Visible to the public Biblio

Found 1107 results

Filters: Keyword is Internet of Things  [Clear All Filters]
2022-09-20
Bentahar, Atef, Meraoumia, Abdallah, Bendjenna, Hakim, Chitroub, Salim, Zeroual, Abdelhakim.  2021.  Eigen-Fingerprints-Based Remote Authentication Cryptosystem. 2021 International Conference on Recent Advances in Mathematics and Informatics (ICRAMI). :1—6.
Nowadays, biometric is a most technique to authenticate /identify human been, because its resistance against theft, loss or forgetfulness. However, biometric is subject to different transmission attacks. Today, the protection of the sensitive biometric information is a big challenge, especially in current wireless networks such as internet of things where the transmitted data is easy to sniffer. For that, this paper proposes an Eigens-Fingerprint-based biometric cryptosystem, where the biometric feature vectors are extracted by the Principal Component Analysis technique with an appropriate quantification. The key-binding principle incorporated with bit-wise and byte-wise correcting code is used for encrypting data and sharing key. Several recognition rates and computation time are used to evaluate the proposed system. The findings show that the proposed cryptosystem achieves a high security without decreasing the accuracy.
2022-09-16
Shamshad, Salman, Obaidat, Mohammad S., Minahil, Shamshad, Usman, Noor, Sahar, Mahmood, Khalid.  2021.  On the Security of Authenticated Key Agreement Scheme for Fog-driven IoT Healthcare System. 2021 International Conference on Artificial Intelligence and Smart Systems (ICAIS). :1760—1765.
The convergence of Internet of Things (IoT) and cloud computing is due to the practical necessity for providing broader services to extensive user in distinct environments. However, cloud computing has numerous constraints for applications that require high-mobility and high latency, notably in adversarial situations (e.g. battlefields). These limitations can be elevated to some extent, in a fog computing model because it covers the gap between remote data-center and edge device. Since, the fog nodes are usually installed in remote areas, therefore, they impose the design of fool proof safety solution for a fog-based setting. Thus, to ensure the security and privacy of fog-based environment, numerous schemes have been developed by researchers. In the recent past, Jia et al. (Wireless Networks, DOI: 10.1007/s11276-018-1759-3) designed a fog-based three-party scheme for healthcare system using bilinear. They claim that their scheme can withstand common security attacks. However, in this work we investigated their scheme and show that their scheme has different susceptibilities such as revealing of secret parameters, and fog node impersonation attack. Moreover, it lacks the anonymity of user anonymity and has inefficient login phase. Consequently, we have suggestion with some necessary guidelines for attack resilience that are unheeded by Jia et al.
Massey, Keith, Moazen, Nadia, Halabi, Talal.  2021.  Optimizing the Allocation of Secure Fog Resources based on QoS Requirements. 2021 8th IEEE International Conference on Cyber Security and Cloud Computing (CSCloud)/2021 7th IEEE International Conference on Edge Computing and Scalable Cloud (EdgeCom). :143—148.
Fog computing plays a critical role in the provisioning of computing tasks in the context of Internet of Things (IoT) services. However, the security of IoT services against breaches and attacks relies heavily on the security of fog resources, which must be properly implemented and managed. Increasing security investments and integrating the security aspect into the core processes and operations of fog computing including resource management will increase IoT service protection as well as the trustworthiness of fog service providers. However, this requires careful modeling of the security requirements of IoT services as well as theoretical and experimental evaluation of the tradeoff between security and performance in fog infrastructures. To this end, this paper explores a new model for fog resource allocation according to security and Quality of Service (QoS). The problem is modeled as a multi-objective linear optimization problem and solved using conventional, off-the-shelf optimizers by applying the preemptive method. Specifically, two objective functions were defined: one representing the satisfaction of the security design requirements of IoT services and another that models the communication delay among the different virtual machines belonging to the same service request, which might be deployed on different intermediary fog nodes. The simulation results show that the optimization is efficient and achieves the required level of scalability in fog computing. Moreover, a tradeoff needs to be pondered between the two criteria during the resource allocation process.
2022-09-09
Palmo, Yangchen, Tanimoto, Shigeaki, Sato, Hiroyuki, Kanai, Atsushi.  2021.  IoT Reliability Improvement Method for Secure Supply Chain Management. 2021 IEEE 10th Global Conference on Consumer Electronics (GCCE). :364—365.

With the rapid development of IoT in recent years, IoT is increasingly being used as an endpoint of supply chains. In general, as the majority of data is now being stored and shared over the network, information security is an important issue in terms of secure supply chain management. In response to cyber security breaches and threats, there has been much research and development on the secure storage and transfer of data over the network. However, there is a relatively limited amount of research and proposals for the security of endpoints, such as IoT linked in the supply chain network. In addition, it is difficult to ensure reliability for IoT itself due to a lack of resources such as CPU power and storage. Ensuring the reliability of IoT is essential when IoT is integrated into the supply chain. Thus, in order to secure the supply chain, we need to improve the reliability of IoT, the endpoint of the supply chain. In this work, we examine the use of IoT gateways, client certificates, and IdP as methods to compensate for the lack of IoT resources. The results of our qualitative evaluation demonstrate that using the IdP method is the most effective.

Zhang, Fan, Ding, Ye.  2021.  Research on the Application of Internet of Things and Block Chain Technology in Improving Supply Chain Financial Risk Management. 2021 International Conference on Computer, Blockchain and Financial Development (CBFD). :347—350.
This article analyzes the basic concepts of supply chain finance, participating institutions, business methods, and exposure to risks. The author combined the basic content of the Internet of Things and block chain technology to carry out research. This paper studies the specific applications of the Internet of Things and block chain technology in supply chain financial risk identification, supply chain financial risk assessment, full-process logistics supervision, smart contract transaction management, corporate financial statement sorting, and risk prevention measures. The author's purpose is to improve the financial risk management level of the enterprise supply chain and promote the stable development of the enterprise economy.
Kieras, Timothy, Farooq, Muhammad Junaid, Zhu, Quanyan.  2020.  RIoTS: Risk Analysis of IoT Supply Chain Threats. 2020 IEEE 6th World Forum on Internet of Things (WF-IoT). :1—6.
Securing the supply chain of information and communications technology (ICT) has recently emerged as a critical concern for national security and integrity. With the proliferation of Internet of Things (IoT) devices and their increasing role in controlling real world infrastructure, there is a need to analyze risks in networked systems beyond established security analyses. Existing methods in literature typically leverage attack and fault trees to analyze malicious activity and its impact. In this paper, we develop RIoTS, a security risk assessment framework borrowing from system reliability theory to incorporate the supply chain. We also analyze the impact of grouping within suppliers that may pose hidden risks to the systems from malicious supply chain actors. The results show that the proposed analysis is able to reveal hidden threats posed to the IoT ecosystem from potential supplier collusion.
Kieras, Timothy, Farooq, Muhammad Junaid, Zhu, Quanyan.  2020.  Modeling and Assessment of IoT Supply Chain Security Risks: The Role of Structural and Parametric Uncertainties. 2020 IEEE Security and Privacy Workshops (SPW). :163—170.

Supply chain security threats pose new challenges to security risk modeling techniques for complex ICT systems such as the IoT. With established techniques drawn from attack trees and reliability analysis providing needed points of reference, graph-based analysis can provide a framework for considering the role of suppliers in such systems. We present such a framework here while highlighting the need for a component-centered model. Given resource limitations when applying this model to existing systems, we study various classes of uncertainties in model development, including structural uncertainties and uncertainties in the magnitude of estimated event probabilities. Using case studies, we find that structural uncertainties constitute a greater challenge to model utility and as such should receive particular attention. Best practices in the face of these uncertainties are proposed.

Muldoon, Connagh, Ikram, Ahsan, Khan Mirza, Qublai Ali.  2021.  Modern Stylometry: A Review & Experimentation with Machine Learning. 2021 8th International Conference on Future Internet of Things and Cloud (FiCloud). :293—298.
The problem of authorship attribution has applications from literary studies (such as the great Shakespeare/Marlowe debates) to counter-intelligence. The field of stylometry aims to offer quantitative results for authorship attribution. In this paper, we present a combination of stylometric techniques using machine learning. An implementation of the system is used to analyse chat logs and attempts to construct a stylometric model for users within the presented chat system. This allows for the authorship attribution of other works they may write under different names or within different communication systems. This implementation demonstrates accuracy of up to 84 % across the dataset, a full 34 % increase against a random-choice control baseline.
2022-08-26
Zhang, Yibo.  2021.  A Systematic Security Design Approach for Heterogeneous Embedded Systems. 2021 IEEE 10th Global Conference on Consumer Electronics (GCCE). :500–502.
Security has become a significant factor of Internet of Things (IoT) and Cyber Physical Systems (CPS) wherein the devices usually vary in computing power and intrinsic hardware features. It is necessary to use security-by-design method in the development of these systems. This paper focuses on the security design issue about this sort of heterogeneous embedded systems and proposes a systematic approach aiming to achieve optimal security design objective.
Li, Zhi, Liu, Yanzhu, Liu, Di, Zhang, Nan, Lu, Dawei, Huang, Xiaoguang.  2020.  A Security Defense Model for Ubiquitous Electric Internet of Things Based on Game Theory. 2020 IEEE 4th Conference on Energy Internet and Energy System Integration (EI2). :3125–3128.
Ubiquitous Electric Internet of Things (UEIoT) is the next generation electrical energy networks. The distributed and open structure of UEIoT is weak and vulnerable to security threats. To solve the security problem of UEIoT terminal, in this paper, the interaction between smart terminals and the malicious attackers in UEIoT as a differential game is investigated. A complex decision-making process and interactions between the smart terminal and attackers are analyzed. Through derivation and analysis of the model, an algorithm for the optimal defense strategy of UEIoT is designed. The results lay a theoretical foundation, which can support UEIoT make a dynamic strategy to improve the defensive ability.
Francisco, Hernandez Muñoz Urian, Ríos-Moreno, G.J..  2021.  Controller of public vehicles and traffic lights to speed up the response time to emergencies. 2021 XVII International Engineering Congress (CONIIN). :1–6.
Frequently emergency services are required nationally and globally, in Mexico during 2020 of the 16,22,879 calls made to 911, statistics reveal that 58.43% were about security, 16.57% assistance, 13.49% medical, 6.29% civil protection, among others. However, the constant traffic of cities generates delays in the time of arrival to medical, military or civil protection services, wasting time that can be critical in an emergency. The objective is to create a connection between the road infrastructure (traffic lights) and emergency vehicles to reduce waiting time as a vehicle on a mission passes through a traffic light with Controller Area Network CAN controller to modify the color and give way to the emergency vehicle that will send signals to the traffic light controller through a controller located in the car. For this, the Controller Area Network Flexible Data (CAN-FD) controllers will be used in traffic lights since it is capable of synchronizing data in the same bus or cable to avoid that two messages arrive at the same time, which could end in car accidents if they are not it respects a hierarchy and the CANblue ll controller that wirelessly connects devices (vehicle and traffic light) at a speed of 1 Mbit / s to avoid delays in data exchange taking into account the high speeds that a car can acquire. It is intended to use the CAN controller for the development of improvements in response times in high-speed data exchange in cities with high traffic flow. As a result of the use of CAN controllers, a better data flow and interconnection is obtained.
Hounsinou, Sena, Stidd, Mark, Ezeobi, Uchenna, Olufowobi, Habeeb, Nasri, Mitra, Bloom, Gedare.  2021.  Vulnerability of Controller Area Network to Schedule-Based Attacks. 2021 IEEE Real-Time Systems Symposium (RTSS). :495–507.
The secure functioning of automotive systems is vital to the safety of their passengers and other roadway users. One of the critical functions for safety is the controller area network (CAN), which interconnects the safety-critical electronic control units (ECUs) in the majority of ground vehicles. Unfortunately CAN is known to be vulnerable to several attacks. One such attack is the bus-off attack, which can be used to cause a victim ECU to disconnect itself from the CAN bus and, subsequently, for an attacker to masquerade as that ECU. A limitation of the bus-off attack is that it requires the attacker to achieve tight synchronization between the transmission of the victim and the attacker's injected message. In this paper, we introduce a schedule-based attack framework for the CAN bus-off attack that uses the real-time schedule of the CAN bus to predict more attack opportunities than previously known. We describe a ranking method for an attacker to select and optimize its attack injections with respect to criteria such as attack success rate, bus perturbation, or attack latency. The results show that vulnerabilities of the CAN bus can be enhanced by schedule-based attacks.
Kang, Dong Mug, Yoon, Sang Hun, Shin, Dae Kyo, Yoon, Young, Kim, Hyeon Min, Jang, Soo Hyun.  2021.  A Study on Attack Pattern Generation and Hybrid MR-IDS for In-Vehicle Network. 2021 International Conference on Artificial Intelligence in Information and Communication (ICAIIC). :291–294.
The CAN (Controller Area Network) bus, which transmits and receives ECU control information in vehicle, has a critical risk of external intrusion because there is no standardized security system. Recently, the need for IDS (Intrusion Detection System) to detect external intrusion of CAN bus is increasing, and high accuracy and real-time processing for intrusion detection are required. In this paper, we propose Hybrid MR (Machine learning and Ruleset) -IDS based on machine learning and ruleset to improve IDS performance. For high accuracy and detection rate, feature engineering was conducted based on the characteristics of the CAN bus, and the generated features were used in detection step. The proposed Hybrid MR-IDS can cope to various attack patterns that have not been learned in previous, as well as the learned attack patterns by using both advantages of rule set and machine learning. In addition, by collecting CAN data from an actual vehicle in driving and stop state, five attack scenarios including physical effects during all driving cycle are generated. Finally, the Hybrid MR-IDS proposed in this paper shows an average of 99% performance based on F1-score.
Teo, Yu Xian, Chen, Jiaqi, Ash, Neil, Ruddle, Alastair R., Martin, Anthony J. M..  2021.  Forensic Analysis of Automotive Controller Area Network Emissions for Problem Resolution. 2021 IEEE International Joint EMC/SI/PI and EMC Europe Symposium. :619–623.
Electromagnetic emissions associated with the transmission of automotive controller area network (CAN) messages within a passenger car have been analysed and used to reconstruct the original CAN messages. Concurrent monitoring of the CAN traffic via a wired connection to the vehicle OBD-II port was used to validate the effectiveness of the reconstruction process. These results confirm the feasibility of reconstructing in-vehicle network data for forensic purposes, without the need for wired access, at distances of up to 1 m from the vehicle by using magnetic field measurements, and up to 3 m using electric field measurements. This capability has applications in the identification and resolution of EMI issues in vehicle data network, as well as possible implications for automotive cybersecurity.
Liu, Nathan, Moreno, Carlos, Dunne, Murray, Fischmeister, Sebastian.  2021.  vProfile: Voltage-Based Anomaly Detection in Controller Area Networks. 2021 Design, Automation & Test in Europe Conference & Exhibition (DATE). :1142–1147.
Modern cars are becoming more accessible targets for cyberattacks due to the proliferation of wireless communication channels. The intra-vehicle Controller Area Network (CAN) bus lacks authentication, which exposes critical components to interference from less secure, wirelessly compromised modules. To address this issue, we propose vProfile, a sender authentication system based on voltage fingerprints of Electronic Control Units (ECUs). vProfile exploits the physical properties of ECU output voltages on the CAN bus to determine the authenticity of bus messages, which enables the detection of both hijacked ECUs and external devices connected to the bus. We show the potential of vProfile using experiments on two production vehicles with precision and recall scores of over 99.99%. The improved identification rates and more straightforward design of vProfile make it an attractive improvement over existing methods.
Zhang, Haichun, Huang, Kelin, Wang, Jie, Liu, Zhenglin.  2021.  CAN-FT: A Fuzz Testing Method for Automotive Controller Area Network Bus. 2021 International Conference on Computer Information Science and Artificial Intelligence (CISAI). :225–231.
The Controller Area Network (CAN) bus is the de-facto standard for connecting the Electronic Control Units (ECUs) in automobiles. However, there are serious cyber-security risks due to the lack of security mechanisms. In order to mine the vulnerabilities in CAN bus, this paper proposes CAN-FT, a fuzz testing method for automotive CAN bus, which uses a Generative Adversarial Network (GAN) based fuzzy message generation algorithm and the Adaptive Boosting (AdaBoost) based anomaly detection mechanism to capture the abnormal states of CAN bus. Experimental results on a real-world vehicle show that CAN-FT can find vulnerabilities more efficiently and comprehensively.
Khadarvali, S., Madhusudhan, V., Kiranmayi, R..  2021.  Load Frequency Control of Two Area System with Security Attack and Game Theory Based Defender Action Using ALO Tuned Integral Controller. 2021 International Conference on Computational Intelligence and Computing Applications (ICCICA). :1—5.

Cyber-attacks in electrical power system causes serious damages causing breakdown of few equipment to shutdown of the complete power system. Game theory is used as a tool to detect the cyber-attack in the power system recently. Interaction between the attackers and the defenders which is the inherent nature of the game theory is exploited to detect the cyber-attack in the power system. This paper implements the cyber-attack detection on a two-area power system controlled using the Load Frequency controller. Ant Lion Optimization is used to tune the integral controller applied in the Load Frequency Controller. Cyber-attacks that include constant injection, bias injection, overcompensation, and negative compensation are tested on the Game theory-based attack detection algorithm proposed. It is considered that the smart meters are attacked with the attacks by manipulating the original data in the power system. MATLAB based implementation is developed and observed that the defender action is satisfactory in the two-area system considered. Tuning of integral controller in the Load Frequency controller in the two-area system is also observed to be effective.

Saquib, Nazmus, Krintz, Chandra, Wolski, Rich.  2021.  PEDaLS: Persisting Versioned Data Structures. 2021 IEEE International Conference on Cloud Engineering (IC2E). :179—190.
In this paper, we investigate how to automatically persist versioned data structures in distributed settings (e.g. cloud + edge) using append-only storage. By doing so, we facilitate resiliency by enabling program state to survive program activations and termination, and program-level data structures and their version information to be accessed programmatically by multiple clients (for replay, provenance tracking, debugging, and coordination avoidance, and more). These features are useful in distributed, failure-prone contexts such as those for heterogeneous and pervasive Internet of Things (IoT) deployments. We prototype our approach within an open-source, distributed operating system for IoT. Our results show that it is possible to achieve algorithmic complexities similar to those of in-memory versioning but in a distributed setting.
2022-08-12
Sachidananda, Vinay, Bhairav, Suhas, Ghosh, Nirnay, Elovici, Yuval.  2019.  PIT: A Probe Into Internet of Things by Comprehensive Security Analysis. 2019 18th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/13th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE). :522–529.
One of the major issues which are hindering widespread and seamless adoption of Internet of Thing (IoT) is security. The IoT devices are vulnerable and susceptible to attacks which became evident from a series of recent large-scale distributed denial-of-service (DDoS) attacks, leading to substantial business and financial losses. Furthermore, in order to find vulnerabilities in IoT, there is a lack of comprehensive security analysis framework. In this paper, we present a modular, adaptable and tunable framework, called PIT, to probe IoT systems at different layers of design and implementation. PIT consists of several security analysis engines, viz., penetration testing, fuzzing, static analysis, and dynamic analysis and an exploitation engine to discover multiple IoT vulnerabilities, respectively. We also develop a novel grey-box fuzzer, called Applica, as a part of the fuzzing engine to overcome the limitations of the present day fuzzers. The proposed framework has been evaluated on a real-world IoT testbed comprising of the state-of-the-art devices. We discovered several network and system-level vulnerabilities such as Buffer Overflow, Denial-of-Service, SQL Injection, etc., and successfully exploited them to demonstrate the presence of security loopholes in the IoT devices.
Ventirozos, Filippos, Batista-Navarro, Riza, Clinch, Sarah, Arellanes, Damian.  2021.  IoT Cooking Workflows for End-Users: A Comparison Between Behaviour Trees and the DX-MAN Model. 2021 ACM/IEEE International Conference on Model Driven Engineering Languages and Systems Companion (MODELS-C). :341–350.
A kitchen underpinned by the Internet of Things (IoT) requires the management of complex procedural processes. This is due to the fact that when supporting an end-user in the preparation of even only one dish, various devices may need to coordinate with each other. Additionally, it is challenging— yet desirable—to enable an end-user to program their kitchen devices according to their preferred behaviour and to allow them to visualise and track their cooking workflows. In this paper, we compared two semantic representations, namely, Behaviour Trees and the DX-MAN model. We analysed these representations based on their suitability for a range of end-users (i.e., novice to experienced). The methodology required the analysis of smart kitchen user requirements, from which we inferred that the main architectural requirements for IoT cooking workflows are variability and compositionality. Guided by the user requirements, we examined various scenarios and analysed workflow complexity and feasibility for each representation. On the one hand, we found that execution complexity tends to be higher on Behaviour Trees. However, due to their fallback node, they provide more transparency on how to recover from unprecedented circumstances. On the other hand, parameter complexity tends to be somewhat higher for the DX-MAN model. Nevertheless, the DX-MAN model can be favourable due to its compositionality aspect and the ease of visualisation it can offer.
Zhu, Jinhui, Chen, Liangdong, Liu, Xiantong, Zhao, Lincong, Shen, Peipei, Chen, Jinghan.  2021.  Trusted Model Based on Multi-dimensional Attributes in Edge Computing. 2021 2nd Asia Symposium on Signal Processing (ASSP). :95—100.
As a supplement to the cloud computing model, the edge computing model can use edge servers and edge devices to coordinate information processing on the edge of the network to help Internet of Thing (IoT) data storage, transmission, and computing tasks. In view of the complex and changeable situation of edge computing IoT scenarios, this paper proposes a multi-dimensional trust evaluation factor selection scheme. Improve the traditional trusted modeling method based on direct/indirect trust, introduce multi-dimensional trusted decision attributes and rely on the collaboration of edge servers and edge device nodes to infer and quantify the trusted relationship between nodes, and combine the information entropy theory to smoothly weight the calculation results of multi-dimensional decision attributes. Improving the current situation where the traditional trusted assessment scheme's dynamic adaptability to the environment and the lack of reliability of trusted assessment are relatively lacking. Simulation experiments show that the edge computing IoT multi-dimensional trust evaluation model proposed in this paper has better performance than the trusted model in related literature.
2022-08-04
de la Piedra, Antonio, Collado, Raphaël.  2021.  Protection Profile Bricks for Secure IoT Devices. 2020 IEEE International Conference on Internet of Things and Intelligence System (IoTaIS). :8—13.
The Internet of Things (IoT) paradigm has been proposed in the last few years with the goal of addressing technical problems in fields such as home and industrial automation, smart lighting systems and traffic monitoring. However, due to the very nature of the IoT devices (generally low-powered and often lacking strong security functionalities), typical deployments pose a great risk in terms of security and privacy. In this respect, the utilization of both a Trusted Execution Environment (TEE) and a Trusted Platform Module (TPM) can serve as a countermeasure against typical attacks. Furthermore, these functional blocks can serve as safe key storage services and provide a robust secure boot implementation and a firmware update mechanism, thus ensuring run-time authentication and integrity. The Common Criteria for Information Technology Security Evaluation allows to determine the degree of attainment of precise security properties in a product. The main objective of this work is to identify, propose and compose bricks of protection profile (PP), as defined by Common Criteria, that are applicable to secure IoT architectures. Moreover, it aims at giving some guiding rules and facilitate future certifications of components and/or their composition. Finally, it also provides a structure for a future methodology of assessment for IoT devices.
2022-08-03
Laputenko, Andrey.  2021.  Assessing Trustworthiness of IoT Applications Using Logic Circuits. 2021 IEEE East-West Design & Test Symposium (EWDTS). :1—4.
The paper describes a methodology for assessing non-functional requirements, such as trust characteristics for applications running on computationally constrained devices in the Internet of Things. The methodology is demonstrated through an example of a microcontroller-based temperature monitoring system. The concepts of trust and trustworthiness for software and devices of the Internet of Things are complex characteristics for describing the correct and secure operation of such systems and include aspects of operational and information security, reliability, resilience and privacy. Machine learning models, which are increasingly often used for such tasks in recent years, are resource-consuming software implementations. The paper proposes to use a logic circuit model to implement the above algorithms as an additional module for computationally constrained devices for checking the trustworthiness of applications running on them. Such a module could be implemented as a hardware, for example, as an FPGA in order to achieve more effectiveness.
2022-08-02
Zhao, Chen, Yin, Jiaqi, Zhu, Huibiao, Li, Ran.  2021.  Modeling and Verifying Ticket-Based Authentication Scheme for IoT Using CSP. 2021 IEEE Intl Conf on Parallel & Distributed Processing with Applications, Big Data & Cloud Computing, Sustainable Computing & Communications, Social Computing & Networking (ISPA/BDCloud/SocialCom/SustainCom). :845—852.
Internet of Things (IoT) connects various nodes such as sensor devices. For users from foreign networks, their direct access to the data of sensor devices is restricted because of security threats. Therefore, a ticket-based authentication scheme was proposed, which can mutually authenticate a mobile device and a sensor device. This scheme with new features fills a gap in IoT authentication, but the scheme has not been verified formally. Hence, it is important to study the security and reliability of the scheme from the perspective of formal methods.In this paper, we model this scheme using Communicating Sequential Processes (CSP). Considering the possibility of key leakage caused by security threats in IoT networks, we also build models where one of the keys used in the scheme is leaked. With the model checker Process Analysis Toolkit (PAT), we verify four properties (deadlock freedom, data availability, data security, and data authenticity) and find that the scheme cannot satisfy the last two properties with key leakage. Thus, we propose two improved models. The verification results show that the first improved model can guarantee data security, and the second one can ensure both data security and data authenticity.
2022-07-14
Lee, Sun-Jin, Shim, Hye-Yeon, Lee, Yu-Rim, Park, Tae-Rim, Park, So-Hyun, Lee, Il-Gu.  2021.  Study on Systematic Ransomware Detection Techniques. 2021 23rd International Conference on Advanced Communication Technology (ICACT). :297–301.
Cyberattacks have been progressed in the fields of Internet of Things, and artificial intelligence technologies using the advanced persistent threat (APT) method recently. The damage caused by ransomware is rapidly spreading among APT attacks, and the range of the damages of individuals, corporations, public institutions, and even governments are increasing. The seriousness of the problem has increased because ransomware has been evolving into an intelligent ransomware attack that spreads over the network to infect multiple users simultaneously. This study used open source endpoint detection and response tools to build and test a framework environment that enables systematic ransomware detection at the network and system level. Experimental results demonstrate that the use of EDR tools can quickly extract ransomware attack features and respond to attacks.