Search

The use of Automatic Dependent Surveillance - Broadcast (ADS-B) for aircraft tracking and flight management operations is widely used today. However, ADS-B is prone to several cyber-security threats due to the lack of data authentication and encryption. Recently, Blockchain has emerged as new paradigm that can provide promising solutions in decentralized systems. Furthermore, software containers and Microservices facilitate the scaling of Blockchain implementations within cloud computing environment. When fused together, these technologies could help improve Air Traffic Control (ATC) processing of ADS-B data. In this paper, a Blockchain implementation within a Microservices framework for ADS-B data verification is proposed. The aim of this work is to enable data feeds coming from third-party receivers to be processed and correlated with that of the ATC ground station receivers. The proposed framework could mitigate ADS- B security issues of message spoofing and anomalous traffic data. and hence minimize the cost of ATC infrastructure by throughout third-party support.

The Internet of Things (IoT) has become an indispensable technology fragment diurnal that has consolidated all the discrete systems and data into a coherent and interconnected process. With the advent of cutting-edge technologies providing meticulous solutions, the digital world still lacks the existence of propitious capabilities for IoT digital forensics. As such, an exceptional increase in the number of electronic devices, enormous collection and consumption of data has necessitated the need for IoT forensics when it comes to cybercrimes. In this paper, we provide a summary of the difference between IoT and conventional digital forensic processes. In addition, we list three categories of IoT-related computer crimes. Furthermore, we group several contributions and case studies that are IoT-specific when it comes to digital investigations. Our results reveal the gap and pinpoint initiatives towards smart equipment forensics such as smartwatches, smart TVs, among others.

Internet security measurements are fundamental techniques to detect cyber attacks and generate intelligence. However, such methods are limited in terms of relevancy, scalability, and data availability when it comes to Operational Technology (OT). Therefore, in this paper, we build cyber security capabilities to collect, detect, analyze, and visualize in near real-time cyberattacks targeting Cyber-Physical Systems (CPS). The latter is a critical component for Industry 4.0 and smart technologies. In order to achieve our tasks, we propose a big data fusion model, which correlates among two trap-based monitoring systems, namely, darknet and honeypot. With approximately hundred deployed sensors (monitors) over a six-month period, we have been able to collect several unauthorized and malicious activities originating from 226 countries. Furthermore, our investigation has revealed various scanning strategies such as CPS-focused scans, in addition to real exploits used by external sources to infiltrate our network. Finally, this study highlighted the importance of such monitoring systems and compare the efficiency among them with an aim to complement existing CPS and on-premise OT security solutions.

As of today, Distributed Denial of Service Attacks remain one the most devastating threats online. This paper presents an estimation model that integrates the discrete wavelet transform (DWT) and Chi-Square test (\( X_{2} \)) for detecting DDoS attacks. The present model presents a distributed architecture reducing the risk of single point of failure and increasing the reliability of the system. First, we uses the DWT to decompose the traffic data. Then, the obtained detail (high-frequency) components is used as input variable to forecast future traffic attack. To ensure a complete distribution of our system we test the PAXOS protocol which give a reliable communication between detection systems. The model is tested using real datasets of DDoS traces. So, our proposed system outperforms other conventional models that use a centralized architecture.

According to experts, by 2025, the IoT cyber infrastructure will incorporate 55 billion interconnected devices. Among other threats, this infrastructure and its hosts will be vulnerable to distributed denial of service (DDoS) attacks, in which the network and its hosts are flooded with false requests, thereby slowing the system or causing it to cease functioning completely. Because of the large amounts of traffic the devices comprising the IoT network will generate in the future, protecting it from such attacks is becoming increasingly important. This paper proposes a defensive algorithm designed to thwart DDoS attacks on IoT networks and presents the results of tests of the algorithm in various scenarios. The method defined by the algorithm consists of three steps: wavelet decomposition of the attack, checking the standard deviation, and collaborative prevention with Paxos protocol. The test results indicate that the proposed method can reduce amount of traffic, detection time, and number of false positives when network traffic exhibits a temporary, sudden increase.

The demand for Electric Vehicles (EVs) has been exponentially increasing, and to achieve sustainable growth, the industry dictated rapid development of the supporting infrastructure. This requires building a reliable EV charging ecosystem that serves customer demands while ensuring the security of the Internet-enabled systems and the connected critical infrastructure against possible cyber attacks. To this end, we devise a system lookup and collection approach to obtain a representative sample of widely deployed EV Charging Station Management Systems (EVCSMS). Furthermore, we leverage reverse engineering and penetration testing techniques to perform a first-of-a-kind comprehensive security and vulnerability analysis of the identified EVCSMS and their software/firmware implementations. Indeed, our systematic analysis unveils an array of vulnerabilities, which demonstrate the insecurity of the EVCSMS against remote cyber attacks. Considering the feasibility of such attacks, we discuss attack implications against the EV charging stations (EVCS) and their users. More importantly, we simulate the impact of practical cyber attack scenarios against the power grid, which result in possible service disruption and failure in the grid. Finally, while we recommend mitigation measures, our discoveries raise concerns about the lack of adequate security considerations in the design of the deployed EVCS, which will motivate vendors to take immediate action to patch their developed systems. Indeed, our communication with the concerned parties resulted in positive responses from some vendors such as Schneider Electric, who acknowledged our findings by reserving 12 CVEs, respectively.

Today, the Internet security community largely emphasizes cyberspace monitoring for the purpose of generating cyber intelligence. In this paper, we present a survey on darknet. The latter is an effective approach to observe Internet activities and cyber attacks via passive monitoring. We primarily define and characterize darknet and indicate its alternative names. We further list other trap-based monitoring systems and compare them to darknet. Moreover, in order to provide realistic measures and analysis of darknet information, we report case studies, namely, Conficker worm in 2008 and 2009, Sality SIP scan botnet in 2011, and the largest amplification attack in 2014. Finally, we provide a taxonomy in relation to darknet technologies and identify research gaps that are related to three main darknet categories: deployment, traffic analysis, and visualization. Darknet projects are found to monitor various cyber threat activities and are distributed in one third of the global Internet. We further identify that Honeyd is probably the most practical tool to implement darknet sensors, and future deployment of darknet will include mobile-based VOIP technology. In addition, as far as darknet analysis is considered, computer worms and scanning activities are found to be the most common threats that can be investigated throughout darknet; Code Red and Slammer/Sapphire are the most analyzed worms. Furthermore, our study uncovers various lacks in darknet research. For instance, less than 1% of the contributions tackled distributed reflection denial of service (DRDoS) amplification investigations, and at most 2% of research works pinpointed spoofing activities. Last but not least, our survey identifies specific darknet areas, such as IPv6 darknet, event monitoring, and game engine visualization methods that require a significantly greater amount of attention from the research community.

While the security issue associated with the Internet-of-Things (IoT) continues to attract significant attention from the research and operational communities, the visibility of IoT security-related data hinders the prompt inference and remediation of IoT maliciousness. In an effort to address the IoT security problem at large, in this work, we extend passive monitoring and measurements by investigating network telescope data to infer and analyze malicious activities generated by compromised IoT devices deployed in various domains. Explicitly, we develop a data-driven approach to pinpoint exploited IoT devices, investigate and differentiate their illicit actions, and examine their hosting environments. More importantly, we conduct discussions with various entities to obtain IP allocation information, which further allows us to attribute IoT exploitations per business sector (i.e., education, financial, manufacturing, etc.). Our analysis draws upon 1.2 TB of darknet data that was collected from a /8 network telescope for a 1 day period. The outcome signifies an alarming number of compromised IoT devices. Notably, around 940 of them fell victims of DDoS attacks, while 55,000 IoT nodes were shown to be compromised, aggressively probing Internet-wide hosts. Additionally, we inferred alarming IoT exploitations in various critical sectors such as the manufacturing, financial and healthcare realms.

Literature contributions have shown that information theoretic techniques can effectively detect various types of Distributed Denial of Service (DDoS) attacks. However, such techniques are often centralized with a limited measurement vantage point and suffer from the issue of single point of failure. Furthermore, with the flourishing of distributed and cloudbased environments, such techniques ought to adapt to such settings for scalability and performance reasons. In this paper, we address the problem of collaborative DDoS detection using information-theoretic techniques. To this end, we propose an entropy-based detection mechanism that supports collaborative agreement to identify suitable tuning network parameters for distributed DDoS inference in real-time. Empirical evaluations with real DDoS attacks demonstrate that the proposed approach is indeed capable of cooperatively inferring DDoS attacks while achieving resiliency and scalability.

This work proposes a novel approach to infer and characterize Internet-scale DNS Distributed Reflection Denial of Service (DRDoS) attacks by leveraging the darknet space. Complementary to the pioneer work on inferring Distributed Denial of Service (DDoS) activities using darknet, this work shows that we can extract DDoS activities without relying on backscattered analysis. The aim of this work is to extract cyber security intelligence related to DRDoS activities such as intensity, rate and geo-location in addition to various network-layer and flow-based insights. To achieve this task, the proposed approach exploits certain DDoS parameters to detect the attacks and the expectation maximization and k-means clustering techniques in an attempt to identify campaigns of DRDoS Attacks. We empirically evaluate the proposed approach using 1.44TB of real darknet data collected from a/13 address space during a recent several months period. Our analysis reveals that the approach was successful in inferring significant DNS amplification DRDoS activities including the recent prominent attack that targeted one of the largest anti-spam organizations. Moreover, the analysis disclosed the mechanism of such DNS amplification attacks. Further, the results uncover high-speed and stealthy attempts that were never previously documented. The extracted insights from various validated DNS DRDoS case studies lead to a better understanding of the nature and scale of this threat and can generate inferences that could contribute in detecting, preventing, assessing, mitigating and even attributing of DRDoS activities.

The explosive growth, complexity, adoption, and dynamism of cyberspace over the last decade have radically altered the globe. A plethora of nations have been at the very forefront of this change, fully embracing the opportunities provided by the advancements in science and technology in order to fortify the economy and to increase the productivity of everyday’s life. However, the significant dependence on cyberspace has indeed brought new risks that often compromise, exploit, and damage invaluable data and systems. Thus, the capability to proactively infer malicious activities is of paramount importance. In this context, generating cyber threat intelligence related to probing/scanning and Distributed Denial of Service (DDoS) activities renders an effective tactic to achieve the latter.