Detecting Abnormal Social Robot Behavior through Emotion Recognition

Sharing characteristics with both the Internet of Things and the Cyber Physical Systems categories, a new type of device has arrived to claim a third category and raise its very own privacy concerns. Social robots are in the market asking consumers to become part of their daily routine and interactions. Ranging in the level and method of communication with the users, all social robots are able to collect, share and analyze a great variety and large volume of personal data.In this thesis, we focus the community’s attention to this emerging area of interest for privacy and security research. We discuss the likely privacy issues, comment on current defense mechanisms that are applicable to this new category of devices, outline new forms of attack that are made possible through social robots, highlight paths that research on consumer perceptions could follow, and propose a system for detecting abnormal social robot behavior based on emotion detection

Immunology Inspired Detection of Data Theft from Autonomous Network Activity

The threat of data theft posed by self-propagating, remotely controlled bot malware is increasing. Cyber criminals are motivated to steal sensitive data, such as user names, passwords, account numbers, and credit card numbers, because these items can be parlayed into cash. For anonymity and economy of scale, bot networks have become the cyber criminal’s weapon of choice. In 2010 a single botnet included over one million compromised host computers, and one of the largest botnets in 2011 was specifically designed to harvest financial data from its victims. Unfortunately, current intrusion detection methods are unable to effectively detect data extraction techniques employed by bot malware. The research described in this Dissertation Report addresses that problem. This work builds on a foundation of research regarding artificial immune systems (AIS) and botnet activity detection. This work is the first to isolate and assess features derived from human computer interaction in the detection of data theft by bot malware and is the first to report on a novel use of the HTTP protocol by a contemporary variant of the Zeus bot

Improving a wireless localization system via machine learning techniques and security protocols

The recent advancements made in Internet of Things (IoT) devices have brought forth new opportunities for technologies and systems to be integrated into our everyday life. In this work, we investigate how edge nodes can effectively utilize 802.11 wireless beacon frames being broadcast from pre-existing access points in a building to achieve room-level localization. We explain the needed hardware and software for this system and demonstrate a proof of concept with experimental data analysis. Improvements to localization accuracy are shown via machine learning by implementing the random forest algorithm. Using this algorithm, historical data can train the model and make more informed decisions while tracking other nodes in the future. We also include multiple security protocols that can be taken to reduce the threat of both physical and digital attacks on the system. These threats include access point spoofing, side channel analysis, and packet sniffing, all of which are often overlooked in IoT devices that are rushed to market. Our research demonstrates the comprehensive combination of affordability, accuracy, and security possible in an IoT beacon frame-based localization system that has not been fully explored by the localization research community

Multimodal Approach for Malware Detection

Although malware detection is a very active area of research, few works were focused on using physical properties (e.g., power consumption) and multimodal features for malware detection. We designed an experimental testbed that allowed us to run samples of malware and non-malicious software applications and to collect power consumption, network traffic, and system logs data, and subsequently to extract dynamic behavioral-based features. We also extracted code-based static features of both malware and non-malicious software applications. These features were used for malware detection based on: feature level fusion using power consumption and network traffic data, feature level fusion using network traffic data and system logs, and multimodal feature level and decision level fusion. The contributions when using feature level fusion of power consumption and network traffic data are: (1) We focused on detecting real malware using the extracted dynamic behavioral features (both power-based and network traffic-based) and supervised machine learning algorithms, which has not been done by any of the prior works. (2) We ran a large number of machine learning experiments, which allowed us to identify the best performing learner, DC voltage rails that led to the best malware detection performance, and the subset of features that are the best predictors for malware detection. (3) The comparison of malware detection performance was done using a comprehensive set of metrics that reflect different aspects of the quality of malware detection. In the case of the feature level fusion using network traffic data and system logs, the contributions are: (1) Most of the previous works that have used network flows-based features have done classification of the network traffic, while our focus was on classifying the software running in a machine as malware and non-malicious software using the extracted dynamic behavioral features. (2) We experimented with different sizes of the training set (i.e., 90%, 75%, 50%, and 25% of the data) and found that smaller training sets produced very good classification results. This aspect of our work has a practical value because the manual labeling of the training set is a tedious and time consuming process. In this dissertation we present a multimodal deep learning neural network that integrates different modalities (i.e., power consumption, system logs, network traffic, and code-based static data) using decision level fusion. We evaluated the performance of each modality individually, when using feature level fusion, and when using decision level fusion. The contributions of our multimodal approach are as follow: (1) Collecting data from different modalities allowed us to develop a multimodal approach to malware detection, which has not been widely explored by prior works. Even more, none of the previous works compared the performance of feature level fusion with decision level fusion, which is explored in this dissertation. (2) We proposed a multimodal decision level fusion malware detection approach using a deep neural network and compared its performance with the performance of feature level fusion approaches based on deep neural network and standard supervised machine learning algorithms (i.e., Random Forest, J48, JRip, PART, Naive Bayes, and SMO)

HỆ THỐNG PHÁT HIỆN TẤN CÔNG BOTNET SỬ DỤNG WEB PROXY VÀ CONVOLUTIONAL NEURAL NETWORK

Botnets are increasingly becoming the most dangerous threats in the field of network security, and many different approaches to detecting attacks from botnets have been studied. Whatever approach is used, the evolution of the botnet\u27s nature and the set of defined rules for detecting botnets can affect the performance of botnet detection systems. In this paper, we propose a general family of architectures that uses a convolutional neural network group to transform the raw characteristics provided by network flow recording and analysis tools into higher-level features, then conducts a (binary) class to assess whether a flow corresponds to a botnet attack. We experimented on the CTU-13 dataset using different configurations of the convolutional neural network to evaluate the potential of deep learning on the botnet detection problem. In particular, we propose a botnet detection system that uses a web proxy. This technique can be helpful in implementing a low-cost, but highly effective botnet detection system.Botnet đang ngày càng trở thành những mối đe dọa nguy hiểm nhất trong lĩnh vực an ninh mạng, nhiều hướng tiếp cận khác nhau để phát hiện tấn công bằng botnet đã được nghiên cứu. Tuy nhiên, dù bất kì hướng tiếp cận nào được sử dụng, sự tiến hóa về bản chất của botnet cùng tập các quy luật được định nghĩa sẵn để phát hiện ra botnet có thể ảnh hưởng đến hiệu suất của hệ thống phát hiện botnet. Trong bài báo này, chúng tôi đề xuất một họ kiến trúc tổng quát sử dụng thuộc nhóm Convolutional Neural Network để biến đổi từ đặc trưng thô do các công cụ ghi nhận và phân tích network flow cung cấp thành đặc trưng cấp cao hơn, từ đó tiến hành phân lớp (nhị phân) để đánh giá một flow tương ứng với tình trạng bị botnet tấn công hay không. Chúng tôi thử nghiệm trên tập CTU-13 với các cấu hình khác nhau của convolutional neural network để đánh giá tiềm năng dùng deep learning với convolutional neural network vào bài toán phát hiện botnet. Đặc biệt là đề xuất hệ thống phát hiện Botnet sử dụng Web proxy. Đây là một kỹ thuật giúp triển khai hệ thống phát hiện botnet với chi phí thấp mang lại hiệu quả cao

Betrayed by the Guardian: Security and Privacy Risks of Parental Control Solutions

For parents of young children and adolescents, the digital age has introduced many new challenges, including excessive screen time, inappropriate online content, cyber predators, and cyberbullying. To address these challenges, many parents rely on numerous parental control solutions on different platforms, including parental control network devices (e.g., WiFi routers) and software applications on mobile devices and laptops. While these parental control solutions may help digital parenting, they may also introduce serious security and privacy risks to children and parents, due to their elevated privileges and having access to a significant amount of privacy-sensitive data. In this paper, we present an experimental framework for systematically evaluating security and privacy issues in parental control software and hardware solutions. Using the developed framework, we provide the first comprehensive study of parental control tools on multiple platforms including network devices, Windows applications, Chrome extensions and Android apps. Our analysis uncovers pervasive security and privacy issues that can lead to leakage of private information, and/or allow an adversary to fully control the parental control solution, and thereby may directly aid cyberbullying and cyber predators

Using Malware Analysis to Evaluate Botnet Resilience

Bos, H.J. [Promotor]Steen, M.R. van [Promotor