Security Tools Research Articles

A five-safes approach to a secure and scalable genomics data repository

Genomic researchers increasingly utilize commercial cloud service providers (CSPs) to manage data and analytics needs. CSPs allow researchers to grow Information Technology (IT) infrastructure on demand to overcome bottlenecks when combining large datasets. However, without adequate security controls, the risk of unauthorized access may be higher for data stored on the cloud. Additionally, regulators are mandating data access patterns and specific security protocols for the storage and use of genomic data. While CSP provides tools for security and regulatory compliance, building the necessary controls required for cloud solutions is not trivial. Research Assets Provisioning and Tracking Online Repository (RAPTOR) by the Genome Institute of Singapore is a cloud-native genomics data repository and analytics platform that implements a "five-safes" framework to provide security and governance controls to data contributors and users, leveraging CSP for sharing and analysis of genomic datasets without the risk of security breaches or running afoul of regulations.

Improving the contour of information protection in the context of a computer network

The study is aimed at the analysis and application of software and hardware information protection in a local computer network on the example of the case of the Main Directorate of the Ministry of Emergency Situations of Russia in the Sverdlovsk Region. The analysis of the existing composition and scheme of the network, as well as the risks that pose a potential threat to the considered local network of the organization, was carried out. The main types of means of protection are determined, considering the idea of processed information in the network and the specifics of the organization in the context of import substitution. The experience of implementing topical tools that are certified by the Federal Service for Technical and Export Control and the Federal Security Service and meet the requirements for information protection in an organization, identified because of an analysis of the requirements for the protection segment, is described. The main approaches to the design of the network and the location of the protection segment in it are determined. The task was set to develop an approach to the administration of information security tools in a local computer network.

Voice Assistant based on GPT-3 and Whisper

Abstract: A voice assistant based on GPT-3 (Generative Pre-Trained Transformer 3) and Whisper, a secure multi-party computation technology, can offer an enhanced level of privacy and security to users. By leveraging Whisper, GPT-3 can securely process user data without compromising privacy, ensuring that sensitive information remains protected. This combination also enables the development of decentralized voice assistants, which can operate without relying on a central server or data centre, further enhancing privacy and security. With this technology, users can interact with the voice assistant confidently, knowing that their data is secure and private. Additionally, the natural language processing capabilities of GPT-3 make the interaction with the voice assistant more intuitive and seamless, allowing users to complete tasks quickly and efficiently. Overall, a voice assistant based on GPT-3 and Whisper offers a powerful and secure tool for individuals and organizations that prioritize privacy and security.

Cryptography Algorithms for Enhancing IoT Security

In today's fast-paced world, a new technology paradigm known as the Internet of Things (IoT) is advancing every business. It provides communication between the digital and physical worlds, transforming the way people do business quickly. The IoT is a network of physical objects (things) equipped with sensors, intelligent networking, radio-frequency identification (RFID), and other technologies that communicate and exchange data with other systems and devices online. IoT applications are now significantly more prevalent worldwide. IoT is driving the real world to become more intelligent in several industries, including smart grids for electricity, intelligent traffic, and smart homes and buildings. As a result, predictions and research point to over 50 billion connected devices by 2020. It will be required to safeguard this growing volume of data during exchange because the amount of data being transmitted will be quite enormous. Data security is represented by cryptography, an essential tool (algorithms) in security, which is why many researchers are developing cryptographic algorithms to improve the Security of IoT. This survey paper introduced an overview of IoT technology, architecture, and applications and a detailed analysis comparing all cryptographic algorithms and their use in day-to-day life activities. This paper discusses lightweight block ciphers, stream ciphers, and hybrid ciphers. The report evaluates security algorithms, comparing performance and robustness with the computational complexity of these techniques. Finally, the survey presents IoT security challenges, threats, and attacks with their mitigation techniques.

Energy Security: New Threats and Solutions

The article presents the conceptual features of energy security management under a radically changed context, increasing crisis phenomena, and threats of various natures. The authors substantiate the claim that energy security is a complex category, which expresses the ability of the fuel and energy complex of the region to supply the required amount and range of energy resources to the domestic market at stable and reasonable prices; to promptly mitigate unexpected fluctuations in demand for fuel and energy resources; and to ensure uninterrupted energy supply and energy carrier parameters in real time. Based on an analysis of scientific publications and practical energy security models, the authors developed theoretical provisions, methodological principles, and management tools for energy security that meet modern requirements. In particular, the authors developed the terminological apparatus and identified the types and forms of modern energy threats and risks. The authors analyzed the impact of structural shifts in the electric power industry on the cost of electricity. The authors proposed a set of measures to neutralize negative scenarios in the field of energy security, which had appeared because of geopolitical factors, structural changes in the economy, and high volatility in energy prices. In addition, the authors considered the impact of the transition to low-carbon energy production on energy security, and developed the organizational and technical concept of the energy transition, which aimed to provide energy systems and individual energy facilities with properties of self-protection from emerging threats. The results of the study are of practical interest in the development of regional energy policy, plans, and specific actions that aim to ensure energy security in a turbulent global environment.

Multi-objective evolving long–short term memory networks with attention for network intrusion detection

Cyber security has received increasing attention, as people use more Internet applications in their lives and worry about the security of their personal data on the Internet. Intrusion Detection Systems (IDSs) are critical security tools that can detect and respond to intrusions. In recent years, Deep Learning (DL) techniques have gained popularity in IDS design due to their promising performance in terms of detection accuracy. However, the design of DL architectures usually requires professional knowledge and significantly impacts the performance of the DL model. Furthermore, the existence of a small ratio of abnormal traffic in vast network traffic leads to a serious imbalanced data problem, which negatively affects the performance of the DL model in detecting minority attack classes. To alleviate these problems, this paper proposes a multi-objective evolutionary DL model (called EvoBMF) to detect network intrusion behaviors. The model incorporates bidirectional Long–short Term Memory (BiLSTM) for preliminary feature extraction, Multi-Head Attention (MHA) for further capturing features and global information of the network traffic, and Full-Connected Layer (FCL) module to perform final classification. To deal with the challenge of manually tuning the parameters of the DL model when tackling different tasks, the parameters of the EvoBMF model are first encoded as the chromosome of the Multi-objective Evolutionary Algorithm (MOEA), which aims to optimize the two conflicting objectives (complexity and classification ability) of the model. A state-of-the-art MOEA (MOEA/D-DRA) is then used to optimize the above two objectives, aiming to obtain the optimal architecture for EvoBMF, which can be easily deployed in cloud computing scenarios to detect and respond to network intrusions. Additionally, to alleviate the severe imbalance in routine network traffic, the synthetic minority over-sampling technique is introduced to generate representative samples of minority classes to improve the overall performance of the model. At last, the experimental results conducted on two popular datasets (UNSW-NB15 and CIC-IDS 2018) have demonstrated that the proposed EvoBMF model can provide superior performance for intrusion detection when compared to some state-of-the-art IDSs.

Anomaly-based Network Intrusion Detection System using Deep Intelligent Technique

Background and objectives: Computer systems and network infrastructures are still exposed to many security risks and cyber-attack vulnerabilities despite advancements of information security. Traditional signature-based intrusion detection systems and security solutions by matching rule-based mechanism and prior knowledge are insufficient of fully protecting computer networks against novel attacks. For this purpose, Anomaly-based Network Intrusion Detection System (A-NIDS) as cyber security tool is considered for identifying and detecting anomalous behavior in the flow-based network traffic alongside with firewalls and other security measures. The main objective of the research is to improve the detection rate and reduce false-positive rates of the classifier using anomaly-based technique. Methods: an intelligent technique using deep learning algorithm and mutual information feature selection (MIFS) method to select optimal features on the benchmark datasets. Proposed method accurately capable of classifying normal and anomalous states of the data packets in a comprehensive way by combination of Long-Short term memory (LSTM) algorithm and MIFS method. Results: The model achieved encouraging results in terms of accuracy 99.79%, 0.002 false-positive rate with minimum time compared to other models recorded only 81.75s on CSE-CIC-IDS2018 dataset. At the end of the study, comparative studies are conducted to verify the effectiveness of proposed method on three realistic and latest intrusion detection datasets, named CSE_CIC-IDS2018, CIC-IDS2017, and NF-CSE-CIC-IDS2018 dataset. Conclusions: Proposed model in a combination of LSTM NN and Feature selection method (MIFS) increased detection rate and reduced false-positive alarms, also the model able to detect low frequent attacks while other existing models are suffering from.

Full-stack vulnerability analysis of the cloud-native platform

Cloud-native systems have recently emerged as one of the most popular platforms for application development, providing lightweight virtualization, simplified DevOps procedures, scaling, resource efficiency, monitoring, and more. The typical cloud-native system may include containers, container orchestrators, and service meshes. However, a number of attacks exploit vulnerabilities in different components, leading the attacker to gain control over the cloud-native system. In this paper, we collect, classify, exploit, and mitigate vulnerabilities of different components. Firstly, we choose Docker, Kubernetes, and Istio as the most popular cloud technologies and give each an overview. Secondly, we give an in-depth analysis of the vulnerabilities. We collect cloud-native vulnerabilities over the past five years and propose two classifications of those vulnerabilities. One is based on the architecture of the component, and the other is based on the attack enabled. We exploit vulnerabilities that enable us to discover some insightful findings and provide mitigation solutions. Third, we analyze 15 open-source security tools provided for the cloud-native environment. We argue that among all these security tools, none of them covers all features which we will discuss in this paper. We believe that our analysis of cloud security vulnerabilities and open-source security tools can benefit the security of the cloud-native ecosystem.

Development and Validation of a Physical Food Security Tool for Older Adults

BackgroundCurrent measures of food insecurity focus on economic access to food, but not on the physical aspect of food insecurity that captures the inability to access food or prepare meals. This is particularly relevant among the older adult population who are at a high risk of functional impairments. ObjectivesTo develop a short-form physical food security (PFS) tool among older adults using statistical methods based on the Item Response Theory (Rasch) model. MethodsPooled data from adults aged ≥60 y of the NHANES (2013–2018) (n = 5892) were used. The PFS tool was derived from the physical limitation questions included in the physical functioning questionnaire of NHANES. Item severity parameters, fit and reliability statistics, and residual correlation between items were estimated using the Rasch model. The construct validity of the tool was assessed by examining associations with the Healthy Eating Index (HEI)-2015 scores, self-reported health, self-reported diet quality, and economic food insecurity, using weighted multivariable linear regression analysis, controlling for potential confounders. ResultsA 6-item scale was developed, which had adequate fit statistics and high reliability (0.62). It was categorized based on raw score severity into high, marginal, low, and very low PFS. Very low PFS was associated with respondent’s self-reported poor health (OR = 23.8; 95% CI: 15.3, 36.9; P < 0.0001), self-reported poor diet (OR = 3.9; 95% CI: 2.8, 5.5; P < 0.0001), low and very low economic food security (OR = 6.08; 95% CI: 4.23, 8.76; P < 0.0001), and with lower mean HEI-2015 index score, in comparison to older adults with high PFS (54.5 compared with 57.5, P = 0.022). ConclusionsThe proposed 6-item PFS scale captures a new dimension of food insecurity that can inform on how older adults experience food insecurity. The tool will require further testing and evaluation in larger and different contexts to demonstrate its external validity.

Cracking the Anonymous IoT Routing Networks: A Deep Learning Approach

In recent years, IoT technology has been one of the most rapidly expanding fields, connecting over 27 billion connected devices worldwide. Increasing security concerns, such as software flaws and cyberattacks, limit the use of IoT devices. Tor, also known as “The Onion Router,” is one of the most popular, secure, and widely deployed anonymous routing systems in IoT networks. Tor is based on a worldwide network of relays operated by volunteers worldwide. Tor continues to be one of the most popular and secure tools against network surveillance, traffic analysis, and information censorship due to its robust use of encryption, authentication, and routing protocols. However, ToR is not anticipated to be entirely safe. The increasing computational capabilities of adversaries threaten Tor's ability to withstand adversarial attacks and maintain anonymity. This article describes the foundation of the Tor network, how it operates, potential attacks against Tor, and the network's defense strategies. In addition, the authors present a framework for deep learning that uses bandwidth performance to identify the server's location in Tor, thereby compromising anonymity. This article examines Tor's network's current and projected future in the Internet of Things.

The research of electrical parameters of threshold detectors

This research work provides an in-depth analysis of the fire alarm system, considered as a security tool for a variety of facilities, from industrial buildings to residential premises. Two key subsystems serve as the basis for the study: the fire alarm system, which is designed to detect and report the occurrence of fire, and the intrusion alarm system, whose task is to detect attempts at illegal intrusion. For each of these subsystems, their functions and components are investigated, their mechanism of action, principles of operation, and possible implementation options are described, depending on the specific conditions and security requirements. At the same time, emphasis is placed on three types of automatic fire alarm systems: threshold, addressable and addressable-analog, each of which has its own features, advantages and disadvantages. The article goes beyond theoretical analysis and presents the results of a practical study of the three main types of fire alarm systems: wired, wireless and addressable. The study is based on a specially designed training stand, which allows you to simulate the operation of fire alarm systems in conditions as close to reality as possible. The article demonstrates the connection schemes of detectors, explains their states in the "normal" and "alarm" modes. It is noted that the currents and voltages of alarm loops in different modes were measured. Dependency diagrams of these parameters are presented, and the alarm threshold levels are measured. The research presented in the paper provides a valuable contribution to the study and optimization of alarm and fire systems, providing meaningful data for the development and testing of these systems. The paper can be useful for fire and security professionals and those interested in improving the performance of these systems.

Co-Creation in Secure Software Development: Applied Ethnography and the Interface of Software and Development

Long-term ethnographic research conducted at a software company examined how security concerns and practices became part of software development. Participant observation over a two-year period was done by researchers with cybersecurity backgrounds and training in both computer science and qualitative research, with ongoing analysis done by a larger interdisciplinary team. In situ researchers joined as software engineers and participated in daily work activities while observing development practices and analyzing software (in)security. The first year of research found that improving security during software development can be helped by a co-creation model, whereby security experts work directly with software developers to provide security tools applicable to the specific software within the workflow. Researchers-as-developers fostered conversations, concerns, and considerations of how to implement security within the process of development. The second year used a situated learning approach to understand the interface between software development, security, and the development team. Through an interactive learning process, software engineers gathered knowledge and applied it, helping to foster greater concerns for security as part of the overall “culture” of development within the company. This locally situated co-creation approach has resonances with participatory approaches in business anthropology and implications for how to promote the co-creation of knowledge and expertise more broadly.

Novel Convolutional Neural Networks based Jaya algorithm Approach for Accurate Deepfake Video Detection

Deepfake videos are becoming an increasing concern due to their potential to spread misinformation and cause harm. In this paper, we propose a novel approach for accurately detecting deepfake videos using the combination of Convolutional Neural Networks (CNNs) with the Jaya algorithm optimization. The approach is evaluated on two publicly available datasets, the DeepFake Detection Challenge (DFDC) dataset and the Celeb-DF dataset, and achieves state-of-the-art performance on both datasets. Our approach achieves an accuracy of 99.3% on the DFDC dataset and 97.6% on the Celeb-DF dataset, with high F1 scores indicating a high precision and recall for detecting deepfake videos. Furthermore, our approach is more robust against adversarial attacks than existing state-of-the-art methods. The combination of CNNs with the Jaya algorithm optimization enables effective capture of the temporal information in the video sequence, while the use of robust evaluation metrics ensures objective measurement and comparison with existing methods. Our proposed approach offers a highly effective solution for detecting deepfake videos, which has the potential to be a valuable tool for media forensics, content moderation, and cyber security.

METHOD FOR DETECTION OF RANSOMWARE CYBER THREATS BASED ON HONEYPOT: STATE-OF-ART

The work presents the research of the methods for detecting cyber threats such as Ransomware based on the use of Honeypot. Today, lack of awareness allows attacks to bypass basic security mechanisms, security vulnerabilities in the IT systems of small and large corporations are increasingly being used to cause business failures. The cyberattackscontinue to expand rapidly as cybercriminals constantly bypass the security tools developed and implemented by organizations. The purpose of attacks is increasingly data that is critical to both individuals and organizations. Attackers use capabilitiesthat can help them seize control of valuable data to demand a ransom from the data owner. Ransomware is a form of malware that infects a computer or multiple computers over a network by encrypting files and folders, making them unusable. The users are then asked to make a ransom. Ransomware is not a new threat, but its use is growing rapidly and causing large financial losses in the world. This is a serious challenge for cybersecurity analysts because typical ransomware is not detected by antivirus software due to its polymorphic nature. There was a sudden surge in extremely dangerous ransomware attacks that harmed most companies and individuals. Ransomware poses a great threat and must be fought at a global level. There is a lack of comprehensive analysis to cover the security issues of individual users and corporations. Ransomware avoidance methods are the most effective and require special attention as the reduction and recovery of ransomware becomes increasingly difficult. The task arises to investigate the effectiveness of known methods in order to assess and identify their advantages and disadvantages, which will allow in the future to develop and implement new effective methods and means of combating Ransomware-type SPZ based on the use of Honeypot. The study shows that because malware is automated and targets any location arbitrarily, placing the bait anywhere to detect activity is an improvement over the lack of monitoring at all. Experimental studies indicate a high reliability of the proposed methods, in particular the reliability of the detection of cyber threats of the Ransomware type, but the insufficient adaptability of these methods in the evolution of the malware.

The concept of strategic management national security

Analytical description of the community, national strategic management of national security as the basis for the formation of state security with a reflection of the collective actions of diplomacy, administration, and general knowledge management. An attempt to create a package and goals in the context of a comprehensive strategy as a concept of concrete state action to promote social and civic science is typical in the cause-and-effect relationship of the system as a security tool. Accumulated knowledge related primarily to modern views on the philosophical and methodological foundations of ensuring national security is presented and systematized. In particular, the principles of the scientific study of security as a social phenomenon are considered. The article is devoted to systemic aspects of the foundations of national security. The main concepts and categories of national security are considered national interests, threats and challenges to national security, the structure of national values of Ukraine, and their relationship with national interests and goals. The concept and design of the national security system, conceptual approaches to its provision, as well as the system of federal security provision, are considered in detail (in particular, such issues as identification and comprehensive assessment of the level of threats to national security, conceptual principles for assessing the state's defense adequacy, determining the agenda for state authorities, adequate to threats to vital national interests). Several other principles are considered issues, the solution of which depends on the effectiveness of state management decisions on ensuring national security. Among them the information model of the mechanism of state-management decision-making in the process of ensuring national security, the basis of the coordination mechanism interests of man and society, theoretical foundations, and practical aspects of the organization of strategic management in the field of national security. Keywords: national security, state security, management strategy, and planning

Calculation of the security level coefficient of the automated system of the internal affairs bodies based on the information security of the information security system with updates of virus and threat signatures

Objective. This paper considers protection against threats that occur more often in the period from the start of the operating system boot. Consideration of various configurations will allow an overview of a fairly wide range of situations that arise. To solve the problem, it is necessary to determine the vulnerabilities, as well as to designate the coefficients that determine the state of the automated system.Method. Computer facilities are a set of software and hardware components (including information security tools) of data processing systems that can function independently or as part of other systems. Methods for analyzing the process of the impact of computer threats at the stage of loading the operating system are applied.Result. A technique is proposed for calculating the security factor of automated systems in a secure design, depending on the availability of the necessary security policies and the timely updating of virus and threat signature databases. The vulnerabilities in the process of starting the operating system are summarized, conclusions are drawn on the calculation of the security level coefficient of the automated ATS system based on the information security of the information security system with updates of virus and threat signatures.Conclusion. The developed methodology makes it possible to assess the security of automated systems, taking into account the situation of information security in the field.

A Review on Intrusion Detection System and its Techniques

Technology development has brought so many threats and hazards at a very high rate in the recent years. The development of application, software tools and its usage in all the fields has brought the awareness about the security. Many mechanisms are used as the security tool such as firewalls, antivirus, spam filters and anti-malware for the security purposes to protect their system and network. Intrusion detection system is a very powerful security system to detect any abnormal or unauthorised access to the system and to the network. This paper is about the study of the importance of intrusion detection, classification of intrusion detection system (IDS), its datasets and usage in various applications. The intrusion detection system has got many developments through its datasets, new technologies and methods but as the technologies increases, the threats of attacking the system and data breaches also increases, so in order to overcome this problem a hybrid framework for the intrusion detection has to be developed to detect the intrusions from the intruder.

Evaluation of Static Vulnerability Detection Tools With Java Cryptographic API Benchmarks

Several studies showed that misuses of cryptographic APIs are common in real-world code (e.g., Apache projects and Android apps). There exist several open-sourced and commercial security tools that automatically screen Java programs to detect misuses. To compare their accuracy and security guarantees, we develop two comprehensive benchmarks named CryptoAPI-Bench and ApacheCryptoAPI-Bench. CryptoAPI-Bench consists of 181 unit test cases that cover basic cases, as well as complex cases, including interprocedural, field sensitive, multiple class test cases, and path sensitive data flow of misuse cases. The benchmark also includes correct cases for testing false-positive rates. The ApacheCryptoAPI-Bench consists of 121 cryptographic cases from 10 Apache projects. We evaluate four tools, namely, SpotBugs, CryptoGuard, CrySL, and another tool (anonymous) using both benchmarks. We present their performance and comparative analysis. The ApacheCryptoAPI-Bench also examines the scalability of the tools. Our benchmarks are useful for advancing state-of-the-art solutions in the space of misuse detection.

ПРОГРАММНАЯ РЕАЛИЗАЦИЯ ЗАЩИТЫ ОТ НЕСАНКЦИОНИРОВАННОГО ДОСТУПА

Information security tools are an integral part of system users. The concept of information security implies the development and expansion of the scope of innovative technologies in information processing. To keep the information security system up to date, it is necessary to periodically update and supplement the structure of information protection, information security threat model and hardware and software complex. This paper analyzes the existing methods of information protection and proposes the implementation software system modules for personality recognition by photo and video, voice recognition, deep neural network and the creation of configuration for its weights file. Based on the generated data set, a method for synthesizing the parameters of a mathematical model of a convolutional neural network, presented as an array of real numbers, which are unique identifiers of a personal computer user, has been developed and proposed. This study uses the features of simulation modeling of user authorization systems, as well as the error function when compiling a neural network model. The training model of multi-factor biometric authentication is trained using categorical cross-entropy. The training sample is generated by adding distorted images from the database by changing the receptive fields of the convolutional neural network. The objective of this study is the application of new methods and means of protecting information of workstations from information threats. The result of the study is the developed information security system designed to ensure the information security of users of personal computers and workstations of enterprises.

APIRO: A Framework for Automated Security Tools API Recommendation

Security Orchestration, Automation, and Response (SOAR) platforms integrate and orchestrate a wide variety of security tools to accelerate the operational activities of Security Operation Center (SOC). Integration of security tools in a SOAR platform is mostly done manually using APIs, plugins, and scripts. SOC teams need to navigate through API calls of different security tools to find a suitable API to define or update an incident response action. Analyzing various types of API documentation with diverse API format and presentation structure involves significant challenges such as data availability, data heterogeneity, and semantic variation for automatic identification of security tool APIs specific to a particular task. Given these challenges can have negative impact on SOC team’s ability to handle security incident effectively and efficiently, we consider it important to devise suitable automated support solutions to address these challenges. We propose a novel learning-based framework for automated security tool API R ecommendation for security O rchestration, automation, and response, APIRO . To mitigate data availability constraint, APIRO enriches security tool API description by applying a wide variety of data augmentation techniques. To learn data heterogeneity of the security tools and semantic variation in API descriptions, APIRO consists of an API-specific word embedding model and a Convolutional Neural Network (CNN) model that are used for prediction of top three relevant APIs for a task. We experimentally demonstrate the effectiveness of APIRO in recommending APIs for different tasks using three security tools and 36 augmentation techniques. Our experimental results demonstrate the feasibility of APIRO for achieving 91.9% Top-1 Accuracy. Compared to the state-of-the-art baseline, APIRO is 26.93%, 23.03%, and 20.87% improved in terms of Top-1, Top-2, and Top-3 Accuracy and outperforms the baseline by 23.7% in terms of Mean Reciprocal Rank (MRR).