9 research outputs found

    Block the Root Takeover: Validating Devices Using Blockchain Protocol

    Get PDF
    This study addresses a vulnerability in the trust-based STP protocol that allows malicious users to target an Ethernet LAN with an STP Root-Takeover Attack. This subject is relevant because an STP Root-Takeover attack is a gateway to unauthorized control over the entire network stack of a personal or enterprise network. This study aims to address this problem with a potentially trustless research solution called the STP DApp. The STP DApp is the combination of a kernel /net modification called stpverify and a Hyperledger Fabric blockchain framework in a NodeJS runtime environment in userland. The STP DApp works as an Intrusion Detection System (IPS) by intercepting Ethernet traffic and blocking forged Ethernet frames sent by STP Root-Takeover attackers. This study’s research methodology is a quantitative pre-experimental design that provides conclusive results through empirical data and analysis using experimental control groups. In this study, data collection was based on active RAM utilization and CPU Usage during a performance evaluation of the STP DApp. It blocks an STP Root-Takeover Attack launched by the Yersinia attack tool installed on a virtual machine with the Kali operating system. The research solution is a test blockchain framework using Hyperledger Fabric. It is made up of an experimental test network made up of nodes on a host virtual machine and is used to validate Ethernet frames extracted from stpverify

    Using Malware Analysis to Evaluate Botnet Resilience

    Get PDF
    Bos, H.J. [Promotor]Steen, M.R. van [Promotor

    Identification and Recognition of Remote-Controlled Malware

    Full text link
    This thesis encapsulates research on the detection of botnets. First, we design and implement Sandnet, an observation and monitoring infrastructure to study the botnet phenomenon. Using Sandnet, we evaluate detection approaches based on traffic analysis and rogue visual monetization. Therefore, we identify and recognize botnet C&C channels by help of traffic analysis. To a large degree, our clustering and classification leverage the sequence of message lengths per flow. As a result, our implementation, CoCoSpot, proves to reliably detect active C&C communication of a variety of botnet families, even in face of fully encrypted C&C messages. Furthermore, we found a botnet that uses DNS as carrier protocol for its command and control channel. By help of statistical entropy as well as behavioral features, we design and implement a classifier that detects DNS-based C&C, even in mixed network traffic of benign users. Finally, perceptual clustering of Sandnet screenshots enables us to group malware into rogue visual monetization campaigns and study their monetization properties

    Inter-Municipal Cooperation as a Tool of Resilience in Small Communities

    Get PDF
    The hypothesis of the paper is that the resilience of small communities can be engaged by inter-municipal cooperation. The economy of scale of public services is a great challenge for the small communities in Europe. The review of the international models will focus on the models based on the merge of the municipalities and on the models based on the engagement of inter-municipal cooperation. The literature on these reforms will be reviewed. Based on the hypothesis, the regulation on inter-municipal cooperation and service provision of the rural areas in Hungary in the last two decades will be shortly presented. As part of this research, empirical research was carried out in a Hungarian rural area, which has a strong inter-municipal cooperation. Similarly, empirical research has been carried out in a Slovenian rural area which is based on the merge of the small communities. The advantages and disadvantages of the inter-municipal model, and the model based on the merge of the communities were compared in the paper: efficient units of public services provision can be established not only by the merge of the communities but by the establishment of inter-municipal associations. Although decision-making is more complicated, the small communities could be more resilient based on this model, because the flexibility and the community building of the small municipal model prevail as well. The merge of the municipalities offers more efficient decision-making, but the resilience engaged by the grassroots service provision requires some administrative actions in this model

    Jornadas Nacionales de Investigación en Ciberseguridad: actas de las VIII Jornadas Nacionales de Investigación en ciberseguridad: Vigo, 21 a 23 de junio de 2023

    Get PDF
    Jornadas Nacionales de Investigación en Ciberseguridad (8ª. 2023. Vigo)atlanTTicAMTEGA: Axencia para a modernización tecnolóxica de GaliciaINCIBE: Instituto Nacional de Cibersegurida
    corecore