Security Appliances Research Articles

[formula omitted]-LB: Software-defined IDS with UAV Resource Aware Load-Balancing in FANET disaster scenarios

In critical scenarios like natural disasters, the physical infrastructure of the network may be heavily damaged or completely torn down making difficult communications and rescue activities. In such cases, due to their nature, Unmanned Aerial Vehicles (UAVs) are usually employed to provide a temporary support network by forming a Flying Ad-Hoc Network (FANET). However, this network should be carefully monitored and safeguarded to guarantee its stability by deploying network security appliances, like Intrusion Detection Systems (IDSs). In the wake of these considerations, this paper delves into the utilization of IDS functions deployed on UAVs, named IDS-enabled UAVs, in emergencies leveraging the modern Software-Defined Network (SDN) paradigm. Specifically, the study proposes a dynamic approach to promptly activate IDS-enabled UAVs, in an SDN-FANET, responding to network traffic increasing and/or malicious activities taking place within the network. In order to achieve this objective, a Software-defined IDS with UAV Resource Aware Load Balancing strategy – SURA-LB – is proposed and implemented within the SDN controller, leveraging its programmable nature and its holistic view of the network. The SURA-LB strategy equally distributes the load among the set of IDS-enabled UAVs by considering their resources and energy utilization along with the experienced network traffic conditions. Finally, an extensive experimental campaign shows the benefits of the proposed load-balancing strategy in reducing and fairly distributing the workload among the IDS-enabled UAVs outperforming naive and baseline load-balancing strategies like Random and Round-Robin and, therefore, bolstering the resilience and the reliability of the set of IDS-enabled UAVs while the traffic to be monitored and analyzed increases.

4MIDable: Flexible Network Offloading For Security VNFs

The ever-growing volume of network traffic and widening adoption of Internet protocols to underpin common communication processes augments the importance of network security. In order to enforce network security policies, network managers adopt a widening set of middleboxes and network appliances to improve traffic monitoring and processing capabilities. The resource requirements to support network security appliances are constantly increasing, making efficiency of these systems an essential aspect. The move toward Software-Defined Networking and programmable data planes offers a mean to offload traffic processing functionalities to within the network itself. To this end, we present the 4MIDable framework: a platform that facilitates the integration of existing middleboxes and monitoring appliances with an SDN (P4) network infrastructure. We also present P4Protect, a 4MIDable agent that protects the network from control plane DoS attacks with negligible impact on control plane latency, and P4ID (P4-Enhanced Intrusion Detection), a 4MIDable agent that offers stateful processing and feedback to unmodified Intrusion Detection System middleboxes and reduces traffic processing by over 80% without affecting threat detection rates.

AI-Assisted Security Alert Data Analysis with Imbalanced Learning Methods

Intrusion analysis is essential for cybersecurity, but oftentimes, the overwhelming number of false alerts issued by security appliances can prove to be a considerable hurdle. Machine learning algorithms can automate a task known as security alert data analysis to facilitate faster alert triage and incident response. This paper presents a bidirectional approach to address severe class imbalance in security alert data analysis. The proposed method utilizes an ensemble of three oversampling techniques to generate an augmented set of high-quality synthetic positive samples and employs a data subsampling algorithm to identify and remove noisy negative samples. Experimental results using an enterprise and a benchmark dataset confirm that this approach yields significantly improved recall and false positive rates compared with conventional oversampling techniques, suggesting its potential for more effective and efficient AI-assisted security operations.

A Cooperative Defense Framework Against Application-Level DDoS Attacks on Mobile Edge Computing Services

Mobile edge computing (MEC), extending computing services from cloud to edge, is recognized as one of key pillars to facilitate real-time services and tackle backhaul bottleneck. However, it is not economically efficient to attach intensive security appliances to every MEC node to defend application-level DDoS attacks and ensure the availability of services. Thus, we explore the elasticity of security defense among MEC nodes by proposing a COoperative DEfense ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">CODE</i> ) framework for MEC, referred to as <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">CODE4MEC</i> . CODE4MEC aims to adapt to traffic changes by coordinating container-carried defensive resources among cooperative MEC nodes in an automatic way. Towards this aim, we propose four control plane functions to enable a life-cycle management for CODE4MEC, namely, CODE triggering, scheduling, coordination and releasing. However, an effective CODE4MEC requires non-trivial algorithmic schemes, in particular for CODE scheduling and coordination functions. We thus design an online combinatorial auction mechanism for real-time CODE scheduling, and prove a tighter performance bound relative to prior arts. As for CODE coordination, a flow-based traffic and context information coordination scheme is proposed to enable classical defense schemes to work properly and efficiently. Finally, using a combination of real testbed and simulation evaluations, we validate the effectiveness of CODE4MEC.

Mobile Phone Based Home Surveillance System

This paper presents an application of the GSM technology. Using the public GSM networks, a mobile phone based home surveillance system has been designed. The system automatically sends sms messages to specified phone / phones in case any door or window is opened by some intruder. The system also allows the homeowner monitoring and controlling the electrical home appliances via the mobile phone by sending commands in the form of SMS messages and receiving the appliances status. Virtual control panel is realized using VB on windows 98. Electronic circuit to control security and electrical appliances is interfaced to PC using PCL-812 Lab card. This home surveillance system has been tested and found to very effective in security control as well as controlling and monitoring electrical home appliances virtually from any place.

Automatic Construction of Hardware Traffic Validators

This paper describes a fully automated process that creates a custom hardware traffic validator directly from a formal grammar and deploys it within a specialized network security appliance. The appliance appears as a hidden, all-hardware “bump-in-the-wire” that can be inserted within any network segment; it stores and validates messages on-the-fly, and either forwards or drops individual packets in real-time. Consequently, it serves to disrupt and mitigate stealthy remote attacks that leverage zero-day exploits and persistent implants. Allowed traffic, files, and mission payload formats are specified formally using a standard Look-Ahead, Left-to-Right (LALR) grammar that operates on ASCII and/or binary data. The grammars can be expressed either in Backus-Naur Form (BNF), used by industry standard tools such as Bison, or through state-of-the-art combinators, such as Hammer, under development within the DARPA SafeDocs program. Bison and Hammer compiler tools are used to generate standard shift/reduce parsing tables. These tables are post-processed to improve their compactness and practical viability. The optimized tables are then combined with a generic push-down automaton to form a complete parser. The parser is then automatically transformed into a hardware circuit using High-Level Synthesis (HLS). The result is a composable block of circuitry that can be directly inserted into a generic communications harness embedded within a Field Programmable Gate Array (FPGA) on the network appliance.

Agency banking business and operators’ risk of exposure to criminal victimisation in Ibadan, Nigeria

Despite the growing popularity of the agency banking business in Nigeria, a major problem confronting its operators is criminal victimisation. Thus, this study examined the risk of exposure of agency banking operators in Ibadan city to criminal attacks. Routine activity theory was deployed as the conceptual framework. Data were elicited from 11 operators of the business who were victims of criminal attacks and 20 of their counterparts who were yet to be victimised, using key informant and in-depth interview methods. Results showed that operators of agency banking business were being targeted by lone criminals and gangs of criminals using violent and non-violent tactics. Scamming through fake SMS credit/debit transaction alerts was the most common type of criminal victimisation suffered by people involved in the business. A combination of factors was responsible for their vocational-related victimisation. It is imperative for operators of agency banking business to invest in physical security appliances, such as CCTV surveillance system, protective barriers, and alarm devices.

An Efficient Framework for Securing the Smart City Communication Networks.

Recently, smart cities have increasingly been experiencing an evolution to improve the lifestyle of citizens and society. These emerge from the innovation of information and communication technologies (ICT) which are able to create a new economic and social opportunities. However, there are several challenges regarding our security and expectation of privacy. People are already involved and interconnected by using smart phones and other appliances. In many cities, smart energy meters, smart devices, and security appliances have recently been standardized. Full connectivity between public venues, homes, cares, and some other social systems are on their way to be applied, which are known as Internet of Things. In this paper, we aim to enhance the performance of security in smart city communication networks by using a new framework and scheme that provide an authentication and high confidentiality of data. The smart city system can achieve mutual authentication and establish the shared session key schemes between smart meters and the control center in order to secure a two-way communication channel. In our extensive simulation, we investigated and evaluated the security performance of the smart city communication network with and without our proposed scheme in terms of throughput, latency, load, and traffic received packet per seconds. Furthermore, we implemented and applied a man-in-the-middle (MITM) attack and network intrusion detection system (NIDS) in our proposed technique to validate and measure the security requirements maintaining the constrained resources.

Cybersecurity in ICT Supply Chains: Key Challenges and a Relevant Architecture.

The specific demands of supply chains built upon large and complex IoT systems, make it a must to design a coordinated framework for cyber resilience provisioning, intended to guarantee trusted supply chains of ICT systems, built upon distributed, dynamic, potentially insecure, and heterogeneous ICT infrastructures. As such, the solution proposed in this paper is envisioned to deal with the whole supply chain system components, from the IoT ecosystem to the infrastructure connecting them, addressing security and privacy functionalities related to risks and vulnerabilities management, accountability, and mitigation strategies, as well as security metrics and evidence-based security assurance. In this paper, we present FISHY as a preliminary architecture that is designed to orchestrate existing and beyond state-of-the-art security appliances in composed ICT scenarios. To this end, the FISHY architecture leverages the capabilities of programmable networks and IT infrastructure through seamless orchestration and instantiation of novel security services, both in real-time and proactively. The paper also includes a thorough business analysis to go far beyond the technical benefits of a potential FISHY adoption, as well as three real-world use cases highlighting the envisioned benefits of a potential FISHY adoption.

SmartX Multi-Sec: A Visibility-Centric Multi-Tiered Security Framework for Multi-Site Cloud-Native Edge Clusters

Recently, to match the emerging demands for multi-site edge clouds, the cloud-based information and communication technology (ICT) infrastructure is rapidly expanding. To protect distributed edge-based cloud assets from networking-based threats by recognizing suspicious traffic, cloud operators should monitor the overall underlying topology to categorize and identify diversified networking packet traffic, flowing through various paths among virtualized and containerized cloud nodes. Perimeter-based networking security, which employs security appliances in fixed locations, cannot address this visibility challenge. As a result, in this paper, we propose the SmartX Multi-tier Security (Multi-Sec) framework, which aims to provide intuitive and systematic visibility for multi-site edge-cloud security. SmartX Multi-Sec abstracts the underlying networking topology among multi-site edge clusters as multiple onion-ring-based tiers of physical, virtualized, and containerized cloud nodes. It also provides collective DevSecOps automation features for monitoring, visualizing, and filtering targeted networking traffic from the respective tiers of the abstracted networking topology. The resulting flow-centric visibility using SmartX Multi-Sec can be featured with extended Berkeley Packet Filter and eXpress Data Path (eBPF/XDP)-leveraged lightweight flow capture and filtering, three-dimensional onion-ring visualization, and automated deployment of DevSecOps functions. By integrating these features, the Proof-of-Concept (PoC)-version of the SmartX Multi-Sec framework is realized to verify the flexible and scalable flow-centric security for multi-site cloud-native edge clouds.

Deep Learning and Entity Embedding-Based Intrusion Detection Model for Wireless Sensor Networks

Wireless sensor networks (WSNs) are considered promising for applications such as military surveillance and healthcare. The security of these networks must be ensured in order to have reliable applications. Securing such networks requires more attention, as they typically implement no dedicated security appliance. In addition, the sensors have limited computing resources and power and storage, which makes WSNs vulnerable to various attacks, especially denial of service (DoS). The main types of DoS attacks against WSNs are blackhole, grayhole, flooding, and scheduling. There are two primary techniques to build an intrusion detection system (IDS): signature-based and data-driven-based. This study uses the data-driven approach since the signature-based method fails to detect a zero-day attack. Several publications have proposed data-driven approaches to protect WSNs against such attacks. These approaches are based on either the traditional machine learning (ML) method or a deep learning model. The fundamental limitations of these methods include the use of raw features to build an intrusion detection model, which can result in low detection accuracy. This study implements entity embedding to transform the raw features to a more robust representation that can enable more precise detection and demonstrates how the proposed method can outperform state-of-the-art solutions in terms of recognition accuracy.

Retrofitted IoT Based Communication Network with Hot Standby Router Protocol and Advanced Features for Smart Buildings

The advent of renewable energy sources brings the concept of building power systems, which are located at the load-centres/buildings. Further, the concept of smart building in the modern energy era increases operational efficiency, safety, and consumer comfort, where, all its operations are monitored and controlled by central monitoring and control unit (CMCU). However, for reliable communication between the components of smart building and the CMCU, a well-established network is essential. This network shall provide advanced features such as user alerts, usage details, remote control options, link failure handling, security, etc. However, the traditional IoT network can’t provide all these features and poses a challenge to use it for smart buildings due to inadequate technology to meet the unremitting user requirements. In this context, this paper proposes a retrofitted IoT based communication network with Hot Standby Router Protocol (HSRP) for remote monitoring and control of smart building devices. Besides, this proposed network possess Adaptive Security Appliance (ASA) firewall, Message Queuing Telemetry Transport (MQTT) protocol, and email alert to facilitate all the advanced features. The HSRP handles the link failures by providing a redundant path, thereby ensures reliable communication in the network. The ASA firewall provides intrusion prevention (blocking unauthorized packets). The MQTT enables the broker for broadcasting messages to all the subscribers of a particular topic. Similarly, the email alert provides communication between different users in the building. Altogether, this proposed communication network establishes a reliable monitoring and control facility in smart buildings, which is simulated and verified using Cisco Packet Tracer 7.3.1.

Decentralized accessibility of e-commerce products through blockchain technology

A distributed and transparent ledger system is considered for various e-commerce products including health medicines, electronics, security appliances, food products and many more to ensure technological and e-commerce sustainability. This solution, named as ‘PRODCHAIN’, is a generic blockchain framework with lattice-based cryptographic processes for reducing the complexity for tracing the e-commerce products. Moreover, we have introduced a rating based consensus process called Proof of Accomplishment (PoA). The solution has been analyzed and experimental studies are performed on Ethereum network. The results are discussed in terms of latency and throughput which prove the efficiency of PRODCHAIN in e-commerce products and services. The presented solution is beneficial for improving the traceability of the products ensuring the social and financial sustainability. This work will help the researchers to gain knowledge about the blockchain implications for supply chain possibilities in future developments for society.

A smart home system with security and electrical appliances

As the need for the daily household appliances and home security increases, the application of interaction technologies and electrical appliances used in smart home system has been widely developed. Considering home security, life convenience, and construction cost, a smart home system conjugated with single-chip controlling unit is presented in the paper. The functions of an intelligent home design include daily tasks (cooking, a morning wake-up call) and security mission when residents are not at home. Here, infrared ray sensors used to detect the intruding event are installed onto the entrances (i.e. windows and door). In addition, an IPCAM’s motion detecting function is also adopted for intruding event detecting. Considering the entrance convenience (without key) and safe (key losing) when coming home, a vocal identification system in conjunction with keyboard inputting device (an auxiliary device for the vocal identification system) system is adopted in the second generation of smart home system. In order to facilitate the manipulation of the smart home system, an android-based cell phone connected to the microcontroller is also established. And, to assure the home safety, the second lock (lock #2) will be triggered by the user via the cell phone if the intruding event is confirmed. The user can open the optional window to recheck the reality. Moreover, a ventilation system linked to thermal detectors can be automatically triggered via internet. Consequently, “family activity” can be pretended by the audio broadcast system while the house is vacant.

On High-Speed Flow-Based Intrusion Detection Using Snort-Compatible Signatures

Signature-based Network Intrusion Detection Systems (NIDS) have become state-of-the-art in modern network security solutions. However, most systems are not designed for modern high-speed network links. In the field of network monitoring, an alternative solution has become the choice for such high-speed networks. Flow-monitoring, typically based on the Internet Protocol Flow Information Export (IPFIX) standard, now goes well beyond collecting statistical information about network connections. Current solutions are even able to include selected parts of the payload in these Flows to be used in conjunction with NIDS. Recently, we extended this concept to application layer HTTP Flows. We now present our improved version of the IPFIX-based Signature-based Intrusion Detection System (FIXIDS). <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Fixids</small> makes use of HTTP intrusion detection signatures from the popular Snort system and applies them to incoming IPFIX-conforming HTTP Flows. Our evaluation shows that <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Fixids</small> can deal with four times higher network data rates without drops compared to Snort, while maintaining the same event detection rate. Furthermore, a substantial part of the data traffic can be outsourced to <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Fixids</small> so that Snort can be relieved of a significant portion of rules and traffic. This increases both the detection rate and the data rate the overall security appliance can handle.

Special issue on video and imaging systems for critical engineering applications [SI 1096

A recent change in the global economy, experiencing an unparalleled integration of science and technology, i.e., smart watches, smartphones and other electronic gadgets, has dramatically changed the way we connect with the world around us. Various challenges and issues brought by this integration for mobile and video lie ahead, and many research questions remain to be answered. For instance, the complex nature of mobile and video imaging need radical version to the swift changes in our society, economy, environment, and technological revolution; there is an utmost need to address and propose dynamic and innovative solutions to problems which tend to be either complex or static or rapidly evolving with a large number of unknowns. Furthermore, the battle against the severe disease such as cancer, tuberculosis, high blood pressure and ECG, fight against the terror, exploration and management of the natural resources in remote area using remote sensing, underground and tunnel inspection, other and environmental monitoring are some of the areas that need to be addressed with urgency. In addition, the complication of involved imaging scenarios, and demanding design parameters, i.e., signal to noise ratio, high speed specification, high contrast and spatial resolution, complex background, harsh environment, requires the growth of multifunctional, scalable imaging suit of sensors, solutions driven by novelty, operating on diverse detection and imaging principles. Moreover, artificial neural network when combined with pattern recognition techniques, such as classification, feature selection, clustering, text analysis, image and color representation of video and image processing promise the solution of challenging technical problems, below the umbrella of complex video and imaging situations of stimulating technical problems, with applications in medical video and image processing, aerospace, radars and defense system, and other security appliances. Witnessing all these mobile breakthroughs, therefore, we believe that it is important to investigate the current advances and future trends in the mobile image and video processing.

Arduino, Wi-Fi based Home Automation Systems and Security Appliances- A Review

Arduino, Wi-Fi based Home Automation Systems and Security Appliances- A Review

Design and Simulation of a Secured Enterprise Network for Faculty of Engineering, Rivers State University

Institutions generally seek for a network infrastructure solution that intelligently combines voice and data networks. To compete globally, It has become necessary for the Faculty of Engineering to build and setup a secured enterprise network solution to drive the rapid engineering and technological advancement of the University. The aim of this study is to develop a secured, scalable, available, and manageable enterprise network for the Faculty of Engineering, Rivers State University, Port Harcourt, Nigeria. In this article the various services that comprise the enterprise network as a unit have been put together using the Hierarchical Network Model. The physical and logical network topology was designed for the Faculty of Engineering infrastructures and the results from the simulation showed that any user who tried to connect to the network and initiated http traffic were redirected to the authentication server for verification of credentials, before being allowed on the network. The result also shows that the Cisco Adaptive Security Appliance, the Core Router, the distribution switches and the integrated service routers were properly configured. The design reduced network device load and the time to identify network issues to resolve them. The configured network security provided availability, integrity, and confidentiality. This design also enhanced rapid connectivity, and the inclusion of new devices did not affect the transfer of packets. Finally, the specifications and commands used in this study is a model that could be modified and deployed for other Faculties or Universities. Keywords : Configuration,design, enterprise network, topology, security, Cisco ASA. DOI : 10.7176/CEIS/10-5-04 Publication date :June 30 th 2019

FORTRESS: An Efficient and Distributed Firewall for Stateful Data Plane SDN

The Software Defined Networking (SDN) paradigm decouples the logic module from the forwarding module on traditional network devices, bringing a wave of innovation to computer networks. Firewalls, as well as other security appliances, can largely benefit from this novel paradigm. Firewalls can be easily implemented by using the default OpenFlow rules, but the logic must reside in the control plane due to the dynamic nature of their rules that cannot be handled by data plane devices. This leads to a nonnegligible overhead in the communication channel between layers, as well as introducing an additional computational load on the control plane. To address the above limitations, we propose the architectural design of FORTRESS: a stateful firewall for SDN networks that leverages the stateful data plane architecture to move the logic of the firewall from the control plane to the data plane. FORTRESS can be implemented according to two different architectural designs: Stand-Alone and Cooperative, each one with its own peculiar advantages. We compare FORTRESS against FlowTracker, the state-of-the-art solution for SDN firewalling, and show how our solution outperforms the competitor in terms of the number of packets exchanged between the control plane and the data plane—we require 0 packets for the Stand-Alone architecture and just 4 for the Cooperative one. Moreover, we discuss how the adaptability, elegant and modular design, and portability of FORTRESS contribute to make it the ideal candidate for SDN firewalling. Finally, we also provide further research directions.

A Comprehensive Tutorial on Science DMZ

Science and engineering applications are now generating data at an unprecedented rate. From large facilities such as the Large Hadron Collider to portable DNA sequencing devices, these instruments can produce hundreds of terabytes in short periods of time. Researchers and other professionals rely on networks to transfer data between sensing locations, instruments, data storage devices, and computing systems. While general-purpose networks, also referred to as enterprise networks, are capable of transporting basic data, such as e-mails and Web content, they face numerous challenges when transferring terabyte- and petabyte-scale data. At best, transfers of science data on these networks may last days or even weeks. In response to this challenge, the Science Demilitarized Zone (Science DMZ) has been proposed. The Science DMZ is a network or a portion of a network designed to facilitate the transfer of big science data. The main elements of the Science DMZ include: 1) specialized end devices, referred to as data transfer nodes (DTNs), built for sending/receiving data at a high speed over wide area networks; 2) high-throughput, friction-free paths connecting DTNs, instruments, storage devices, and computing systems; 3) performance measurement devices to monitor end-to-end paths over multiple domains; and 4) security policies and enforcement mechanisms tailored for high-performance environments. Despite the increasingly important role of Science DMZs, the literature is still missing a guideline to provide researchers and other professionals with the knowledge to broaden the understanding and development of Science DMZs. This paper addresses this gap by presenting a comprehensive tutorial on Science DMZs. The tutorial reviews fundamental network concepts that have a large impact on Science DMZs, such as router architecture, TCP attributes, and operational security. Then, the tutorial delves into protocols and devices at different layers, from the physical cyberinfrastructure to application-layer tools and security appliances, that must be carefully considered for the optimal operation of Science DMZs. This paper also contrasts Science DMZs with general-purpose networks, and presents empirical results and use cases applicable to current and future Science DMZs.