Search

Investigating digital crimes in cloud service environments is complex due to the decentralized nature of these services, posing challenges in data collection and presenting credible evidence in court. While existing research focuses more on external investigators, Cloud Service Providers (CSPs) have less responsibilities. To address this gap, a new framework named Microservices Forensics as a Service (MsFaaS) is introduced, aiming to ensure the reliable presentation of evidence. MsFaaS integrates international law enforcement, assigning responsibility to CSPs validated by local authorities where incidents occur. The framework consolidates existing literature, tackling unresolved challenges like legality, standardization, and data collection through the collection of diverse data types and the use of event reconstruction techniques to construct a comprehensive crime scene in both real-time and postmortem scenarios. Blockchain secures collected data against tampering, while hash functions and public key cryptography validate Microservices workflows against man-in-the-middle attacks. Machine learning enables proactive response actions to incidents. Moreover, MsFaaS facilitates auditing and recording of both internal and external cloud traffic, producing evidence reports certified by local authorities. By addressing the limitations of traditional digital forensics, MsFaaS enhances investigation reliability and effectiveness, offering services for internal CSP auditing and maintaining Chain of Custody integrity critical for trial decision-making. [ABSTRACT FROM AUTHOR]

The Nth-degree Truncated polynomial Ring Unit (NTRU) is one of the famous post-quantum cryptographic algorithms. Researchers consider NTRU to be the most important parameterized family of lattice-based public key cryptosystems that has been established to the IEEE P1363 standards. Lattice-based protocols necessitate operations on large vectors, which makes parallel computing one of the appropriate solutions to speed it up. NTRUEncrypt operations contain a large amount of data that requires many repetitive arithmetic operations. These operations make it a strong candidate to take advantage of the high degree of parallelism. The main costly operation that is repeated in all NTRU algorithm steps is polynomial multiplication. In this work, a Parallel Post-Quantum NTRUEncrypt algorithm called PPQNTRUEncrypt is proposed. This algorithm exploits the capabilities of parallel computing to accelerate the NTRUEncrypt algorithm. Both analytical and Apache Spark simulation models are used. The proposed algorithm enhanced the NTRUEncrypt algorithm by approximately 49.5%, 74.5%, 87.6%, 92.5%, 93.4%, and 94.5%, assuming that the number of processing elements is 2, 4, 8, 12, 16, and 20 respectively. [ABSTRACT FROM AUTHOR]

The rapid development of cyberattacks in the field of the Internet of things (IoT) introduces new security challenges regarding zero-day attacks. Intrusion-detection systems (IDS) are usually trained on specific attacks to protect the IoT application, but the attacks that are yet unknown for IDS (i.e., zero-day attacks) still represent challenges and concerns regarding users' data privacy and security in those applications. Anomaly-detection methods usually depend on machine learning (ML)-based methods. Under the ML umbrella are classical ML-based methods, which are known to have low prediction quality and detection rates with regard to data that it has not yet been trained on. DL-based methods, especially convolutional neural networks (CNNs) with regularization methods, address this issue and give a better prediction quality with unknown data and avoid overfitting. In this paper, we evaluate and prove that the CNNs have a better ability to detect zero-day attacks, which are generated from nonbot attackers, compared to classical ML. We use classical ML, normal, and regularized CNN classifiers (L1, and L2 regularized). The training data consists of normal traffic data, and DDoS attack data, as it is the most common attack in the IoT. In order to give the full picture of this evaluation, the testing phase of those classifiers will include two scenarios, each having data with different attack distribution. One of these is the backdoor attack, and the other is the scanning attack. The results of the testing proves that the regularized CNN classifiers still perform better than the classical ML-based methods in detecting zero-day IoT attacks. [ABSTRACT FROM AUTHOR]

Personal credentials, such as passports and drivers' licenses, can be implemented electronically using multi-show protocols. In this paper, we introduce an IoT Privacy-Oriented selective disclosure credential system, i.e. based on bilinear pairings and multilinear maps. The proposed system consists of three protocols, which allow users to be in control of their personal credentials. The Credentials Authority (CA) verifies and attests to the users credentials. Once the CA signs these credentials, the users cannot modify any of them. Moreover, the users can mask these credentials in every showing process to protect their identity from being revealed through a collusion between the CA and the verifiers. The proposed system maintains unlinkability between the issuing and showing protocols. Furthermore, it achieves unlinkability in the showing protocol such that the verifier cannot distinguish a user in two different sessions of the showing protocol. The proposed system is novel and practical in terms of introducing a new multi-show credential system that supports selective disclosure (Some credentials can be disclosed and others kept secret during the showing protocol.) The proposed system is the first that utilizes multilinear maps in the identification protocol. Making use of bilinear pairings and multilinear maps are suitable for IoT devices that have limited capabilities in terms of power consumption, key storage, and computing power. The security analysis of the proposed system is discussed using Burrows–Abadi–Needham (BAN) logic. [ABSTRACT FROM AUTHOR]