Search

The cryptography employed against user files makes the effect of crypto-ransomware attacks irreversible even after detection and removal. Thus, detecting such attacks early, i.e. during pre-encryption phase before the encryption takes place is necessary. Existing crypto-ransomware early detection solutions use a fixed time-based thresholding approach to determine the pre-encryption phase boundaries. However, the fixed time thresholding approach implies that all samples start the encryption at the same time. Such assumption does not necessarily hold for all samples as the time for the main sabotage to start varies among different crypto-ransomware families due to the obfuscation techniques employed by the malware to change its attack strategies and evade detection, which generates different attack behaviors. Additionally, the lack of sufficient data at the early phases of the attack adversely affects the ability of feature extraction techniques in early detection models to perceive the characteristics of the attacks, which, consequently, decreases the detection accuracy. Therefore, this paper proposes a Dynamic Pre-encryption Boundary Delineation and Feature Extraction (DPBD-FE) scheme that determines the boundary of the pre-encryption phase, from which the features are extracted and selected more accurately. Unlike the fixed thresholding employed by the extant works, DPBD-FE tracks the pre-encryption phase for each instance individually based on the first occurrence of any cryptography-related APIs. Then, an annotated Term Frequency-Inverse Document Frequency (aTF-IDF) technique was utilized to extract the features from runtime data generated during the pre-encryption phase of crypto-ransomware attacks. The aTF-IDF overcomes the challenge of insufficient attack patterns during the early phases of the attack lifecycle. The experimental evaluation shows that DPBD-FE was able to determine the pre-encryption boundaries and extract the features related to this phase more accurately compared to related works.

Database Forensic Investigation (DBFI) involves the identification, collection, preservation, reconstruction, analysis, and reporting of database incidents. However, it is a heterogeneous, complex, and ambiguous field due to the variety and multidimensional nature of database systems. A small number of DBFI process models have been proposed to solve specific database scenarios using different investigation processes, concepts, activities, and tasks as surveyed in this paper. Specifically, we reviewed 40 proposed DBFI process models for RDBMS in the literature to offer up-to-date and comprehensive background knowledge on existing DBFI process model research, their associated challenges, issues for newcomers, and potential solutions for addressing such issues. This paper highlights three common limitations of the DBFI domain, which are: 1) redundant and irrelevant investigation processes; 2) redundant and irrelevant investigation concepts and terminologies; and 3) a lack of unified models to manage, share, and reuse DBFI knowledge. Also, this paper suggests three solutions for the discovered limitations, which are: 1) propose generic DBFI process/model for the DBFI field; 2) develop a semantic metamodeling language to structure, manage, organize, share, and reuse DBFI knowledge; and 3) develop a repository to store and retrieve DBFI field knowledge.

Vehicular Ad Hoc Networks (VANETs) are among the main enablers for future Intelligent Transportation Systems (ITSs) as they facilitate information sharing, which improves road safety, traffic efficiency, and provides passengers’ comfort. Due to the dynamic nature of VANETs, vehicles need to exchange the Cooperative Awareness Messages (CAMs) more frequently to maintain network agility and preserve applications’ performance. However, in many situations, broadcasting at a high rate leads to congest the communication channel, rendering VANET unreliable. Existing broadcasting schemes designed for VANET use partial context variables to control the broadcasting rate. Additionally, CAMs uncertainty, which is context-dependent has been neglected and a predefined fixed certainty threshold has been used instead, which is not suitable for the highly dynamic context. Consequently, vehicles disseminate a high rate of unnecessary CAMs which degrades VANET performance. A good broadcasting scheme should accurately determine which and when CAMs are broadcasted. To this end, this study proposes a Context-Aware Adaptive Cooperative Awareness Messages Broadcasting Scheme (CA-ABS) using combinations of Adaptive Kalman Filter, Autoregression, and Sequential Deep Learning and Fuzzy inference system. Four context variables have been used to represent the vehicular context, namely, individual driving behaviors, CAMs uncertainty, vehicle density, and traffic flow. Kalman Filter and Autoregression are used to estimate and predict the CAMs messages respectively. The deep learning model has been constructed to estimate the CAMs’ uncertainties which is an important context variable that has been neglected in the previous research. Fuzzy Inference System takes context variables as input and determines an accurate broadcasting threshold and broadcasting interval. Extensive simulations have been conducted to evaluate the proposed scheme. Results show that the proposed scheme improves the CAMs delivery ratio and decreases the CAMs prediction errors.

Many large confined spaces in tropical countries employ a combination of natural ventilation and mechanical fans for space cooling purposes. However, due to low wind velocity and an inability of mechanical fans to remove warm air, this cooling method is not capable of providing a satisfactory thermal comfort to the occupants. This study aims to find out a simple strategy for improving the thermal comfort inside a mosque building in Malaysia. Field measurements were first carried out to acquire the airflow velocity, air temperature, relative humidity and mean radiant temperature inside the mosque, for a duration of one-year. These data were then used to calculate two thermal comfort indices namely predicted mean vote (PMV) and predicted the percentage of dissatisfied (PPD). A computational fluid dynamic (CFD) method was employed to predict airflow and temperature distributions and to examine the effects of installing exhaust fans on the thermal comfort condition inside the mosque. Parametric flow analyses were conducted to find out the arrangement of the exhaust fans that would produce highest improvement in the PMV and PPD thermal comfort indices. It was found that, under the present ventilation condition, both PMV and PPD values at the selected locations inside the mosque exceed the respective upper limits as recommended in the ASHRAE Standard-55, indicating that the thermal comfort inside the mosque is extremely hot. Results of parametric flow analyses show that installing ten exhaust fans with a 1-m diameter at the south-side wall, at the height of 6 m from the floor, has a potential of reducing the PMV index by 75–95% and the PPD index by 87–91%. This translates into a vast improvement in the thermal comfort inside the mosque building. Keywords: Large confined space, CFD flow simulation, Thermal comfort, Predicted Mean Vote (PMV), Predicted Percentage of Dissatisfied (PPD), Exhaust fan

Crypto-ransomware is a type of malware whose effect is irreversible even after detection and removal. Thus, early detection is crucial to protect user files from being encrypted and held to ransom. Several studies have proposed early detection solutions based on the data acquired during the pre-encryption phase of the attacks. However, the lack of sufficient data in the early phases of the attack adversely affects the ability of feature selection techniques in these models to perceive the common characteristics of the attack features, which makes it challenging to reduce the redundant features, consequently decreasing the detection accuracy. Therefore, this study proposes a novel Redundancy Coefficient Gradual Upweighting (RCGU) technique that makes better redundancy–relevancy trade-offs during feature selection. Unlike existing feature significance estimation techniques that rely on the comparison between the candidate feature and the common characteristics of the already-selected features, RCGU compares the mutual information between the candidate feature and each feature in the selected set individually. Therefore, RCGU increases the weight of the redundancy term proportional to the number of already selected features. By integrating the RCGU into the Mutual Information Feature Selection (MIFS) technique, the Enhanced MIFS (EMIFS) was developed. Further improvement was achieved by proposing MM-EMIFS which incorporates the MaxMin approximation with EMIFS to prevent the redundancy overestimation that RCGU could cause when the number of features in the already-selected set increases. The experimental evaluation shows that the proposed techniques achieved accuracy higher than that in related works, which confirms the ability of RCGU to make better redundancy–relevancy trade-offs and select more discriminative pre-encryption attack features compared to existing solutions.

Online news articles are an important source of information for decisions makers to understand the causal relation of events that happened. However, understanding the causality of an event or between events by traditional machine learning-based techniques from natural language text is a challenging task due to the complexity of the language to be comprehended by the machines. In this study, the Knowledge-oriented convolutional neural network (K-CNN) technique is used to extract the causal relation from online news articles related to the South China Sea (SCS) dispute. The proposed K-CNN model contains a Knowledge-oriented channel that can capture the causal phrases of causal relationships. A Data-oriented channel that captures the position information was added to the K-CNN model in this phase. The online news articles were collected from the national news agency and then the sentences which contain relation such as causal, message-topic, and product-producer were extracted. Then, the extracted sentences were annotated and converted into lower form and base form followed by transformed into the vector by looking up the word embedding table. A word filter that contains causal keywords was generated and a K-CNN model was developed, trained, and tested using the collected data. Finally, different architectures of the K-CNN model were compared to find out the most suitable architecture for this study. From the study, it was found out that the most suitable architecture was the K-CNN model with a Knowledge-oriented channel and a Data-oriented channel with average pooling. This shows that the linguistic clues and the position features can improve the performance in extracting the causal relation from the SCS online news articles. Keywords-component; Convolutional Neural Network, Causal Relation Extraction, South China Sea.

Advanced Persistent Threat is a very sophisticated targeted attack aimed at organizations. Several approaches have been proposed to detect APT. This paper defines an APT as an attack that has certain objectives to be achieved, and are performed by well-funded organizations, and is long term campaign. In this paper we have identified APT as a threat that follows a kill chain process. Intrusion detection and intrusion detection methods are summarized in this paper. Detection of an APT is a challenge. In this paper various detection methods used by researchers and the challenges in detecting APT is highlighted.

Vehicular ad hoc networks (VANETs) play an important role as enabling technology for future cooperative intelligent transportation systems (CITSs). Vehicles in VANETs share real-time information about their movement state, traffic situation, and road conditions. However, VANETs are susceptible to the cyberattacks that create life threatening situations and/or cause road congestion. Intrusion detection systems (IDSs) that rely on the cooperation between vehicles to detect intruders, were the most suggested security solutions for VANET. Unfortunately, existing cooperative IDSs (CIDSs) are vulnerable to the legitimate yet compromised collaborators that share misleading and manipulated information and disrupt the IDSs&rsquo, normal operation. As such, this paper proposes a misbehavior-aware on-demand collaborative intrusion detection system (MA-CIDS) based on the concept of distributed ensemble learning. That is, vehicles individually use the random forest algorithm to train local IDS classifiers and share their locally trained classifiers on-demand with the vehicles in their vicinity, which reduces the communication overhead. Once received, the performance of the classifiers is evaluated using the local testing dataset in the receiving vehicle. The evaluation values are used as a trustworthiness factor and used to rank the received classifiers. The classifiers that deviate much from the box-and-whisker plot lower boundary are excluded from the set of the collaborators. Then, each vehicle constructs an ensemble of weighted random forest-based classifiers that encompasses the locally and remotely trained classifiers. The outputs of the classifiers are aggregated using a robust weighted voting scheme. Extensive simulations were conducted utilizing the network security laboratory-knowledge discovery data mining (NSL-KDD) dataset to evaluate the performance of the proposed MA-CIDS model. The obtained results show that MA-CIDS performs better than the other existing models in terms of effectiveness and efficiency for VANET.

Most of Vehicular Ad Hoc Network’s (VANET) and Fly Ad Hoc Network (FANET) applications, protocols, and service rely on cooperativeness among network participants. Vehicles, could be unmanned aerial vehicles (e.g. drones), share their sensors’ information to improve network performance and provide safety, traffic efficiency, and entertainments. The accuracy and reliability of this information are vital for VANET performance. However, misbehaving (or faulty) vehicles, which exploit the cooperativeness feature by sharing bogus information, can disrupt the fundamental operations of any potential application and cause loss of people lives and properties. Unfortunately, existing detection approaches cannot effectively thwart such attacks. The highly dynamic vehicular context has been vastly neglected as well as they rely on predefined and static security perimeters to differentiate between false and correct information. In this paper, a context-aware detection approach is proposed to improve the detection accuracy and reduce the false alarm rate. Firstly, the features that well represent the vehicular context has been extracted. Then, an online unsupervised learning method namely the hierarchical clustering algorithm is used to classify the received messages into either genuine or spurious. Finally, Bayesian-based hypothesis testing has been used to confirm the validity of the classification. Results show that the proposed detection approach is promising in effectively detect bogus information attack and improve applications performance.

Vehicular Ad Hoc Networks (VANETs) have emerged mainly to improve road safety and traffic efficiency and provide user comfort. The performance of such networks’ applications relies on the availability of accurate and recent mobility-information shared among vehicles. This means that misbehaving vehicles that share false mobility information can lead to catastrophic losses of life and property. However, the current solutions proposed to detect misbehaving vehicles are not able to cope with the dynamic vehicular context and the diverse cyber-threats, leading to a decrease in detection accuracy and an increase in false alarms. This paper addresses these issues by proposing a Hybrid and Multifaceted Context-aware Misbehavior Detection model (HCA-MDS), which consists of four phases: data-collection, context-representation, context-reference construction, and misbehavior detection. Data-centric and behavioral-detection-based features are derived to represent the vehicular context. An online and timely updated context-reference model is built using unsupervised nonparametric statistical methods, namely Kalman and Hampel filters, through analyzing the temporal and spatial correlation of the consistency between mobility information to adapt to the highly dynamic vehicular context. Vehicles’ behaviors are evaluated locally and autonomously according to the consistency, plausibility, and reliability of their mobility information. The results from extensive simulations show that HCA-MDS outperforms existing solutions in increasing the detection rate by 38% and decreasing the false positive rate by 7%. These results demonstrate the effectiveness and robustness of the proposed HCA-MDS model to strengthen the security of VANET applications and protocols.

Accurate positioning is a key factor for enabling innovative applications to properly perform their tasks in various areas including: Intelligent Transportation Systems (ITS) and Vehicular Ad Hoc Network (VANET). Vehicle positioning accuracy depends heavily on positioning techniques and the measurements condition in its surroundings. Several approaches which can be used for improving vehicle positioning accuracy have been reported in literature. Although some positioning techniques have achieved high accuracy in a controlled environment, they suffer from dynamic measurement noises in real environments leading to low accuracy and integrity for some VANET applications. To solve this issue, some existing positioning approaches assume the availability of prior knowledge concerning measurement noises, which is not practical for VANET. The aim of this paper is to propose an algorithm for improving accuracy and integrity of positioning information under dynamic and unstable measurement conditions. To do this, a positioning algorithm has been designed based on the Innovation-based Adaptive Estimation Kalman Filter (IAE_KF) by integrating the positioning measurements with vehicle kinematic information. Following that, the IAE_KF algorithm is enhanced in terms of positioning accuracy and integrity (EIAE_KF) in order to meet VANET applications requirements. This enhancement involves two stages which are: a switching strategy between dead reckoning and the Kalman Filter based on the innovation property of the optimal filter; and the estimation of the actual noise covariance based on the Yule–Walker method. An online error estimation model is then proposed to estimate the uncertainty of the EIAE_KF algorithm to enhance the integrity of the position information. Next Generation Simulation dataset (NGSIM) which contains real world vehicle trajectories is used as ground truth for the evaluation and testing procedure. The effectiveness of the proposed algorithm is demonstrated through a comprehensive simulation study. The results show that the EIAE_KF algorithm is more effective than existing solutions in terms of enhancing positioning information accuracy and integrity so as to meet VANET applications requirements.

Wireless Mesh Networks (WMNs) are promising means to provide inexpensive deployment, flexible and fast broadband access. Recent WMNs use multiple-radio and multiple channels to provide high performance. However, interference between channels is considered the key challenge for WMN performance. In WMN, the data flows are directed from/to the gateways. Thus, the quality of the critical links close to the gateways should be properly considered during channel assignments. Otherwise, network fragmentation and bottleneck problem may occur which affect the performance of the network due to congestions, and unfair channel distribution. Unfortunately, the existing channel assignments focusing only on the links close to the gateways and neglecting other critical links. This paper proposes a fair channel assignment algorithm based on weighted link ranking scheme in order to minimize the interference and thus improve the capacity of the network. The links are fairly ranked based on multiple criteria obtained from traffic and network topology such as distance from the gateways, interference index, and, traffic load. The results from numerical simulation demonstrate that the proposed channel assignment algorithm has reduced the interference, improving the network capacity, and achieves the fairness of channel distribution.

The presence of motion artefacts in ECG signals can cause misleading interpretation of cardiovascular status. Recently, reducing the motion artefact from ECG signal has gained the interest of many researchers. Due to the overlapping nature of the motion artefact with the ECG signal, it is difficult to reduce motion artefact without distorting the original ECG signal. However, the application of an adaptive noise canceler has shown that it is effective in reducing motion artefacts if the appropriate noise reference that is correlated with the noise in the ECG signal is available. Unfortunately, the noise reference is not always correlated with motion artefact. Consequently, filtering with such a noise reference may lead to contaminating the ECG signal. In this paper, a two-stage filtering motion artefact reduction algorithm is proposed. In the algorithm, two methods are proposed, each of which works in one stage. The weighted adaptive noise filtering method (WAF) is proposed for the first stage. The acceleration derivative is used as motion artefact reference and the Pearson correlation coefficient between acceleration and ECG signal is used as a weighting factor. In the second stage, a recursive Hampel filter-based estimation method (RHFBE) is proposed for estimating the ECG signal segments, based on the spatial correlation of the ECG segment component that is obtained from successive ECG signals. Real-World dataset is used to evaluate the effectiveness of the proposed methods compared to the conventional adaptive filter. The results show a promising enhancement in terms of reducing motion artefacts from the ECG signals recorded by a cost-effective single lead ECG sensor during several activities of different subjects.

Life-saving decisions in vehicular ad hoc networks (VANETs) depend on the availability of highly accurate, up-to-date, and reliable data exchanged by neighboring vehicles. However, spreading inaccurate, unreliable, and false data by intruders create traffic illusions that may cause loss of lives and assets. Although several solutions for misbehavior detection have been proposed to address these issues, those solutions lack adequate representation and the adaptability to vehicular context. The use of predefined static thresholds and lack of comprehensive context representation have rendered the existing solutions limited to specific scenarios and attack types, which impedes their generalizability. This paper addresses these limitations by proposing an ensemble-based hybrid context-aware misbehavior detection system (EHCA-MDS) model. EHCA-MDS has been developed in four phases, as follows. The static thresholds have been replaced by dynamic ones created on the fly by analyzing the spatial and temporal properties of the mobility information collected from neighboring vehicles. Kalman filter-based algorithms were used to collect the mobility information of neighboring vehicles. Three sets of features were then derived, each of which has a different perspective, namely data consistency, data plausibility, and vehicle behavior. These features were used to construct a dynamic context reference using the Hampel filter. The Hampel-based z-score was used to evaluate the vehicles based on their behavioral activities, data consistency, and plausibility. For comprehensive features representation, multifaceted, non-parametric-based statistical classifiers were constructed and updated online using a Hampel filter-based algorithm. For accurate representation, the output of the statistical classifiers, vehicles’ scores, context reference parameters, and the derived features were used as input to an ensemble learning-based algorithm. Such representation helps to identify the misbehaving vehicles more effectively. The proposed EHCA-MDS model was evaluated in the presence of different types of misbehaving vehicles under different context scenarios through extensive simulations, utilizing a real-world traffic dataset. The results show that the accuracy and robustness of the proposed EHCA-MDS under different vehicular dynamic context scenarios were higher than existing solutions, which confirms its feasibility and effectiveness to improve the performance of VANET critical applications.

Vehicular ad hoc Networks (VANETs) have emerged mainly to improve road safety, traffic efficiency, and passenger comfort. The performance of most VANET applications and services relies on the availability of accurate and up-to-date mobility-information, through so-called Cooperative Awareness Messages (CAMs), shared by neighbouring vehicles. However, sharing false mobility information can disrupt any potential VANET application. As cryptographic techniques used to protect CAMs in VANETs are expensive, complicated, and vulnerable to internal misbehaviour, security lapses are inevitable. Although several misbehaviour detection solutions have been proposed, those solutions assume that the VANET's context is stationary, which does not hold for VANETs in a real scenario, as the vehicle's context changes continuously. The use of static and predefined security thresholds in highly dynamic and harsh environments is the major drawback of those solutions. To address this issue, a context-aware data-centric misbehaviour detection scheme (CA-DC-MDS) is proposed, using sequential analysis of temporal and spatial correlation of the consistency between neighbouring vehicles' mobility information. The static thresholds have been replaced by a dynamic context reference model that is constructed online and updated in a timely fashion using statistical techniques. Firstly, the Kalman filter algorithm is used to track the mobility information received from neighbouring vehicles. Then, the innovation errors of the Kalman filter are utilized to construct a temporal consistency assessment model for each neighbouring vehicle, using a box-and-whisker plot. After that, the Hampel filter is used to construct a spatial consistency assessment model that represents the current context reference. Similarly, plausibility assessment reference models are built online and updated in a timely fashion using the Hampel filter and by utilizing the consistency assessment reference model of neighbouring information. Finally, a message is classified as suspicious if its consistency and plausibility scores deviate significantly from the context reference model. The proposed context-aware scheme achieved a 73% reduction in the false alarm rate while achieving a 37% improvement in the detection rate. This demonstrates the effectiveness of the proposed context-aware scheme compared with the existing static solutions.

In vehicular networks, the exchange of mobility information is considered as the basis for many applications. The quality of this information affects applications and networks performance. False mobility information leads applications, network services and security services to make wrong decisions. Accordingly, many verification approaches were proposed as a security countermeasure. However, most of these approaches assume accurate mobility information regardless of localisation errors occurrence. Therefore, estimating the mobility information is an important security procedure to enhance the verification performance. In this paper, mobility information estimation algorithm MIEA was proposed based on Kalman filter to estimate the actual mobility information from noisy measurements. To evaluate the algorithm effectiveness, the study used next generation simulation dataset NGSIM. White noises were injected into vehicle trajectories to simulate localisation errors. Results show that the root mean square error RMSE is reduced which implies the effectiveness of the proposed algorithm.