Attack Protection Research Articles

Mitigating distributed denial of service attack: Blockchain and software‐defined networking based approach, network model with future research challenges

AbstractWith the rise of technology and easy access to the internet, it is nowadays very easy to perform distributed denial of service (DDoS) attacks. The main target of a DDoS attack is to suspend or interrupt any available services online. It can be done for personal profits or professional reasons, and sometimes over political reasons too. Some of the recent attacks are as follows: the largest ever recorded packet per second based DDoS attack on Akamai servers, the attack on Amazon, and the attacks on the website of the US Department of Health and Human Services. Cutting‐edge technology like Blockchain and software‐defined networking (SDN) are very helpful in developing a mitigating architecture with their collaborative approach, where SDN can authenticate the legitimate IP address and Blockchain can help to store the legitimate user in the trust list with a complex architecture of different assistant Blockchain. This paper proposes three different network architectures for the protection of DDOS attack by enabling Blockchain technology with SDN concept.

What do we know about cryptocurrency? Past, present, future

PurposeThe authors make a fundamental initial effort to conduct a systematic review analysis on “cryptocurrency,” mainly to analyze the way it has been changing the “stereotype” financial transactions, and also identify the probable unexplored research avenues on this innovative investment regime. The study aims to draw the landscape of the current state, prospects, challenges, trends and possible agendas of cryptocurrency in the global market.Design/methodology/approachUsing a quali-quantitative approach widely known as meta-literature review, the synthesis analysis on “cryptocurrency” is conducted. Methodologically, the authors review and analyze the most recent and relevant papers preferably published between 2016 and 2020 in leading business and finance journals of ISI Web of Science (ISI WOS) through bibliometric analysis particularly coupled with content analysis.FindingsThe findings of the meta-analysis summarize the relevant stylized facts of the cryptocurrency market: distinctive features of blockchain technology, decentralized payment method, low-cost facility, ensuring pseudo-anonymity, independence from central authority, double spending attack protection, organic and instantaneous nature, among others. In addition, the analysis identified several future research regimes: pricing model, prospect of investment regime, hedging properties, volatility dynamics, information asymmetry, underlying risk factors and bubble-like nature in global cryptocurrency market.Practical implicationsThis academic novelty significantly contributes to enhance our knowledge on the current state-of-the-art of digital finance, outlines the research agenda and eventually provides important investment implications for financial managers, research analysts, investors, market practitioners, regulatory compliance professionals and policymakers. Therefore, the findings shed the lights on new investment opportunity in the global market.Originality/valueCryptocurrency, virtual currency or digital asset having cryptography for idiosyncratic security features, seems to be a persistent paradigm shift in the digitalized financial system. Despite the continuing growth, the academic research on cryptocurrency is still at nascent stage, particularly because researchers did not deeply draw attention at this financial innovation. In addition, the authors argue that none of the earlier studies yet conducted a meta-analysis on this latest investment regime. Therefore, this review study is the initial attempt to fill up the gap in the finance literature.

Identifying vital nodes in complex networks based on information entropy, minimum dominating set and distance

Identifying the vital nodes in complex networks is essential in disease transmission control and network attack protection. In this paper, in order to identify the vital nodes, we define a centrality method named EMDC, which is based on information entropy, minimum dominating set (MDS) and the distance between node pairs. This method calculates the local spreading capability (LSC) of node by information entropy and selects that nodes have the largest value of LSC as core nodes by MDS. Then it defines the node’s spreading capability (SC) to use the sum of weighted distances from a node to the core nodes. Finally, the nodes are ranked by considering SC of their neighbors. The key nodes can be further identified in complex networks. In order to verify the effectiveness of this method, key nodes identification simulation experiments are carried out on 11 real networks, Scale-Free (BA) networks and Small-World (WS) networks, respectively. Experimental results show that this method can more effectively identify the influence of nodes in the networks.

Lightweight Cryptographic Algorithms for Guessing Attack Protection in Complex Internet of Things Applications

As the world keeps advancing, the need for automated interconnected devices has started to gain significance; to cater to the condition, a new concept Internet of Things (IoT) has been introduced that revolves around smart devicesʼ conception. These smart devices using IoT can communicate with each other through a network to attain particular objectives, i.e., automation and intelligent decision making. IoT has enabled the users to divide their household burden with machines as these complex machines look after the environment variables and control their behavior accordingly. As evident, these machines use sensors to collect vital information, which is then the complexity analyzed at a computational node that then smartly controls these devicesʼ operational behaviors. Deep learning‐based guessing attack protection algorithms have been enhancing IoT security; however, it still has a critical challenge for the complex industries’ IoT networks. One of the crucial aspects of such systems is the need to have a significant training time for processing a large dataset from the networkʼs previous flow of data. Traditional deep learning approaches include decision trees, logistic regression, and support vector machines. However, it is essential to note that this convenience comes with a price that involves security vulnerabilities as IoT networks are prone to be interfered with by hackers who can access the sensor/communication data and later utilize it for malicious purposes. This paper presents the experimental study of cryptographic algorithms to classify the types of encryption algorithms into the asymmetric and asymmetric encryption algorithm. It presents a deep analysis of AES, DES, 3DES, RSA, and Blowfish based on timing complexity, size, encryption, and decryption performances. It has been assessed in terms of the guessing attack in real‐time deep learning complex IoT applications. The assessment has been done using the simulation approach and it has been tested the speed of encryption and decryption of the selected encryption algorithms. For each encryption and decryption, the tests executed the same encryption using the same plaintext for five separate times, and the average time is compared. The key size used for each encryption algorithm is the maximum bytes the cipher can allow. To the comparison, the average time required to compute the algorithm by the three devices is used. For the experimental test, a set of plaintexts is used in the simulation—password‐sized text and paragraph‐sized text—that achieves target fair results compared to the existing algorithms in real‐time deep learning networks for IoT applications.

Features of cyber security policy formation of the European Union: legal aspects

The article deals with the current legal and organizational principles of the European Union`s cybersecurity, the problems and prospects for the development of the relevant EU mechanism in the context of modern cyber threats. The evolution and qualitative dynamics of the EU cyber policy from the adoption of the first legal acts in the early 2000s to the publication of the second EU Security Strategy draft in December 2020 are analyzed. The study found that the European Union has the potential to achieve strategic autonomy in cyberpolitics. However, it needs a more coherent policy of coordination, further increase of funding and building of institutional capacity of the EU, equalization of member states possibilities. The conclusions state that Europe is interested in the comprehensive development of EU cybersecurity policy. The cross-border nature of cyber threats means that the EU's resilience in this matter directly affects its security. The current direction of the EU's capacity building and especially close cooperation with NATO provide a chance to avoid difficult political dilemmas. Official data from the European Union's Cyber Security Agency show that the number of violations of privacy is growing among the types of cyber attacks. This puts on the agenda the activities of EU structures and Member States the need to develop a system of human rights protection in the field of cybersecurity. One of its basic elements should be updated legislation, in particular, the new EU Cyber Security Strategy. The European Union does not stop there and constantly strives to develop opportunities to counter and prevent cyber threats in order to achieve strategic autonomy of the organization. The EU needs to overcome its excessive bureaucratization and imbalance in the funding of cyber policy management programs and the practical development of cyber attack protection, prevention and repulsion systems. The EU’s place in the future global cybersecurity system will depend on the real strengthening of this second segment of programs.

DOMREP–An Orthogonal Countermeasure for Arbitrary Order Side-Channel and Fault Attack Protection

Protection against physical attacks is a major requirement for cryptographic implementations on devices which can be accessed by attackers. Side-channel and fault injection attacks are the most common types of physical attacks. In this work we present a novel generic solution for simultaneous protection against side-channel and fault attacks with arbitrary order. We combine domain oriented masking and repetition codes in an orthogonal way and call this approach DOMREP. The resistance against side-channel attacks and fault attacks can be scaled independently of each other, for the protection against higher-order side-channel analysis and the injection of multiple faults including SIFA. We develop the generic concept of orthogonal protection, and implement the DOMREP concept on GIMLI, a round two NIST LWC competition candidate, on a Xilinx Artix-7 FPGA. Our implementation of GIMLI is verified to be resistant against univariate first-order side-channel attacks by TVLA. The resistance against SIFA is verified by means of fault emulation of single as well as multiple bit faults. Our implementation of GIMLI achieves the expected security level according to these measurements. We also provide numbers for the area overhead for our protected implementation of GIMLI.

Low-Cost Side-Channel Secure Standard 6T-SRAM-Based Memory With a 1% Area and Less Than 5% Latency and Power Overheads

Side-channel attacks constitute a concrete threat to IoT systems-on-a-chip (SoCs). Embedded memories implemented with 6T SRAM macrocells often dominate the area and power consumption of these SoCs. Regardless of the computational platform, the side-channel sensitivity of low-hierarchy cache memories can incur significant overhead to protect the memory content (i.e., data encryption, data masking, etc.). In this manuscript, we provide a silicon proof of the effectiveness of a low cost side-channel attack protection that is embedded within the memory macro to achieve a significant reduction in information leakage. The proposed solution incorporates low-cost impedance randomization units, which are integrated into the periphery of a conventional 6T SRAM macro in fine-grain memory partitions, providing possible protection against electromagnetic adversaries. Various blocks of unprotected and protected SRAM macros were designed and fabricated in a 55 nm test-chip. The protected ones had little as 1% area overhead and less than 5% performance and power penalties compared to a conventional SRAM design. To evaluate the security of the proposed solution, we applied a robust mutual information metric and an adaptation to the memory context to enhance this evaluation framework. Assessment of the protected memory demonstrated a significant information leakage reduction from 8 bits of information exposed after only 100 cycles of attack to less than ~1.5 bits of mutual information after 160K traces. The parametric nature of the protection mechanisms are discussed while specifying the proposed design parameters. Overall, the proposed methodology enables designs with higher security-level at a minimal cost.

Research on the Optimization Management of Cloud Privacy Strategy Based on Evolution Game

Cloud computing services have great convenience, but privacy security is a big obstacle of popularity. In the process result of privacy protection of cloud computing, it is difficult to choose the optimal strategy. In order to solve this problem, we propose a quantitative weight model of privacy information, use evolutionary game theory to establish a game model of attack protection, design the optimal protection strategy selection algorithm, and make the evolutionary stable equilibrium solution method from the limited rational constraint. In order to study the strategic dependence of the same game group, the classical dynamic replication equation is improved by using the incentive coefficient, an improved evolutionary game model of attack protection is constructed, the stability of equilibrium point is further analyzed by Jacobian matrix method, and the optimal selection strategy is obtained under different conditions. Finally, the correctness and validity of the model are verified by experiments, different strategies of the same group have the dual effects of promotion and inhibition, and the advantages of this paper are shown by comparing with other articles.

The optimal privacy strategy of cloud service based on evolutionary game

Cloud service has great convenience, because of its complex structure and dynamic nature, it is difficult to choose the best cost-effective strategy in the process of security and privacy information. To solve this problem, we construct a quantitative benefit of game strategy, use evolutionary game theory to build a game model of attack protection, propose the optimal protection strategy selection algorithm, and make the stable equilibrium solution based on limited rational constraints. Because of the inter dependency among the strategies in the same game group, we use the incentive coefficient to improve the classical dynamic replication equation, establish an improved attack protection evolutionary game model, further discuss and analyze the stability of the equilibrium point based on Jacobian matrix method, and give the optimal selection strategy under different conditions. Finally, we show the correctness, credibility, and effectiveness of the model through experiments; different strategies of the same group have the dual effects of promotion and inhibition, and show the characteristics and advantages of this paper by comparing with other literatures.

Intrusion Detection for Cybersecurity of Smart Meters

The integration of Information and Communications Technology (ICT) enables real-time communication for smart meters to participate in power system operations. However, Advanced Metering Infrastructures (AMI) are vulnerable to cyber attacks. Both utilities and power consumers may become victims of cyber intrusions. In this paper, a two-stage cyber intrusion protection system is proposed. At the first stage of intrusion detection, a Support Vector Machine (SVM) is used as a detection algorithm to discover suspicious behaviors inside a smart meter. At the second stage, the Temporal Failure Propagation Graph (TFPG) technique is used to generate attack routes for identifying attack events. Finally, the proposed pattern recognition algorithm is used to calculate the similarity between a detected abnormal event and pre-defined cyber attacks. A higher similarity value implies a higher chance that a smart meter is under attack. An AMI security test platform has been developed to: (1) Collect training/testing data for SVM, (2) Simulate and analyze cyber attack events, and (3) Validate the proposed cyber attack protection system. The test platform consists of Network-Simulator 3 (NS-3) software to simulate an AMI network environment and single board computers (SBCs) to emulate the IEEE 802.15.4 communication between a grid router and a smart meter.

Comments on “Insider Attack Protection: Lightweight Password-Based Authentication Techniques Using ECC”

The radical progress in web services has drained more attraction towards escalating the security of several applications that serve and interact with the Internet users. In order to get authenticated from servers, the users must disclose their secret information to the server such as password and username so that they can access distinct applications on the Web. Due to distinct security attacks, such secret credentials should be discouraged from being revealed. Moreover, it is vibrant to secure the systems from known attacks. In contrast to all known security attacks, the insider attack is considered devastating because the privileged insiders of a system can violate the secret credentials, which may lead towards irrecoverable damage to both the system and the user. Therefore, to ensure the security of the system from insider attacks, different protocols have been proposed. Very recently, Rajamanickam et al. “Insider attack protection: Lightweight password-based authentication techniques using ECC,” presented novel authentication scheme for insider attack protection. They claimed that their protocol not only prevents insider attack but it is also immune to several known security attacks. This comment discloses the non-trivial weaknesses in the authentication phase between client and server. We have identified that the adversary can successfully impersonate the entities communicating with each other through this protocol. Moreover, their protocol fails to offer forward and backward secrecy. Consequently, we suggest possible solution for attack resilience.

An Entropy-Based Self-Adaptive Node Importance Evaluation Method for Complex Networks

Identifying important nodes in complex networks is essential in disease transmission control, network attack protection, and valuable information detection. Many evaluation indicators, such as degree centrality, betweenness centrality, and closeness centrality, have been proposed to identify important nodes. Some researchers assign different weight to different indicator and combine them together to obtain the final evaluation results. However, the weight is usually subjectively assigned based on the researcher’s experience, which may lead to inaccurate results. In this paper, we propose an entropy-based self-adaptive node importance evaluation method to evaluate node importance objectively. Firstly, based on complex network theory, we select four indicators to reflect different characteristics of the network structure. Secondly, we calculate the weights of different indicators based on information entropy theory. Finally, based on aforesaid steps, the node importance is obtained by weighted average method. The experimental results show that our method performs better than the existing methods.

Optimal Filter Assignment Policy Against Distributed Denial-of-Service Attack

A distributed denial-of-service (DDoS) attack is a cyber-attack in which attackers from different locations send out many requests to exhaust the capacity of a server. Current DDoS attack protection services filter out the DDoS attack packets in the middle of the path from the attacker to the servers. Some of the DDoS protection systems filter them out at the victim server. As a result, unnecessary attack traffic congests the network and wastes bandwidth. This can be minimized if we block them as early as possible. In this paper, we propose a DDoS attack protection system by using the filter router. The victim needs to wisely select and send filters to a subset of filter routers to minimize attack traffic and blockage of legitimate users (LUs). Many filters can easily minimize the attack traffic and blockage of LUs, but it is costly to the victim. So, we formulate two problems with different settings for selecting filter routers given a constraint on the number of filters. We propose dynamic programming solutions for both problems. Both problems consider the blockage of all attack traffic before it reaches the victim. We conduct extensive simulation to support our solutions.

An Enhanced Anomaly Detection in Web Traffic Using a Stack of Classifier Ensemble

A Web attack protection system is extremely essential in today's information age. Classifier ensembles have been considered for anomaly-based intrusion detection in Web traffic. However, they suffer from an unsatisfactory performance due to a poor ensemble design. This paper proposes a stacked ensemble for anomaly-based intrusion detection systems in a Web application. Unlike a conventional stacking, where some single weak learners are prevalently used, the proposed stacked ensemble is an ensemble architecture, yet its base learners are other ensembles learners, i.e. random forest, gradient boosting machine, and XGBoost. To prove the generalizability of the proposed model, two datasets that are specifically used for attack detection in a Web application, i.e. CSIC-2010v2 and CICIDS-2017 are used in the experiment. Furthermore, the proposed model significantly surpasses existing Web attack detection techniques concerning the accuracy and false positive rate metrics. Validation result on the CICIDS-2017, NSL-KDD, and UNSW-NB15 dataset also ameliorate the ones obtained by some recent techniques. Finally, the performance of all classification algorithms in terms of a two-step statistical significance test is further discussed, providing a value-added contribution to the current literature.

On Flight Risk Analysis Method Based on Stability Region of Dynamic System Under Icing Conditions

The occurrence of loss of control in flight is often accompanied by deep coupling of flight parameters. In order to explore the mechanism of coupling induced flight risk, a method of flight risk assessment based on the stability region of a nonlinear dynamic system was proposed. The Monte Carlo method was improved to identify the boundary of the stability region, and the key parameters that can represent the flight safety were set. The risk quantification method and the colorized flight risk characterization method were proposed. Combined with the case of aircraft encountering icing, the variation trend of flight stability region and flight risk under different icing degrees was calculated. The results showed that with the aggravation of icing, the flight stability region was significantly reduced and the coupling of flight parameters was aggravated. And compared with the traditional angle of attack protection method, this method can find the potential flight risk earlier, and characterize the way of parameters’ coupling and the flight risk evolution process. The proposed method can improve the pilot’s situational awareness, and also provide theoretical support for the prevention of flight risk under adverse conditions, and provide reference for the further development of boundary protection control law.

Architectural Optimization of Parallel Authenticated Encryption Algorithm for Satellite Application

High-speed data communication is becoming essential for many applications, including satellite communication. The security algorithms associated with the communication of information are also required to have high-speed for coping up with the communication speed. Moreover, the Authenticated Encryption (AE) algorithms provide high-speed communication and security services include data encryption, authentication, and integrity. The AE algorithms are available with serial and parallel architectures; among them, the Galois Counter Mode (GCM) algorithm has a parallel architecture. The Synthetic Initialization Vector (SIV) mode in the AES-GCM-SIV algorithm provides the nonce misuse protection using the GCM algorithm. Besides, reduced data throughput is provided using the AES-GCM-SIV algorithm as compared to the AES-GCM algorithm. This work introduced a parallel algorithm with re-keying and randomization of the initialization vector for high data throughput, nonce misuse protection, and side-channel attack protection. The implementation of the proposed algorithm is performed on Field Programmable Gate Array (FPGA) and it’s compared with the FPGA implementations of AES-GCM, AES-GCM-SIV, and recently introduced algorithms. The optimization of the proposed algorithm and security analysis is presented for space application using different optimizations and a combination of optimizations.

A Cluster Based Approach for Detection and Protection of Wormhole Attack in Wireless Sensor Network

Wireless Sensor Network (WSN) technology is progressing at a rapid pace and its demand is also increasing massively due to its cost-effective nature and less-challenging installation demands. However, due to its vulnerable wireless environment, WSNs are prone to various types of severely damaging attacks like wormhole, sinkhole, Denial of Service (DoS) etcetera. Therefore, it requires to be more secure and confidential to maintain the productive flow of communication between the nodes. One of the greatest threats which if placed strategically can seriously impair the network is the wormhole attack. In this paper, we proposed a cluster based technique to detect and protect WSN from wormhole attacks. The entire network is divided into clusters eventually at the end and each cluster is governed by a cluster head (CH). Based on Round Trip Time and hop count the security of the network has enhanced and nullified the wormhole attack in the network. A significant improvement in throughput, PDR, Delay has been observed and reported with proposed scheme.

Insider Attack Protection: Lightweight Password-Based Authentication Techniques Using ECC

The radical advancement in web services has drawn more attention toward intensifying the security of numerous applications that interact and serve the Internet users. In order to access the different applications on the web, users need to disclose their personal credentials such as username and password to the servers to get authenticated. This private information should be prevented from being exploited due to different security attacks that will result in illegal activities. Securing the systems from several attacks is vital. In comparison to all the security attacks, insider attacks are devastating due to the privilege the insiders of an organization possess to breach the information, which results in irrecoverable damage to both user and the organization. Numerous protocols were proposed to secure the system from insider attacks but proved to be inefficient. This article puts forward a novel authentication protocol for insider attacks based on a robust cryptographic algorithm, ECC. The informal security analysis of the protocol reveals that the proposed protocol is not only immune to insider attacks but also prevents several attacks. It shows that the protocol is relatively better than other existing protocols in terms of computational cost and communication overhead with high level of security.

Immunogenicity of the truncated NDV F protein surface-displayed on Lactobacillus casei

To evaluate immune efficacy of the recombinant Lactobacillus casei, we constructed pLA-Newcastle disease virus (NDV)-F/L. casei and obtained the expression products. PCR amplified the NDV F gene carrying part of the major epitopes. The target gene was inserted to the shuttle plasmid pLA, and then transformed into Escherichia coli BL21 (DE3) in order to screen positive recombinant plasmid. The positive recombinant plasmid was transformed into L. casei by electroporation to construct pLA-NDV-F/L. casei. The positive strains were identified by PCR. The reactivity of the recombinant bacteria was identified by Western blotting and the protein expression was detected by indirect immunofluorescence, flow cytometry and laser confocal microscopy. The 14-day-old chickens in each group were vaccinated by oral plus nose drops. The pLA-NDV-F/L. casei twice immunization group and three times immunization group, the commercial vaccine group, the pLA/L. casei group, the unchallenge PBS and the challenge PBS group were established. IgG in serum and sIgA in the lavage fluid of intestinal, nasal and lung were detected by ELISA. The protection rate of chickens was evaluated. The results showed that 94.10% of the recombinant bacteria expressed the F protein. The recombinant protein was highly expressed on the surface of L. casei with a protein size of 62 kDa, which specifically bound to anti-NDV serum. The levels of anti-F IgG and sIgA antibodies in each test group were significantly higher than those in the control groups. The duration of antibody in the pLA-NDV-F/L. casei three-time immunization group lasted 28 days longer than that in the twice immunized group, and there was no significant difference between antibody peak values. The attack protection rates in each group of immunized pLA-NDV-F/L. casei three times, twice, attenuated vaccine, pLA/L. casei and PBS were 80%, 80%, 90%, 0% and 0%, respectively. Therefore, the antigenic protein of NDV F was successfully expressed by L. casei expression system, which has of reactogenicity and immunogenicity, and could induce protective immune responses in chickens.

Nuclear Power Plants and Terror Attacks in Japan

The operation of several Japanese nuclear power plants has been halted because the Nuclear Regulatory Committee (NRC) reported that these nuclear power plants are not sufficiently prepared for potential terror attacks. It is unclear how the Japanese judiciary exercises judicial review for this NRC decision regarding terror attack protection measures. Japanese courts previously avoided the constitutionality of defense and peace statutes by using political questions. The attitude of the Japanese judiciary toward national defense is symbolic in several cases for Article 9, the pacifism provision of the Japanese constitution. Japanese administrative agencies are authorized to exercise discretion in the scope of power that is vested in them by the statutes passed in the parliament, or Diet. Under the Administrative Case Litigation Act (ACLA), which was revised in 2004, Japanese courts can review administrative discretion according to several principles such as fact-finding, purpose, timing, equal principles, constitutional rights infringement, and unconstitutional motives. The Judiciary has reviewed administrative agencies’ decision under under ACLA. Under ACLA, Japanese courts maintain arbitrary and capricious administrative discretion but not the political validity and policy judgement capability of administrative agencies. Judiciary defers to administrative agency decisions for its expertise. Citizens may take action toward administrative agencies regarding its validity by the Administrative Appeal Act (AAA). The AAA provides an avenue that is simpler than ACLA and yields a more rapid response, but it is not as fair as the ACLA because agencies themselves conduct an internal review on the validity of its decisions. In the famous Ikata nuclear power plant case of 1992, the Japanese Supreme Court deferred to the administrative agency decision for its expertise but did not use the term “discretion.” This may have been because nuclear power plants are related to Japanese energy policy, thus affecting Japan as a whole. This paper argues that in general, the judiciary does not thoroughly review public records and the reasoning behind administrative decisions but may identify unconstitutional motives. The Japanese court has not yet reviewed the NRC decision of halting nuclear power plant operation due to possible terror attacks. The statute for terror attacks was passed soon after the Great East Japan Earthquake in 2011. Terror attacks may provide an avenue for the Japanese judiciary to avoid conducting a judicial review of the administrative agency’s decision. It is unclear whether the Japanese judiciary will carefully examine this issue or defer to the NRC as terrorist protection overlaps with the field of national defense, which is stipulated in Article 9. This paper argues that national defense and nuclear power plant safety in the event of natural disasters both differ and overlap. Japanese administrative law scholars must analyze the expertise of the administrative agency in giving deference to the Japanese judiciary.