradigms, their expandability, and applicability in different problem spaces have made them invaluable in modern computing solutions. Security becomes a real concern, especially when it comes to the development of applications in these environments, as numerous security issues may arise from potential design flaws. Secure application development across these three technologies can only be achieved when applications and systems are designed and developed with security in mind. This will improve the quality of the solutions and ensure that vulnerabilities are identified. It will also help in defining countermeasures against cyberattacks or mitigate the effects of potential threats to the systems. This article surveys existing approaches, tools, and techniques for attack and system modeling applicable to IoT, Cloud computing, and Mobile Computing. It also evaluates the strengths and limitations of the reviewed approaches and tools, from which it highlights the main existing challenges and open issues in the area.

The past couple of years have marked continued growth in the applications and services of the Internet of Things (IoT). This has attracted the attention of new operators as well as institutional, corporate, and private investors in every sector of the economy, and as a result, new businesses are springing up rapidly. These include many start-up companies that are producing various kinds of useful IoT devices and Smart Applications (smart apps). While this can be seen as a boost for innovation in the IoT, some of these companies produce IoT devices and smart apps with security vulnerabilities. In this paper, we propose the IoT Hardware Platform Security Advisor (IoT-HarPSecA), a security framework intended to provide support to such IoT producers. IoT-HarPSecA offers three functionality features, namely security requirement elicitation, security best practice guidelines for secure development, and above all, a feature that recommends specific LightWeight Cryptographic Algorithms (LWCAs) for both software and hardware implementations. Accordingly, IoT-HarPSecA is composed of three main components, namely Security Requirements Elicitation (SRE) component, Security Best Practice Guidelines (SBPG) component, and LightWeight Cryptographic Algorithms Recommendation (LWCAR) component, each of them servicing one of the aforementioned features. We implement a command-line tool in C++ to serve as an interface between users and the proposed framework. IoT-HarPSecA can be employed during the early stages of IoT systems design, and it can also be used to facilitate the implementation of security in existing IoT systems. This paper presents a detailed description, design, and implementation of the SRE, SBPG, and LWCAR components of the proposed framework. Using real-world practical scenarios, we show how IoT-HarPSecA can be used to elicit security requirements and recommend appropriate LWCAs based on user inputs. While a full performance evaluation of the SRE and SBPG components is beyond the scope of this paper, we present a detailed performance evaluation of the LWCAR component, which shows that IoT-HarPSecA can serve as a roadmap for secure IoT development.

In recent years, the Internet of Things (IoT) security and privacy have been receiving growing attention among researchers in both academia and industry, resulting in various innovative IoT security and privacy solutions. While research approaches and findings may vary considerably across different studies, the consensus is that a key prerequisite for addressing IoT security and privacy issues is to build security and privacy protection into IoT devices and Smart Applications (smart apps) from the onset. To this end, the IoT Hardware Platform Security Advisor (IoT-HarPSecA) framework was proposed to foster the design and development of secure IoT devices and smart apps. This paper presents preliminary results of the functionality tests conducted on two of the three component tools of the IoT-HarPSecA framework, namely the Security Requirements Elicitation (SRE) component and Security Best Practice Guidelines (SBPG) component tools. It also briefly evaluates the performance of the SRE component and SBPG component tools.

The limitations of traditional classification methods based on port number and payload inspection to classify encrypted or obfuscated Internet traffic have led to significant research efforts focusing on classification approaches based on Machine Learning techniques using Transport Layer statistical features. However, these approaches also have their own limitations, leading to the investigation of alternative approaches, including statistics-based approaches. Statistical approaches can be an alternative to machine learning ones because statistical approaches can operate in real time and do not need to be retrained each time a new type of traffic appears. In this article, we propose two statistical classifiers for encrypted Internet traffic based on Kullback-Leibler divergence and Euclidean distance, which are computed using the flow and packet size obtained from some of the protocols used by applications. In our experiments, we evaluate the two proposed classifiers and compare them with a classifier based on Support Vector Machine (SVM). During our study, we were able to classify the traffic by using few features without compromising the performance of the classifier. The experimental results illustrate the effectiveness of our models used for traffic classification.

Submitted by (prmi@ubi.pt) on 2020-02-09T16:28:58Z No. of bitstreams: 1 Filho-Elsevier-PDC2018.pdf: 3621188 bytes, checksum: d928aef777df70621891c5e7c8dd3238 (MD5) Approved for entry into archive by Pessoa (pfep@ubi.pt) on 2020-02-12T11:55:13Z (GMT) No. of bitstreams: 1 Filho-Elsevier-PDC2018.pdf: 3621188 bytes, checksum: d928aef777df70621891c5e7c8dd3238 (MD5) Approved for entry into archive by Pessoa (pfep@ubi.pt) on 2020-02-12T11:59:51Z (GMT) No. of bitstreams: 1 Filho-Elsevier-PDC2018.pdf: 3621188 bytes, checksum: d928aef777df70621891c5e7c8dd3238 (MD5) Made available in DSpace on 2020-02-12T11:59:51Z (GMT). No. of bitstreams: 1 Filho-Elsevier-PDC2018.pdf: 3621188 bytes, checksum: d928aef777df70621891c5e7c8dd3238 (MD5) Previous issue date: 2018-01 info:eu-repo/semantics/publishedVersion

Representing, manipulating, and inferring trust from the user point of view certainly is a grand challenge in virtual worlds, including online games. When someone meets an unknown individual, the question is “Can I trust him/her or not?” This requires the user to have access to a representation of trust about others, as well as a set of operators to undertake inference about the trustability of other users/players. In this paper, we employ a trust representation generated from in-world data in order to feed individual trust decisions. To achieve that purpose, we assume that such a representation of trust already exists; in fact, it was proposed in another paper of ours. Thus, the focus here is on the trust mechanisms required to infer trustability of other users/players. More specifically, we use an individual trust representation deployed as a trust network as base to the inference mechanism that employs two subjective logic operators (consensus and discount) to automatically derive trust decisions. The proposed trust inference system has been validated through OpenSimulator scenarios, which has led to a 5% increase on trustability of avatars in relation to the reference scenario (without trust).

The applications of Internet of Things (IoT) and associated technologies have been spreading rapidly across a wide range of domains, including environmental monitoring, home automation, and supply chain, having a significant bearing on the social and economic well-being of humans as well as enhancing environmental sustainability. In recent years, however, there have been several data breaches and other security and privacy incidents involving IoT devices, which have attracted significant attention from the research community in both academia and industry. This has resulted in a surge of proposals put forward by many researchers, including IoT blockchain-based security solutions, IoT intrusion detection systems, IoT authentication systems, and IoT security analytics. While these proposals are aimed at addressing various IoT security and privacy-related issues, many of these solutions arguably seem not to focus on helping designers and developers with little or no security expertise in start-up companies to produce secure IoT systems. To this end, the IoT Hardware Platform Security Advisor (IoT-HarPSecA) framework was proposed to foster the design and implementation of secure IoT systems. In this paper, we present the performance and usability evaluation of the Security Requirements Elicitation (SRE) and Security Best Practice Guidelines (SBPG) component tools of IoT-HarPSecA, which are two of the three component tools of the security framework. Results show that the two components of the IoT-HarPSecA framework can facilitate the development of secure IoT systems and that the SRE and SBPG tools are easy to use.

Context In large software projects bug fixing is a time-bound, time-consuming, mind-numbing, and challenging task that requires a collaborative effort with multiple developers, separated geographically. Objective The objective of this paper is to propose a decentralized automated bug assignment approach to improve the quality of bug assignments to minimize backlogs and overall bug fixing time. Method To the best of our knowledge, the literature lacks in studies focusing on how to increase software developer's motivation for efficient bug resolution. It is a novel decentralized blockchain oriented, transparent auction-based bug assignment framework which uses incentive mechanism as reward and penalty backed by blockchain technology using smart contracts for developers motivation. The process allows individual developers to select bug reports, matching their preferences and schedule for which they shall we able to provide robust solutions with reduced overhead in cost and time of bug fixing. Results Results of experimentation and surveys conclude that the proposed method is transparent and effective in bug assignment minimizing overall bug fixing time. The low cost of contract execution demonstrates that it can be used quantitatively and without ambiguity. Conclusion The work presented is novel to improve (i) bug assignment (ii) allow individual developers to choose what they like to provide robust solutions (iii) handles two major issues of differentiating between active and inactive developers and confusion over the assignment of bugs (iv) will further reduce bug-fixing delays and will prevent reassignment problem.

In virtual worlds (including computer games), users develop trust relationships from their in-world interactions with others. However, these trust relationships end up not being represented in the data structures (or databases) of such virtual worlds, though they sometimes appear associated with reputation and recommendation systems. In addition, as far as we know, the user is not provided with a personal trust tool to sustain his/her decision-making while he/she interacts with other users in the virtual or game world. In order to come up with a computational formal representation of these personal trust relationships, we need to succeed in converting in-world interactions into reliable sources of trust-related data. In this paper, we develop the required formalisms to gather and represent in-world interactions—which are based on the activity theory—as well as a method to convert in-world interactions into trust networks. In the companion paper, we use these trust networks to produce a computational trust decision based on subjective logic. This solution aims at supporting in-world user (or avatar) decisions about others in the game world.

The exponential growth in the number of Internet of Things (IoT) devices and applications in recent years can be attributed partly to the emergence of several new IoT startup companies and potential applications. While many of these startups offer significant innovations in the IoT, some of them lack security expertise, resulting in the development of ill-equipped IoT devices and applications in terms of security. For example, one of the fundamental problems faced by non-security experts in the IoT space is how to select the right Lightweight Cryptographic Algorithm (LWCA) for a given security requirement. To address this specific problem, an IoT Hardware Platform Security Advisor (IoT-HarPSecA) framework is proposed in this paper. The security framework is aimed at facilitating the choice of specific security algorithms given a set of security goals, hardware specifications, message payload size, application area, and energy requirement. Within the scope of this framework, we develop an easy-to-use tool in C++ that allows users to interact with the IoT-HarPSecA framework. The tool can potentially help non-security experts, such as electronics and computer engineers as well as application developers make informed decisions on selecting the appropriate security algorithms for their various applications. Finally, the paper presents some preliminary results and discussion.

International audience; Distributed Denial of Service (DDoS) attacks are still among the most dangerous attacks on the Internet. With the advance of methods for detecting and mitigating these attacks, crackers have improved their skills in creating new DDoS attack types with the aim of mimicking normal traffic behaviour therefore becoming silently powerful. Among these advanced DDoS attack types, the so-called lowrate DoS attacks aim at keeping a low level of network traffic. In this paper, we study one of these techniques, called Reduction of Quality (RoQ) attack. To investigate the detection of this type of attack, we evaluate and compare the use of four machine learning algorithms: Multi-Layer Perceptron (MLP) neural network with backpropagation, K-Nearest Neighbors (K-NN), Support Vector Machine (SVM) and Multinomial Naive Bayes (MNB). We also propose an approach for detecting this kind of attack based on three methods: Fuzzy Logic (FL), MLP and Euclidean Distance (ED). We evaluate and compare the approach based on FL, MLP and ED to the above machine learning algorithms using both emulated and real traffic traces. We show that among the four Machine Learning algorithms, the best classification results are obtained with MLP, which, for emulated traffic, leads to a F1-score of 98.04% for attack traffic and 99.30% for legitimate traffic, while, for real traffic, it leads to a F1-score of 99.87% for attack traffic and 99.95% for legitimate traffic. Regarding the approach using FL, MLP and EC, for classification of emulated traffic, we obtained a F1-score of 98.80% for attack traffic and 99.60% for legitimate traffic, while, for real traffic, we obtained a F1-score of 100% for attack traffic and 100% for legitimate traffic. However, the better performance of the approach based on FL, MLP and ED is obtained at the cost of larger execution time, since MLP required 0.74 ms and 0.87ms for classification of the emulated and real traffic datasets, respectively, where as the approach using FL, MLP and ED required 11'46" and 46'48" to classify the emulated and real traffic datasets, respectively.

The world is witnessing the emerging role of Internet of Things (IoT) as a technology that is transforming different industries, global community and its economy. Currently a plethora of interconnected smart devices have been deployed for diverse pervasive applications and services, and billions more are expected to be connected to the Internet in the near future. The potential benefits of IoT include improved quality of life, convenience, enhanced energy efficiency, and more productivity. Alongside these potential benefits, however, come increased security risks and potential for abuse. Arguably, this is partly because many IoT start-ups and electronics hobbyists lack security expertise, and some established companies do not make security a priority in their designs, and hence they produce IoT devices that are often ill-equipped in terms of security. In this paper, we discuss different IoT application areas, and identify security threats in IoT architecture. We consider security requirements and present typical security threats for each of the application domains. Finally, we present several possible security countermeasures, and introduce the IoT Hardware Platform Security Advisor (IoT-HarPSecA) framework, which is still under development. IoT-HarPSecA is aimed at facilitating the design and prototyping of secure IoT devices.

The dramatic drop in price of computing hardware, coupled with the recent breakthroughs in embedded systems design that enabled the integration of high‐level software and low‐level electronics, have created a paradigm shift in embedded systems development. This has led to the development of different varieties of user‐friendly Internet of Things ( IoT ) hardware development platforms for IoT prototyping. The ubiquity of such prototyping platforms has undoubtedly contributed toward the explosive growth of the IoT , which is already seeping into all areas of human endeavor, including transportation, logistics, business, and healthcare. Building IoT projects that can be controlled over the Internet can be challenging, especially for beginners. This chapter discusses the design and development of prototypes for IoT applications with focus on Arduino and Raspberry Pi platforms. The aim is to provide insightful information on best practices for designing and prototyping IoT projects, as well as to serve as step‐by‐step guidelines for beginners.

Cloud computing is an established technology to provide computing resources on demand that currently faces several challenges. Main challenges include management of shared resources, energy consumption, load balancing, resource provisioning and allocation, and fulfilment of service level agreements (SLAs). Due to its inherent complexity, cloud simulation is largely used to experiment new models and algorithms. This work presents CloudSim Plus, an open source simulation framework that pursues conformance to software engineering principles and object-oriented design in order to provide an extensible, modular and accurate tool. Based on the CloudSim framework, it aims to improve several engineering aspects, such as maintainability, reusability and extensibility. This work shows the benefits of CloudSim Plus, its particular features, how it ensures more accuracy, extension facility and usage simplicity.

The Internet of Things (IoT) is an environment in which ordinary and complex consumer products, buildings, bridges, animals or even people, etc. are embedded with sensors, equipped with a variety of communication technologies and given unique identifiers that can enable them connect to the Internet. This allows them to talk to each other, collect data and transfer data over the Internet. IoT has the potential to enhance the way we do things by increasing productivity and efficiency. It also has the prospects of delivering significant business benefits. Nonetheless, implementing secure communication in the IoT and integrating security mechanisms into some of its devices have been a major impediment to its progress, resulting in many privacy concerns. Although IoT is a hybrid network of the Internet, many security solutions for the Internet cannot be directly used on the resource-constrained devices of the IoT, hence the need for new security solutions. In this chapter, we discuss the security challenges of the IoT. First, we discuss some basic concepts of security and security requirements in the context of IoT. We then consider fundamental security issues in the IoT and thereafter highlight the security issues that need immediate attention.

This paper proposes a multiscale automated model for the classification of suspicious malignancy of breast masses, through log detrended fluctuation cumulant-based multifractal analysis of images acquired by dynamic contrast-enhanced magnetic resonance. Features for classification are extracted by computing the multifractal scaling exponent for each of the 70 clinical cases and by quantifying the log-cumulants reflecting multifractal information related with texture of the enhanced lesions. The output is compared with the radiologist diagnosis that follows the Breast Imaging-Reporting and Data System (BI-RADS). The results suggest that the log-cumulant C 2 can be effective in classifying typically biopsy-recommended cases. The performance of a supervised classification was evaluated by receiver operating characteristic (ROC) with an area under the curve of 0.985. The proposed multifractal analysis can contribute to novel feature classification techniques to aid radiologists every time there is a change in the clinical course, namely, when biopsy should be considered.

Dynamic contrast-enhanced magnetic resonance (DCE-MR) of the breast is especially robust for the diagnosis of cancer in high-risk women due to its high sensitivity. Its specificity may be, however, compromised since several benign masses take up contrast agent as malignant lesions do. In this paper, we propose a novel method of 3D multifractal analysis to characterize the spatial complexity (spatial arrangement of texture) of breast tumors at multiple scales. Self-similar properties are extracted from the estimation of the multifractal scaling exponent for each clinical case, using lacunarity as the multifractal measure. These properties include several descriptors of the multifractal spectra reflecting the morphology and internal spatial structure of the enhanced lesions relatively to normal tissue. The results suggest that the combined multifractal characteristics can be effective to distinguish benign and malignant findings, judged by the performance of the support vector machine classification method evaluated by receiver operating characteristics with an area under the curve of 0.96. In addition, this paper confirms the presence of multifractality in DCE-MR volumes of the breast, whereby multiple degrees of self-similarity prevail at multiple scales. The proposed feature extraction and classification method have the potential to complement the interpretation of the radiologists and supply a computer-aided diagnosis system.

Voice over Internet Protocol (VoIP) applications based on peer-to-peer (P2P) communications have been experiencing considerable growth in terms of number of users. To overcome filtering policies or protect the privacy of their users, most of these applications implement mechanisms such as protocol obfuscation or payload encryption that avoid the inspection of their traffic, making it difficult to identify its nature. The incapacity to determine the application that is responsible for a certain flow raises challenges for the effective management of the network. In this paper, a new method for the identification of VoIP sessions is presented. The proposed mechanism classifies the flows, in real-time, based on the speech codec used in the session. To make the classification lightweight, the behavioral signatures for each analyzed codec were created using only the lengths of the packets. Unlike most previous approaches, the classifier does not use the lengths of the packets individually. Instead, it explores their level of heterogeneity in real time, using entropy to emphasize such feature. The results of the performance evaluation show that the proposed method is able to identify VoIP sessions accurately and simultaneously recognize the used speech codec.

In the last few years, the appealing features of cloud computing have been fueling the integration of cloud environments in the industry, which has been consequently motivating the research on related technologies by both the industry and the academia. The possibility of paying-as-you-go mixed with an on-demand elastic operation is changing the enterprise computing model, shifting on-premises infrastructures to off-premises data centers, accessed over the Internet and managed by cloud hosting providers. Regardless of its advantages, the transition to this computing paradigm raises security concerns, which are the subject of several studies. Besides of the issues derived from Web technologies and the Internet, clouds introduce new issues that should be cleared out first in order to further allow the number of cloud deployments to increase. This paper surveys the works on cloud security issues, making a comprehensive review of the literature on the subject. It addresses several key topics, namely vulnerabilities, threats, and attacks, proposing a taxonomy for their classification. It also contains a thorough review of the main concepts concerning the security state of cloud environments and discusses several open research topics.

The emergence of new Internet paradigms has changed the common properties of network data, increasing the bandwidth consumption and balancing traffic in both directions. These facts raise important challenges, making it necessary to devise effective solutions for managing network traffic. Since traditional methods are rather ineffective and easily bypassed, particular attention has been paid to the development of new approaches for traffic classification. This article surveys the studies on peer-to-peer traffic detection and classification, making an extended review of the literature. Furthermore, it provides a comprehensive analysis of the concepts and strategies for network monitoring.

Due to the relevance of self-similarity analysis in several research areas, there is an increased interest in methods to generate realizations of self-similar processes, namely in the ones capable of simulating long-range dependence. This article describes a new algorithm to approximate persistent fractional Brownian motions with a predefined Hurst parameter. The algorithm presents a computational complexity of O ( n ) and generates sequences with n ( n ∈ N) values with a small multiple of log 2 ( n ) variables. Because it operates in a sequential manner, the algorithm is suitable for simulations demanding real-time operation. A network traffic simulator is presented as one of its possible applications.

The inclusion of encryption or evasive techniques in popular applications increased the importance of characterizing network traffic based on behavior. This study aims to characterize peer-to-peer (P2P) traffic from the perspective of host computers by focusing on the packet lengths. The article explores the dissimilarities between the lengths of Internet Protocol (IP) packets generated by P2P and non-P2P applications. The heterogeneity of those lengths was assessed using entropy and compared for different classes of applications, through the implementation of a sliding analysis window. Initial observations show that the lengths of the packets generated by P2P applications are more varied than those of non-P2P applications. These patterns were used to implement a method to identify hosts running P2P applications. Unlike previous studies on this area, we used the heterogeneity of the packet lengths instead of the length value per se, and a sliding window calculation procedure was adopted to allow real-time processing. The results of this study can be used for the characterization of traffic generated by P2P applications, as well as for traffic classification and management purposes.

This paper describes a new algorithm for the generation of pseudo random numbers with approximate self-similar structure. The Simple Self-Similar Sequences Generator (4SG) elaborates on an intuitive approach to obtain a fast and accurate procedure, capable of reproducing series of points exhibiting the property of persistence and anti-persistence. 4SG has a computational complexity of O(n) and memory requirements of the order of log"2(N), where N is the number of points to be generated. The accuracy of the algorithm is evaluated by means of computer-based simulations, recurring to several Hurst parameter estimators, namely Variance Time (VT) and the Wavelets-based estimator. The Hosking and the Wavelets-based methods for the generation of self-similar series were submitted to the same tests the 4SG was analysed with, providing for a basis for comparison of several performance aspects of the algorithm. Results show that the proposal embodies a good candidate not only for on-demand emulation of arbitrarily long self-similar sequences, but also for fast and efficient online simulations.