Search

In recent years, vulnerabilities in industrial control systems have increased substantially. The operational environment’s availability constraints hinder penetration testing from the attacker’s perspective as a viable vulnerability management method, thereby limiting the ability to map attack flows fully. To address this, research has been focused on understanding attack techniques by analyzing vulnerability descriptions that detail the attack flow of these vulnerabilities. However, existing research faces the challenge of not fully capturing the overall meaning of sentences, as it relies on word embedding-based learning for vulnerability information. This study proposes the V2TSA model, which uses a semantic approach to extract attack technique information from vulnerability descriptions. Additionally, the study seeks to identify the most efficient attack techniques by applying a threshold of at least 10% for the similarity probability between vulnerability and attack technique descriptions. Compared to expert analysis, the proposed model effectively identifies specific attack paths associated with vulnerabilities. Moreover, the vulnerability attack information can be leveraged to implement appropriate detection and mitigation strategies.

In the landscape of the Fourth Industrial Revolution, the integration of the Internet of Things (IoT) in smart-home technology presents intricate challenges for digital forensics. This study investigates these challenges, focusing on developing forensic methodologies suitable for the diverse and complex world of smart-home IoT devices. This research is contextualized within the rising trend of interconnected smart homes and their associated cybersecurity vulnerabilities. Methodologically, we formulate a comprehensive approach combining open-source intelligence, application, network, and hardware analyses, aiming to accommodate the operational and data storage characteristics of various IoT devices. Extensive experiments were conducted on prevalent platforms, such as Samsung SmartThings, Aqara, QNAP NAS, and Hikvision IP cameras, to validate the proposed methodology. These experiments revealed crucial insights into the complexities of forensic data acquisition in smart-home environments, emphasizing the need for customized forensic strategies tailored to the specific attributes of various IoT devices. The study significantly advances the field of IoT digital forensics and provides a foundational framework for future explorations into broader IoT scenarios. It underscores the need for evolving forensic methodologies to keep pace with rapid technological advancements in IoT.

Security incidents targeting control systems and the industrial internet of things (IIoT) are on the rise as attackers gain a better understanding of the nature of these systems and their increasing connectivity to information technology (IT). Every year, the number of vulnerabilities associated with these incidents increases, making it impractical to apply timely patches for all of them. The current vulnerability assessments, which are the basis for vulnerability patching, have limitations in that they do not adequately reflect the risk of exploitation in the real world after discovery and do not consider operational technology (OT) and industrial control system (ICS) environments other than IT environments. This study proposes to evaluate exploit risk in real-world environments by considering OT/ICS environments and calculating three metrics, including exploit chain risk, exploit code availability, and exploit use probability based on cyber threat information, including IIoT vulnerability data, used in OT/ICS environments. In addition, we construct exploitation scenarios in a control system environment to prioritize vulnerabilities with a high risk of exploitation based on the three metrics. We show that by assessing the risk of attackers’ intentions and exploited technologies for attacks against IIoT devices in a control system environment, we can provide defenders with comprehensive attack risk information for proactive defense.

Recently, as new threats from attackers are discovered, the damage and scale of these threats are increasing. Vulnerabilities should be identified early, and countermeasures should be implemented to solve this problem. However, there are limitations to applying the vulnerability discovery framework used in practice. Existing frameworks have limitations in terms of the analysis target. If the analysis target is abstract, it cannot be easily applied to the framework. Therefore, this study proposes a framework for vulnerability discovery and countermeasures that can be applied to any analysis target. The proposed framework includes a structural analysis to discover vulnerabilities from a scenario composition, including analysis targets. In addition, a proof of concept is conducted to derive and verify threats that can actually occur through threat modeling. In this study, the open platform communication integrated architecture used in the industrial control system and industrial Internet of Things environment was selected as an analysis target. We find 30 major threats and four vulnerabilities based on the proposed framework. As a result, the validity of malicious client attacks using certificates and DoS attack scenarios using flooding were validated, and we create countermeasures for these vulnerabilities.

Recently, the number of users and the demand for live-streaming services have increased. This has exponentially increased the traffic to such services, and live-streaming service platforms in Korea use a grid computing system that distributes traffic to users and reduces traffic loads. However, ensuring security with a grid computing system is difficult because the system exchanges general user traffic in a peer-to-peer (P2P) manner instead of receiving data from an authenticated server. Therefore, in this study, to explore the vulnerabilities of a grid computing system, we investigated a vulnerability discovery framework that involves a three-step analysis process and eight detailed activities. Four types of zero-day vulnerabilities, namely video stealing, information disclosure, denial of service, and remote code execution, were derived by analyzing a live-streaming platform in Korea, as a representative service, using grid computing.

With the growing awareness regarding the importance of personal data protection, many countries have established laws and regulations to ensure data privacy and are supervising managements to comply with them. Although various studies have suggested compliance methods of the general data protection regulation (GDPR) for personal data, no method exists that can ensure the reliability and integrity of the personal data processing request records of a data subject to enable its utilization as a GDPR compliance audit proof for an auditor. In this paper, we propose a delegation-based personal data processing request notarization framework for GDPR using a private blockchain. The proposed notarization framework allows the data subject to delegate requests to process of personal data; the framework makes the requests to the data controller, which performs the processing. The generated data processing request and processing result data are stored in the blockchain ledger and notarized via a trusted institution of the blockchain network. The Hypderledger Fabric implementation of the framework demonstrates the fulfillment of system requirements and feasibility of implementing a GDPR compliance audit for the processing of personal data. The analysis results with comparisons among the related works indicate that the proposed framework provides better reliability and feasibility for the GDPR audit of personal data processing request than extant methods.

Malicious codes may cause virus infections or threats of ransomware through symmetric encryption. Moreover, various bypassing techniques such as steganography, which refers to the hiding of malicious code in image files, have been devised. Unknown or new malware hidden in an image file in the form of malicious code is difficult to detect using most representative reputation- or signature-based antivirus methods. In this paper, we propose the use of ImageDetox method to neutralize malicious code hidden in an image file even in the absence of any prior information regarding the signatures or characteristics of the code. This method is composed of four modules: image file extraction, image file format analysis, image file conversion, and the convergence of image file management modules. To demonstrate the effectiveness of the proposed method, 30 image files with hidden malicious codes were used in an experiment. The malicious codes were selected from 48,220 recent malicious codes purchased from VirusTotal (a commercial application programming interface (API)). The experimental results showed that the detection rate of viruses was remarkably reduced. In addition, image files from which the hidden malicious code had previously been removed using a nonlinear transfer function maintained nearly the same quality as that of the original image; in particular, the difference could not be distinguished by the naked eye. The proposed method can also be utilized to prevent security threats resulting from the concealment of confidential information in image files with the aim of leaking such threats.