Security Evaluation Framework Research Articles

Modeling security evaluation framework for IoHT-driven systems using integrated decision-making methodology

The intensification of the Internet of Health Things devices created security concerns due to the limitations of these devices and the nature of the healthcare data. While dealing with the security challenges, several authentication schemes, protocols, processes, and standards have been adopted. Consequently, making the right decision regarding the installation of a secure authentication solution or procedure becomes tricky and challenging due to the large number of security protocols, complexity, and lack of understanding. The major objective of this study is to propose an IoHT-based assessment framework for evaluating and prioritizing authentication schemes in the healthcare domain. Initially, in the proposed work, the security issues related to authentication are collected from the literature and consulting experts’ groups. In the second step, features of various authentication schemes are collected under the supervision of an Internet of Things security expert using the Delphi approach. The collected features are used to design suitable criteria for assessment and then Graph Theory and Matrix approach applies for the evaluation of authentication alternatives. Finally, the proposed framework is tested and validated to ensure the results are consistent and accurate by using other multi-criteria decision-making methods. The framework produces promising results such as 93%, 94%, and 95% for precision, accuracy, and recall, respectively in comparison to the existing approaches in this area. The proposed framework can be picked as a guideline by healthcare security experts and stakeholders for the evaluation and decision-making related to authentication issues in IoHT systems

Automated Differential-Linear Cryptanalysis for AND-RX Ciphers

Differential and linear cryptanalysis are two important methods to evaluate the security of block ciphers. Building on these two methods, differential-linear (DL) cryptanalysis was introduced by Langford and Hellman in 1994. This cryptanalytic method has been not only extensively researched but also proven to be effective. In this paper, a security evaluation framework for AND-RX ciphers against DL cryptanalysis is proposed, which is denoted as K6. In addition to modeling the structure of all the possible differential trails and linear trails at the bit level, we introduce a method to calculate this structure round by round. Based on this approach, an automatic algorithm is proposed to construct the DL distinguisher. Unlike previous methods, K6 uses a truncated differential and a linear hull instead of a differential characteristic and a linear approximation, which brings the bias of the DL distinguisher close to the experimental value. To validate the effectiveness of the framework, K6 is applied to Simon and Simeck, which are two typical AND-RX ciphers. With the automatic algorithm, we discover an 11-round DL distinguisher of Simon32 with bias 2−14.89 and a 12-round DL distinguisher of Simeck32 with bias 2−14.89. Moreover, the 14-round DL distinguisher of Simon48 with bias 2−22.30 is longer than the longest DL distinguisher currently known. In addition, the framework K6 shows advantages when analyzing ciphers with large block sizes. As far as we know, for Simon64/96/128 and Simeck48/64, the first DL distinguishers are obtained with our framework. The DL distinguishers are 16, 23, 32, 17, and 22 rounds of Simon64/96/128 and Simeck48/64 with bias 2−24.31, 2−47.57, 2−60.75, 2−22.54, and 2−31.41, respectively. To prove the correctness of distinguishers, experiments on Simon32 and Simeck32 have been performed. The experimental bias are 2−13.76 and 2−14.82, respectively. Comparisons of the theoretical and experimental results show good agreement.

A Security Evaluation Framework for Intelligent Connected Vehicles Based on Attack Chains

A Security Evaluation Framework for Intelligent Connected Vehicles Based on Attack Chains

A generalized integrated group decision-making framework for computer network security evaluation with Interval Neutrosophic information

The rapid development of global information technology, especially the emergence and widespread application of the Internet, has enabled information technology to quickly penetrate into various fields of the economy and society. Informatization and networking have become important features of today’s era. However, while people enjoy the tremendous progress brought by information technology to humanity, the openness and security vulnerabilities of computer networks have also made network information security issues increasingly prominent. The invasion of hackers, the continuous generation and spread of computer virus, and the rampant use of rogue software have all caused great economic losses to individuals, enterprises, and countries. The computer network security evaluation is a multiple-attribute group decision making (MAGDM). Then, the TODIM and TOPSIS method has been established to deal with MAGDM issues. The interval neutrosophic sets (INSs) are established as an effective tool for representing uncertain information during the computer network security evaluation. In this manuscript, the interval neutrosophic number TODIM-TOPSIS (INN-TODIM-TOPSIS) method is established to solve the MAGDM under INSs. Finally, a numerical example study for computer network security evaluation is established to validate the INN-TODIM-TOPSIS method. The main research contribution of this paper is established: (1) the INN-TODIM-TOPSIS method is put up for MAGDM with INSs; (2) the INN-TODIM-TOPSIS method is put up for computer network security evaluation and were compared with existing methods; (3) Through the detailed comparison, it is evident that INN-TODIM-TOPSIS method for computer network security evaluation proposed in this paper are effective.

A fuzzy group decision-making framework for computer network security evaluation with probabilistic linguistic information

The computer network security evaluation is a classical multiple attribute group decision making (MAGDM) problems. Recently, the Exponential TODIM TODIM (ExpTODIM) method has been used to cope with MAGDM issues. The probabilistic linguistic term sets (PLTSs) are used as a tool for characterizing uncertain information during the computer network security evaluation. In this manuscript, the probabilistic linguistic ExpTODIM (PL-ExpTODIM) is built to solve the MAGDM under PLTSs. In the end, a numerical case study for computer network security evaluation is given to validate the proposed method. The main contribution of this paper is constructed: (1) the Exponential TODIM TODIM (ExpTODIM) method is extended to the PLTSs; (2) the probabilistic linguistic ExpTODIM (PL-ExpTODIM) method is defined to solve the MAGDM under PLTSs; (3) In the end, a numerical case study for computer network security evaluation is given to validate the proposed method.

Spatio-Temporal Evolution of Key Areas of Territorial Ecological Restoration in Resource-Exhausted Cities: A Case Study of Jiawang District, China

Resource-exhausted cities usually face problems of environmental degradation, landscape fragmentation, and impeded ecological mobility. By clarifying the spatial heterogeneity of ecological restoration needs, efficient and coordinated ecological protection and restoration can be carried out. This study selected Jiawang District, a typical resource-exhausted city, and constructed an ecological security evaluation framework to determine the ecological source area from the three aspects of ecosystem service importance, ecological sensitivity, and landscape stability. The resistance surface was corrected with ecological sensitivity evaluation data, and ecological corridors and ecological nodes were identified using circuit theory. Finally, it explored the spatial and temporal evolution of the key areas of territorial ecological restoration in Jiawang District. This study indicates that: (1) In 2000, 2010, and 2020, the ecological source areas were 123.59 km2, 116.18 km2, and 125.25 km2, and the corresponding numbers of ecological corridors were 53, 51, and 49. The total lengths of the ecological corridors were 129.25 km, 118.57 km, and 112.25 km, mainly distributed in the northern and central areas of the study area. (2) The study area contained 17, 13, and 19 ecological pinch points in 2000, 2010, and 2020, respectively, 16, 20, and 15 ecological obstacle points, and 8, 24, and 33 ecological fracture points, respectively. Targeted rehabilitation of these key areas can significantly improve ecological connectivity. (3) The key area of territorial ecological restoration in 2020 was composed of 125.25 km2 ecological source area, 8.77 km2 of ecological pinch point, 12.70 km2 of ecological obstacle point, and 33 ecological fracture points. According to the present situation of land use, protection strategies are put forward.

SP-E: Security Evaluation Framework of In-vehicle Infotainment System based on Threat Analyses and Penetration Tests

With the increasing requirement of people, the functions of in-vehicle infotainment systems are becoming more and more abundant, and their security also affects the safety of vehicles. Therefore, it is more and more important to evaluate the security of the IVI system. This paper proposes a security evaluation framework for in-vehicle infotainment systems based on threat analyses and penetration tests. By constructing the data flow diagram of application scenarios, analyzing threats, combing the attack link diagram, combining white-box audit and black-box test, we use the characteristics of high efficiency of automatic tools and high accuracy of manual methods to set factor sets, and then the whole IVI system is evaluated by Analytic Hierarchy Process and Fuzzy Comprehensive Evaluation.

Security Evaluation Method of Smart Home Cloud Platform

The application of artificial intelligence of things (AIoT) is becoming increasingly widespread. With its rapid development, it has raised many complex network security issues. These have brought crushing security threats and risks to all stakeholders. AIoT cloud platform in the smart home plays a vital role in the security management of devices and is the current research hotspot. This paper discusses the security of the AIoT cloud platform, represented by the smart home. The indicator system describing the protection of the smart home cloud platform is proposed, and the security risk evaluation method of the cloud service is formed. Based on the evaluation method, a lightweight security evaluation framework for smart home cloud service is designed to evaluate the typical cloud platform’s security. The evaluation identifies some technical and administrative issues. Finally, to improve the security of the cloud console of AIoT and discover potential security risks in time, a security self-test model of the scalable cloud console is proposed.

Black-Box Attack-Based Security Evaluation Framework for Credit Card Fraud Detection Models

The security of credit card fraud detection (CCFD) models based on machine learning is important but rarely considered in the existing research. To this end, we propose a black-box attack-based security evaluation framework for CCFD models. Under this framework, the semisupervised learning technique and transfer-based black-box attack are combined to construct two versions of a semisupervised transfer black-box attack algorithm. Moreover, we introduce a new nonlinear optimization model to generate the adversarial examples against CCFD models and a security evaluation index to quantitatively evaluate the security of them. Computing experiments on two real data sets demonstrate that, facing the adversarial examples generated by the proposed attack algorithms, all six supervised models considered largely lose their ability to identify the fraudulent transactions, whereas the two unsupervised models are less affected. This indicates that the CCFD models based on supervised machine learning may possess substantial security risks. In addition, the evaluation results for the security of the models generate important managerial implications that help banks reasonably evaluate and enhance the model security. History: Accepted by Ram Ramesh, Area Editor for Data Science & Machine Learning. Funding: This work was supported in part by the National Natural Science Foundation of China [Grants 72171160 and 71988101], Key Program of National Natural Science Foundation of China and Quebec Research Foundation (NSFC-FRQ) Joint Project [Grant 7191101304], Key Program of NSFC-FRQSC Joint Project [Grant 72061127002], Excellent Youth Foundation of Sichuan Province [Grant 2020JDJQ0021], and National Leading Talent Cultivation Project of Sichuan University [Grant SKSYL2021-03]. Supplemental Material: The software that supports the findings of this study is available within the paper and its Supplemental Information ( https://pubsonline.informs.org/doi/suppl/10.1287/ijoc.2023.1297 ) as well as from the IJOC GitHub software repository ( https://github.com/INFORMSJoC/2021.0076 ) at ( http://dx.doi.org/10.5281/zenodo.7631457 ).

Quantitative evaluation of emergency shelters in mountainous areas among multiple scenarios: Evidence from Biancheng, China

Accurate evaluation of urban emergency shelters is key to improving disaster response capacity and government emergency management ability, especially in mountainous areas where disasters are common. Most existing studies focus on evaluating material aspects, such as the capacity and accessibility of emergency shelters, ignoring the impact of different scenarios in the same area such as topographic, demographic, and population spatial–temporal distribution differences. Considering the multiple scenarios factors influencing emergency shelter practice, this study constructed a validity, efficiency, and security evaluation framework which was tested in Biancheng, Hunan, China. A combination of qualitative multiple scenario analysis and quantitative Network Analysis method were used to portray existing emergency shelters during emergency evacuations. The important conclusions are as follows: (1) there are significant differences in the evaluation of emergency shelters in the different scenarios. Scenario I (considering terrain) and Scenario II (considering demographics) decreased the evaluation results, while Scenario III (considering time–space) increased the evaluation results. (2) All three scenarios could cause variation in the validity indicators (A) and efficiency indicators (B), but A1 were unchanged in Scenario II and B2 remained constant in Scenario III, while none of the security indicators (C) were affected except in Scenario I. (3) While different emergency shelters performed differently in different scenarios, overall ID2 performed best and ID5 performed worst. Consideration of all scenarios was clearly necessary for us to scientifically evaluate the real use of emergency shelters, which can effectively guide emergency shelter planning and thus improve the abilities of urban disaster relief.

A Comprehensive Evaluation of Food Security in China and Its Obstacle Factors.

China's food security has attracted global attention as the various drivers of its instability and uncertainty have intensified. This study developed a new framework for food security evaluation in China by analyzing its availability, distribution, utilization, vulnerability, sustainability, and regulation. The entropy weight method (EWM) and the matter-element extension model (MEEM) were combined to examine China's food security status between 2001 and 2020. Additionally, an obstacle degree model (ODM) was used to investigate the key factors functioning as obstacles to food security. The results show that China's overall food security improved greatly but experienced a slight downward trend in 2003. The main obstacles initially entailed grain distribution but then spread to vulnerability- and sustainability-related issues. Ultimately, the key factors restricting China's food security were the amount of fertilizer application per unit sown area (AFA) and the grain self-sufficiency rate (GSR). The next 40 years could be the most critical period for ensuring China's food security, which incorporates demographic, climate change, and resource shortage factors. China appears to be implementing its national strategies through sustainable farmland use and agricultural technology innovation to facilitate the high-quality development of its grain industries and strengthen its food security. This study provides an overall picture of China's food security and can serve as a reference for those concerned with China's future national security.

Security Oriented Design Framework for EM Side-Channel Protection in RTL Implementations

Electromagnetic (EM) side-channel analysis is a powerful attack for extracting secret information from cryptographic hardware implementations. Countermeasures have been proposed at the register-transfer level (RTL), layout level, and device level. However, existing EM radiation modeling and side-channel vulnerability mitigation methods do not consider the structural resilience of original designs, nor do they provide fine-grained security enhancements to those vulnerable submodules/components. These universal solutions may introduce unnecessary overheads on the circuit under protection and may not be optimized for individual designs. In this article, we propose a design/synthesis for side-channel security evaluation and optimization framework based on the <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">${t}$ </tex-math></inline-formula> -test evaluation results derived from RTL hardware implementations. While the framework apply to different side-channel leakage, we focus more on EM side channels. Supported by this framework, different RTL implementations of the same cryptographic algorithm will be evaluated for their side-channel resistance. In vulnerable implementations, submodules with the most significant side-channel leakages will be identified. Security design/synthesis rules will then be applied to these vulnerable submodules for security enhancements against side-channel attacks (SCAs). Experiments, including simulations and FPGA implementations on different AES designs, are performed to validate the effectiveness of the proposed framework as well as the security design/synthesis rules.

An integrative analytical framework of water-energy-food security for sustainable development at the country scale: A case study of five Central Asian countries

Thoroughly understanding the security of water, energy and food (WEF) and the factors that influence them is essential for sustainable development management in any region. This study proposed a new analytical framework for WEF security evaluation in both individual sectors and the whole system, using the technique for order preference by similarity to an ideal solution (TOPSIS) and four dimensions of security indicators: availability, self-sufficiency, productivity and accessibility. The internal relationships among the three sectors and the main factors influencing WEF security were analysed by Spearman’s rank correlation and radar graphs, respectively. The five countries in Central Asia (CA), which are experiencing WEF crises and facing great challenges in achieving their sustainable development goals (SDGs), were chosen as a case study in this paper. Our results showed that Kazakhstan attained the highest WEF security level, followed by Kyrgyzstan, Turkmenistan and Uzbekistan; Tajikistan exhibited the lowest security level from 2000 to 2014. Three types of internal relationships among the three sectors were identified: synergies, trade-offs and unclassified. The unclassified relationship type accounted for the largest share of 54% in CA, suggesting great potential for synergetic improvement among the three sectors. Approaches for improving the country WEF security based on our research are as follows: Kazakhstan should prioritize food allocation and supply, Kyrgyzstan and Tajikistan should increase energy and food production and raise the supply level and usage efficiency of water and food, Turkmenistan should increase the available water resources and food production and improve the supply level and usage efficiency of water and energy, and Uzbekistan should both increase the available amount and enhance the WEF management performance.

FuzzDocs: An Automated Security Evaluation Framework for IoT

As Internet of Things (IoT) devices have rooted themselves in the daily life of billions of people, security threats targeting IoT devices are emerging rapidly. Thus, IoT vendors have employed security testing frameworks to examine IoT devices before releasing them. However, existing frameworks have difficulty providing automated testing, as they require a lot of manual effort to support new devices due to the lack of information about the input formats of the new devices. To address this challenge, we introduce FUZZDOCS, a document-based black-box IoT testing framework designed to automatically analyze publicly accessible API documents about target IoT devices and extract information, including valid inputs used to call each functionality of the target devices. Based on the extracted information, it generates valid-enough test inputs that are not easily rejected by target devices but can trigger vulnerabilities deep inside them. This document-based input generation allows FUZZDOCS to support new devices without manual work, as well as provide effective security testing. To prove its feasibility, we evaluated FUZZDOCS in a real-world IoT environment, and the results showed that FUZZDOCS extracted input formats with 93% accuracy from hundreds of pages of documents. Also, it outperformed the existing frameworks in testing coverage and found 35 potential vulnerabilities, including two unexpected system failures in five popular IoT devices.

Framework for Integral Data Quality and Security Evaluation in Smartphones

Data quality (DQ) concept should play an important role in decision-making and engineering systems. Underestimation of DQ may lead to resource waste, wrong conclusions, or inefficient decisions. Unfortunately, current approaches to DQ incorporating into data management systems are limited to particular applications. This problem is aggravated by the DQ inequality of data sources. This is especially critical in mobile crowd-sensing applications where data may come from unverified data contributors using the smartphones and other mobile devices. To facilitate the expansion of DQ evaluation to a wider spectrum of applications, this article presents a framework for integral DQ and security evaluation in Android-based smartphones. The developed framework provides support for selecting the DQ metrics and implementing their calculus by integrating diverse sensor DQ and security metrics. We present multiple calculi for DQ and security evaluation such as hierarchical fuzzy rules expert system, neural networks, and algebraic functions. Case studies that demonstrate the framework's performance in addressing real-life tasks are presented and the achieved results are analyzed. The implementation results validate the framework's capability of performing comprehensive DQ evaluations.

Conceptualising a Cloud Business Intelligence Security Evaluation Framework for Small and Medium Enterprises in Small Towns of the Limpopo Province, South Africa

The purpose of this study was to investigate security evaluation practices among small and medium enterprises (SMEs) in small South African towns when adopting cloud business intelligence (Cloud BI). The study employed a quantitative design in which 57 SMEs from the Limpopo Province were surveyed using an online questionnaire. The study found that: (1) the level of cybersecurity threats awareness among decision-makers was high; (2) decision-makers preferred simple checklists and guidelines over conventional security policies, standards, and frameworks; and (3) decision-makers considered financial risks, data and application security, and cloud service provider reliability as the main aspects to consider when evaluating Cloud BI applications. The study conceptualised a five-component security framework for evaluating Cloud BI applications, integrating key aspects of conventional security frameworks and methodologies. The framework was validated for relevance by IT specialists and acceptance by SME owners. The Spearman correlational test for relevance and acceptance of the proposed framework was found to be highly significant at p &lt; 0.05. The study concluded that SMEs require user-friendly frameworks for evaluating Cloud BI applications. The major contribution of this study is the security evaluation framework conceptualised from the best practices of existing security standards and frameworks for use by decision-makers from small towns in Limpopo. The study recommends that future research consider end-user needs when customising or proposing new solutions for SMEs in small towns.

A Cyber Security Evaluation Framework for In-Vehicle Electrical Control Units

Modern vehicles are equipped with more than 100 Electrical Control Units (ECUs) with over 2500 signals to transmit internally. The application of advanced electronics and communication techniques helps a vehicle transform from an information island into a powerful distribution center. However, a large number of ECUs have introduced a wider range of security threats for vehicles. The attackers can compromise a vehicle remotely through a vulnerable ECU. How to evaluate the cyber security of in-vehicle ECUs has become an important issue. Current Threat Analysis and Risk Assessment (TARA) only carries out theoretical analysis on the potential threats and risks faced by the vehicle in the conceptual design phase of the lifecycle, but lacks the details of actual security evaluation. In this paper, we proposed a Cyber Security Evaluation Framework (CSEF) to independently evaluate the security of the in-vehicle ECUs, which is composed of the asset identification, the threat analysis, the risk assessment, and the security test. The proposed CSEF is applied to a pre-installed On-Bord Unit (OBU) to provide a use case. The use case show that the proposed CSEF is able to figure out assets, threats, risks behind threats, and vulnerabilities of OBU, playing an important role in guiding others to conduct security evaluation. Moreover, CSEF can be extended to evaluate the cyber security of other critical ECUs, such as the Telematic Box, the infotainment units, and the gateway.

SecPump: A Connected Open-Source Infusion Pump for Security Research Purposes

This letter presents SecPump, a new open-source wireless infusion pump platform dedicated to security researchers. The novelty of the platform is that it is “plug and play.” Indeed, SecPump simulates a functional infusion pump system on a single board without requiring additional hardware or mechanical components. The presented cyber-physical platform intends to provide a framework for security evaluation, tailored for countermeasure development against security flaws related to medical devices. This letter presents the functionality of the cyber-physical device, its wireless features, and its portability across several hardware architectures. Finally, both hardware and software attacks are showcased on the platform.

Comprehensive Information Security Evaluation Model Based on Multi-Level Decomposition Feedback for IoT

The development of the Internet of Things (IoT) calls for a comprehensive information security evaluation framework to quantitatively measure the safety score and risk (S&R) value of the network urgently. In this paper, we summarize the architecture and vulnerability in IoT and propose a comprehensive information security evaluation model based on multi-level decomposition feedback. The evaluation model provides an idea for information security evaluation of IoT and guides the security decision maker for dynamic protection. Firstly, we establish an overall evaluation indicator system that includes four primary indicators of threat information, asset, vulnerability, and management, respectively. It also includes eleven secondary indicators of system protection rate, attack detection rate, confidentiality, availability, controllability, identifiability, number of vulnerabilities, vulnerability hazard level, staff organization, enterprise grading and service continuity, respectively. Then, we build the core algorithm to enable the evaluation model, wherein a novel weighting technique is developed and a quantitative method is proposed to measure the S&R value. Moreover, in order to better supervise the performance of the proposed evaluation model, we present four novel indicators includes residual risk, continuous conformity of residual risk, head-to-tail consistency and decrease ratio, respectively. Simulation results show the advantages of the proposed model in the evaluation of information security for IoT.

TrustE-VC: Trustworthy Evaluation Framework for Industrial Connected Vehicles in the Cloud

The integration between cloud computing and vehicular ad hoc networks, namely, vehicular clouds (VCs), has become a significant research area. This integration was proposed to accelerate the adoption of intelligent transportation systems. The trustworthiness in VCs is expected to carry more computing capabilities that manage large-scale collected data. This trend requires a security evaluation framework that ensures data privacy protection, integrity of information, and availability of resources. To the best of our knowledge, this is the first study that proposes a robust trustworthiness evaluation of vehicular cloud for security criteria evaluation and selection. This article proposes three-level security features in order to develop effectiveness and trustworthiness in VCs. To assess and evaluate these security features, our evaluation framework consists of three main interconnected components: 1) an aggregation of the security evaluation values of the security criteria for each level; 2) a fuzzy multicriteria decision-making algorithm; and 3) a simple additive weight associated with the importance-performance analysis and performance rate to visualize the framework findings. The evaluation results of the security criteria based on the average performance rate and global weight suggest that data residency, data privacy, and data ownership are the most pressing challenges in assessing data protection in a VC environment. Overall, this article paves the way for a secure VC using an evaluation of effective security features and underscores directions and challenges facing the VC community. This article sheds light on the importance of security by design, emphasizing multiple layers of security when implementing industrial VCs.