Visible to the public Biblio

Found 467 results

Filters: Keyword is IP networks  [Clear All Filters]
2023-02-03
Talukdar, Jonti, Chaudhuri, Arjun, Chakrabarty, Krishnendu.  2022.  TaintLock: Preventing IP Theft through Lightweight Dynamic Scan Encryption using Taint Bits. 2022 IEEE European Test Symposium (ETS). :1–6.
We propose TaintLock, a lightweight dynamic scan data authentication and encryption scheme that performs per-pattern authentication and encryption using taint and signature bits embedded within the test pattern. To prevent IP theft, we pair TaintLock with truly random logic locking (TRLL) to ensure resilience against both Oracle-guided and Oracle-free attacks, including scan deobfuscation attacks. TaintLock uses a substitution-permutation (SP) network to cryptographically authenticate each test pattern using embedded taint and signature bits. It further uses cryptographically generated keys to encrypt scan data for unauthenticated users dynamically. We show that it offers a low overhead, non-intrusive secure scan solution without impacting test coverage or test time while preventing IP theft.
ISSN: 1558-1780
2023-01-20
Ender, Maik, Leander, Gregor, Moradi, Amir, Paar, Christof.  2022.  A Cautionary Note on Protecting Xilinx’ UltraScale(+) Bitstream Encryption and Authentication Engine. 2022 IEEE 30th Annual International Symposium on Field-Programmable Custom Computing Machines (FCCM). :1–9.
FPGA bitstream protection schemes are often the first line of defense for secure hardware designs. In general, breaking the bitstream encryption would enable attackers to subvert the confidentiality and infringe on the IP. Or breaking the authenticity enables manipulating the design, e.g., inserting hardware Trojans. Since FPGAs see widespread use in our interconnected world, such attacks can lead to severe damages, including physical harm. Recently we [1] presented a surprising attack — Starbleed — on Xilinx 7-Series FPGAs, tricking an FPGA into acting as a decryption oracle. For their UltraScale(+) series, Xilinx independently upgraded the security features to AES-GCM, RSA signatures, and a periodic GHASH-based checksum to validate the bitstream during decryption. Hence, UltraScale(+) devices were considered not affected by Starbleed-like attacks [2], [1].We identified novel security weaknesses in Xilinx UltraScale(+) FPGAs if configured outside recommended settings. In particular, we present four attacks in this situation: two attacks on the AES encryption and novel GHASH-based checksum and two authentication downgrade attacks. As a major contribution, we show that the Starbleed attack is still possible within the UltraScale(+) series by developing an attack against the GHASH-based checksum. After describing and analyzing the attacks, we list the subtle configuration changes which can lead to security vulnerabilities and secure configurations not affected by our attacks. As Xilinx only recommends configurations not affected by our attacks, users should be largely secure. However, it is not unlikely that users employ settings outside the recommendations, given the rather large number of configuration options and the fact that Security Misconfiguration is among the leading top 10 OWASP security issues. We note that these security weaknesses shown in this paper had been unknown before.
2023-01-13
Syed, Shameel, Khuhawar, Faheem, Talpur, Shahnawaz, Memon, Aftab Ahmed, Luque-Nieto, Miquel-Angel, Narejo, Sanam.  2022.  Analysis of Dynamic Host Control Protocol Implementation to Assess DoS Attacks. 2022 Global Conference on Wireless and Optical Technologies (GCWOT). :1—7.
Dynamic Host Control Protocol (DHCP) is a protocol which provides IP addresses and network configuration parameters to the hosts present in the network. This protocol is deployed in small, medium, and large size organizations which removes the burden from network administrator to manually assign network parameters to every host in the network for establishing communication. Every vendor who plans to incorporate DHCP service in its device follows the working flow defined in Request for Comments (RFC). DHCP Starvation and DHCP Flooding attack are Denial of Service (DoS) attacks to prevents provision of IP addresses by DHCP. Port Security and DHCP snooping are built-in security features which prevents these DoS attacks. However, novel techniques have been devised to bypass these security features which uses ARP and ICMP protocol to perform the attack. The purpose of this research is to analyze implementation of DHCP in multiple devices to verify the involvement of both ARP and ICMP in the address acquisition process of DHCP as per RFC and to validate the results of prior research which assumes ARP or ICMP are used by default in all of devices.
2022-12-23
Faramondi, Luca, Grassi, Marta, Guarino, Simone, Setola, Roberto, Alcaraz, Cristina.  2022.  Configuration vulnerability in SNORT for Windows Operating Systems. 2022 IEEE International Conference on Cyber Security and Resilience (CSR). :82–89.
Cyber-attacks against Industrial Control Systems (ICS) can lead to catastrophic events which can be prevented by the use of security measures such as the Intrusion Prevention Systems (IPS). In this work we experimentally demonstrate how to exploit the configuration vulnerabilities of SNORT one of the most adopted IPSs to significantly degrade the effectiveness of the IPS and consequently allowing successful cyber-attacks. We illustrate how to design a batch script able to retrieve and modify the configuration files of SNORT in order to disable its ability to detect and block Denial of Service (DoS) and ARP poisoning-based Man-In-The-Middle (MITM) attacks against a Programmable Logic Controller (PLC) in an ICS network. Experimental tests performed on a water distribution testbed show that, despite the presence of IPS, the DoS and ARP spoofed packets reach the destination causing respectively the disconnection of the PLC from the ICS network and the modification of packets payload.
2022-12-09
Yan, Lei, Liu, Xinrui, Du, Chunhui, Pei, Junjie.  2022.  Research on Network Attack Information Acquisition and Monitoring Method based on Artificial Intelligence. 2022 IEEE 10th Joint International Information Technology and Artificial Intelligence Conference (ITAIC). 10:2129—2132.

Cyberspace is the fifth largest activity space after land, sea, air and space. Safeguarding Cyberspace Security is a major issue related to national security, national sovereignty and the legitimate rights and interests of the people. With the rapid development of artificial intelligence technology and its application in various fields, cyberspace security is facing new challenges. How to help the network security personnel grasp the security trend at any time, help the network security monitoring personnel respond to the alarm information quickly, and facilitate the tracking and processing of the monitoring personnel. This paper introduces a method of using situational awareness micro application actual combat attack and defense robot to quickly feed back the network attack information to the monitoring personnel, timely report the attack information to the information reporting platform and automatically block the malicious IP.

2022-12-01
Bardia, Vivek, Kumar, CRS.  2017.  End Users Can Mitigate Zero Day Attacks Faster. 2017 IEEE 7th International Advance Computing Conference (IACC). :935—938.
The past decade has shown us the power of cyber space and we getting dependent on the same. The exponential evolution in the domain has attracted attackers and defenders of technology equally. This inevitable domain has led to the increase in average human awareness and knowledge too. As we see the attack sophistication grow the protectors have always been a step ahead mitigating the attacks. A study of the various Threat Detection, Protection and Mitigation Systems revealed to us a common similarity wherein users have been totally ignored or the systems rely heavily on the user inputs for its correct functioning. Compiling the above we designed a study wherein user inputs were taken in addition to independent Detection and Prevention systems to identify and mitigate the risks. This approach led us to a conclusion that involvement of users exponentially enhances machine learning and segments the data sets faster for a more reliable output.
2022-10-20
King, James, Bendiab, Gueltoum, Savage, Nick, Shiaeles, Stavros.  2021.  Data Exfiltration: Methods and Detection Countermeasures. 2021 IEEE International Conference on Cyber Security and Resilience (CSR). :442—447.
Data exfiltration is of increasing concern throughout the world. The number of incidents and capabilities of data exfiltration attacks are growing at an unprecedented rate. However, such attack vectors have not been deeply explored in the literature. This paper aims to address this gap by implementing a data exfiltration methodology, detailing some data exfiltration methods. Groups of exfiltration methods are incorporated into a program that can act as a testbed for owners of any network that stores sensitive data. The implemented methods are tested against the well-known network intrusion detection system Snort, where all of them have been successfully evaded detection by its community rule sets. Thus, in this paper, we have developed new countermeasures to prevent and detect data exfiltration attempts using these methods.
Ma, Tengchao, Xu, Changqiao, Zhou, Zan, Kuang, Xiaohui, Zhong, Lujie, Grieco, Luigi Alfredo.  2020.  Intelligent-Driven Adapting Defense Against the Client-Side DNS Cache Poisoning in the Cloud. GLOBECOM 2020 - 2020 IEEE Global Communications Conference. :1—6.
A new Domain Name System (DNS) cache poisoning attack aiming at clients has emerged recently. It induced cloud users to visit fake web sites and thus reveal information such as account passwords. However, the design of current DNS defense architecture does not formally consider the protection of clients. Although the DNS traffic encryption technology can alleviate this new attack, its deployment is as slow as the new DNS architecture. Thus we propose a lightweight adaptive intelligent defense strategy, which only needs to be deployed on the client without any configuration support of DNS. Firstly, we model the attack and defense process as a static stochastic game with incomplete information under bounded rationality conditions. Secondly, to solve the problem caused by uncertain attack strategies and large quantities of game states, we adopt a deep reinforcement learning (DRL) with guaranteed monotonic improvement. Finally, through the prototype system experiment in Alibaba Cloud, the effectiveness of our method is proved against multiple attack modes with a success rate of 97.5% approximately.
Nassar, Reem, Elhajj, Imad, Kayssi, Ayman, Salam, Samer.  2021.  Identifying NAT Devices to Detect Shadow IT: A Machine Learning Approach. 2021 IEEE/ACS 18th International Conference on Computer Systems and Applications (AICCSA). :1—7.
Network Address Translation (NAT) is an address remapping technique placed at the borders of stub domains. It is present in almost all routers and CPEs. Most NAT devices implement Port Address Translation (PAT), which allows the mapping of multiple private IP addresses to one public IP address. Based on port number information, PAT matches the incoming traffic to the corresponding "hidden" client. In an enterprise context, and with the proliferation of unauthorized wired and wireless NAT routers, NAT can be used for re-distributing an Intranet or Internet connection or for deploying hidden devices that are not visible to the enterprise IT or under its oversight, thus causing a problem known as shadow IT. Thus, it is important to detect NAT devices in an intranet to prevent this particular problem. Previous methods in identifying NAT behavior were based on features extracted from traffic traces per flow. In this paper, we propose a method to identify NAT devices using a machine learning approach from aggregated flow features. The approach uses multiple statistical features in addition to source and destination IPs and port numbers, extracted from passively collected traffic data. We also use aggregated features extracted within multiple window sizes and feed them to a machine learning classifier to study the effect of timing on NAT detection. Our approach works completely passively and achieves an accuracy of 96.9% when all features are utilized.
2022-10-16
Chang, Zhan-Lun, Lee, Chun-Yen, Lin, Chia-Hung, Wang, Chih-Yu, Wei, Hung-Yu.  2021.  Game-Theoretic Intrusion Prevention System Deployment for Mobile Edge Computing. 2021 IEEE Global Communications Conference (GLOBECOM). :1–6.
The network attack such as Distributed Denial-of-Service (DDoS) attack could be critical to latency-critical systems such as Mobile Edge Computing (MEC) as such attacks significantly increase the response delay of the victim service. Intrusion prevention system (IPS) is a promising solution to defend against such attacks, but there will be a trade-off between IPS deployment and application resource reservation as the deployment of IPS will reduce the number of computation resources for MEC applications. In this paper, we proposed a game-theoretic framework to study the joint computation resource allocation and IPS deployment in the MEC architecture. We study the pricing strategy of the MEC platform operator and purchase strategy of the application service provider, given the expected attack strength and end user demands. The best responses of both MPO and ASPs are derived theoretically to identify the Stackelberg equilibrium. The simulation results confirm that the proposed solutions significantly increase the social welfare of the system.
2022-10-13
A.A., Athulya, K., Praveen.  2020.  Towards the Detection of Phishing Attacks. 2020 4th International Conference on Trends in Electronics and Informatics (ICOEI)(48184). :337—343.
Phishing is an act of creating a website similar to a legitimate website with a motive of stealing user's confidential information. Phishing fraud might be the most popular cybercrime. Phishing is one of the risks that originated a couple of years back but still prevailing. This paper discusses various phishing attacks, some of the latest phishing evasion techniques used by attackers and anti-phishing approaches. This review raises awareness of those phishing strategies and helps the user to practice phishing prevention. Here, a hybrid approach of phishing detection also described having fast response time and high accuracy.
2022-10-06
Fahrianto, Feri, Kamiyama, Noriaki.  2021.  The Dual-Channel IP-to-NDN Translation Gateway. 2021 IEEE International Symposium on Local and Metropolitan Area Networks (LANMAN). :1–2.
The co-existence between Internet Protocol (IP) and Named-Data Networking (NDN) protocol is inevitable during the transition period. We propose a privacy-preserving translation method between IP and NDN called the dual-channel translation gateway. The gateway provides two different channels dedicated to the interest and the data packet to translate the IP to the NDN protocol and vice versa. Additionally, the name resolution table is provided at the gateway that binds an IP packet securely with a prefix name. Moreover, we compare the dual-channel gateway performance with the encapsulation gateway.
2022-08-01
Wiefling, Stephan, Tolsdorf, Jan, Iacono, Luigi Lo.  2021.  Privacy Considerations for Risk-Based Authentication Systems. 2021 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). :320—327.
Risk-based authentication (RBA) extends authentication mechanisms to make them more robust against account takeover attacks, such as those using stolen passwords. RBA is recommended by NIST and NCSC to strengthen password-based authentication, and is already used by major online services. Also, users consider RBA to be more usable than two-factor authentication and just as secure. However, users currently obtain RBA’s high security and usability benefits at the cost of exposing potentially sensitive personal data (e.g., IP address or browser information). This conflicts with user privacy and requires to consider user rights regarding the processing of personal data. We outline potential privacy challenges regarding different attacker models and propose improvements to balance privacy in RBA systems. To estimate the properties of the privacy-preserving RBA enhancements in practical environments, we evaluated a subset of them with long-term data from 780 users of a real-world online service. Our results show the potential to increase privacy in RBA solutions. However, it is limited to certain parameters that should guide RBA design to protect privacy. We outline research directions that need to be considered to achieve a widespread adoption of privacy preserving RBA with high user acceptance.
2022-07-29
Makarova, Mariia S., Maksutov, Artem A..  2021.  Methods of Detecting and Neutralizing Potential DHCP Rogue Servers. 2021 IEEE Conference of Russian Young Researchers in Electrical and Electronic Engineering (ElConRus). :522—525.
In the continuously evolving environment, computer security has become a convenient challenge because of the rapid rise and expansion of the Internet. One of the most significant challenges to networks is attacks on network resources caused by inadequate network security. DHCP is defenseless to a number of attacks, such as DHCP rogue server attacks. This work is focused on developing a method of detecting these attacks and granting active host protection on GNU/Linux operating systems. Unauthorized DHCP servers can be easily arranged and compete with the legitimate server on the local network that can be the result of distributing incorrect IP addresses, malicious DNS server addresses, invalid routing information to unsuspecting clients, intercepting and eavesdropping on communications, and so on. The goal is to prevent the situations described above by recognizing untrusted DHCP servers and providing active host protection on the local network.
Gallus, Petr, Frantis, Petr.  2021.  Security analysis of the Raspbian Linux operating system and its settings to increase resilience against attacks via network interface. 2021 International Conference on Military Technologies (ICMT). :1—5.

The Internet, originally an academic network for the rapid exchange of information, has moved over time into the commercial media, business and later industrial communications environment. Recently, it has been included as a part of cyberspace as a combat domain. Any device connected to the unprotected Internet is thus exposed to possible attacks by various groups and individuals pursuing various criminal, security and political objectives. Therefore, each such device must be set up to be as resistant as possible to these attacks. For the implementation of small home, academic or industrial systems, people very often use small computing system Raspberry PI, which is usually equipped with the operating system Raspbian Linux. Such a device is often connected to an unprotected Internet environment and if successfully attacked, can act as a gateway for an attacker to enter the internal network of an organization or home. This paper deals with security configuration of Raspbian Linux operating system for operation on public IP addresses in an unprotected Internet environment. The content of this paper is the conduction and analysis of an experiment in which five Raspbian Linux/Raspberry PI accounts were created with varying security levels; the easiest to attack is a simulation of the device of a user who has left the system without additional security. The accounts that follow gradually add further protection and security. These accounts are used to simulate a variety of experienced users, and in a practical experiment the effects of these security measures are evaluated; such as the number of successful / unsuccessful attacks; where the attacks are from; the type and intensity of the attacks; and the target of the attack. The results of this experiment lead to formulated conclusions containing an analysis of the attack and subsequent design recommendations and settings to secure such a device. The subsequent section of the paper discusses the implementation of a simple TCP server that is configured to listen to incoming traffic on preset ports; it simulates the behaviour of selected services on these ports. This server's task is to intercept unauthorized connection attempts to these ports and intercepting attempts to communicate or attack these services. These recorded attack attempts are analyzed in detail and formulated in the conclusion, including implications for the security settings of such a device. The overall result of this paper is the recommended set up of operating system Raspbian Linux to work on public IP addresses in an unfiltered Internet environment.

2022-07-01
Que, Jianming, Li, Hui, Bai, He, Lin, Lihong, Liew, Soung-Yue, Wuttisittikulkij, Lunchakorn.  2021.  A Network Architecture Containing Both Push and Pull Semantics. 2021 7th International Conference on Computer and Communications (ICCC). :2211—2216.
Recently, network usage has evolved from resource sharing between hosts to content distribution and retrieval. Some emerging network architectures, like Named Data Networking (NDN), focus on the design of content-oriented network paradigm. However, these clean-slate network architectures are difficult to be deployed progressively and deal with the new communication requirements. Multi-Identifier Network (MIN) is a promising network architecture that contains push and pull communication semantics and supports the resolution, routing and extension of multiple network identifiers. MIN's original design was proposed in 2019, which has been improved over the past two years. In this paper, we present the current design and implementation of MIN. We also propose a fallback-based identifier extension scheme to improve the extensibility of the network. We demonstrate that MIN outperforms NDN in the scenario of progressive deployment via IP tunnel.
2022-06-09
Thom, Jay, Shah, Yash, Sengupta, Shamik.  2021.  Correlation of Cyber Threat Intelligence Data Across Global Honeypots. 2021 IEEE 11th Annual Computing and Communication Workshop and Conference (CCWC). :0766–0772.
Today's global network is filled with attackers both live and automated seeking to identify and compromise vulnerable devices, with initial scanning and attack activity occurring within minutes or even seconds of being connected to the Internet. To better understand these events, honeypots can be deployed to monitor and log activity by simulating actual Internet facing services such as SSH, Telnet, HTTP, or FTP, and malicious activity can be logged as attempts are made to compromise them. In this study six multi-service honeypots are deployed in locations around the globe to collect and catalog traffic over a period of several months between March and December, 2020. Analysis is performed on various characteristics including source and destination IP addresses and port numbers, usernames and passwords utilized, commands executed, and types of files downloaded. In addition, Cowrie log data is restructured to observe individual attacker sessions, study command sequences, and monitor tunneling activity. This data is then correlated across honeypots to compare attack and traffic patterns with the goal of learning more about the tactics being employed. By gathering data gathered from geographically separate zones over a long period of time a greater understanding can be developed regarding attacker intent and methodology, can aid in the development of effective approaches to identifying malicious behavior and attack sources, and can serve as a cyber-threat intelligence feed.
Chin, Kota, Omote, Kazumasa.  2021.  Analysis of Attack Activities for Honeypots Installation in Ethereum Network. 2021 IEEE International Conference on Blockchain (Blockchain). :440–447.
In recent years, blockchain-based cryptocurren-cies have attracted much attention. Attacks targeting cryptocurrencies and related services directly profit an attacker if successful. Related studies have reported attacks targeting configuration-vulnerable nodes in Ethereum using a method called honeypots to observe malicious user attacks. They have analyzed 380 million observed requests and showed that attacks had to that point taken at least 4193 Ether. However, long-term observations using honeypots are difficult because the cost of maintaining honeypots is high. In this study, we analyze the behavior of malicious users using our honeypot system. More precisely, we clarify the pre-investigation that a malicious user performs before attacks. We show that the cost of maintaining a honeypot can be reduced. For example, honeypots need to belong in Ethereum's P2P network but not to the mainnet. Further, if they belong to the testnet, the cost of storage space can be reduced.
Başer, Melike, Güven, Ebu Yusuf, Aydın, Muhammed Ali.  2021.  SSH and Telnet Protocols Attack Analysis Using Honeypot Technique: Analysis of SSH AND ℡NET Honeypot. 2021 6th International Conference on Computer Science and Engineering (UBMK). :806–811.
Generally, the defense measures taken against new cyber-attack methods are insufficient for cybersecurity risk management. Contrary to classical attack methods, the existence of undiscovered attack types called’ zero-day attacks’ can invalidate the actions taken. It is possible with honeypot systems to implement new security measures by recording the attacker’s behavior. The purpose of the honeypot is to learn about the methods and tools used by the attacker or malicious activity. In particular, it allows us to discover zero-day attack types and develop new defense methods for them. Attackers have made protocols such as SSH (Secure Shell) and Telnet, which are widely used for remote access to devices, primary targets. In this study, SSHTelnet honeypot was established using Cowrie software. Attackers attempted to connect, and attackers record their activity after providing access. These collected attacker log records and files uploaded to the system are published on Github to other researchers1. We shared the observations and analysis results of attacks on SSH and Telnet protocols with honeypot.
2022-05-24
Grewe, Dennis, Wagner, Marco, Ambalavanan, Uthra, Liu, Liming, Nayak, Naresh, Schildt, Sebastian.  2021.  On the Design of an Information-Centric Networking Extension for IoT APIs. 2021 IEEE 94th Vehicular Technology Conference (VTC2021-Fall). :1–6.
Both the Internet of Things (IoT) and Information Centric Networking (ICN) have gathered a lot of attention from both research and industry in recent years. While ICN has proved to be beneficial in many situations, it is not widely deployed outside research projects, also not addressing needs of IoT application programming interfaces (APIs). On the other hand, today's IoT solutions are built on top of the host-centric communication model associated with the usage of the Internet Protocol (IP). This paper contributes a discussion on the need of an integration of a specific form of IoT APIs, namely WebSocket based streaming APIs, into an ICN. Furthermore, different access models are discussed and requirements are derived from real world APIs. Finally, the design of an ICN-style extension is presented using one of the examined APIs.
2022-05-19
Ji, Songyan, Dong, Jian, Qiu, Junfu, Gu, Bowen, Wang, Ye, Wang, Tongqi.  2021.  Increasing Fuzz Testing Coverage for Smart Contracts with Dynamic Taint Analysis. 2021 IEEE 21st International Conference on Software Quality, Reliability and Security (QRS). :243–247.
Nowadays, smart contracts manage more and more digital assets and have become an attractive target for adversaries. To prevent smart contracts from malicious attacks, a thorough test is indispensable and must be finished before deployment because smart contracts cannot be modified after being deployed. Fuzzing is an important testing approach, but most existing smart contract fuzzers can hardly solve the constraints which involve deeply nested conditional statements, resulting in low coverage. To address this problem, we propose Targy, an efficient targeted mutation strategy based on dynamic taint analysis. We obtain the taint flow by dynamic taint propagation, and generate a more accurate mutation strategy for the input parameters of functions to simultaneously satisfy all conditional statements. We implemented Targy on sFuzz with 3.6 thousand smart contracts running on Ethereum. The numbers of covered branches and detected vulnerabilities increase by 6% and 7% respectively, and the average time required for covering a branch is reduced by 11 %.
2022-05-12
Marian, Constantin Viorel.  2021.  DNS Records Secure Provisioning Mechanism for Virtual Machines automatic management in high density data centers. 2021 IEEE International Black Sea Conference on Communications and Networking (BlackSeaCom). :1–5.

Nowadays is becoming trivial to have multiple virtual machines working in parallel on hardware platforms with high processing power. This appropriate cost effective approach can be found at Internet Service Providers, in cloud service providers’ environments, in research and development lab testing environment (for example Universities’ student’s lab), in virtual application for security evaluation and in many other places. In the aforementioned cases, it is often necessary to start and/or stop virtual machines on the fly. In cloud service providers all the creation / tear down actions are triggered by a customer request and cannot be postponed or delayed for later evaluation. When a new virtual machine is created, it is imperative to assign unique IP addresses to all network interfaces and also domain name system DNS records that contain text based data, IP addresses, etc. Even worse, if a virtual machine has to be stopped or torn down, the critical network resources such as IP addresses and DNS records have to be carefully controlled in order to avoid IP addresses conflicts and name resolution problems between an old virtual machine and a newly created virtual machine. This paper proposes a provisioning mechanism to avoid both DNS records and IP addresses conflicts due to human misconfiguration, problems that can cause networking operation service disruptions.

2022-05-10
Hammad, Mohamed, Elmedany, Wael, Ismail, Yasser.  2021.  Design and Simulation of AES S-Box Towards Data Security in Video Surveillance Using IP Core Generator. 2021 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies (3ICT). :469–476.
Broadcasting applications such as video surveillance systems are using High Definition (HD) videos. The use of high-resolution videos increases significantly the data volume of video coding standards such as High-Efficiency Video Coding (HEVC) and Advanced Video Coding (AVC), which increases the challenge for storing, processing, encrypting, and transmitting these data over different communication channels. Video compression standards use state-of-the-art techniques to compress raw video sequences more efficiently, such techniques require high computational complexity and memory utilization. With the emergent of using HEVC and video surveillance systems, many security risks arise such as man-in-the-middle attacks, and unauthorized disclosure. Such risks can be mitigated by encrypting the traffic of HEVC. The most widely used encryption algorithm is the Advanced Encryption Standard (AES). Most of the computational complexity in AES hardware-implemented is due to S-box or sub-byte operation and that because it needs many resources and it is a non-linear structure. The proposed AES S-box ROM design considers the latest HEVC used for homeland security video surveillance systems. This paper presents different designs for VHDL efficient ROM implementation of AES S-box using IP core generator, ROM components, and using Functions, which are all supported by Xilinx. IP core generator has Block Memory Generator (BMG) component in its library. S-box IP core ROM is implemented using Single port block memory. The S-box lookup table has been used to fill the ROM using the .coe file format provided during the initialization of the IP core ROM. The width is set to 8-bit to address the 256 values while the depth is set to 8-bit which represents the data filed in the ROM. The whole design is synthesized using Xilinx ISE Design Suite 14.7 software, while Modelism (version10.4a) is used for the simulation process. The proposed IP core ROM design has shown better memory utilization compared to non-IP core ROM design, which is more suitable for memory-intensive applications. The proposed design is suitable for implementation using the FPGA ROM design. Hardware complexity, frequency, memory utilization, and delay are presented in this paper.
2022-04-19
Shehab, Manal, Korany, Noha, Sadek, Nayera.  2021.  Evaluation of the IP Identification Covert Channel Anomalies Using Support Vector Machine. 2021 IEEE 26th International Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD). :1–6.
IP Identification (IP ID) is an IP header field that identifies a data packet in the network to distinguish its fragments from others during the reassembly process. Random generated IP ID field could be used as a covert channel by embedding hidden bits within it. This paper uses the support vector machine (SVM) while enabling a features reduction procedure for investigating to what extend could the entropy feature of the IP ID covert channel affect the detection. Then, an entropy-based SVM is employed to evaluate the roles of the IP ID covert channel hidden bits on detection. Results show that, entropy is a distinct discrimination feature in classifying and detecting the IP ID covert channel with high accuracy. Additionally, it is found that each of the type, the number and the position of the hidden bits within the IP ID field has a specified influence on the IP ID covert channel detection accuracy.
Tanakas, Petros, Ilias, Aristidis, Polemi, Nineta.  2021.  A Novel System for Detecting and Preventing SQL Injection and Cross-Site-Script. 2021 International Conference on Electrical, Computer and Energy Technologies (ICECET). :1–6.
SQL Injection and Cross-Site Scripting are the two most common attacks in database-based web applications. In this paper we propose a system to detect different types of SQL injection and XSS attacks associated with a web application, without the existence of any firewall, while significantly reducing the network overhead. We use properly modifications of the Nginx Reverse Proxy protocols and Suricata NIDS/ IPS rules. Pure work has been done from other researchers based on the capabilities of Nginx and Suricata and our approach with the experimental results provided in the paper demonstrate the efficiency of our system.