Attackers compromise organizations with increasingly sophisticated ways, such as Advanced Persistent Threat (APT) attackers. Usually, such attacks have the intention to exploit endpoints to gain access to critical data. For security controls and defense evaluation, organizations may employ offensive security activities. The most important one is penetration testing and red teaming, but such operations are usually resource exhaustive and extend over a longer period of time. Furthermore, traditional Venerability Assessment and Penetration Testing (VAPT) works effectively in the mitigation of known attacks but did not prove to be effective against stealthy attacks. VAPT considers the whole offsec as an acting problem but in reality, an attacker has to deal with uncertainty while conducting real-world attacks. In this paper, we are presenting an adversary emulation approach based on MITRE ATT & CK adversary emulation plan with consideration of planning as a major part of each attack phase. The approach utilizes stealthy attack vectors and paths to emulate adversary for defense evaluation. For effective defense evaluation, we picked more than 40 techniques from ATT & CK, deployed their mitigation on target machines, and then launched attacks against all those techniques. We show that attack paths and payloads generated using our approach are strong enough to evade security controls at endpoints. This approach provides a special environment for cyber defenders to think like adversary, and create new attack vectors and paths to evaluate organizational security preparedness. This process constructs a special environment to expand the attack landscape view and defense evaluation with minimal resources for the organization.

Cyber-attacks on financial institutions and corporations are on the rise, particularly during pandemics. These attacks are becoming more sophisticated. Reports of hacking activities against government and commercial sector organisations have garnered a lot of attention in the last several years. By design, the focus of Cyber Threat Intelligence (CTI) is exclusively defensive. This is because most of the CTI-derived analysis output is intended to prevent breaches or facilitate early detection. So, there is a need to have a new mechanism for unmasking the attacker. In this research, we demonstrate cyber threat intelligence enrichment with counterintelligence and counterattack combined with certain new methods to exploit the adversary's vulnerability and fully control the attacker's system. Attackers use a VPN to establish an anonymous connection. A VPN creates a secure "tunnelling" to the internet, with the VPN server acting as a middleman between the attacker and the web. This provides anonymity because the attacker's IP address seems to be that of the VPN rather than his own, masking the IP address. So, hackers used this application to create persistence because it is automatically launched each time a computer is restarted. As a result, we are attempting to eliminate the persistence by removing it from the startup and registry. This research will help firms detect and identify an assault in its earliest phases, allowing them to respond accordingly. This project will develop new and innovative strategies to bypass VPNs and other security measures in order to obtain correct source information. Companies will be able to identify new methods by which their systems are penetrated and rapidly harden them. Using counterattack and counterintelligence, a proposed technique can bypass a VPN and get adversarial intel. The main goal of this research is to find the attacker's footprints or tracks and find out why the attack was planned in the first place.

Machine-to-machine communication allows smart devices like sensors, actuators, networks, gateways, and other controllers to communicate with one another. The industrial Internet of things (IIoT) has become a vital component. Many industrial devices are connected to perform a task automatically in machine-to-machine communication, but they are not properly secured, allowing an adversary to compromise them against a variety of attacks due to communication system vulnerabilities. Recently, a secure lightweight authentication protocol (SLAP) was proposed by Panda et al. They asserted that every known attack that could happen in the IIoT is deterred by their suggested protocol. In this study, we prove that the SLAP protocol is vulnerable to desynchronization, impersonation, replay, and eavesdropping attacks. To prevent these attacks and enhance that protocol, we need to implement a secure authentication mechanism that ensures the security of communication. This paper proposed a secure M2M Communication in IIoT with a single-factor lightweight authentication protocol (SF-LAP). Single-factor authentication is a simple and secure way to communicate. It uses less power and communication overhead while providing a secure mechanism for conversation. In the machine-to-machine (M2M) scenario, the proposed protocol uses an exclusive-OR operation and a hashing function to ensure secure communication between the sensor and the controller. The proposed mechanism uses a secure preshared key and timestamp technique to protect and safeguard this connection against desynchronization attacks and eavesdropping attacks. We used Burrows Abadi Needham (BAN) Gong, Needham, and Yahalom (GNY) logic, and the automated validation of Internet security protocols applications (AVISPA) tool for formal verification and perform a security analysis as an informal verification to make sure the suggested protocol is secure. Analysis that shows the SF-LAP consumes the least computing and communication overhead and is more secure because it prevents desynchronization and eavesdropping attacks to all of the known attacks that are modification attacks, tracing attacks, impersonation, man-in-the-middle, and replay attacks.

Recently, Attribute-Based Encryption (ABE) is used as a baseline technology for keyword searching mechanisms to cater users’ security and privacy-related concerns who outsource their data to the powerful and resource-rich cloud server. Almost all the existing Attribute-Based Keyword Searching (ABKS) schemes either operate on a single-keyword or multiple; conjunctive-keyword search setting. These schemes work on the premise of an “all-or-nothing” retrieval mode, which greatly limits users’ searching capabilities. The most recent work incorporates multi-keyword ranked search in attribute-based encryption, which improves user search results accuracy and the flexibility of retrieval mode. However, these schemes demand high computation overhead, which ultimately suffers searching efficiency. This dilemma prevents further research and application of ABKS schemes, especially mobile-resource constrained devices such as mobile phones. This paper proposes an Online/Offline-aided Attribute-Based Multi-keyword Search (OOABMS) scheme to delegate most laborious computation operations to the offline phase before acquiring the attribute-based access control policy or keywords. An online phase then quickly assembles the pre-computed index or trapdoor with the required specifics when it becomes known. Theoretical comparison and simulation results show that our scheme is more efficient and practical in the real world scenario for mobile cloud computing in terms of computation overhead and flexibility.

Cyber education development is a crucial issue considering the human resource and skill shortage in the current cybersecurity arena. A cyber range is a tried and tested hands-on training in cybersecurity education, providing threat simulation of various scenarios. However, the threat scenario development poses crucial challenges that hurt the learning process and trainee's engagement in training. Firstly, the threat scenarios are static and have limited applicability. Secondly, due to the lack of proper representation of procedures and training scenarios used in attacks, it is hard to recognize redundant procedures. We propose an Attack Specific Language (ASL) based on the Mitre ATT&CK framework. It provides one representation for all threat scenarios. This language will give information about attack techniques in compact ways, which will streamline and automate the cyber range functions of threat and challenge execution. It will help identify and reduce redundancy. ASL will also provide training customization through dynamic threat execution, which will be trainee-aware and will consider the trainee's performance while executing scenarios. It will provide trainees, better engagement, and training experience.

There exists a gap between existing security mechanisms and their ability to detect advancing threats. Antivirus and EDR (End Point Detection and Response) aim to detect and prevent threats; such security mechanisms are reactive. This approach did not prove to be effective in protecting against stealthy attacks. SCADA (Supervisory Control and Data Acquisition) security is crucial for any country. However, SCADA is always an easy target for adversaries due to a lack of security for heterogeneous devices. An attack on SCADA is mainly considered a national-level threat. Recent research on SCADA security has not considered “unknown threats,” which has left a gap in security. The proactive approach, such as threat hunting, is the need of the hour. In this research, we investigated that threat hunting in conjunction with cyber deception and kill chain has countervailing effects on detecting SCADA threats and mitigating them. We have used the concept of “decoy farm” in the SCADA network, where all attacks are engaged. Moreover, we present a novel threat detection and prevention approach for SCADA, focusing on unknown threats. To test the effectiveness of approach, we emulated several SCADA, Linux and Windows based attacks on a simulated SCADA network. We have concluded that our approach detects and prevents the attacker before using the current reactive approach and security mechanism for SCADA with enhanced protection for heterogeneous devices. The results and experiments show that the proposed threat hunting approach has significantly improved the threat detection ability.

The way services offered by cloud computing gets its unprecedented and undisputed popularity, so its security concerns. Among them the storage as service model (SaaS) is of the forefront of these concerns. SaaS liberates individuals and enterprises from management of IT infrastructure and data centers to concentrate on their core business. Because of untrusted and out-of-premise architecture users are reluctant to outsource their personal and important data. Encryption before outsourcing addresses some of these issues but at the same time strips the data of its useful operation such as sharing and searching. Now to address this issue, the combination of keyword based searchable encryption (KSE) and attribute-based encryption (ABE) leads to an attribute-based keyword searching (ABKS). The resultant combined concept is capable of fine-grained search operation in the multi-owner/multi-user (M/M) setting. However, the underlying costly pairing operation and complex secret sharing mechanism of ABE makes it unsuitable in practical application for resource-limited devices. On top of it, in most of the existing ABKS schemes the size of the secret key and its associated pairing operation linearly expands to the number of attributes. This paper aims at presenting a novel ABKS scheme with pairing-free access verification and constant size secret key based on AND gate access structure and ciphertext-policy (CP) framework. The security of the proposed work is reduced to the standard Decisional Diffie-Hellmen (DDH) assumption, and also collision free and error tolerant. Finally, the performance evaluation and experimental results shows that the proposed scheme improved the overall efficiency and communication overhead.

With the evolution of Internet technology, social networking sites have gained a lot of popularity. People make new friends, share their interests, experiences in life, etc. With these activities on social sites, people generate a vast amount of data that is analyzed by third parties for various purposes. As such, publishing social data without protecting an individual’s private or confidential information can be dangerous. To provide privacy protection, this paper proposes a new degree anonymization approach k-NDDP, which extends the concept of k-anonymity and differential privacy based on Node DP for vertex degrees. In particular, this paper considers identity disclosures on social data. If the adversary efficiently obtains background knowledge about the victim’s degree and neighbor connections, it can re-identify its victim from the social data even if the user’s identity is removed. The contribution of this paper is twofold. First, a simple and, at the same time, effective method k–NDDP is proposed. The method is the extension of k-NMF, i.e., the state-of-the-art method to protect against mutual friend attack, to defend against identity disclosures by adding noise to the social data. Second, the achieved privacy using the concept of differential privacy is evaluated. An extensive empirical study shows that for different values of k, the divergence produced by k-NDDP for CC, BW and APL is not more than 0.8%, also added dummy links are 60% less, as compared to k-NMF approach, thereby it validates that the proposed k-NDDP approach provides strong privacy while maintaining the usefulness of data.

With advances in fog and edge computing, various problems such as data processing for large Internet of Things (IoT) systems can be solved in an efficient manner. One such problem for the next generation smart grid (SG) IoT system comprising of millions of smart devices is the data aggregation problem. Traditional data aggregation schemes for SGs incur high computation and communication costs, and in recent years, there have been efforts to leverage fog computing with SGs to overcome these limitations. In this article, a new fog-enabled privacy-preserving data aggregation scheme (FESDA) is proposed. Unlike existing schemes, the proposed scheme is resilient to false data injection attacks by filtering out the inserted values from external attackers. To achieve privacy, a modified version of the Paillier cryptosystem is used to encrypt the consumption data of the smart meter (SM) users. In addition, FESDA is fault-tolerant, which means, the collection of data from other devices will not be affected even if some of the SMs malfunction. We evaluate its performance along with three other competing schemes in terms of aggregation, decryption, and communication costs. The findings demonstrate that FESDA reduces the communication cost by 50%, when compared with the privacy-preserving fog-enabled data aggregation scheme.

Supply chains are evolving into automated and highly complex networks and are becoming an important source of potential benefits in the modern world. At the same time, consumers are now more interested in food product quality. However, it is challenging to track the provenance of data and maintain its traceability throughout the supply chain network. The traditional supply chains are centralized and they depend on a third party for trading. These centralized systems lack transparency, accountability and auditability. In our proposed solution, we have presented a complete solution for blockchain-based Agriculture and Food (Agri-Food) supply chain. It leverages the key features of blockchain and smart contracts, deployed over ethereum blockchain network. Although blockchain provides immutability of data and records in the network, it still fails to solve some major problems in supply chain management like credibility of the involved entities, accountability of the trading process and traceability of the products. Therefore, there is a need of a reliable system that ensures traceability, trust and delivery mechanism in Agri-Food supply chain. In the proposed system, all transactions are written to blockchain which ultimately uploads the data to Interplanetary File Storage System (IPFS). The storage system returns a hash of the data which is stored on blockchain and ensures efficient, secure and reliable solution. Our system provides smart contracts along with their algorithms to show interaction of entities in the system. Furthermore, simulations and evaluation of smart contracts along with the security and vulnerability analyses are also presented in this work.

IOTA is a lightweight quantum-resistant distributed ledger protocol designed for Internet of Things devices. The protocol uses a one-time cryptographic signature scheme that is resistant against attacks by quantum computers. This one-time signature scheme results in a portion of an address's private key being revealed in the signature of each outgoing transaction from that address. If an address is used for multiple outgoing transfers, it is feasible for an adversary to forge a signature by using parts of the private key associated with the address that have been revealed. In this paper, we propose the use of the cuckoo filter in the IOTA core lightweight client in order to avoid address reuse. We validate our proposed approach by implementation and evaluation in the real IOTA architecture. The obtained performance results show that the cuckoo filter integration in the IOTA core lightweight client avoids address reuse and makes the process of new address generation much more efficient and secure. Additionally, our approach can be integrated directly into the current IOTA core lightweight client.

The drastic increase in road accidents has motivated transport community to safeguard passengers from serious injuries and casualties. Intelligent Transportation System (ITS) introduced smart vehicles that can wirelessly communicate with each other to contribute to the enhancement of road safety by forming a network on ad-hoc basis called Vehicular Ad-hoc Networks (VANETs). In VANETs, vehicles periodically broadcast beacon messages to get better and timely awareness of road's condition. However, these unencrypted beacon messages bring a serious concern on the people's privacy if an adversary overhears them. The research community has proposed to use a pseudonym instead of real identity; however, vehicle's location traces can still be built with ease. Numerous location privacy protection techniques have been proposed; however, they work on turning the vehicle's radio transmitter off which consequently can affect safety applications. Protecting the drivers’ location at the risk of sacrificing their safety makes the key purpose of VANETs questionable. In this paper, we aim to develop a holistic safety-aware location preserving scheme called Coupling Privacy with Safety (CPS) which ensures to provide drivers’ privacy along with their safety. CPS contributes to providing protection against syntactic linking attack, semantic linking attack, misleading attack/false alarm, Sybil attack and impersonation attack. It also avoids congestion and communication overhead. It also maintains QoS along with location protection and provides revocation facility.

Security of VMs is now becoming a hot topic due to their outsourcing in cloud computing paradigm. All VMs present on the network are connected to each other, making exploited VMs danger to other VMs. and threats to organization. Rejuvenation of virtualization brought the emergence of hyper-visor based security services like VMI (Virtual machine introspection). As there is a greater chance for any intrusion detection system running on the same system, of being dis-abled by the malware or attacker. Monitoring of VMs using VMI, is one of the most researched and accepted technique, that is used to ensure computer systems security mostly in the paradigm of cloud computing. This thesis presents a work that is to integrate LibVMI with Volatility on a KVM, a Linux based hypervisor, to introspect memory of VMs. Both of these tools are used to monitor the state of live VMs. VMI capability of monitoring VMs is combined with the malware analysis and virtual honeypots to achieve the objective of this project. A testing environment is deployed, where a network of VMs is used to be introspected using Volatility plug-ins. Time execution of each plug-in executed on live VMs is calculated to observe the performance of Volatility plug-ins. All these VMs are deployed as Virtual Honeypots having honey-pots configured on them, which is used as a detection mechanism to trigger alerts when some malware attack the VMs. Using STIX (Structure Threat Information Expression), extracted IOCs are converted into the understandable, flexible, structured and shareable format.

There are a number of research challenges associated with Internet of Things (IoT) security, and one of these challenges is to design novel frameworks to mine malicious frequent patterns for identifying misuse and detecting anomalies without incurring high computational costs (e.g., due to generation and analysis of unnecessary patterns and gap creation between patterns). Association rule mining is a popular approach in the literature; hence, in this paper, we critically analyze existing association rule mining techniques. We then present a framework for mining malicious frequent patterns in an IoT deployment, prior to evaluating the utility of the proposed framework using data from a Pakistan-based organization.

IOTA is a distributed ledger technology for the Internet-of-Things (IoT) industry. The protocol distinguishes itself from existing distributed ledgers by being formed on a directed acyclic graph. To enable micro-transactions for smart devices, it uses a scalable approach for network growth and transaction confirmations. Being a public distributed ledger, the transactions on the ledger are completely transparent hence opening up the possibilities for linking and identification attacks. Different promising privacy enhancing techniques have been proposed for improving anonymity in distributed ledgers. However, many of the proposed approaches provide security guarantees only against Elliptic Curve Digital Signature (ECDSA) schemes and thus become incompatible with the IOTA ledger because IOTA uses quantum resilient hash-based signatures. While centralized solutions can still work with IOTA ledger for enhancing privacy, they are still proprietary and prone to single point of failures. We propose a novel decentralized mixing protocol for the IOTA ledger that incorporates a combination of decryption mixnets and multi-signatures. Our technique does not require any (trusted or accountable) third party and it is completely compatible with the IOTA protocol. Analysis of our results for this technique shows that the security and privacy are guaranteed even in the presence of malicious entities in the system. Our technique provides strong privacy to the IOTA ledger and the degree of anonymity it adds, protects entities against identification and linking attacks.

Distributed ledger technologies will play an important role in the communication and data integrity of internet of things (IoT) devices in the future. IOTA is a public distributed ledger that can serve as a scalable, secure and feeless settlement layer for IoT transactions. It enables micro‐transactions for smart devices and offers a highly scalable architecture for network consensus and overcomes the inefficiencies of existing distributed ledgers. Like most mining‐based ledgers, IOTA also require solving a computational puzzle for every request to the ledger to avoid unwanted (ie, spam) content added to the ledger. We propose a system architecture that consumes the available computational resources of public volunteer devices for solving the expensive computational puzzles. We show that our proposed architecture can integrate with the global data and network layer of the IOTA ledger and acts as a middleware for providing computational resources from public volunteer devices to the IOTA network.

IoT security and privacy have proven to be a significant challenge. The traditional access control protocols are not suitable for IoT mainly due to a massive scale, ubiquitous connectivity and distributed nature. Blockchain based access control approaches provide decentralized security but they involve scalability problem, high transaction fees, a significant delay, and computational overhead that is not acceptable for resource-constrained IoT devices. Moreover, data published on the blockchain are public which is not ideal for many scenarios. In this paper, we proposed a new decentralized access control system based on the Tangle which empowers the users to dictate the access to their resource. In our proposed decentralized access control model the policies and access rights are published on the Tangle which guarantees distributed auditability and prevents the user from fraudulently denying the granted access rights. The main contribution of the paper is to provide privacy of the policy by leveraging Masked Authenticated Messaging (MAM) data communication protocol. The proposed work is validated by implementation and is tested with AVISPA tool which confirms security in the presence of the intruder.

In cyber crimes, attackers are becoming more inventive with their exploits and use more sophisticated techniques to bypass the deployed security system. These attacks are targeted and are commonly referred as Advanced Persistent Threats (APTs). The currently available techniques to tackle these attacks are mostly reactive and signature based. Security Information and Event Management (SIEM), a proactive approach is the best solution. However, the major problem with SIEM is tackling huge amount of data in real time that makes it a time consuming and tedious task for security analyst. The use of threat intelligence caters to such issue by prioritizing the level of threat. In this paper, we assign risk score and confidence value to each feed generated at our product “T-Eye platform”. On the basis of these values, we assign a severity score to each feed type. Severity score assigns a level to the threat means prioritize the threat. The results, we achieved for prioritizing the threat is more apparent and accurate. In addition, we optimize the rules of IBM-Q-Radar by using threat feeds generated at T-Eye platform. Furthermore, a huge amount of false positive alarms generated at IBM Q-Radar is reduced to a certain extent.

Internet Engineering Task Force (IETF) has recommended the use of routing protocol for Low Power and Lossy Network (RPL) for Internet Protocol version 6 (IPv6) enabled Internet of Things. However, RPL is vulnerable to internal and external attacks in a network. A malicious node in a rank attack, which is consumed by its child nodes, advertises false rank information. This consequently causes the selection of a malicious node as preferred parent for routing information to the sink node. Given the widespread application of RPL protocol in smart homes, smart cities, and the smart world, it is imperative to address this problem. In this paper, a novel Sink-based intrusion detection system (SBIDS) for the detection of rank attack in RPL is presented. SBIDS has less computational overhead as all detection processes take place at the sink node, which saves network resources. Through a comprehensive simulation analysis, it is shown that the proposed SBIDS provides high detection rate.

Security information and event management (SIEM) systems are generally used to monitor the network for malicious activities. These systems are capable of detecting a wide range of malicious activities in the network using built-in rules to generate alerts on malicious activities. Although SIEM systems provide comprehensive reports about each alert including relevant details such as, severity score, events, and events counts. However, a key limitation of SIEM systems is not presenting the rule's status in real time before an alert is raised. This paper presents a novel visual tool that enables security analyst to grasp visually, and in real time a complete overview of SIEM rules execution, and alert circumstances that may happen in advance based on near-miss situation. Apart from the real time rules analysis, it also enables security analysts to explore the reasoning behind the alerts in an organized and efficient manner via security questions. The essence of the approach is to evaluate and visualize the current status of each rule execution according to pre-compiled conditions in real time. We demonstrate the utility of our approach using IBM QRadar events data to support the informative analysis of different rules in real time, and security questions based insight about the rules via story page.