Security Devices Research Articles

A Review of Penetration Testing Process For Sql Injection Attack

In this rapidly developing information technology age, the Internet has emerged as a critical component of modern life. The usage of the web server has become crucial in providing services to users for various transactions like online banking, online purchasing, and web-based email. Due to this atmosphere, protecting a web server from cyber-attacks became essential to prevent data breaches. Secured coding implementation in developing online systems is crucial, as failure to do so will result in an SQL injection attack. Another problem concerning this problem is configuration against security devices, which makes the attack possible to be executed. Furthermore, owing to the emergence of technology, cyber intruders can utilize various techniques and sophisticated tools to steal information easily. Penetration testing is the approach that can be taken to measure a web server's security level and prevent an attack. This study aims to review SQL injection attacks and describe the required steps to execute penetration testing successfully. Next, the practical SQL injection attack was executed according to the penetration methodology. The outcome indicates that cyber intruders can log in as regular users and steal sensitive information if the web server is vulnerable to attack.

Unveiling the core of IoT: comprehensive review on data security challenges and mitigation strategies

The Internet of Things (IoT) is a collection of devices such as sensors for collecting data, actuators that perform mechanical actions on the sensor's collected data, and gateways used as an interface for effective communication with the external world. The IoT has been successfully applied to various fields, from small households to large industries. The IoT environment consists of heterogeneous networks and billions of devices increasing daily, making the system more complex and this need for privacy and security of IoT devices become a major concern. The critical components of IoT are device identification, a large number of sensors, hardware operating systems, and IoT semantics and services. The layers of a core IoT application are presented in this paper with the protocols used in each layer. The security challenges at various IoT layers are unveiled in this review paper along with the existing mitigation strategies such as machine learning, deep learning, lightweight encryption techniques, and Intrusion Detection Systems (IDS) to overcome these security challenges and future scope. It has been concluded after doing an intensive review that Spoofing and Distributed Denial of Service (DDoS) attacks are two of the most common attacks in IoT applications. While spoofing tricks systems by impersonating devices, DDoS attacks flood IoT systems with traffic. IoT security is also compromised by other attacks, such as botnet attacks, man-in-middle attacks etc. which call for strong defenses including IDS framework, deep neural networks, and multifactor authentication system.

A Review on the emerging technology of TinyML

Tiny Machine Learning (TinyML) is an emerging technology proposed by the scientific community for developing autonomous and secure devices that can gather, process, and provide results without transferring data to external entities. The technology aims to democratize AI by making it available to more sectors and contribute to the digital revolution of intelligent devices. In this work, a classification of the most common optimization techniques for Neural Network compression is conducted. Additionally, a review of the development boards and TinyML software is presented. Furthermore, the work provides educational resources, a classification of the technology applications, and future directions and concludes with the challenges and considerations.

DBN-protected material Enhanced intrusion prevention sensor system defends against cyber attacks in the IoT devices

By linking objects globally, the Internet of Things (IoT) has transformed technology with the goal of achieving an unparalleled degree of intelligence that will benefit mankind in many areas. Resilient applications in safety, healthcare, and industrial processes rely heavily on continuous connectivity and interaction with surrounding objects. But the IoT ecosystem's enormous number of businesses and apps significantly raises the possibility of unwanted access, raising worries about cyberattacks. It is important to protect symmetrical networks used in modern communication from these dangers. With an emphasis on a sophisticated intrusion detection and prevention system based on Deep Belief Symmetrical Networks (DBNs), this study investigates cutting edge techniques and tactics for preventing security breaches. Our research specifically investigates possibly dangerous behaviour within IoT symmetrical networks and attempts to determine its source. We present a DBN-protected material improved symmetrical intrusion prevention sensor system that improves IoT device security. We improve the system's capacity to identify and prevent cyber-attacks by exploiting DBNs. We compare the suggested method's performance to industry-standard Intrusion Detection Systems (IDS) algorithms and Domain Generation Algorithms (DGAs) to assess its effectiveness. We create results that demonstrate the usefulness of our method in fighting against cyber-attacks in the IoT environment through rigorous research and testing. This study advances the development of safe IoT Symmetrical devices and encourages the full realization of their promise in allowing a connected and intelligent world.

Stateful black-box fuzzing for encryption protocols and its application in IPsec

Owing to the rapid development of information security technology, the security analysis of encryption protocols has received widespread attention. In this paper, we propose a stateful black-box encryption protocol fuzzing method to analyze the security of real-world black-box encryption protocol programs and devices. This method does not rely on the source code but uses captured packets as input, performs state selection based on a Monte Carlo tree search algorithm, and processes the encryption/decryption conversion of mutant test cases based on the intermediate mapper. It sends test cases and collects responses in interactive communication with the tested program and dynamically optimizes the corpus based on the collected state information. Based on this method, we develop SBEPFuzz and primarily analyze IPsec. We evaluate SBEPFuzz on six widely used IPsec implementations. The experimental results show that SBEPFuzz achieves higher code coverage, and can discover more protocol state sequences and vulnerabilities. Furthermore, we discover four anomalies, including malformed packets triggering service crashes and abnormal interactions leading to plaintext ID leakage, which also reflect the differences in details among different implementations.

Security Analysis of Low-Budget IoT Smart Home Appliances Embedded Software and Connectivity

This paper investigates the challenge of finding and analyzing security vulnerabilities among widely available low-budget Internet of Things smart home appliances. It considers the identification of security vulnerabilities within the appliances’ embedded software and connectivity functions over wired and wireless channels in local networks and external communications with manufacturers’ cloud services. To analyze the security of these appliances, a universal laboratory test bench is proposed and a set of methodologies for testing the security of smart home devices is described. The proposed testing platform offers a practical solution for security analysis of Internet of Things smart home devices and it can serve as a reference approach for future research. The results from the research indicated varying levels of susceptibility across different types of devices. A list of recommendations for manufacturers and others to improve the security level of these appliances is provided. The findings emphasize the need for regular security assessments of smart home devices, to maintain the protection of personal and sensitive information.

Classification of malware for security improvement in IoT using heuristic aided adaptive multi-scale and dilated ResneXt with gated recurrent unit

The rise of malware in the Internet of Things (IoT) realm exploits sensitive IoT devices that lead to extensive malicious attacks that pose a significant danger to the integrity of the Internet ecosystem. Addressing this threat effectively requires a robust system for classifying and attributing IoT malware, serving as vital initial steps toward implementing countermeasures for attack prevention and mitigation. So, in this work, a new malware classification technique using deep learning is developed for solving different kinds of malware in IoT. The required images for the malware classification process are gathered from online databases and given to the developed Adaptive Multi-scale and Dilated ResneXt with Gated Recurrent Unit (AMDR-GRU)-based malware classification process. Here, the last layer of the ResneXt is modified with GRU, and several parameters are optimized in the suggested AMDR-GRU model with the support of the designed Intensified Random Parameter-based Chameleon Swarm Algorithm (IRPCSA) to enhance the classification performance. Finally, the developed AMDR-GRU model offered the classified outcome and the obtained classification results are compared with different existing malware classification models to prove the effectiveness of the developed model over others. The developed model offered 99.59 % of precision. The result proved that the developed model is used to classify different malware without reverse engineering, binary code analysis, and feature engineering. Moreover, by effectively classifying malware, this technique can contribute to enhancing the security of IoT devices, protecting them from potential threats and vulnerabilities. This has significant implications for ensuring the privacy, integrity, and overall safety of IoT systems.

Digitalization of hypertension management: a paradigm shift.

Hypertension, which stands as a leading global health challenge, demands a dynamic approach for its effective management. The traditional methods of managing hypertension, centered on periodic clinic visits for blood pressure measurement and pharmacological interventions, are increasingly being complemented and enhanced by digital technologies. The integration of wearable devices, mobile applications, personalized treatments, and telehealth solutions into healthcare system is reshaping traditional hypertension care. Digitalization of hypertension management extends to population health, in addition to individual patient benefits, aimed at preventing and controlling hypertension on a broader scale. However, this digital revolution in hypertension management brings forth challenges related to data security, data accuracy, equitable access, and standardization of devices by international regulatory agencies. Addressing these issues is equally important to ensure that the benefits of digital technologies are accessible to everyone, irrespective of socio-economic factors. This paper concludes with a forward-looking perspectives, emphasizing the potential of digitalization to modify the landscape of hypertension management.

Exploring Android Security Landscape: Threats, Vulnerabilities, and Best Practices

With over 2.5 billion active devices, the Android operating system is among the most popular mobile operating systems. This article looks at the security concerns and challenges it faces. While Android has many advantages, such as numerous customization options and a large app ecosystem, its widespread use exposes it to security flaws and attacks. The article discusses various security threats to Android smartphones, such as stalker ware, SMS phishing, web-based attacks, and fake apps. To improve Android device security, users should exercise caution when downloading apps, enable full disc encryption, careful examine the messages and links, practice safe web browsing, and stay informed about emerging threats. The Stage fright vulnerability, the Humming Bad malware, the Joker malware, and the most recent Flu Bot malware are among the high-profile security flaws that have affected the Android operating system and are discussed in the article. It also lists CVE-2021- 0397 and CVE-2021-0390, two vulnerabilities discovered in 2021, as well as the security updates that were released to address them.

An Incident Management System Design to Protect Critical Infrastructures from Cyber Attacks

In recent years, there has been a noticeable trend toward targeted threats to information security, where companies are now leveraging vulnerabilities and risks associated with widely used services in order to generate financial gain. Additionally, they implement numerous precautions and consistently carry out their tasks. One item that requires precautionary measures is the network devices utilized. Network devices in computer networks possess the capability to log events. These logs enable the identification of security events on the network and facilitate the implementation of precautionary measures. Various security measures can be implemented to handle such data. One of these measures is Security Information and Event Management (SIEM). It is a system that gathers and analyzes data from networks and security devices. SIEM is a technique employed to consolidate critical information within a cohesive structure. It allows for the correlation of events from different security devices, thereby improving the monitoring capabilities of cybersecurity operations centers. This study extensively covers the critical infrastructure-SIEM relationship, current studies, critical infrastructure, cyber security policies, and SIEM. Our system design was developed using the UNSW\_NB15 dataset, a widely recognized dataset in cybersecurity due to its comprehensive and realistic representation of cyber threats. This dataset consists of data obtained from network traffic, various attack activities, and real-life modern normal scenarios, making it particularly relevant to our study. With the studies, a total of 10 different categories were analyzed, with the category consisting of nine types of attacks, namely Analysis, Backdoor, DoS, Exploits, Fuzzers, Generic, Reconnaissance, Shellcode, and Worms and Normal activities. The study is divided into two as the basic structure. The first step was carried out on Google Collaboratory, and then some experimental studies were carried out in Weka. Classifications were made using several methods, including Logistic Regression (LR), Extra Trees (XT), Support Vector Machines (SVM), Random Forest (RF), and Decision Trees (DT). These methods were chosen for their proven effectiveness in similar studies. In the application developed with Google Colabratory, we achieved 98.62\% in Random Forest, 99.10\% in Decision Trees, 98.87\% in Logistic Regression, 95.13\% success in Extra Trees and 99.12\% success in Support Vector Machines. As a result of the studies and experiments carried out in Weka, we achieved 92.05\% in Random Forest, 100\% in Decision Trees, 100\% in k-Nearest Neighbours, 100\% in J48, 99.19\% in Naive-Bayes and 99.35\% in BayesNet achievements.

Novel cascaded switched-diode five level inverter for renewable energy integration

This research presents the usage of a unique five-level cascaded switching diode for medium voltage integration of renewable energy sources. Its primary purpose is to decrease the quantity of gate drivers and switches. In addition to that, the cost and space for the installation of multilevel inverters are less. The inverter topology of novel cascaded multilevel inverters and switched diodes will combine both benefits. One-cycle control (OCC), which is used for clock phase-shifting (CPS) to regulate a two-stage container security device (CSD) multilevel inverter of renewable energy integration, was created to address issues with the multilevel inverter's direct current (DC) source variations. The topology also provides efficiency, harmonic distortion reduction, and voltage output quality. Waveforms are created, and a robust resistance to DC source variations is attained. The viability of the unique five-level inverter using cascaded switched diodes is confirmed by discussing the results of both simulation and experiment.

Kali Linux – a simple and effective way to study the level of cyber security and penetration testing of power electronic devices

The work presents the possibility to use Kali Linux in the process of power electronic devices research, which has not been applied before. Several of the built-in tools of Kali Linux have been used for the purpose of the research. Nmap has been used for vulnerability testing - scanning for open ports and finding out specific, well-known security vulnerabilities by using specific scripts. Wireshark and Burp Suite have been used to find out if the exchanged information is secure or not. hping3 has been used to scan for open ports and generating different TCP DoS attacks, thus studying what is the response of the power electronic device when it is subjected to different TCP DoS attacks – can it be accessed or not, has it experienced any performance violation, etc. Based on the results of this research, it can be argued that Kali Linux is applicable and can be used during the process of power electronic device research.

Systematic Literature Review of IoT Botnet DDOS Attacks and Evaluation of Detection Techniques.

Internet of Things (IoT) technology has become an inevitable part of our daily lives. With the increase in usage of IoT Devices, manufacturers continuously develop IoT technology. However, the security of IoT devices is left behind in those developments due to cost, size, and computational power limitations. Since these IoT devices are connected to the Internet and have low security levels, one of the main risks of these devices is being compromised by malicious malware and becoming part of IoT botnets. IoT botnets are used for launching different types of large-scale attacks including Distributed Denial-of-Service (DDoS) attacks. These attacks are continuously evolving, and researchers have conducted numerous analyses and studies in this area to narrow security vulnerabilities. This paper systematically reviews the prominent literature on IoT botnet DDoS attacks and detection techniques. Architecture IoT botnet DDoS attacks, evaluations of those attacks, and systematically categorized detection techniques are discussed in detail. The paper presents current threats and detection techniques, and some open research questions are recommended for future studies in this field.

An optimal attention PLSTM‐based classification model to enhance the performance of IoMT attack detection in healthcare application

AbstractThe Internet of Medical Things (IoMT) has revolutionized the healthcare industry by allowing remote monitoring of patients suffering from chronic diseases. However, security concerns arise due to the potential life‐threatening damage that can be caused by attacks on IoMT devices. To enhance the security of IoMT devices, researchers propose the use of novel artificial intelligence‐based intrusion detection techniques. This article presents a hybrid alex net model and an orthogonal opposition‐based learning Yin‐Yang‐pair optimization (OOYO) optimized attention‐based Peephole long short term memory (PLSTM) model to distinguish between malicious and normal network traffic in the IoMT environment. To improve the scalability of the model in handling the random and dynamic behavior of malicious attacks, the hyper parameters of the PLSTM framework are optimized using the OOYO algorithm. The proposed model is evaluated on different IoT benchmark datasets such as N‐BaIoT and IoT healthcare security. Experimental results demonstrate that the proposed model provides a classification accuracy of 99% and 98% on the healthcare security and N‐BaIoT datasets, respectively. Moreover, the proposed model exhibits high generalization ability for multi‐class classifications and is effective in reducing the false discovery rate. Overall, the proposed model achieves high accuracy, scalability, and generalization ability in identifying malicious traffic, which can help improve the security solution of IoMT devices.

Magnetic micro‐fluidics in 3D microchannel at the micro‐scale: Unlocking nano‐porous electrode potential for lithium‐ion micro‐batteries

AbstractEnhancing the nanosized‐electrolyte's characteristics in Lithium‐driven micro‐batteries (LIMBs) is indispensable to improve the overall efficiency, security, and lifespan of these energy devices, designing nano‐sized electrolyte with a wide electrochemical stability window while keeping them compatible with electrode materials is one of the improvement goals. Battery technologies must go through this optimization process in order to be used practically. A sensing mechanism to keep an eye on the health of Li‐ion energy devices through the magnetization. Magnetic micro‐fluidic patterns that change could be a sign of battery deterioration or other problems with performance. Li‐ion battery health is one application of magnetic sensing that you can do with magnetic sensing. Battery health variations and other performance problems can be found using magnetic mass transport patterns. Present study examines the effects of magnetic field on Eyring–Powel mass transport in nano‐porous channels over a stretching sheet. The principal equations exhibiting the phenomenon are transformed into non‐linear differential equation by second‐order approximation by using a similarity transformation. Furthermore, a semi‐analytic technique named optimal homotopy asymptotic method (OHAM) is used to solve the transformed Eyring–Powell model. The numerical results demonstrated the impact of variations in velocity, skin‐friction coefficient and Sherwood number for the proposed scheme.

Improving industrial security device detection with convolutional neural networks

<p>Employee safety is paramount in the manufacturing industry to ensure their well-being and protection. Technological advancements, particularly convolutional neural networks (CNN), have significantly enhanced this safety aspect by facilitating object detection and recognition. This project aims to utilize CNN technology to detect personal protective equipment and implement a safety implement detection system. The CNN architecture with the YOLOv5x model was employed to train a dataset. Dataset videos were converted into frames, with resolution scale adjustments made during the data collection phase. Subsequently, the dataset was labeled, underwent data cleaning, and label and bounding box revisions. The results revealed significant metrics in safety equipment detection in industrial settings. Helmet precision reached 91%, with a recall of 74%. Goggles achieved 85% precision and an 87% recall. Mask absence recorded 92% precision and an 89% recall. The YOLOv5x model exhibited commendable performance, showcasing its robust ability to accurately locate and detect objects. In conclusion, the utilization of a CNN-based safety equipment detection system, such as YOLOv5x, has yielded substantial improvements in both speed and accuracy. These findings lay a solid foundation for future industrial security applications aimed at safeguarding workers, fostering responsible workplace behavior, and optimizing the utilization of information technology resources.</p>

Klasifikasi Malware Menggunakan Metode Convolutional Neural Network (CNN) Berbasis Website

This study aims to develop a web-based malware detection system using Convolutional Neural Network (CNN) utilizing the IoT23 dataset. Malware is malicious software that can exploit security vulnerabilities in computer systems, steal data, and degrade performance. The implementation of this detection system involves CNN, capable of extracting important features from both visual and textual data, applied to malware classification. The IoT23 dataset comprises 23 scenarios of IoT network traffic, including traffic from malware-infected devices. The study results show that the developed web application can detect malware attacks with accuracy, precision, recall, and F1-score of 99% on separate data scenarios. This CNN-based detection system has proven effective in identifying and classifying malware attacks, contributing to the enhancement of network and device security.

Investigating data storage security and retrieval for Fitbit wearable devices

PurposeThe use of wearable devices to monitor aspects of personal health is increasing. The Fitbit is an example of a popular device used for this purpose.It is unknown whether users’ privacy (i.e. sensitive data collected from wearable devices) would be leaked via unauthorized access. So, this investigation will answer the following questions; are the data transmissions protected against unauthorised access or modification? what data are transmitted between the device and the server? how much data can be collected by unauthorized access?MethodThis paper describes an investigation into data access in the Fitbit Blaze and, specifically, whether this is possible without connecting to the Fitbit server. A Man-In-The-Middle (MITM) attack was used in this investigation.ResultIn this experiment, the firmware image, transferred when the device connects to the Fitbit server, is first captured and analysed to obtain data. This was done to attempt to identify the encryption method and obtain the unique device MAC address. Secondly, some fitness data, namely, the authentication key, the cryptographic key and the Nonce, were extracted from the Fitbit application. We attempted to connect the Fitbit Blaze device and the Fitbit application directly without connecting via the Fitbit server. We also attempted direct access to the Fitbit Blaze using a charger cable. In addition, Fitbit Java files were extracted from the Fitbit application.ConclusionFinally, the outcomes of this investigation are compared with investigations into other Fitbit devices in the previous research.

DICEguard: enhancing DICE security for IoT devices with periodic memory forensics

The number of Internet-of-Things (IoT) devices has been increasing rapidly every year. Most of these devices have access to important personal data such as health, daily activities, location, and finance. However, these devices have security problems since they have limited processing power and memory to implement complex security measures. Therefore, they possess weak authentication mechanisms and a lack of encryption. Additionally, there are no widely accepted standards for IoT security. Device Identifier Composition Engine (DICE) was proposed as a standard that enables adding a security layer to low-cost microcontrollers with minimal silicon overhead. However, previous studies show that DICE-based attestation is vulnerable to some remote attacks. In this study, we present a novel method called DICEguard to address the security problems of DICE. One of the key innovations of DICEguard is its incorporation of periodic memory forensics (PMF) technique, leveraging a hardware-based hash engine to detect and mitigate potential security breaches resulting from firmware vulnerabilities. DICEguard enhances the overall resilience of IoT devices against attacks by swiftly detecting alterations indicative of malicious activity through periodic calculation and comparison of firmware digests. Furthermore, DICEguard introduces a one-time programmable (OTP) memory component to safeguard critical security parameters, such as public keys used for signature verification, against tampering by adversaries. This ensures the integrity of essential security measures even in the face of sophisticated attacks. We implemented the enhanced DICE architecture using the open-source RISC-V platform Ibex and the mbedTLS library for cryptographic operations. We performed the hash operations required by DICE in a hardware-based manner on a commercial Field Programmable Gate Array (FPGA) platform rather than firmware, which is more vulnerable to attacks. Our test results show that with negligible area overhead to a standard microcontroller system, the proposed method can detect the simulated attacks.

A systematic review on elliptic curve cryptography algorithm for internet of things: Categorization, application areas, and security

Cyberattacks on the Internet of Things (IoT) may be avoided by implementing cybersecurity protocols on IoT devices, platform packages, and Internet tools. A significant problem is developing a simple security mechanism suitable for resource-constrained IoT devices. Elliptic curve cryptography (ECC) is extensively utilized and well-suited for use in low-resource environments like smartphone devices. ECC utilizes short crypto keys with the same security strength as conventional cryptosystems, decreasing power consumption and enhancing device efficiency. This study comprehensively evaluates ECC data privacy and security techniques in IoT-based devices. The research also looked into other cryptography protocols that ECC may use to increase security and performance. The inclusion procedures were papers published between 2018 and 2023, written in English, and published in a peer-reviewed scholarly outlet. This research eventually reviewed 61 suitable publications in total. Compared to other cryptographic methods, the study discovered that ECC has received greater attention or is frequently employed in IoT-based systems. However, additional issues and concerns must be addressed, including efficient IoT device security, maintaining privacy, and device security against vulnerability assaults such as man-in-the-middle attacks. For the efficient security of the IoT-based system, an improved ECC-based algorithm should be developed to enhance the security and privacy issues of the IoT system.