Security Logs Research Articles

The eternal return: Imagining security futures at the Doomsday Vault

This article examines how imaginaries of security in the Anthropocene function at the Svalbard Global Seed Vault (SGSV), otherwise known as the ‘Doomsday Vault’. Recent explorations by scholars of security have suggested that different ways of seeing, understanding, acting in, and imagining the world are necessary to adequately respond to complex crises in the Anthropocene. The dissolution of the nature/culture divide and the existential risk from planetary threats are said to require new and creative formations of security. Buried in the Norwegian high Arctic, the heavily fortified SGSV was built in 2008 as a planetary-scale, ‘deep-time organisation’ that would forever secure a wide variety of plant seeds and their genetic makeup against regional or global upheavals. The article argues that his seed ‘ark’ materialises three Anthropocene security imaginaries: apocalypse, hope and escape. The prevalence and use of these imaginaries reveal the stability of long-held security logics and challenge the widely-held belief in the innately transformative properties of the Anthropocene concept for security. Instead, the SGSV demonstrates the difficulty in overcoming a collective mindfulness that fixes security to eternal forms even in the midst of unprecedented threats, interventions and technology.

AN INTELLIGENT CYBER SECURITY DETECTION AND RESPONSE PLATFORM

To further solve the cyber security challenges faced by the digital transformation of the Philippines university industry. This paper designed and proposed a cyber security detection and response platform (CSDRP), which can deal with traditional network security problems, improve the network security management capabilities of universities, and provide a method for real-time monitoring of network status and network security response in universities. With the outbreak of the epidemic, many universities in the Philippines have launched online courses and online services. These online courses and online services continue to proliferate, and with them come a host of cyber security risks and hidden dangers. CSDRP extracts logs through the traffic probes, and the platform performs correlation analysis on many security logs, combines relevant models and machine learning algorithms and generates response logs, which can be responded to and linked with policies, and finally presents relevant threats visually. This study deploys the platform in the actual network environment. The experimental results show that it provides accurate threat warnings, as well as good real-time detection and visualization of cyber threats, and can collect logs from different data sources in real time. linkage of safety equipment.

Visual Analysis of Multisource Heterogeneous Data Based on Improved DPCA Algorithm

This paper proposes a multiview collaborative visual analysis system of network security based on a DPCA (clustering by fast search and find of density peaks) clustering algorithm called DPCANETVis, with network security analysis requirements for multisource heterogeneous data. Firstly, the system proposes an improved DPCA clustering algorithm based on the hierarchical relationship of mail sending and receiving to achieve the purpose of accurate classification. Secondly, a three-layer visual layout is designed to display relevant information such as data hierarchy, node relationship, behavior model, and other relevant information, by mixing a variety of interactive visual analysis methods such as tree diagram, word cloud, line diagram, subject river, and parallel coordinate. Lastly, based on the exploration of events, all suspicious nodes and their abnormal behaviors can be displayed in the system. Finally, the prototype system is used to analyze the network security log data set provided by the ChinaVis 2018, and the feasibility of the multilevel interactive visual analysis method for network security is verified through many experiments and discussions.

Assessing threatening uncertainties: Counterterrorism and everyday practices of preemptive policing in Ghana

The preemptive turn in counterterrorism has turned future uncertainties into key objects of contemporary security governance. From an empirically grounded perspective, this article contributes with novel insight into the everyday practices of preemptive politics. Focusing on Ghana as a unique case through which to trace how the mobilization of affect accelerates the transnational proliferation of counterterrorism measures and the commodification of future uncertainty, it shows how the global War on Terror has shaped the emergence of counterterrorism in a context characterized by the absence of terrorist attacks on home soil. Exploring how preemption animates outreach activities, simulation exercises, and nighttime patrols, it shows how police officers attempt to make uncertain futures tangible and actionable through practices of imagination and performance. Aimed at assessing terrorist threats that have not (yet) materialized, the article argues that preemptive policing practices cause a conflation of ordinary crime and extraordinary terror that inflates already existing uncertainties and subverts the institutional security logics of preemption.

SKG-Lock+: A Provably Secure Logic Locking SchemeCreating Significant Output Corruption

The current trend to globalize the supply chain in the Integrated Circuits (ICs) industry has raised several security concerns including, among others, IC overproduction. Over the past years, logic locking has grown into a prominent countermeasure to tackle this threat in particular. Logic locking consists of “locking” an IC with an added primary input, the so-called key, which, unless fed with the correct secret value, renders the ICs unusable. One of the first criteria ensuring the quality of a logic locking technique was the output corruption, i.e., the corruption at the outputs of a locked circuit, for any wrong key value. However, since the introduction of SAT-based attacks, resulting countermeasures have compromised this criterion in favor of a better resilience against such attacks. In this work, we propose SKG-Lock+, a Provably Secure Logic Locking scheme that can thwart SAT-based attacks while maintaining significant output corruption. We perform a comprehensive security analysis of SKG-Lock+ and show its resilience against SAT-based attacks, as well as various other state-of-the-art attacks. Compared with related works, SKG-Lock+ provides higher output corruption and incurs acceptable overhead.

Multisource traffic incident reporting and evidence management in Internet of Vehicles using machine learning and blockchain

Intelligent transportation systems require efficient ways to manage traffic incidents like accidents and traffic rule violations. Secure logging of incident related data is important in case of accidents for forensic analysis, insurance, and legal settlements. Internet of vehicles can be enhanced using machine learning techniques to detect events automatically at the vehicle and road infrastructure level and blockchain can be used as a source for immutable evidence storage and management. The work proposes a framework addressing multiple challenges in traffic incident detection and evidence management like gathering of traffic event related evidence from multiple sources, addressing fault management in embedded vehicle on board units, resiliency from malicious event reporting and handling conflicting traffic incident event reports. The framework relies on a combination of cooperative event correlation and trust model to detect malicious and erroneous reporting of traffic incidents followed by Long Short term Memory (LSTM) and Bayesian model to resolve conflicting event reports. The events are correlated and verified before being transmitting onto the blockchain for evidence management and access control by various stakeholders. Analysis is presented highlighting the improvement in efficiency achieved by convergence of the multiple approaches proposed.

Guilty knowledge: A postcolonial inquiry into knowledge, suspicion, and responsibility in the fight against terrorism financing

AbstractThis article studies practices of knowledge production during counterterrorism financing court cases in European courts. Developments in international law have contributed to novel regulations to criminalise and prosecute the funding of terrorism in advance of terrorist violence. In this study, we study how court cases have become important spaces for contesting and evaluating multiple knowledge claims on terrorist threat and suspicion by analysing case proceedings from both the Netherlands and the United Kingdom. Building on recent debates in International Relations and postcolonial theory, we make two contributions. First, building on insights from postcolonial literature on ‘abyssal thinking’, we illustrate how legal practices differentiate between different ways of knowing by dismissing certain experiences as ‘emotional’ or ‘subjective’ in contrast to the assumed objectivity of other knowledge claims. We argue that decisions on what counts as knowledge in a court setting are situated in a specific sociopolitical setting, whereby particular knowledge and life-worlds are recognised at the expense of others. Second, we empirically show how the novel criminal laws shifts the responsibility to know terrorist threat from the state to ordinary citizens. We illustrate how the court reinforces new security logics where the state can entertain doubt, uncertainty, and trust in their practices, while the citizens cannot.

Virtual Fence Geospatial Intelligence to Protect Enterprise Cloud Server Data

Abstract: Data sharing and access area unit capabilities businesses and organizations need the foremost currently. Remote operating and mobile access to resources and collaboration platforms created it easier to access knowledge and resources from anyplace, anytime. Employees need to access documents and email from completely different devices, and from varied locations at a time. Access from untrusted networks is usually a threat to businesses. This may lead to knowledge loss and overexposure of essential knowledge. To mitigate the deficiencies of logical security mechanisms, and coinciding with the trend of cyber-physical systems, security mechanisms are planned that integrate with the physical surroundings. to make sure that business’s knowledge and resources area unit safe. In this project we tend to propose AN innovative Virtual Fence that uses a location knowledge and geospatial intelligence. Geospatial knowledge analysis enhances understanding, insight, decision-making, and prediction. Location intelligence (LI) is achieved via image and analysis of geospatial knowledge. Then we tend to improve the safety of information access in knowledge Server for an organization or the other specific locations exploitation the location-based cryptosystem. Virtual Fence provides a way to secure sensitive data among a company. It are often set to Off, On, Restricted read or browse solely. Once a geo-fenced boundary is outlined, the opportunities what businesses will do is proscribed by solely their creativeness. The most advantage of fitting such a geo fence is in avoiding knowledge discharge. Once outlined the trusty network locations, nobody will access knowledge from a unique network location/device. The experiment shows that our theme is possible in sensible applications.

SMS-I: Intelligent Security for Cyber–Physical Systems

Critical infrastructures are an attractive target for attackers, mainly due to the catastrophic impact of these attacks on society. In addition, the cyber–physical nature of these infrastructures makes them more vulnerable to cyber–physical threats and makes the detection, investigation, and remediation of security attacks more difficult. Therefore, improving cyber–physical correlations, forensics investigations, and Incident response tasks is of paramount importance. This work describes the SMS-I tool that allows the improvement of these security aspects in critical infrastructures. Data from heterogeneous systems, over different time frames, are received and correlated. Both physical and logical security are unified and additional security details are analysed to find attack evidence. Different Artificial Intelligence (AI) methodologies are used to process and analyse the multi-dimensional data exploring the temporal correlation between cyber and physical Alerts and going beyond traditional techniques to detect unusual Events, and then find evidence of attacks. SMS-I’s Intelligent Dashboard supports decision makers in a deep analysis of how the breaches and the assets were explored and compromised. It assists and facilitates the security analysts using graphical dashboards and Alert classification suggestions. Therefore, they can more easily identify anomalous situations that can be related to possible Incident occurrences. Users can also explore information, with different levels of detail, including logical information and technical specifications. SMS-I also integrates with a scalable and open Security Incident Response Platform (TheHive) that enables the sharing of information about security Incidents and helps different organizations better understand threats and proactively defend their systems and networks.

A critical view on the real-world security of logic locking

With continuously shrinking feature sizes of integrated circuits, the vast majority of semiconductor companies have become fabless, outsourcing to foundries across the globe. This exposes the design industry to a number of threats, including piracy via IP-theft or unauthorized overproduction and subsequent reselling on the black market. One alleged solution for this problem is logic locking, where the genuine functionality of a chip is “locked” using a key only known to the designer. Solely with a correct key, the design works as intended. Since unlocking is handled by the designer only after production, an adversary in the supply chain should not be able to unlock overproduced chips. In this work, we focus on logic locking against the threat of overproduction. First, we survey existing locking schemes and characterize them by their handling of keys, before extracting similarities and differences in the employed attacker models. We then compare said models to the real-world capabilities of the primary adversary in overproduction—a malicious foundry. This comparison allows us to identify pitfalls in existing models and derive a more realistic attacker model. Then, we discuss how existing schemes hold up against the new attacker model. Our discussion highlights that several attacks beyond the usually employed SAT-based approaches are viable. Crucially, these attacks stem from the underlying structure of current logic locking approaches, which has never changed since its introduction in 2008. We conclude that logic locking, while being a promising approach, needs a fundamental rethinking to achieve real-world protection against overproduction.

Security, Exile, Population: Colonization from David Walker to the Liberia Herald

Abstract By looking at colonization at white responses to Black population increase in the US, this essay argues that exile and other biopolitical mechanisms undo the logic of security by showing how the search for safety itself generates and amplifies insecurity. Framed against contemporary meditations on exile, the essay examines how whites presented the deportation of US Blacks to Liberia as a solution to a national security crisis. In response, Black activists and writers such as James Forten and Russell Parrott demonstrated how white concerns created insecurity among the US Black population. To offset the vulnerability of exile that other colonizationists mandated for Black people, the use of racial arithmetic in Freedom’s Journal, the first African American newspaper, and by David Walker shows that security for Blacks can be achieved, at least rhetorically, by mobilizing biopower and exploiting arithmetical ratios of Blacks to whites. In a twist, however, the editor of Freedom’s Journal, John Russwurm, emigrated to West Africa to publish the Liberia Herald whose columns reveal how in the exile’s safe haven racial differences upheld by the US continued to have meaning. In exile, security and insecurity remained twined about each other in cycles of violence. Extermination is population security at its most absolute. . . . if the problem of security is the population’s ceaseless potential for being born, reproducing, and dying, then, exile and colonization serve as technologies for radically altering the polity in the name of national interest.

Geopolitics of security and surveillance in Nepal and Afghanistan: A comparative analysis

This article examines the geopolitics and geo-economics of security and surveillance. We comparatively focus on the effects of geopolitically powerful states – China and the United States – and their influence over the use of surveillance technologies in the name of spatial security in relatively weaker states – Nepal and Afghanistan. We use these two areas of comparison to address the similarities in security logics across disparate spaces and to highlight the everyday experiences and responses to both outside influence from powerful states and national security regimes. Through interview data from our respective qualitative research in Afghanistan and Nepal, we show how the logics of security situates particular racialized and gendered bodies as suspicious and examine how individuals living in these spaces experience, understand, and challenge these security regimes. We conclude by arguing for more comparative studies of security technologies and surveillance regimes. Additionally, we view these spaces of heightened security as potential sites for increased violence, rather than security.

GNNUnlock+: A Systematic Methodology for Designing Graph Neural Networks-Based Oracle-Less Unlocking Schemes for Provably Secure Logic Locking

Leading-edge design houses outsource the fabrication process to pure-play foundries eliminating the expenses of owning and maintaining a fab. The intellectual property (IP) of an outsourced design is now subject to IP piracy, which drives the need for a protection mechanism. Logic locking is a technique that aims to thwart IP piracy throughout the supply chain. However, state-of-the-art, provably secure logic locking (PSLL) techniques are vulnerable to functional and structural analysis-based attacks. Few removal attack protection mechanisms have been developed, such as diversified tree logic and wire entanglement, to protect PSLL against structural attacks. In this work, we significantly enhance GNNUnlock ( <b>GNNUnlock+</b> ) and demonstrate how the most advanced PSLL techniques armed with removal attack protection have no impact on its effectiveness. Our evaluation demonstrates that GNNUnlock+ is <inline-formula><tex-math notation="LaTeX">$89.66\%-100\%$</tex-math></inline-formula> successful in breaking benchmarks locked using 9 different PSLL techniques—Stripped functionality logic locking, tenacious and traceless logic locking, Anti-SAT, SAT attack resistant logic locking (SARLock), Anti-SAT with diversified tree logic (Anti-SAT-DTL), Anti-SAT with wire entanglement, SARLock-DTL, corrupt and correct (CAC) and CAC-DTL. GNNUnlock+ can break the considered techniques under different parameters, synthesis settings, and technology nodes. Moreover, GNNUnlock+ successfully breaks corner cases where even the most advanced state-of-the-art attacks fail.

Design of an Integrated Cryptographic SoC Architecture for Resource-Constrained Devices

One of the active research areas in recent years that has seen researchers from numerous related fields converging and sharing ideas and developing feasible solutions is the area of hardware security. The hardware security discipline deals with the protection from vulnerabilities by way of physical devices such as hardware firewalls or hardware security modules rather than installed software programs. These hardware security modules use physical security measures, logical security controls, and strong encryption to protect sensitive data that is in transit, in use, or stored from unauthorized interferences. Without mechanisms to circumvent the ever-evolving attacking strategies on hardware devices and the data that they process or store, billions of dollars will always be lost to attackers who ply their trade by targeting such vulnerable devices. This paper, therefore, proposes an integrated cryptographic SoC architecture solution to this menace. The proposed architecture provides security by way of key exchange, management, and encryption. The proposed architecture is based on a True Random Number generator core that generates secret keys that are used in Elliptic Curve Diffie-Hellman Key Exchange to perform elliptic curve scalar multiplication to obtain public and shared keys after the exchange of the public keys. The proposed architecture further relies on a Key Derivation Function based on the CubeHash algorithm to obtain Derived Keys that provide the needed security using the ChaCha20_Poly1305 Authenticated Encryption with Associated (AEAD) Data Core. The proposed Integrated SoC architecture is interconnected by AMBA AHB-APB on-chip bus and the system is scheduled and controlled using the PicoRV32 opensource RISC-V processor. The proposed architecture is tested and verified on the Virtex-4 FPGA board using a custom-designed GUI desktop application.

Overcoming Fraud and Cybercrime: The Role of Integrity in Village Financial System Reporting

This research aims to describe the implementation of control in village financial system (Indonesia: Sistim Keuangan Desa / Siskeudes) in order to maintain the integrity data of village funds, outright the monitoring againsts the threat of fraud, both in a form of conventional and also cybercrime. The technique used in this research is descriptive qualitative methods and the data used are primary data obtained from direct interviews with the key person informants and the secondary data in the form of documentation to support this research as evidence of the controls to be identified. Results shows that Internal Control such as Environmental Control, Physical Security Control, Logical Security Control and IS Operating Control has been implemented in Siskeudes Samirono. If all the control is being optimally implemented and periodically reviewed to ensure that it is able to mitigate the risk of fraud and cybercrime in the implementation of Siskeudes, the quality of the information produced will be ensured.

Predicting future community intrusions using a novel type and encryption mechanism architecture for attack node mitigation

The recent exponential rise in the number of cyber-attacks has demanded intensive study into community intrusion detection, prediction, and mitigation systems. Even though there are a variety of intrusion detection technologies available, predicting future community intrusions is still a work in progress. Existing approaches rely on statistical and/or superficial device mastery techniques to solve the problem, and as a result, feature selection and engineering are required. The truth is that no single classifier can provide the highest level of accuracy for all five types of training data set. Cyber-attack detection is a technique for detecting cyber-attacks as they emerge on a laptop or network device, intending to compromise the gadget's security. As a result, using a novel type and encryption mechanism, this paper offered a unique architecture for attack node mitigation. The input UNSW-NB15 dataset is first acquired and divided into training and testing statistics. First and foremost, the information is pre-processed and capabilities are retrieved in the training section. The Taxicab Woodpecker Mating Algorithm (TWMA) is then used to select the critical characteristics. The attacked and non-attacked information are then classified using the BRELU-ResNet (Bernoulli's Leaky Rectified Linear Unit - Residual Neural Community) classifier. The encrypted at Ease Hash Probability-Based Elliptic-Curve Cryptography (ESHP-ECC) technique is used to encrypt the ordinary facts, which are subsequently kept in the security log report. Following that, using Euclidean distance, the shortest course distance is estimated. Finally, the records are decrypted using a set of principles known as Decrypted Relaxed Hash Probability-Based Elliptic-Curve Cryptography (DSHP-ECC). If the input appears in the log file during testing, it is regarded as attacked data and is prevented from being transmitted. If it isn't found, the procedure of detecting cyber-attacks continues.

“CLASS: Cloud Log Assuring Soundness and Secrecy” Scheme for Cloud Forensics

Abstract-User activity logs can be a valuable source of information in cloud forensic investigations; hence, ensuring the reliability and integrity of such logs is crucial. Most existing solutions for secure logging are designed for conventional systems rather than the complexity of a cloud environment. In this paper, we propose the Cloud Log Assuring Soundness and Secrecy (CLASS) process as an alternative scheme for the securing of logs in a cloud environment. In CLASS, logs are encrypted using the individual user’s public key so that only the user is able to decrypt the content. In order to prevent unauthorized modification of the log, we generate proof of past log (PPL) using Rabin’s fingerprint and Bloom filter. Such an approach reduces verification time significantly. Findings from our experiments deploying CLASS in OpenStack demonstrate the utility of CLASS in a real-world context Keywords- Cloud Log, Cloud Computing, Virtual Machine, Cloud Server, Apache Tom cat, Java.

Application of blockchain to underground utilities

Blockchain technology enables encrypted and secure logging and transactions for information and data. This technology is expected to revolutionize computing in several areas, mainly where centralization is unnatural, and privacy is important. We are driven by circumstance and the complexity of underground utilities, which need measures to record information, secure data, and utilize new technologies with recorded information and store it into a secure digital platform. The platform must be able to deal with different types of files and documents with high efficiency and workability. Current problems due to uncertain information regarding the location of existing underground utilities often leads to striking of such utilities. This study describes blockchain technology and a proposed application to manage infrastructure utilities. The paper compares blockchain with Underground Infrastructure Management (UIM) and One Call System 811, and the potential advantage of this technology to manage underground utilities. Potential integration with blockchain and UIM is described to maximize infrastructure sustainability in underground utilities with respect to security and management. The research presented is focused on exploring the possibilities that blockchain has to offer with regard to protection of underground utilities.

A Novel Approach of BRELU RESNET Based Cyber Attack Detection System with BAIT Based Approach for Mitigation

Purpose: Industrial Control Systems become more vulnerable to digital attacks by merging communication groups and the Internet of Things, which could have severe implications. An Intrusion Detection System is essential in IoT businesses for identifying and stopping assaults. To ensure data privacy and security in the face of digital attacks, legislation and large enterprises should develop network security policies today. As people-based full frameworks have become more vital in today's society, they've also become targets for hostile activities, compelling both industry and research to concentrate more on dealing with local area disruption recognition issues. Contraption reviewing techniques have shown to be effective tools for resolving in-network interruption location issues. Design/Methodology/Approach: This investigation yielded a very unique strategy for tackling hub moderation utilizing a Classification and Encryption method. The UNSW-NB15 dataset is acquired and divided into Data for preparation and testing from the start. The information is pre-handled and included are eliminated right away within the preparation time frame. The TWM Algorithm is then used to determine the relevant highlights from that moment onward. The BRELU-RESNET classifier then sorts the input into went after and non-went after categories. The compromised information is then saved in the security log record, and the typical data is encrypted using the ESHP-ECC computation. The shortest path distance is then calculated using Euclidean distance. Finally, the data is available. Finally, using the DSHP-ECC computation, the information is decrypted. If the information is available in the log document during testing, it is regarded as the sought-after data and is prevented from the transmission. If it is not present, then the process of digital assault recognition begins. Findings/Result: The research is based on the UNSW-NB 15 dataset, which shows that the proposed method achieves an unreasonable awareness level of 98.34 percent, particularity level of 77.54 percent, exactness level of 96.6 percent, Precision level of 97.96 percent, review level of 98.34 percent, F-proportion of 98.15 percent, False Positive Rate of 22.46 percent, False Negative Rate of 1.66 percent, and Matthew's connection coefficient of 77.38 Originality/Value: This experimental-based research article examines the malicious activities in the cyberspace using BRELU-RESNET approach and mitigated by using BAIT based approach mechanism. Paper Type: Research Analysis.

Link Security Situation Identification Method Based on the Ad Hoc Network of Medical Units.

In order to strengthen the management and security status monitoring of the internal network of medical units and make up for security vulnerabilities in time, an ad hoc network link security situation identification method is proposed. According to the architecture of the ad hoc network, it is analyzed that it has the advantages of strong persistence and its own protocol. Combined with the data of detection equipment and security log, the hierarchical acquisition model is used to obtain the situation elements such as port scanning attack and flood attack. The transmission rate factor, forwarding rate factor, dispersion factor, and node aggregation factor are regarded as eigenvectors. We determine the relationship between identity, difference, and opposition, identify the security situation through the description of the node state, and conduct quantitative processing to obtain the final identification result. The experimental results show that the weight value of this method is the same as the standard weight, which can identify the security situation level, obtain the specific situation value, and present a more intuitive identification result.