Security Level Of System Research Articles

Decomposed Task Scheduling for Security-Critical Mobile Cyber–Physical Systems

With the recent advances in mobile sensing, computing, and communication technologies, mobile cyber–physical systems (MCPSs) become a promising networking paradigm that provides mobile users with various applications and services from cyber space to the physical world. One of the main challenges in the MCPSs is to defend security threats launched by adversaries. Exploiting security services to defend threats is energy consuming, whereas the energy of mobile devices is generally limited since most of mobile devices are battery powered. This necessitates the need to design new methodologies to tackle the tradeoff between security and energy of MCPSs. To this end, this article aims to maximize MCPSs’ security under the constraints of energy and deadline. In this article, we first formulate the MCPS security maximization problem as a mixed-integer nonlinear programming (MINLP) problem and then transform it into a mixed-integer linear programming (MILP) problem without performance degradation. To solve the transformed MILP problem efficiently, we propose a decomposed algorithm to derive the optimum task scheduling solution instead of using MILP solvers that may be very time consuming for MCPSs of large granularity. The derived task scheduling solution decides the assignment, operating frequency, execution order, as well as security service selection for all tasks. We implement a series of simulation-based experiments to validate the proposed decomposed task scheduling scheme. Simulation results demonstrate that the proposed scheme increases system security level by 20.38% and 65.11% on average as compared to a state-of-art approach and a baseline method.

Utilizing 3D joints data extracted through depth camera to train classifiers for identifying suicide bomber

Safety and security of humans is an important concern in every aspect. With the advancement in engineering, sciences, and technology (unfortunately) new methods to harm humans have also been introduced. At the same time, scientists are paying attention to the security aspects by developing new software and hardware gadgets. In comparison to the system level security, the safety/security of human beings is more important. Suicide bombing is one such nuisance that is still an open challenge for the world to detect before it is triggered. This work deals with the identification of a suicide bomber using a 3D depth camera and machine learning techniques. This work utilizes the skeletal data provided by the 3D depth camera to identify a bomber wearing a suicide jacket. The prediction is based on real-time 3D posture data of the body joints obtained through the depth camera. Using a comprehensive experimental design, a dataset is created consisting of 20 joints information obtained from 120 participants. The dataset records this for each of the participants with and without wearing a suicide jacket. Experiments are performed with the suicide jacket bearing 10- to 20-kg weight. Simulations are performed using 3D spatial features of the participants' body in four ways: full body joints (20 joints), upper-half of the body (above the spine base of the skeleton), 20 joints with 15 frames, and 20 joints with 20 frames. It is observed that 15 to 20 frames are sufficient to identify a suspected suicide bomber. The proposed framework utilize four classifiers to identify vulnerability of a subject to be a suicide bomber. Results show that the proposed framework is capable of identifying a suicide bomber with an average accuracy of 92.30%.

Application of Fault Prediction and Health Management in Vehicle Control System

Vehicle control system is a large and complex system with high degree of integration and informationization, which makes fault diagnosis and support more difficult. It puts forward new requirements for fault prediction and maintenance in terms of improving the reliability and efficiency of vehicle control system and reducing the cost of use and maintenance. In order to ensure the stable operation of vehicle control system and give full play to its combat capability, it is necessary to strengthen the monitoring and health assessment of the operation state of vehicle control system, and make appropriate maintenance decisions according to the health state of the system, so as to improve the security level and effectiveness of the vehicle control system.

Automation security in a machine-building plant

The operating system is the most important software component of any computer, and therefore, the security of the enterprise information system as a whole depends on the level of implementation of the security policy in a single operating system. In general, Linux operating systems (OS) cannot be considered as a ready-to-use security system. There are many recommendations on improving Linux security, but the authors of these recommendations do not guarantee that their recommendations are sufficient to achieve the required level of system security. This study attempts to systematize available methods for increasing the level of security of application software for Linux-like OSs operating as part of control systems at nuclear power facilities. The required level of security of the entire system can be achieved at the application software level.

The Innovative FlexPlan Grid-Planning Methodology: How Storage and Flexible Resources Could Help in De-Bottlenecking the European System

The FlexPlan Horizon2020 project aims at establishing a new grid-planning methodology which considers the opportunity to introduce new storage and flexibility resources in electricity transmission and distribution grids as an alternative to building new grid elements, in accordance with the intentions of the Clean Energy for all Europeans regulatory package of the European Commission. FlexPlan creates a new innovative grid-planning tool whose ambition is to go beyond the state of the art of planning methodologies by including the following innovative features: assessment of the best planning strategy by analysing in one shot a high number of candidate expansion options provided by a pre-processor tool, simultaneous mid- and long-term planning assessment over three grid years (2030, 2040, 2050), incorporation of a full range of cost–benefit analysis criteria into the target function, integrated transmission distribution planning, embedded environmental analysis (air quality, carbon footprint, landscape constraints), probabilistic contingency methodologies in replacement of the traditional N-1 criterion, application of numerical decomposition techniques to reduce calculation efforts and analysis of variability of yearly renewable energy sources (RES) and load time series through a Monte Carlo process. Six regional cases covering nearly the whole European continent are developed in order to cast a view on grid planning in Europe till 2050. FlexPlan will end up formulating guidelines for regulators and planning offices of system operators by indicating to what extent system flexibility can contribute to reducing overall system costs (operational + investment) yet maintaining current system security levels and which regulatory provisions could foster such process. This paper provides a complete description of the modelling features of the planning tool and pre-processor and provides the first results of their application in small-scale scenarios.

Colony: A Privileged Trusted Execution Environment With Extensibility

The code base of system software is growing fast, which results in a large number of vulnerabilities: for example, 296 CVEs have been found in Xen hypervisor and 2195 CVEs in Linux kernel. To reduce the reliance on the trust of system software, many researchers try to provide trusted execution environments (TEEs), which can be categorized into two types: non-privileged TEEs and privileged TEEs. Non-privileged TEEs (e.g., Intel SGX) are extensible, but cannot protect security services like virtual machine introspection (VMI) due to the lack of system-level semantics. On the contrary, privileged TEEs (e.g., the secure world of ARM TrustZone) have system-level semantics, but any additional service implemented in the privileged TEE directly increases the TCB of the entire system. In this article, we propose a new design of TEE to support system-level security services and achieve better extensibility with a small TCB. Each TEE instance of the proposed design is named a <small>Colony</small>. Specifically, we introduce a <i>secure monitor</i> for isolation and capability management. Each <small>Colony</small> is assigned capabilities to access only necessary system-level semantics. We use the new TEE to build four security services, including secure device accessing, VMI tools, a system call tracer, and a much more complex service to virtualize ARM TrustZone with multiple <small>Colonies</small>. We have implemented the system on ARMv7 and ARMv8 platforms, in Xen hypervisor and Linux kernel, and perform a detailed evaluation to show its efficiency.<xref rid="fn1" ref-type="fn">¹</xref><fn id="fn1"><label>1.</label> This paper is an extended version of the conference paper published in USENIX Security&#x2019;17: vTZ: Virtualizing ARM TrustZone <xref ref-type="bibr" rid="ref29">[29]</xref> . A brief summary of differences is in Section<xref ref-type="sec" rid="sec8">8</xref> . </fn>

FACE RECOGNITION TECHNIQUE FOR ATM SECURITY

In the recent decades the people are depending more on ATM machines for getting instant cash in anytime and anywhere. In related to these ATM machines are installing in every part of the country. As the ATM machines are growing, providing security level for ATM machines is the challenging factor. In the present days, ATM systems uses access card and PIN for identity verification. The technology advancement has bought different biometric identification technique like finger print, facial recognition and retina scanning. But still the security level is not compromising to customers. This model proposes a concept of providing two level security system in order to reduce the frauds like hacking of ATM cards, PIN stolen, Phishing attack etc., In this model Crypto-biometric system is adopted where biometric and cryptography are combined to achieve high security. Between face features and pairs of random vectors given by user, the two dimensional quantization of distance vectors process is used [1]. The cryptographic key generated is of 128 bits it is difficult for hacking. The merging of face features and random vectors are done by using MATLAB.

Методика оценивания защищенности на основе семантической модели метрик и данных

The purpose of the article: development of semantic model of metrics and data and technique for security assessment based on of this model to get objective scores of information system security. Research method: theoretical and system analysis of open security data sources and security metrics, semantic analysis and classification of security data, development of the security assessment technique based on the semantic model and methods of logical inference, functional testing of the developed technique. The result obtained: an approach based on the semantic model of metrics and data is proposed. The model is an ontology generated considering relations among the data sources, information system objects and data about them, primary metrics of information system objects and integral metrics and goals of assessment. The technique for metrics calculation and assessment of unspecified information systems security level in real-time using the proposed model is developed. The case study demonstrating applicability of the developed technique and ontology to answer security assessment questions is provided. The area of use of the proposed approach are security assessment components of information security monitoring and management systems aimed at increasing their efficiency.

Online Steady-State Security Awareness Using Cellular Computation Networks and Fuzzy Techniques

Power system steady-state security relates to its robustness under a normal state as well as to withstanding foreseeable contingencies without interruption to customer service. In this study, a novel cellular computation network (CCN) and hierarchical cellular rule-based fuzzy system (HCRFS) based online situation awareness method regarding steady-state security was proposed. A CCN-based two-layer mechanism was applied for voltage and active power flow prediction. HCRFS block was applied after the CCN prediction block to generate the security level of the power system. The security status of the power system was visualized online through a geographic two-dimensional visualization mechanism for voltage magnitude and load flow. In order to test the performance of the proposed method, three types of neural networks were embedded in CCN cells successively to analyze the characteristics of the proposed methodology under white noise simulated small disturbance and single contingency. Results show that the proposed CCN and HCRFS combined situation awareness method could predict the system security of the power system with high accuracy under both small disturbance and contingencies.

Blockchain-Based Securing of Data Exchange in a Power Transmission System Considering Congestion Management and Social Welfare

Using blockchain technology as one of the new methods to enhance the cyber and physical security of power systems has grown in importance over the past few years. Blockchain can also be used to improve social welfare and provide sustainable energy for consumers. In this article, the effect of distributed generation (DG) resources on the transmission power lines and consequently fixing its conjunction and reaching the optimal goals and policies of this issue to exploit these resources is investigated. In order to evaluate the system security level, a false data injection attack (FDIA) is launched on the information exchanged between independent system operation (ISO) and under-operating agents. The results are analyzed based on the cyber-attack, wherein the loss of network stability as well as economic losses to the operator would be the outcomes. It is demonstrated that cyber-attacks can cause the operation of distributed production resources to not be carried out correctly and the network conjunction will fall to a large extent; with the elimination of social welfare, the main goals and policies of an independent system operator as an upstream entity are not fulfilled. Besides, the contracts between independent system operators with distributed production resources are not properly closed. In order to stop malicious attacks, a secured policy architecture based on blockchain is developed to keep the security of the data exchanged between ISO and under-operating agents. The obtained results of the simulation confirm the effectiveness of using blockchain to enhance the social welfare for power system users. Besides, it is demonstrated that ISO can modify its polices and use the potential and benefits of distributed generation units to increase social welfare and reduce line density by concluding contracts in accordance with the production values given.

Applying a comprehensive approach to construct indicators that reflect the financial security of the Russian Federation

Subject. This article discusses the theoretical and methodological approaches to the formation of indicators affecting the diminution of financial security. Objectives. The article aims to develop comprehensive methodological approaches of integrated graphic and point rating methods, using indicators to form a functional adaptive system to reduce risks and improve financial security stability. Methods. For the study, we used comparative, economics and statistics analyses, abstraction, and an integrated approach. Results. The article proposes an original method of constructing consolidated integrated accounts that characterize the financial system's security level. Conclusions and Relevance. To ensure sustainable social and economic development of the State, it is necessary to use effective sensitive indicators, the application of which will help improve the validity of decisions made regarding the financial system. The results of the study can be used by government authorities at the State, regional, municipal, and economic sector levels.

Cyber Security Analysis of Academic Services based on Domain Delivery Services and Support using Indonesian E-Government Ratings (PEGI)

Safe academic services are the most important part of universities. The security of academic services is very important to maintain information optimally and safely. Along with the development of technology, academic information services are often misused by some irresponsible parties that can cause threats. To prevent these things from happening, it is necessary to know the extent of governance of higher education academic information system security by evaluating. So the research was conducted to determine the maturity of the security of Higher Education academic information service security by using the COBIT 5 framework in the DSS05 domain. The DSS05 domain in COBIT 5 is a good framework for use in implementing and evaluating the security of academic information services. Meanwhile, to determine the achievement of the evaluation of the security level of academic information systems, the Indonesian e-government ranking (PEGI) method is required. The combination of the COBIT 5 framework in the DSS05 domain using the PEGI method in academic information security service is able to provide a level of achievement in the form of Customer Value. The results of the COBIT 5 framework analysis of the DSS05 domain using the PEGI method get a score of 3.50 so that the quality of academic information service security evaluation achievement is at a very good level. At this level, universities are increasingly open to technological development. Higher education has applied the concept of quantification in every process, and has always been monitored and controlled for its performance in the security of academic information systems.

2.5D Root of Trust: Secure System-Level Integration of Untrusted Chiplets

Dedicated, after acceptance and publication, in memory of the late Vassos Soteriou. For the first time, we leverage the 2.5D interposer technology to establish system-level security in the face of hardware- and software-centric adversaries. More specifically, we integrate chiplets (i.e., third-party hard intellectual property of complex functionality, like microprocessors) using a security-enforcing interposer. Such hardware organization provides a robust 2.5D root of trust for trustworthy, yet powerful and flexible, computation systems. The security paradigms for our scheme, employed firmly by design and construction, are: 1) stringent physical separation of trusted from untrusted components, and 2) runtime monitoring. The system-level activities of all untrusted commodity chiplets are checked continuously against security policies via physically separated security features. Aside from the security promises, the good economics of outsourced supply chains are still maintained; the system vendor is free to procure chiplets from the open market, while only producing the interposer and assembling the 2.5D system oneself. We showcase our scheme using the Cortex-M0 core and the AHB-Lite bus by ARM, building a secure 64-core system with shared memories. We evaluate our scheme through hardware simulation, considering different threat scenarios. Finally, we devise a physical-design flow for 2.5D systems, based on commercial-grade design tools, to demonstrate and evaluate our 2.5D root of trust.

New Approach for Information Security Evaluation and Management of IT Systems in Educational Institutions

Security evaluation and management has become increasingly important for Web-based information technology (IT) systems, especially for educational institutions. For the security evaluation and management of IT systems in educational institutions, determining the security level for a single IT system has been well developed. However, it is still difficult to evaluate the information security level of the entire educational institution considering multiple IT systems, because there might be too many different IT systems in one institution, educational institutions can be very different, and there is no standard model or method to provide a justifiable information security evaluation among different educational institutions considering their differences. In light of these difficulties, a security evaluation model of educational institutions’ IT systems (SEMEIS) is proposed in this work to facilitate the information security management for the educational institutions. Firstly, a simplified educational industry information system security level protection rating (EIISSLPR) with a new weight redistribution strategy for a single IT system is proposed by choosing important evaluation questions from EIISSLPR and redistributing the weights of these questions. Then for the entire educational institution, analytic hierarchy process (AHP) is used to redistribute the weights of multiple IT systems at different security levels. Considering the risk of possible network security vulnerabilities, a risk index is formulated by weighting different factors, normalized by a utility function, and calculated with the real data collected from the institutions under the evaluation. Finally, the information security performance of educational institutions is obtained as the final score from SEMEIS. The results show that SEMEIS can evaluate the security level of the education institutions practically and provide an efficient and effective management tool for the information security management.

Non-Strategic Capacity Withholding from Distributed Energy Storage within Microgrids Providing Energy and Reserve Services

Microgrids have the potential to provide security and flexibility to power systems through the integration of a wide range of resources, including distributed energy storage, usually in the form of batteries. An aggregation of microgrids can enable the participation of these resources in the main system’s energy and ancillary services market. The traditional minimum-cost operation, however, can undermine microgrid’s ability to hold reserve capacity for operation in islanded mode and can rapidly degrade distributed batteries. This paper studies the impacts of various operational strategies from distributed energy storage plants on their revenues and on market prices, considering an array of microgrids that act in a synchronized fashion. The operational model minimizes the entire electric power system cost, considering transmission-connected and distributed energy resources, and capturing capacity degradation of batteries as part of the cost function. Additionally, microgrid-based, distributed batteries can provide energy arbitrage and both system-level and microgrid-level security services. Through several case studies, we demonstrate the economic impacts of distributed energy storage providing these services, including also capacity degradation. We also demonstrate the benefits of providing reserve services in terms of extra revenue and battery lifespan. Finally, we conclude that limitations in the provision of system-level services from distributed batteries due to degradation considerations and higher microgrid-level security requirements may, counterintuitively, increase system-level revenues for storage owners, if such degradation considerations and microgrid-level security requirements are adopted, at once, by a large number of microgrids, leading to unintended, non-strategic capacity withholding by distributed storage owners.

A Web-Based Honeypot in IPv6 to Enhance Security

IPv6 is a next-generation IP protocol that replaces IPv4. It not only expands the number of network address resources but also solves the problem of multiple access devices connected to the Internet. While IPv6 has brought excellent convenience to the public, related security issues have gradually emerged, and an assessment of the security situation in IPv6 has also become more important. Unlike passive defense, the honeypot is a security device for active defense. The real network application and the fake network application, disguised by the honeypot, are located on a similar subnet, and provide a network application service; but, in both cases, behavior logs from unauthorized users are caught. In this manner, and to protect web-based applications from attacks, this article introduces the design and implementation of a web-based honeypot that includes a weak password module and an SQL inject module, which supports the IPv6 network to capture unauthorized access behavior. We also propose the Security Situation Index (SSI), which can measure the security situation of the network application environment. The value of SSI is established according to the different parameters that are based on honeypots. There is a firewall outside the test system environment, so the obtained data should be used as the real invasion data, and the captured behavior is not a false positive. Threats can be spotted smartly by deploying honeypots; this paper demonstrates that the honeypot is an excellent method of capturing malicious requests and can be measured with the SSI of the whole system. According to the information, the administrator can modify the current security policy, which can improve the security level of a whole IPv6 network system.

RETRACTED ARTICLE: Multi objective dragonfly algorithm for congestion management in deregulated power systems

Congestion in transmission corridors are the major bother for deregulated power system’s operation. Generator rescheduling along with demand alteration is a traditional remedy for transmission line congestion. According to market clearing process, the system operator (SO) has to pay a certain amount of cost to the market participants for rescheduling the generation and demand. This kind of redispatch related congestion management (CM) procedure is mainly carried out to reduce the congestion cost, but they are failing to provide an attention in power systems security. The risky generator’s power shifts may diminish the voltage and transient stability of the power system. So power system security should be included in the congestion management procedure. In this proposed multi objective congestion management procedure, rescheduling of active power is carried out to improve/retain the power systems security along with a congestion cost reduction. Voltage security margin (λ) and corrected transient energy margin (CTEM) provides a measure for power system security level. Multi Objective Dragonfly Algorithm (MODA) is employed to trace the non dominated solutions for three conflicting objectives. Fuzzy decision making principle is applied to select the best Pareto solution depends on the objective’s significances. The goodness of the MODA optimization approaches is experimented in congestion alleviation of New England 39 bus systems and solutions are compared with some reputed methods.

Towards a Formal IoT Security Model

The heterogeneity of Internet of Things (IoT) systems has so far prevented the definition of adequate standards, hence making it difficult to compare meaningfully the security degree of diverse architectural choices. This task can be nonetheless achieved with formal methodologies. However, the dedicated IoT literature shows no evidence of a universal model allowing the security evaluation of any arbitrary system. Based on these considerations, we propose a new model that aims at being global and all-encompassing. Our model can be used to fairly analyse the security level of different IoT systems and compare them in a significant way. It is designed to be adaptive with realistic definitions of the adversary’s (1) actions of interacting with IoT systems; (2) capabilities of accessing the data generated by and exchanged in IoT systems with established rules; and (3) objectives of attacking IoT systems according to the four recognised security properties of confidentiality, integrity, availability and soundness. Such a design enables the straightforward characterization of new adversaries. It further helps in providing a fine-grained security evaluation of IoT systems by either accurately describing attacks against the analysed systems or formally proving their guaranteed level of security.

Research and Application of Power Information Risk Early Warning System Based on Big Data

With the increase of power equipment and business systems and the increasing complexity of IT system architecture and operation scale, the existing manual operation and maintenance mode can no longer meet the needs of business. This paper proposes an electric power information risk early warning system based on big data, which analyzes operation and maintenance data from five angles of transaction analysis, trend analysis, comparative analysis, composition analysis and comprehensive analysis. The system consists of three parts: data collection, data management, data analysis and risk early warning. By improving the operation and maintenance automation level, the system security level and operation efficiency are greatly improved.

Security assurance of MongoDB in singularity LXCs: an elastic and convenient testbed using Linux containers to explore vulnerabilities

It is essential to ensure the data security of data analytical frameworks as any security vulnerability existing in the system can lead to a data loss or data breach. This vulnerability may occur due to attacks from live attackers as well as automated bots. However inside attacks are also becoming more frequent because of incorrectly implemented security requirements and access control policies. Thus, it is important to understand security goals and formulate security requirements and access control policies accordingly. Therefore, it is equally important to identify the existing security vulnerabilities of a given software system. To find the available vulnerabilities against any system, it is mandatory to conduct vulnerability assessments as scheduled tasks in a regular manner. Thus, an easily deployable, easily maintainable, accurate vulnerability assessment testbed or a model is helpful as facilitated by Linux containers. Nowadays Linux containers (LXCs) which have operating system level virtualization, are very popular over virtual machines (VMs) which have hypervisor or kernel level virtualization in high performance computing (HPC) due to reasons, such as high portability, high performance, efficiency and high security (Chae et al in Clust Comput 22:1765-1775, 2019. https://doi.org/10.1007/s10586-017-1511-2 ). Hence, LXCs can make an efficient and scalable vulnerability assessment testbed or a model by using already developed analyzing tools such as OpenVas, Dagda, PortSpider, MongoAudit, NMap, Metasploit Framework, Nessus, OWASP Zed Attack Proxy, and OpenSCAP, to assure the required security level of a given system very easily. To verify the overall security of any given software system, this paper first introduces a virtual, portable and easily deployable vulnerability assessment general testbed within the Linux container network. Next, the paper presents, how to conduct experiments using this testbed on a MongoDB database implemented in Singularity Linux containers to find the available vulnerabilities in 1. MongoDB application itself, 2. Images accompanied by containers, 3. Host, and 4. Network by integrating seven tools: OpenVas, Dagda, PortSpider, MongoAudit, NMap, Metasploit Framework, and Nessus to the container-based testbed. Finally, it discusses how to use generated results to improve the security level of the given system.