Security Analysis of System Behaviour - From "Security by Design" to "Security at Runtime" -

The Internet today provides the environment for novel applications and processes which may evolve way beyond pre-planned scope and purpose. Security analysis is growing in complexity with the increase in functionality, connectivity, and dynamics of current electronic business processes. Technical processes within critical infrastructures also have to cope with these developments. To tackle the complexity of the security analysis, the application of models is becoming standard practice. However, model-based support for security analysis is not only needed in pre-operational phases but also during process execution, in order to provide situational security awareness at runtime. This cumulative thesis provides three major contributions to modelling methodology. Firstly, this thesis provides an approach for model-based analysis and verification of security and safety properties in order to support fault prevention and fault removal in system design or redesign. Furthermore, some construction principles for the design of well-behaved scalable systems are given. The second topic is the analysis of the exposition of vulnerabilities in the software components of networked systems to exploitation by internal or external threats. This kind of fault forecasting allows the security assessment of alternative system configurations and security policies. Validation and deployment of security policies that minimise the attack surface can now improve fault tolerance and mitigate the impact of successful attacks. Thirdly, the approach is extended to runtime applicability. An observing system monitors an event stream from the observed system with the aim to detect faults - deviations from the specified behaviour or security compliance violations - at runtime. Furthermore, knowledge about the expected behaviour given by an operational model is used to predict faults in the near future. Building on this, a holistic security management strategy is proposed. The architecture of the observing system is described and the applicability of model-based security analysis at runtime is demonstrated utilising processes from several industrial scenarios. The results of this cumulative thesis are provided by 19 selected peer-reviewed papers

Isolation of DDoS Attacks and Flash Events in Internet Traffic Using Deep Learning Techniques

The adoption of network function visualization (NFV) and software-defined radio (SDN) has created a tremendous increase in Internet traffic due to flexibility brought in the network layer. An increase in traffic flowing through the network poses a security threat that becomes tricky to detect and hence selects an appropriate mitigation strategy. Under such a scenario occurrence of the distributed denial of service (DDoS) and flash events (FEs) affect the target servers and interrupt services. Isolating the attacks is the first step before selecting an appropriate mitigation technique. However, detecting and isolating the DDoS attacks from FEs when happening simultaneously is a challenge that has attracted the attention of many researchers. This study proposes a deep learning framework to detect the FEs and DDoS attacks occurring simultaneously in the network and isolates one from the other. This step is crucial in designing appropriate mechanisms to enhance network resilience against such cyber threats. The experiments indicate that the proposed model possesses a high accuracy level in detecting and isolating DDoS attacks and FEs in networked systems

Diverse Intrusion-tolerant Systems

Over the past 20 years, there have been indisputable advances on the development of Byzantine Fault-Tolerant (BFT) replicated systems. These systems keep operational safety as long as at most f out of n replicas fail simultaneously. Therefore, in order to maintain correctness it is assumed that replicas do not suffer from common mode failures, or in other words that replicas fail independently. In an adversarial setting, this requires that replicas do not include similar vulnerabilities, or otherwise a single exploit could be employed to compromise a significant part of the system. The thesis investigates how this assumption can be substantiated in practice by exploring diversity when managing the configurations of replicas. The thesis begins with an analysis of a large dataset of vulnerability information to get evidence that diversity can contribute to failure independence. In particular, we used the data from a vulnerability database to devise strategies for building groups of n replicas with different Operating Systems (OS). Our results demonstrate that it is possible to create dependable configurations of OSes, which do not share vulnerabilities over reasonable periods of time (i.e., a few years). Then, the thesis proposes a new design for a firewall-like service that protects and regulates the access to critical systems, and that could benefit from our diversity management approach. The solution provides fault and intrusion tolerance by implementing an architecture based on two filtering layers, enabling efficient removal of invalid messages at early stages in order to decrease the costs associated with BFT replication in the later stages. The thesis also presents a novel solution for managing diverse replicas. It collects and processes data from several data sources to continuously compute a risk metric. Once the risk increases, the solution replaces a potentially vulnerable replica by another one, trying to maximize the failure independence of the replicated service. Then, the replaced replica is put on quarantine and updated with the available patches, to be prepared for later re-use. We devised various experiments that show the dependability gains and performance impact of our prototype, including key benchmarks and three BFT applications (a key-value store, our firewall-like service, and a blockchain).Unidade de investigação LASIGE (UID/CEC/00408/2019) e o projeto PTDC/EEI-SCR/1741/2041 (Abyss

Building a Better Pedestrian Flow Model for the Indianapolis Motor Speedway

Undeniable shifts in how public events are conducted with regard to security have occurred since the terrorist attacks on the United States on September 11, 2001. Increased security requirements are a product of the paradigm shift in security for Mega-Event locations. This study examined the Indianapolis Motor Speedway during Mega-Event status events, with specific focus on the 2013, Indianapolis 500 automobile race. The objective was to study the phenomenon of pedestrian flow as it related to entry gate procedures and resulting impacts. This data was then used to compile modeling scenarios employing AnyLogic computer software that allowed for free-agent, variable play to replicate the conditions of the security processing. Through manipulation of agent variables the researcher was able to determine the optimal pedestrian throughput under maximum load conditions. This data was therefore used to identify the processing time standard required in order for security personnel to achieve steady-state flow, which allowed for adequately conducted security checks, and reduction of patron wait times

Автоматизированное определение активов и оценка их критичности для анализа защищенности информационных систем

The research aims to develop the technique for an automated detection of information system assets and comparative assessment of their criticality for farther security analysis of the target infrastructure. The assets are all information and technology objects of the target infrastructure. The size, heterogeneity, complexity of interconnections, distribution and constant modification of the modern information systems complicate this task. An automated and adaptive determination of information and technology assets and connections between them based on the determination of the static and dynamic objects of the initially uncertain infrastructure is rather challenging problem. The paper proposes dynamic model of connections between objects of the target infrastructure and the technique for its building based on the event correlation approach. The developed technique is based on the statistical analysis of the empirical data on the system events. The technique allows determining main types of analysed infrastructure, their characteristics and hierarchy. The hierarchy is constructed considering the frequency of objects use, and as the result represents their relative criticality for the system operation. For the listed goals the indexes are introduced that determine belonging of properties to the same type, joint use of the properties, as well as dynamic indexes that characterize the variability of properties relative to each other. The resulting model is used for the initial comparative assessment of criticality for the system objects. The paper describes the input data, the developed models and proposed technique for the assets detection and comparison of their criticality. The experiments that demonstrate an application of the developed technique on the example of analyzing security logs of Windows operating system are provided.Цель исследования заключается в разработке методики автоматизированного выделения активов информационной системы и сравнительной оценки уровня их критичности для последующей оценки защищенности анализируемой целевой инфраструктуры. Под активами в данном случае понимаются все информационно-технологические объекты целевой инфраструктуры. Размеры, разнородность, сложность взаимосвязей, распределенность и динамичность современных информационных систем затрудняют определение целевой инфраструктуры и критичности информационно-технологических активов для ее корректного функционирования. Автоматизированное и адаптивное определение состава информационно-технологических активов и связей между ними на основе выделения статичных и динамичных объектов изначально неопределенной инфраструктуры является достаточно сложной задачей. Ее предлагается решить за счет построения актуальной динамической модели отношений объектов целевой инфраструктуры с использованием разработанной методики, которая реализует подход на основе корреляции событий, происходящих в системе. Разработанная методика основана на статистическом анализе эмпирических данных о событиях в системе. Методика позволяет выделить основные типы объектов инфраструктуры, их характеристики и иерархию, основанную на частоте использования объектов, и, как следствие, отражающую их относительную критичность для функционирования системы. Для этого в работе вводятся показатели, характеризующие принадлежность свойств одному типу, совместное использование свойств, а также показатели динамичности, характеризующие вариативность свойств относительно друг друга. Результирующая модель используется для сравнительной оценки уровня критичности типов объектов системы. В работе описываются используемые входные данные и модели, а также методика определения типов и сравнения критичности активов системы. Приведены эксперименты, показывающие работоспособность методики на примере анализа журналов безопасности операционной системы Windows

Автоматизированное определение активов и оценка их критичности для анализа защищенности информационных систем

Цель исследования заключается в разработке методики автоматизированного выделения активов информационной системы и сравнительной оценки уровня их критичности для последующей оценки защищенности анализируемой целевой инфраструктуры. Под активами в данном случае понимаются все информационно-технологические объекты целевой инфраструктуры. Размеры, разнородность, сложность взаимосвязей, распределенность и динамичность современных информационных систем затрудняют определение целевой инфраструктуры и критичности информационно-технологических активов для ее корректного функционирования. Автоматизированное и адаптивное определение состава информационно-технологических активов и связей между ними на основе выделения статичных и динамичных объектов изначально неопределенной инфраструктуры является достаточно сложной задачей. Ее предлагается решить за счет построения актуальной динамической модели отношений объектов целевой инфраструктуры с использованием разработанной методики, которая реализует подход на основе корреляции событий, происходящих в системе. Разработанная методика основана на статистическом анализе эмпирических данных о событиях в системе. Методика позволяет выделить основные типы объектов инфраструктуры, их характеристики и иерархию, основанную на частоте использования объектов, и, как следствие, отражающую их относительную критичность для функционирования системы. Для этого в работе вводятся показатели, характеризующие принадлежность свойств одному типу, совместное использование свойств, а также показатели динамичности, характеризующие вариативность свойств относительно друг друга. Результирующая модель используется для сравнительной оценки уровня критичности типов объектов системы. В работе описываются используемые входные данные и модели, а также методика определения типов и сравнения критичности активов системы. Приведены эксперименты, показывающие работоспособность методики на примере анализа журналов безопасности операционной системы Windows

Математические модели визуализации в SIEM-системах

The paper suggests the mathematical models of data visualization in SIEM-systems. The visualization models formalize three main stages of the visualization process. At the first stage the models are being suggested which fulfill the unification of data on the computer network objects having heterogeneous structures and different sources. At the second stage, on the basis of the suggested models, a multidimensional matrix of relations is generated. At the third stage a uniform approach to the visualization of various security aspects of the computer network on the basis of constructed matrix is proposed.В статье предложены математические модели визуализации данных в SIEM-системах. Модели визуализации служат для формализации трех основных этапов процесса визуализации. На первом этапе предлагаются модели, с помощью которых происходит унификация сведений об объектах компьютерной сети, имеющих разнородные структуры и различные источники. На втором этапе на базе построенных моделей формируется многомерная матрица связей. На третьем этапе предлагается унифицированный подход к визуализации различных аспектов безопасности компьютерной сети на основе построенной матрицы

The Use of Human Behaviour to Inform Egress Modeling in Stadiums

With growing concerns of public safety in infrastructure where large crowds gather, designing for egress under normal and emergency conditions is pertinent to ensuring efficient and safe conditions in stadia. There is a need for a large database of publicly available pedestrian movement profiles through experiments and the evaluation of relevant case studies. This thesis outlines novel human behaviour data collection at two stadia. Subsequent egress model validation using the MassMotion Advanced Crowd Simulation Software (MassMotion) was performed and measured total egress times. Although demographics and anthropometry in the stands slightly influenced the egress times, the stadium architecture was the governing factor which impeded pedestrian flow under non-emergency conditions. Analysis of a stadium fire case study allowed for evaluation of this conclusion during an evacuation which revealed that behavioural aspects of both occupant and staff may begin to dominate the egress simulation in an emergency context

Analytical attack modeling and security assessment based on the common vulnerability scoring system

The paper analyzes an approach to the analytical attack modeling and security assessment on the base of the Common Vulnerability Scoring System (CVSS) format, considering different modifications that appeared in the new version of the CVSS specification. The common approach to the analytical attack modeling and security assessment was suggested by the authors earlier. The paper outlines disadvantages of previous CVSS version that influenced negatively on the results of the attack modeling and security assessment. Differences between new and previous CVSS versions are analyzed. Modifications of the approach to the analytical attack modeling and security assessment that follow from the CVSS modifications are suggested. Advantages of the modified approach are described. Case study that illustrates enhanced approach is provided

Utilizing a Modular Approach to Gamification to Improve Nutrition and Fitness in Children

Obesity is a worldwide epidemic that affects adults and children, impacts over 30% of the population in several states of the U.S., damages national economies, and is a factor in four out of the six of the leading causes of death, including diabetes and heart disease. Obesity is preventable: solution approaches include better education, more exercise, better nutrition, and changing eating habits. Still, it is difficult for many people to remain interested enough to educate themselves and to learn new behaviors to change their eating and exercise habits. Gamification is a relatively new research area that involves using video game mechanisms to make applications such as work, education, and behavior change seem less like a job and more like entertainment. The objective of this thesis is to develop a system for gamifying the process of education and behavior change aimed at reducing obesity in children. The approach involved identifying requirements, developing a methodology, implementing a suite of games, developing a common application program interface and integration framework so that metrics from the games could form a user progress model that is securely sharable with parents, educators, and health professionals. The idea is that as users get better at playing the game, they will get healthier. We specified the following requirements for the framework and suite of games: large domain coverage in the areas of nutrition and fitness; extensibility and scalability; user diversity; measurability and metrics; and security and privacy. A working prototype at http://www.edufitment.com demonstrates the framework and the games developed so far. Future work will involve refining the game content coverage with the help of domain experts, adding more games, and deploying and testing the framework on the Internet