Security Flaws Research Articles

A Review of CPS Design and Vulnerability Analysis

Cyber-Physical Systems (CPS) offer a wide array of applications. Integration of various heterogeneous infrastructures that generate data for intelligent analysis is discussed. The objective of this article is to review CPS and provide a discussion of the system's security flaws. Many earlier investigations have also been properly explained. Because of the increasing usage of CPS in sensitive organizations (e.g., healthcare and connected homes), the requirement for a risk assessment strategy is essential. The major concentration of risk evaluation has shifted from computer risk evaluation to network-based risk analysis as a result of our substantial dependence on the Internet. The goal of CPS vulnerability analysis is to develop a quantitative model for future system protection.

APT-Attack Detection Based on Multi-Stage Autoencoders

In the face of emerging technological achievements, cyber security remains a significant issue. Despite the new possibilities that arise with such development, these do not come without a drawback. Attackers make use of the new possibilities to take advantage of possible security defects in new systems. Advanced-persistent-threat (APT) attacks represent sophisticated attacks that are executed in multiple steps. In particular, network systems represent a common target for APT attacks where known or yet undiscovered vulnerabilities are exploited. For this reason, intrusion detection systems (IDS) are applied to identify malicious behavioural patterns in existing network datasets. In recent times, machine-learning (ML) algorithms are used to distinguish between benign and anomalous activity in such datasets. The application of such methods, especially autoencoders, has received attention for achieving good detection results for APT attacks. This paper builds on this fact and applies several autoencoder-based methods for the detection of such attack patterns in two datasets created by combining two publicly available benchmark datasets. In addition to that, statistical analysis is used to determine features to supplement the anomaly detection process. An anomaly detector is implemented and evaluated on a combination of both datasets, including two experiment instances–APT-attack detection in an independent test dataset and in a zero-day-attack test dataset. The conducted experiments provide promising results on the plausibility of features and the performance of applied algorithms. Finally, a discussion is provided with suggestions of improvements in the anomaly detector.

Web application security

This study aims to show how security flaws of web applications can threat information security. Web Application Security is a branch of Information Security which focuses on web application level security flaws and their solutions. Evolution of Web continues with a big momentum. Amount of information shared over Web increases every day, various business domains continue to integrate their operations to digital world. This brings its own risks and makes Information Security of Web Applications more important than ever. Most common and serious Web vulnerabilities have been analyzed along with their solutions. This study focuses on how web developers can already prevent security problems during the development life cycle. What are the best practices to follow before/during the development and post-development phases? Which security tools can be used to support developers? Building totally secure web applications is not an easy job. Following security standards and development cycles with security concerns can already prevent most of the potential problems. A security checklist for web developers came out at the end of the study. Evolving web technologies and new security threats force us to keep this checklist up to date. We are working on a mechanism which will keep this checklist up to date.

A Comparative Study of Distributed Denial of Service Attacks On The Inter- net Of Things By Using Shallow Neural Network

The Internet of Things (IoT) is a term used to indicate a world in which objects are linked to the Internet. in some way, but not in the way that most people imagine. However, for the Internet of Things to be a success, computing must go beyond standard scenarios involving laptops and smartphones to include the networking of common intelligent Intelligence integration with the environment”, ”Smart homes, cities, and other wearable devices are examples. As a result, there will be new computing problems and features. Because of its variety, the Internet of Things has a difficult time guaranteeing universal privacy in areas like smart homes, smart hospitals, and so forth. Vulnerability can appear in a variety of forms. The internet of things has grown in popularity during the previous era. The internet of things (IoT), which may be characterized as a network of networked gadgets, has exploded in popularity during the last decade. Many elements of our lives have been fast-devoured by the Internet of Things (IoT). Smart homes, savvy cities, and other wearable devices are examples. IoT devices work to achieve their objectives, which include the building of a contemporary city. At the same time, there are a lot of security flaws in IoT devices that attackers could exploit. Distributed Denial of Service (DDoS) is the most common hazard to IoT security. The main goal of these assaults is to knock down victim computers and prevent legitimate people from accessing them using malicious software. The goal of this research is to provide compression of two algorithms 1. Scaled Conjugate Gradient (SCG) and 2. Levenberg–Marquardt algorithms (LMA) by training a Shallow neural network look into and assesses security vulnerabilities linked to DDoS attacks, as well as solutions like layered IoT device protection. In this research, it is discovered that the conjugant gradient algorithm has better accuracy as compared with Levenberg–Marquardt algorithm.

Optimizing IoT Web Fuzzing by Firmware Infomation Mining

IoT web fuzzing is an effective way to detect security flaws in IoT devices. However, without enough information of the tested targets, IoT web fuzzing is often blind and inefficient. In this paper, we propose to use static analysis to assist IoT web fuzzing. Our insight is that plenty of useful information is hidden in firmwares, which can be mined by static analysis and used to guide the subsequent dynamic analysis—fuzzing. Hence, our approach contains two stages: pre-fuzzing stage and fuzzing stage. In the pre-fuzzing stage, we perform static analysis on the IoT firmwares to exploit helpful information, such as web page paths, interfaces, and shared keywords. These kinds of information are used to construct diverse seeds for covering more web paths and interfaces, and are also used to prioritize seeds according to their importance (related to shared keywords) in the fuzzing stage. Based on this approach, we implement a prototype IoT web fuzzing system—IoTParser. Experiments show that IoTParser increased the vulnerability discovery capability by 44% on average, while increasing the vulnerability discovery efficiency by 48.2% on average compared with state-of-the-art IoT web fuzzer. In addition, IoTParser has found 13 vulnerabilities, including 7 0-day.

Early SoCs Information Flow Policies Validation using SystemC-based Virtual Prototypes at the ESL

Virtual Prototypes (VPs) at the Electronic System Level (ESL) are being increasingly adopted by the semiconductor industry and play an important role in modernizing the System-on-Chips (SoCs) design flow to raise design productivity and reduce time-to-market constraints. Due to their early availability and significantly faster simulation speed in comparison to Register Transfer Level (RTL) designs, VPs are used as reference models for lower levels of abstraction. Leveraging VPs and extending their use-cases for early security validation are shown as a promising direction. As the cost of fixing any security flaws increases with the stage of development, VP-based security validation can significantly avoid costly iterations. In this paper, we present a novel VP-based dynamic information flow analysis approach at the ESL, consisting of three main phases which are run-time behavior extraction (in terms of transactions), transactions transformation, and security validation. The proposed approach empowers designers to validate the information flow policies of a given VP-based SoC against the most occurring security threat models which are information leakage (confidentiality) and unauthorized access to data in a memory (integrity). Experimental results including an extensive set of standard benchmarks and two real-world VP-based SoCs demonstrate the scalability and applicability of the proposed approach.

A two-factor security authentication scheme for wireless sensor networks in IoT environments

As an important part of the Internet of Things, wireless sensor networks have been widely used in all aspects of people's lives. Identity authentication in wireless sensor networks guarantees security for users to safely access real-time data in sensor nodes. In the literature, numerous research works have been done on designing an efficient and secure authentication scheme for wireless sensor networks, but most of them suffer from various security flaws. In 2019, Sharif et al. proposed an efficient user authentication scheme, which was later found insecure by Chen et al. who then proposed an enhanced scheme. However, we find that Chen et al.’s scheme is vulnerable to off-line password guessing attack, impersonation attack and fails to achieve perfect forward secrecy, user anonymity, and unlinkability. To overcome those weaknesses, we propose a two-factor authentication scheme based on elliptic curve cryptosystem, and prove its security by formal verification tool ProVerif. Compared with related schemes, our scheme provides higher level of security, meanwhile achieves acceptable efficiency in computational cost. To the best of our knowledge, this is the first scheme fulfilling both two-factor security and user anonymity under sensor node captured attack.

An Improved ID-Based Data Storage Scheme for Fog-Enabled IoT Environments.

In a fog-enabled IoT environment, a fog node is regarded as the proxy between end users and cloud servers to reduce the latency of data transmission, so as to fulfill the requirement of more real-time applications. A data storage scheme utilizing fog computing architecture allows a user to share cloud data with other users via the assistance of fog nodes. In particular, a fog node obtaining a re-encryption key of the data owner is able to convert a cloud ciphertext into the one which is decryptable by another designated user. In such a scheme, a proxy should not learn any information about the plaintext during the transmission and re-encryption processes. In 2020, an ID-based data storage scheme utilizing anonymous key generation in fog computing was proposed by some researchers. Although their protocol is provably secure in a proof model of random oracles, we will point out that there are some security flaws inherited in their protocol. On the basis of their work, we further present an improved variant, which not only eliminates their security weaknesses, but also preserves the functionalities of anonymous key generation and user revocation mechanism. Additionally, under the Decisional Bilinear Diffie–Hellman (DBDH) assumption, we demonstrate that our enhanced construction is also provably secure in the security notion of IND-PrID-CPA.

A Systematic Review of the Intrusion Detection Techniques in VANETS

Vehicular Ad hoc Networks are an important subset of MANETs. VANET is the group of vehicles that are connected to each other wirelessly. VANET security is a major issue that is being worked upon these days. One tiny security flaw can cause a huge loss of lives. For ensuring the security, Intrusion Detection Systems (IDS) are implemented in VANETs for detecting any intrusion. The IDS analyzes the network and detects any malicious node if present. This paper presents a comprehensive review of some of the recent and important intrusion detection research works and presents a comparative analysis of the techniques used in detecting intrusions as well as attacks focused.

DESIGN AND DEVELOPMENT OF ANTI-LOCK BRAKING SYSTEM FOR ELECTRIC VEHICLE

Modern automobiles are more than just mechanical gadgets. Because of the connectivity which is increased between the vehicular networks and the present outside world, hackers now have more security flaws via which they can cause exploitations of a vehicular network. The CAN network that is controlled area network is a common communication bus protocol that helps ECU that is electronic control units in a vehicular network to communicate with one another. The safety systems which connect to network, on the other hand, are particularly vulnerable to malicious internal or external assaults due to their varied security flaws. This study presents a new way for introducing a Message Authentication System to enhance CAN security. The electric vehicle is basically driven by the lithium-ion battery coupled to hub motor. The motor needs a power supply to run which can be from an array of source. Electric vehicles do not emit any carbon dioxide because they are fuelled by electricity rather than any other fuel. Carbon dioxide contributes to the greenhouse effect. The design of the electric vehicle includes Hub motor which is brushless dc motor the outer part which rotates is called rotor and permanent magnets is used above the rotor inner part is called as stator and windings are used above it. Hence hub motors are dc motors as they work on dc voltage. Lithium-ion battery is made up of anode, cathode, electrolyte and two current collectors (positive and negative). Li-ion batteries can be recharged 100 times and are more stable. Henceforth, high efficiency with less noise and environment friendly electric vehicle is designed. The method that is proposed and implemented in a MATLAB and Simulink of CAN-based in the networks of the vehicle design along with ABS. By introducing additional security characteristic information unique to each transmitted CAN packets, model that applies Authentication of messages with a safety mechanism for any unknown detection that is intruded. The suggested method's result analysis revealed the fact that the feature which is security

DESIGN AND DEVELOPMENT OF ANTI-LOCK BRAKING SYSTEM FOR ELECTRIC VEHICLE

Modern automobiles are more than just mechanical gadgets. Because of the connectivity which is increased between the vehicular networks and the present outside world, hackers now have more security flaws via which they can cause exploitations of a vehicular network. The CAN network that is controlled area network is a common communication bus protocol that helps ECU that is electronic control units in a vehicular network to communicate with one another. The safety systems which connect to network, on the other hand, are particularly vulnerable to malicious internal or external assaults due to their varied security flaws. This study presents a new way for introducing a Message Authentication System to enhance CAN security. The electric vehicle is basically driven by the lithium-ion battery coupled to hub motor. The motor needs a power supply to run which can be from an array of source. Electric vehicles do not emit any carbon dioxide because they are fuelled by electricity rather than any other fuel. Carbon dioxide contributes to the greenhouse effect. The design of the electric vehicle includes Hub motor which is brushless dc motor the outer part which rotates is called rotor and permanent magnets is used above the rotor inner part is called as stator and windings are used above it. Hence hub motors are dc motors as they work on dc voltage. Lithium-ion battery is made up of anode, cathode, electrolyte and two current collectors (positive and negative). Li-ion batteries can be recharged 100 times and are more stable. Henceforth, high efficiency with less noise and environment friendly electric vehicle is designed. The method that is proposed and implemented in a MATLAB and Simulink of CAN-based in the networks of the vehicle design along with ABS. By introducing additional security characteristic information unique to each transmitted CAN packets, model that applies Authentication of messages with a safety mechanism for any unknown detection that is intruded. The suggested method's result analysis revealed the fact that the feature which is security that has been proven to be very effective method that detects and blocks any third-party that has been intruded into the anti-lock braking system through the controlled area network bus protocol, The stability is maintained between all coupled Electronic control units. Hence method that is implemented with the design of electric vehicle gives the best results of the output.

Tech Optimization in Cybersecurity Defenses by Advanced ML Methods: The Use Case of Volleyball Industry.

Individual and team performance can be improved by utilizing “smart” devices and applications that are connected through networks. In sports, the Internet of Things (IoT) refers to all of the “smart” devices and applications linked through networks to reduce injuries to the bare minimum, develop advanced training techniques, and apply analytical advanced sports improvement methodologies to improve sports performance in general. The Internet of Things (IoT) in sports is closely related to the objective of both security and privacy in sports, which has become a topic of crucial concern for the sports business in recent years, as evidenced by the adoption of IoT in sports years. For this reason, security flaws can have catastrophic consequences, including the disclosure of personal data, the manipulation of statistical findings, the harming of organizations' reputations, and enormous financial losses for the sporting organization. One or more of the consequences, as previously mentioned, is related to sports organizations and the athletes who are members of those organizations, and they have a direct impact on the corresponding set of sports-related, medical-related, and paramedical enterprises, specifically those that provide specialized sports equipment and associated services. A critical need to detect and quantify threats has long been recognized to better support decision-making when adopting or constructing a safe and reliable sports Internet-of-Things infrastructure, which is becoming increasingly common. Using advanced machine learning algorithms, this research provides a methodology for technology optimization in cybersecurity defenses that is then used in a unique case study utilizing volleyball players to demonstrate its effectiveness. In conjunction with a Monte Carlo optimization technique, an upgraded variant of fuzzy cognitive maps (FCM) is presented in greater detail. This model is utilized for a specific scenario of risk identification of volleyball industry, assessment, and optimization for IoT sports networks.

Secure Transmission Design for Cooperative NOMA in the Presence of Internal Eavesdropping

The application of successive interference cancellation (SIC) introduces critical security risks to cooperative non-orthogonal multiple access (NOMA) systems in the presence of untrustworthy network nodes, referred to as internal eavesdroppers. To address this potential security and reliability flaw, by assuming all users are untrusted, this letter investigates the effective secrecy throughput (EST) for a cooperative NOMA system, where a near user serves as an amplify-and-forward relay to help forward the information of a far user. Considering the inverse power allocation and SIC decoding order, a novel jamming strategy is proposed to enhance the security performance of the far user. Gauss-Chebyshev approximations of ESTs over Nakagami- <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">${m}$ </tex-math></inline-formula> channels are derived. Asymptotic EST expressions are proposed to provide further insights. Numerical results demonstrate that the proposed jamming strategy and the inverse power allocation and SIC decoding order are both essential for achieving positive secrecy rates for both users.

Lightweight Privacy and Confidentiality Preserving Anonymous Authentication Scheme for WBANs

The recent developments in the wireless body area networks (WBAN) play a vital role in the modern remote health care monitoring system. In WBAN, the deployed intelligent, resource-limited body sensors will collect the patient's biological information (BI) and communicate the same to the doctor for further action through the Internet. But during the communication among the WBAN entities, the privacy, security of the BI, and user's personal data need to be protected against various security threats. To address these security flaws, in this article, a computationally efficient privacy-preserving anonymous authentication scheme is proposed for resource-limited WBAN. Also, it preserves the physical security of sensors and the confidentiality of BI and provides conditional privacy to the WBAN users. The comprehensive security and performance evaluation phase ensures that the proposed scheme is efficient and secure in terms of computational and communication complexity when compared with the other conventional schemes.

Hideout: The Socializing App

Abstract: Advances in communication technologies offer new opportunities for the conduct of qualitative research. Among these, Hideout—an innovative video conferencing platform—has a number of unique features that enhance its potential appeal to qualitative and mixed-methods researchers. Hideout has become nearly synonymous with office meetings and socializing as people around the world have adapted to life at home amid the coronavirus outbreak. That has put the roughly 9-year-old company in the spotlight more than ever before - for both the good and the bad, as an onslaught of security issues have come to light. As the coronavirus pandemic forced millions of people to stay home over the past month, Hideout suddenly became the video meeting service of choice. It encourages users to connect with friends and familyMany Cybersecurity research companies research says that it found security flaws in video conferencing platforms. While Hideout has addressed the issue, the report raises deeper concerns about the safety of video-conferencing apps that require access to microphones and cameras. Keywords: video conferencing, communication, community building.

Certificateless Integrity Checking of Group Shared Data on Public Distributed Storage

Abstract: Distributed storage administration supplies individuals with an effective strategy to share information inside a gathering. The cloud server isn't reliable, so loads of far-off information ownership checking (RDPC) conventions are proposed and remembered to be a successful method for guaranteeing the information honesty. Notwithstanding, the vast majority of RDPC conventions depend on the system of customary public key framework (PKI), which has clear security defect and bears enormous weight of testament the board. To stay away from this inadequacy, personality-based cryptography (IBC) is many times decided to be the premise of RDPC. Tragically, IBC has an inborn disadvantage of key escrow. To tackle these issues, we use the method of certificateless mark to introduce another RDPC convention for checking the trustworthiness of information divided between a gathering. In this paper, we propose a novel server-side deduplication scheme for encrypted data. It allows the cloud server to control access to outsourced data even when the ownership changes dynamically by exploiting randomized convergent encryption and secure ownership group key distribution. This prevents data leakage not only to revoked users even though they previously owned that data, but also to an honest-but-curious cloud storage server. In addition, the proposed scheme guarantees data integrity against any tag inconsistency attack. Thus, security is enhanced in the proposed scheme. The efficiency analysis results demonstrate that the proposed scheme is almost as efficient as the previous schemes, while the additional computational overhead is negligible. Keywords: Cloud, Encryption, de-duplication,

Internet of Things: Security Vulnerabilities and Countermeasures

People's lives will be transformed by the Internet of Things (IoT), which connects everything from smart phones and sensors to the cloud to mobile apps and web-based controls. Security concerns are on the rise as the number of heterogeneous devices and data processing grows. Most IoT apps and devices are also well-known for their security flaws, making them vulnerable to many forms of attacks. To further complicate matters, threats have variable consequences on the device's security and quality. Unfortunately, enterprises are having difficulty determining which risks they face from their data assets and how to mitigate them. To better identify IoT security risks, this article has built a taxonomy based on the application domain and the design of the architecture. Servers, clients, IoT development boards, sensors, cloud subscriptions, and other components all play a role in this test setup. Vulnerability and network host scanning technologies are used to obtain raw data relevant to IoT-based smart city projects. This article also includes a mitigation approach for IoT network flaws.

On the Security of a Lightweight and Secure Access Authentication Scheme for Both UE and mMTC Devices in 5G Networks

The Internet of Things (IoT) and 5G networks play important roles in the latest systems for managing and monitoring various types of data. These 5G based IoT environments collect various data in real-time using micro-sensors as IoT things devices and sends the collected data to a server for further processing. In this scenario, a secure authentication and key agreement scheme is needed to ensure privacy when exchanging data between IoT nodes and the server. Recently, Cao et al. in “LSAA: A lightweight and secure access authentication scheme for both UE and mMTC devices in 5G networks” presented a new authentication scheme to protect user privacy. They contend that their scheme not only prevents various protocol attacks, but also achieves mutual authentication, session key security, unlinkability, and perfect forward/backward secrecy. This paper demonstrates critical security weaknesses of their scheme using informal and formal (mathemati) analysis: it does not prevent a single point of failure and impersonation attacks. Further, their proposed scheme does not achieve mutual authentication and correctness of security assumptions, and we perform simulation analysis using a formal verification tool to its security flaws. To ensure attack resilience, we put forward some solutions that can assist constructing more secure and efficient access authentication scheme for 5G networks.

Cryptanalysis of an Efficient and Secure Certificateless Aggregate Signature-Based Authentication Scheme for Vehicular Ad Hoc Networks

Vehicular ad hoc networks (VANETs) apply the Internet of Things technology to provide secure communication among the vehicles, thereby improving the safe driving of vehicles, the utilization of traffic resources, and the efficiency of information services. Due to the openness and vulnerability of wireless networks in VANETs, messages in sharing and transmission are easily attacked and destroyed. Therefore, a large number of schemes for VANETs were proposed to protect the privacy of vehicles and ensure the authentication, integrity, and nonrepudiation of messages. However, most of these schemes have serious security flaws or poor performance issues. Recently, Thumbur et al. presented an efficient certificateless aggregate signature-based authentication scheme for VANETs and then gave the detailed security proof (IEEE Internet of Things Journal, vol. 8, no. 3, pp. 1908–1920, 2021). In this article, we analyze the security of Thumbur et al.’s scheme and demonstrate that it has significant security problems. Specifically, their scheme cannot resist public key replacement attacks from external adversaries, and it is not secure against coalition attacks from malicious vehicles. Then, we improve Thumbur et al.’s scheme to address the security weaknesses. According to the security and performance analysis, the improved scheme enhances the security while maintaining the performance of the original scheme.

Implementation of Improved Cryptography Algorithm

A network is an interconnected group of independent computing devices which uses a different set of protocols to communicate with each other independently and meaningfully. This communication should be carried out securely. Due to different attacks, this security sometimes gets compromised. So, to communicate securely different cryptography algorithms are used i.e., symmetric and asymmetric algorithms. Cryptography helps to achieve authentication, confidentiality, integrity, non-repudiation, and availability of data. Nowadays many algorithms provide security to data but these algorithms have various security flaws. To improve the strength of these algorithms, a new security protocol is designed using features of symmetric key and asymmetric key algorithms. The security principles can be achieved by AES and RSA algorithms. The main purpose of designing this algorithm is to provide better security to data in transit against passive as well as from active attacks. The new proposed hybrid algorithm is implemented in MATLAB R2019a. This algorithm will be analysed and compared on three parameters like avalanche effect, performance, and security against attacks. The proposed model will contribute towards improving the excellence of educators and academics, as well as increase competitiveness of educational programmes on cybersecurity among similar institutions in the EU countries.