Security Logs Research Articles

Enhancing Intrusion Detection Systems through Distributed Ledger Technology for Secure Logging

Nodes in Mobile Ad Hoc Networks (MANETs) are limited battery powered. That’s why energy efficient routing has become an important optimization criterion in MANETs. The conventional routing protocols do not consider energy of the nodes while selecting routes which leads to early exhaustion of nodes and partitioning of the network. This paper attempts to provide an energy aware routing algorithm. The proposed algorithm finds the transmission energy between the nodes relative to the distance and the performance of the algorithm is analyzed between two metrics Total Transmission energy of a route and Maximum Number of Hops. The proposed algorithm shows efficient energy utilization and increased network lifetime with total transmission energy metric.

SFLL-AD: a self-adaptive and secure logic locking

SFLL-AD: a self-adaptive and secure logic locking

Reversible Acid-Base Long Persistent Luminescence Switch Based on Amino-Functionalized Metal-Organic Frameworks.

Metal-organic frameworks (MOFs) with long persistent luminescence (LPL) have attracted extensive research attention from researchers due to their potential applications in information encryption, anticounterfeiting technology, and security logic. In contrast to short-lived fluorescent materials, LPL materials offer a visible response that can be easily distinguished by the naked eye, thereby facilitating a much clearer visualization. However, there are few reports on functional LPL MOF materials as probes. In this article, two amino-functional LPL MOFs (VB4-2D and VB4-1D) were synthesized. They both exhibited adjustable fluorescence and phosphorescence from blue to green and from cyan to green, respectively. Notably, the MOFs emitted bright and adjustable LPL upon the removal of the different radiation sources. The basic amino functional groups in the MOFs exhibited acid and ammonia sensitivity, and fluorescence and phosphorescence emission intensities can be burst and restored in two atmospheres, respectively, which can be cycled multiple times. Furthermore, LPL intensity undergoes switching between two different conditions as well, which can be visually discerned by the naked eye, enabling visual sensing of volatiles by LPL. This combination of photoluminescence and the visual LPL switching behavior of acids and bases in functional MOFs may provide an effective avenue for stimulus response, anticounterfeiting, and encryption applications.

Designing Logical Sequence by Using Microcontroller as Security Tools

The objective of this paper are 1) to tell how to design logical security tools by using microcontroller 2) to describe the sequence of designing logical using microcontroller toward security controller. To explain the sequence step by step the researcher used design electronic chain. An Embedded system usually consists of at least a system unit microprocessor its memory for the program, data also input or output interface simple system. The interface like floppy disk, keyboard, appearance or printer which are usually available on the personal computer exactly is not available at the micro control system. Microcontroller systems are used for important simple works like control motors, switch, variable resistor or electronic device, one of micro control used is box control or safe deposit boxes such as house, office, or bank for safe security. By utilizing micro control, the owner has valuables are not felt worried about the safe deposit box from stolen

LπCET: A Logic Security Analysis for Cryptographic Protocols Based on π‐Calculus Extension Theory

The π‐calculus is a basic theory of mobile communication based on the notion of interaction, which, is aimed at analyzing and modeling the behaviors of communication processes in communicating and mobile systems, and is widely applied to the security analysis of cryptographic protocol’s design and implementation. But the π‐calculus does not provide seamless logical security analysis, so the logical flaws in the design and the implementation of a cryptographic protocol cannot be discovered in time. This paper introduces logical rules and logical proofs, binary tree, and the KMP algorithm and proposes a new extension of the π‐calculus theory, a logical security analysis method, and an algorithm. The aim is to analyze whether there are logical flaws in the design and the implementation of a cryptographic protocol, to ensure the security of the cryptographic protocol when it is encoded into software and implemented. This paper presents the logical security proof and analysis of the TLS1.3 protocol’s interactional implementation process. Empirical results show that the additional extension theory, the logical security analysis method, and the algorithm can effectively analyze whether there are logical flaws in the design and the implementation of a cryptographic protocol.

Pioneering Security: A Hybrid Logic Framework for the Future of IoT Protection

In a complicated situation, the Internet of Things simplifies the process of connecting a wide range of things. Because of its openness and lack of human control, the Internet of Things is open to assaults like denial of service (DoS) and man-in-the-middle attacks. Furthermore, any device that can connect to the internet may be hacked. These attacks put the network connections and the actual equipment at danger. IoT security and privacy will so be compromised. Due to its limited power, bandwidth, and storage, the Internet of Things requires a security solution that does not overload it. This study aims to preserve consumers' trust in the Internet of Things (IoT) by safeguarding their data against unauthorised access and maintaining the privacy of their personal information. With the ultimate objective of presenting a unique hybrid and optimised lightweight logical security architecture to ensure data privacy and integrity while making effective use of available resources, all research are carried out with this purpose in mind. The Hybrid Lightweight Security Framework (HLSF), which this study suggests, offers secrecy and integrity in addition to authentication. The structure consists of three distinct steps. The first step is registration, the second is authentication, and the third is transit security, which protects data while it is being transported. Compared to other current frameworks, the results reveal that HLSF performs better in terms of precision, recall, and accuracy when applied to an IoT situation.

IoT security with blockchain: A review

The relationship between the Internet of Things (IoT) and Blockchain has emerged to address the challenges of security, data integrity and transparency of IoT devices. Blockchain, with its distributed and decentralized nature, ensures reliable data transmission between IoT devices and security by preventing data manipulation. It also enhances the security and transparency of IoT applications by supporting automated and trusted transactions through smart contracts. In this context, Blockchain plays a critical role in making the IoT ecosystem more reliable and effective. In this study, we review studies that emphasize the importance of Blockchain technology for IoT security and propose various solutions. The proposed solutions include scalable frameworks for secure transactions in dynamic applications, Hyperledger Sawtooth-based frameworks that support secure logging of industrial activities, specialized access control mechanisms such as Trust-Based Access Control Mechanism (TABI), and IoT Cop monitoring framework that offers advanced security features. In addition, blockchain-based access control protocols, authentication systems and security models are aimed at enhancing IoT security. While most of the studies in the literature focus on the current challenges of IoT and Blockchain integration, they also reveal future research opportunities. These studies are briefly mentioned and the necessary ones are expressed in a table. In this way, it is aimed to create the necessary infrastructure for those who will work in this field.

МЕТОД ТА ЗАСІБ МОНІТОРИНГУ БЕЗПЕКИ В КОМП'ЮТЕРНІЙ МЕРЕЖІ ЗАСОБАМИ SIEM

This work focuses on researching, analyzing, and enhancing methods and tools for security monitoring in computer networks. The study develops security monitoring tools and methods based on SIEM agents, improving the data normalization process from security logs. The research explores SIEM's role in the SIEM-EDR-NDR triad perspective to accelerate responses to network security threats. The investigation is grounded in the experiences of foreign companies and domestic banking networks. The interaction of SIEM-EDR-NDR components, forming a SOC triad, is examined. SIEM is utilized for centralized data analysis, including EDR and NDR, providing a comprehensive security overview. EDR detects and responds to threats on endpoints, complemented by NDR, extending SIEM analysis. This combination ensures effective response to cyberattacks, reducing "dwell time" until detection. The formulation of tasks for EDR components in the SIEM-EDR-NDR triad is discussed. Emphasis is placed on the importance of protecting endpoints at all stages of an attack, and effective strategies, such as traffic analysis, application control, and centralized cybersecurity management, are identified. Integration of EDR with existing security tools to create a comprehensive system is highlighted. Within the SIEM context, data processing stages, from log collection and normalization to event classification and correlation, are illuminated. The role of correlation in incident formation and investigation is underscored. An enhanced normalization scheme with an expanded agent deployment and key data processing stages within the SIEM system is proposed. The work addresses the improvement of event log processing in SIEM for effective network security monitoring and timely threat mitigation. The achieved goal accelerates threat response processes through SIEM agent integration, facilitating the organization and classification of information flows for prompt threat mitigation.

The de-perimeterisation of information security: The Jericho Forum, zero trust, and narrativity.

This article analyses the transformation of information security induced by the Jericho Forum, a group of security professionals who argued for a new 'de-perimeterised' security model. Having focused on defensive perimeters around networks, early 2000s information security faced a growing set of pressures: the maintainability of firewalls given increasing traffic volume and variety, the vulnerability of interior network domains, and the need to cope with and enable new working arrangements and ways of doing business. De-perimeterisation was a radical rethinking of the nature of security and created the conditions for the rise of 'Zero Trust' architectures. This shift has radical implications for the architectures of digital infrastructures that undergird many aspects of contemporary life, the risks to which people and societies are exposed, and the nature of work and business in a digital economy. We develop a semiotic analysis of the Jericho Forum's interventions. Using insights from material semiotics, security theory and the theory of narrativity, we argue that de-perimeterisation can be understood as a shift in security logic, or, a shift in how security can (be made to) make sense. We examine a cluster of images used by the Jericho Forum, and analyse how they challenged the coherence of perimeter-based thinking and provided the materials for constructing a new model. We argue that a focus on the narrative dimension of security provides a window into fundamental semantic transformations, reciprocal historical relations between semantics and technical change, the agencement of security technologies, and determinations of value (what is worth securing).

Penetration Testing Tangerang City Web Application With Implementing OWASP Top 10 Web Security Risks Framework

The speed of technological development has made it possible for all people to be connected to one another. The creation of web-based information systems that help in all areas, including government, health, and education, is one of the forces behind the development of technology. With these technological advancements, websites are susceptible to cybercrimes that could end in the theft of crucial data. Top 10 Web Application Security Risks is the most effective prevention process for decrease company information leaks. On the website tangerangkota.go.id, the researcher will conduct a test using the Top 10 Web Application Security Risks technique. Top 10 Web Application Security Risks consist of Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable and Outdated Components, Identification and Authentication Failures, Software and Data Integrity Failures, Security Logging and Monitoring Failures, Server-Side Request Forgery. The penetration testing results found on the Tangerang City website which are 4 injections, 2 broken access controls, 1 security misconfiguration.

Forward Security with Crash Recovery for Secure Logs

Logging is a key mechanism in the security of computer systems. Beyond supporting important forward security properties, it is critical that logging withstands both failures and intentional tampering to prevent subtle attacks leaving the system in an inconsistent state with inconclusive evidence. We propose new techniques combining forward security with crash recovery for secure log data storage. As the support of specifically forward integrity and the online nature of logging prevent the use of conventional coding, we propose and analyze a coding scheme resolving these unique design constraints. Specifically, our coding enables forward integrity, online encoding, and most importantly a constant number of operations per encoding. It adds a new log item by 𝖷𝖮𝖱 ing it to k cells of a table. If up to a certain threshold of cells is modified by the adversary, or lost due to a crash, we still guarantee recovery of all stored log items. The main advantage of the coding scheme is its efficiency and compatibility with forward integrity. The key contribution of the paper is the use of spectral graph theory techniques to prove that k is constant in the number n of all log items ever stored and small in practice, e.g., k = 5. Moreover, we prove that to cope with up to \(\sqrt {n}\) modified or lost log items, storage expansion is constant in n and small in practice. For k = 5, the size of the table is only 12% more than the simple concatenation of all n items. We propose and evaluate original techniques to scale the computation cost of recovery to several GBytes of security logs. We instantiate our scheme into an abstract data structure which allows to either detect adversarial modifications to log items or treat modifications like data loss in a system crash. The data structure can recover lost log items, thereby effectively reverting adversarial modifications.

Anchor: A Library for Building Secure Persistent Memory Systems

Cloud infrastructure is experiencing a shift towards disaggregated setups, especially with the introduction of the Compute Express Link (CXL) technology, where byte-addressable ersistent memory (PM) is becoming prominent. To fully utilize the potential of such devices, it is a necessity to access them through network stacks with equivalently high levels of performance (e.g., kernel-bypass, RDMA). While, these advancements are enabling the development of high-performance data management systems, their deployment on untrusted cloud environments also increases the security threats. To this end, we present Anchor, a library for building secure PM systems. Anchor provides strong hardware-assisted security properties, while ensuring crash consistency. Anchor exposes APIs for secure data management within the realms of the established PM programming model, targeting byte-addressable storage devices. Anchor leverages trusted execution environments (TEE) and extends their security properties on PM. While TEE's protected memory region provides a strong foundation for building secure systems, the key challenge is that: TEEs are fundamentally incompatible with PM and kernel-bypass networking approaches-in particular, TEEs are neither designed to protect untrusted non-volatile PM, nor the protected region can be accessed via an untrusted DMA connection. To overcome this challenge, we design a PM engine that ensures strong security properties for the PM data, using confidential and authenticated PM data structures, while preserving crash consistency through a secure logging protocol. We further extend the PM engine to provide remote PM data operations via a secure network stack and a formally verified remote attestation protocol to form an end-to-end system. Our evaluation shows that Anchor incurs reasonable overheads, while providing strong security properties.

DASLog: Decentralized Auditable Secure Logging for UAV Ecosystems

DASLog: Decentralized Auditable Secure Logging for UAV Ecosystems

Transforming the grid for a more environmentally and socially sustainable electricity system in Great Britain is a slow and uneven process.

Electricity system decarbonization is key for environmental sustainability. From a consumption-production perspective, much attention has been paid to changes in how electricity is generated and used, but electricity systems also rely on a grid infrastructure that connects and integrates production and consumption, and which will also need to transform. At the same time, new technologies in the electricity system, including the grid, offer the potential for more socially sustainable ways of producing and consuming energy. However, in practice, change has been slow, uneven, and often dysfunctional. A socio-technical transitions approach offers insights into why this is so, seeing electricity system change not simply in technical and economic terms, but also as the outcomes of interactions between technology and social and political processes. The approach draws attention to the particular challenges of achieving rapid transitions in complex critical infrastructures like electricity with strong institutional logics of security. This article applies this approach to the case of Great Britain, where despite strong commitments to sustainability in the form of high-level climate policy, the electricity grid has often been a constraint on the pace of change. The nature of the British transition is explained partly by weak links between these high-level goals on the one hand and the detailed rules and practices in the electricity system on the other. It is also explained by patterns of ownership and grid regulation in the British case that protect incumbents and make it difficult for new actors to develop the system in more socially sustainable directions.

SigML++: Supervised Log Anomaly with Probabilistic Polynomial Approximation

Security log collection and storage are essential for organizations worldwide. Log analysis can help recognize probable security breaches and is often required by law. However, many organizations commission log management to Cloud Service Providers (CSPs), where the logs are collected, processed, and stored. Existing methods for log anomaly detection rely on unencrypted (plaintext) data, which can be a security risk. Logs often contain sensitive information about an organization or its customers. A more secure approach is always to keep logs encrypted (ciphertext). This paper presents “SigML++”, an extension of “SigML” for supervised log anomaly detection on encrypted data. SigML++ uses Fully Homomorphic Encryption (FHE) according to the Cheon–Kim–Kim–Song (CKKS) scheme to encrypt the logs and then uses an Artificial Neural Network (ANN) to approximate the sigmoid (σ(x)) activation function probabilistically for the intervals [−10,10] and [−50,50]. This allows SigML++ to perform log anomaly detection without decrypting the logs. Experiments show that SigML++ can achieve better low-order polynomial approximations for Logistic Regression (LR) and Support Vector Machine (SVM) than existing methods. This makes SigML++ a promising new approach for secure log anomaly detection.

Ecological Aftermaths in the Black Pacific: The Racial Logics of Settler Security and Writing Toward Futurity in the Poetry of Teresia Teaiwa and Kathy Jetñil-Kijiner

Ecological Aftermaths in the Black Pacific: The Racial Logics of Settler Security and Writing Toward Futurity in the Poetry of Teresia Teaiwa and Kathy Jetñil-Kijiner

LAVA: Log Authentication and Verification Algorithm

Log files provide essential information regarding the actions of processes in critical computer systems. If an attacker modifies log entries, then critical digital evidence is lost. Therefore, many algorithms for secure logging have been devised, each achieving different security goals under different assumptions. We analyze these algorithms and identify their essential security features. Within a common system and attacker model, we integrate these algorithms into a single (parameterizable) “meta” algorithm called LAVA that possesses the union of the security features and can be parameterized to yield the security features of former algorithms. We present a security and efficiency analysis and provide a Python module that can be used to provide secure logging for forensics and incident response.

Regulating misleading political advertising on online platforms: an example of regulatory mercantilism in digital policy

ABSTRACT Since its Joint Communication on Hybrid Threats, the EU has publicly recognized the risks to its security posed by non-traditional means aimed at undermining its legitimacy. The propagation of disinformation including misleading political advertising serves as a key example of how the Commission’s perception of the EU’s vulnerability to hybrid threats in times of geopolitical instability is shaping its regulatory policies. This article uses the framework of regulatory mercantilism, which argues that in conditions of perceived vulnerability, a state-like actor will reassert regulatory control based on a security logic in areas previously characterized by self-regulatory regimes. This article considers the Commission’s 2019–2024 priorities, and how the spheres of technology, security, and democracy policies are intersecting as a response to hybrid threats. As a result, online platform governance in the EU is being substantially restructured with a move from systems of self-regulation to co-regulation backed by sanction as a means of combating hybrid threats online. The Commission’s “taking back control” from platforms in the context of a digital sovereignty agenda serves as an example of regulatory mercantilism in digital policy, which sees the Commission seek to promote regulatory strength in response to perceived vulnerability.

Mechanical sex, science, security: Intersex medical violence, Thomas Hobbes and John Money’s invention of gender

According to a widespread contemporary medical discourse, intersex people’s well-being is threatened by their own bodily features, which must be ‘corrected’ through emergency surgical measures. Yet intersex people and activists have abundantly documented how these measures enact precisely the suffering that they were framed as countering. This article asks how the presence of such exceptionalist security logic in mundane hospital settings highlights particular intersections of security, bodies and materiality in Western modernity. It puts 17th-century philosopher Thomas Hobbes in dialogue with 20th-century sexologist John Money, and shows how both struggled to construct social order in spite of the disorderly materiality of human bodies. Hobbes ‘invented’ a universal abstracted body, a machine in which matter is subsumed to the fiction of a social will. As science provided mechanistic understandings of sex, race and deviance, the messy materiality of concrete bodies eventually failed to substantiate a biological grounding for the sex binary. Money then ‘invented’ the concept of gender – a social category to which physiological sex is subservient, which feminists later borrowed – to justify violent interventions that physically cut that disorderly materiality out of intersex people’s bodies.

Perception of a “Color Revolution” in China under the Xi Jinping Regime and National Security Implications—Close interconnection between domestic politics and diplomacy—

The Xi Jinping regime in China has been implementing various policies that prioritize the concept of “national security,” and highlight concerns about the perceived threat of a Color Revolution. The concept of “national security” has been elevated to a policy philosophy of “holistic” or “comprehensive” security. This comprehensive security means that “security” is related to all areas, including the economy, culture, and the environment, and that security takes precedence over other factors such as the economy, culture, and the environment. Diplomacy is no exception, and the policy philosophy is to treat diplomacy and security together, where security takes precedence over diplomacy. The emphasis on the logic of national security also influenced its Hong Kong policy and its policy of governing the Xinjiang Uyghur Autonomous Region. Furthermore, it led to the strengthening of domestic management of foreigners and international NGOs. Moreover, this domestic logic of “national security” has had a strong influence on foreign policy. For example, the domestically propagated discourse on the “color revolution” directly influenced the US-China summit meeting, where the topic of discussion was whether the US was planning to overthrow the CCP regime or not. In China, diplomacy and domestic politics appear to be rapidly becoming one and the same.