Search

Edited by Jaroslaw Watrobski, Wojciech Salabun, Carlos Toro, Cecilia Zanni-Merk, Robert J. Howlett, Lakhmi C. Jain; International audience; Nowadays, special attention is directed to trust issues in the Decentralized Online Social Network (DOSN). In a distributed system for social networking, interactions and collaborations can be unreliable because some users resort to malicious behaviors in order to increase their trust values in the network to be chosen later by others, and launch trust-related attacks. In this unreliable situation, users will not be able to estimate the trustworthiness of the received social services’ list of recommendations. Hence, a trust management model becomes a necessity in order to overcome its trust-related attacks and to recommend trustworthy social services. In this respect, we propose a new trust management model that helps prevent trust-related attacks in order to ensure a reliable environment. Towards this end, our suggested model implements a new technology, called blockchain. Based on the studied trust-related attacks, we intend to add logical security to blockchain since this technology takes into account only the physical security. Evaluation values show the effectiveness of our model.

One primary goal of a computer system and data network security program is to prevent unauthorized access to computer systems and facilities. Another goal, should unauthorized access occur, is to prevent the misuse of, or damage to, computer and network assets. This chapter brings together fundamental security concepts to provide data center managers and data network managers with an overview of the data security function. Computer systems and data networks must be secured against three types of violations: unauthorized access, misuse, and damage. When customers are granted direct access to the organization’s computer systems via the company’s or a third party’s data network, the usual credit checks and business viability verifications need to be performed. The trend is toward much broader access to an organization’s computer systems. Examples are students and staff having direct access to college computer systems, customers and suppliers connecting into companies’ systems, and private citizens accessing government data.

We introduce VisIDAC presented in Song at al (In: Nguyen, P.Q., Zhou, J. (eds.) Information Security—20th International Conference, ISC 2017, Security and Cryptology, vol. 10599. Springer International Publishing, 2017), which is a 3-D real-time visualization of security event log collection detected by intrusion detection systems installed in multiple networks. VisIDAC consists of three parallel plane-squares which represent global source networks, target networks, and global destination networks. Security events are displayed in different shapes, colors and spaces, according to their main features. It helps security operators to immediately understand the key properties of security events. We also apply VisIDAC to a public cyber security operations center, Science and Technology Cyber Security Center (ST whether they are inbound or outbound traffic; whether they are momentary or continuous; and what protocol and port number are mainly used.

Owing to the high value of business data, sophisticated cyber-attacks targeting enterprise networks have become more prominent, with attackers trying to penetrate deeper into and reach wider from the compromised machines. An important security requirement is that domain experts and network administrators have a common vocabulary to share security knowledge and quickly help each other respond to new threats. We propose an innovative ontology and graph-based approach for security assessment. An ontology is designed to represent security knowledge such as that of assets, vulnerabilities, and attacks in a common form. Using the inference abilities of the ontological model, an efficient system framework is proposed to generate attack graphs and assess network security. The performance of the proposed system is evaluated on test networks of differing sizes and topologies.

Rapidly changing in Information Technology initiates various innovation that aims to provide convenience for enterprises, organizations, and institutions. Innovation is created to ease users in completing tasks and activities. Unfortunately, easiness in innovation gives chances of fraud and disruption to happen. This paper discusses how countermeasures on those issues are done in Salatiga Library and Archive Office using 4 (four) control aspects in Information System Audit: environtment security control, physical security control, logical security control, and IS operation control. This paper use three step of method, they are: planning and preparation, implementation, and reporting. The aim of this research is to examine the Information System security level in Salatiga Library and Archive Office.

This paper explains various security issues in the existing home automation systems and proposes the use of logic-based security algorithms to improve home security. This paper classifies natural access points to a home as primary and secondary access points depending on their use. Logic-based sensing is implemented by identifying normal user behavior at these access points and requesting user verification when necessary. User position is also considered when various access points changed states. Moreover, the algorithm also verifies the legitimacy of a fire alarm by measuring the change in temperature, humidity, and carbon monoxide levels, thus defending against manipulative attackers. The experiment conducted in this paper used a combination of sensors, microcontrollers, Raspberry Pi and ZigBee communication to identify user behavior at various access points and implement the logical sensing algorithm. In the experiment, the proposed logical sensing algorithm was successfully implemented for a month in a studio apartment. During the course of the experiment, the algorithm was able to detect all the state changes of the primary and secondary access points and also successfully verified user identity 55 times generating 14 warnings and 5 alarms.

Traffic volumes in mobile networks are rising and end-user needs are rapidly changing. Mobile network operators need more flexibility, lower network operating costs, faster service roll-out cycles, and new revenue sources. The 5th Generation (5G) and future networks aim to deliver ultra-fast and ultra-reliable network access capable of supporting the anticipated surge in data traffic and connected nodes in years to come. Several technologies have been developed to meet these emergent demands of future mobile networks, among these are software defined networking, network function virtualization, and cloud computing. In this paper, we discuss the security challenges these new technologies are prone to in the context of the new telecommunication paradigm. We present a multi-tier component-based security architecture to address these challenges and secure 5G software defined mobile network (SDMN), by handling security at different levels to protect the network and its users. The proposed architecture contains five components, i.e., secure communication, policy-based communication, security information and event management, security defined monitoring, and deep packet inspection components for elevated security in the control and the data planes of SDMNs. Finally, the proposed security mechanisms are validated using test bed experiments.

The frequency of unauthorized actions to information systems (IS) in the process of their integration is steadily increasing, which inevitably leads to huge financial and material losses. According to statistics, internal users of IS, commit more than half of all violations. All of this forms a dangerous group of risk. Existing approaches for IS security are mainly provided by specialized tools of differentiation of user access to information resources. At the same time each user is assigned certain rights, in accordance with which it is permitted/prohibited local access to information is stored in PC, or remote access via communication links to information available on other PC.After analyzing we identified 2 major vulnerabilities: tools of differentiation of local access are not able to provide protection against the actions of offenders are not directly related to obtaining unauthorized access to IS resources and tools of differentiation of remote access does not provide protection from network by internal users of the system.The results of this research will lead to an improvement of the process of ensuring effective protection against threats to information security in the IS.

The main goal of the research consists in the elaboration of a system concerning the investigation of security communication, which regards a set of security factors, such as: the degree of encryption, the freshness of nonces, intruder activation, the lifetime of keys, secrets, etc. This paper is devoted to the presentation of systematization formalisms describing the functioning of a security model. In our variant, we investigate the changes of all chosen factors (security attributes) during the realization of protocol operations. The security attributes should be systematically corrected in this process. It changes the general security level of communication. The audit system strategy leads us to one of the most noticeable security in fluence characteristics that refer to time parameters. We can introduce the notation concerning the lifetime of elements (key, message, nonces, secret, etc.). When the value of time activity of an element exceeds its lifetime, then the communication security is definitely threatened. By using special rules presented in the works of Burrows, and Needham2, among other authors, and by creating additional logic formulas, we can estimate intermediate security probability parameters. Finally, we propose a certain kind of probability time automata in order to investigate and predicate different types of communication threats. These automata are built on the basis of a colored Petri net. In addition, this investigation consists in checking communication security (or a kind of threats) and making a threat prediction about possible cases that are connected with losing information. We also included in the model a procedure of security modification with respect to time (the activity of some parameters depends on time). We define the finite set of states by using the LU - technique (interval attribute activity) of a date notation. The proposed system resolves security problem in more comprehensive (multifaceted) way. Ingredient security factors can be grouped in different combinations. This approach increased the range of investigated threaten structures to even unknown hacker algorithm inventions.

Successful execution of future network-centric military operations relies on effective enforcement of both need-to-know and responsibility- to-share principles. In modern military missions and coalitions, which have an increasingly agile character, a promising solution is to enforce security policies based on the properties of individual information objects - we call this approach content-based security. This article discusses the enforcement of content-based security policies at the different layers of the TCP/ IP model, and introduces a proof-of-concept implementation of a content-based protection and release mechanism in a software-defined networking environment. Our aim is to provide consistent enforcement of security policies across multiple system layers and multiple security dimensions (confidentiality, integrity, and availability). The results of an analysis of a concrete example of a software-defined network emulated in Mininet are encouraging and confirm the effectiveness of our approach with respect to improving protection of data in transit. The work presented in this article offers a basis for further research in this area.

The security of computer systems often relies upon decisions and actions of end users. In this paper, we set out to investigate users’ susceptibility to cybercriminal attacks by concentrating at the most fundamental component governing user behavior—the human brain. We introduce a novel neuroscience-based study methodology to inform the design of user-centered security systems as it relates to cybercrime. In particular, we report on an functional magnetic resonance imaging study measuring users’ security performance and underlying neural activity with respect to two critical security tasks: 1) distinguishing between a legitimate and a phishing website and 2) heeding security (malware) warnings. We identify the neural markers that might be controlling users’ performance in these tasks, and establish relationships between brain activity and behavioral performance as well as between users’ personality traits and security behavior. Our results provide a largely positive perspective on users’ capability and performance vis-a-vis these crucial security tasks. First, we show that users exhibit significant brain activity in key regions associated with decision-making, attention, and problem-solving (phishing and malware warnings) as well as language comprehension and reading (malware warnings), which means that users are actively engaged in these security tasks. Second, we demonstrate that certain individual traits, such as impulsivity measured via an established questionnaire, are associated with a significant negative effect on brain activation in these tasks. Third, we discover a high degree of correlation in brain activity (in decision-making regions) across phishing detection and malware warnings tasks, which implies that users’ behavior in one task may potentially be predicted by their behavior in the other. Fourth, we discover high functional connectivity among the core regions of the brain, while users performed the phishing detection task. Finally, we discuss the broader impacts and implications of our work on the field of user-centered security, including the domain of security education, targeted security training, and security screening.

Lately, the Internet of Things (IoT) has opened up new opportunities to business and enterprises, however, the cost of providing security and privacy best practices is preventing numerous organizations from adopting this innovation. With the proliferation of connecting devices in IoT, significant increases have been recorded in energy use, harmful contamination and e-waste. A new paradigm of green IoT is aimed at designing environmentally friendly protocols by reducing the carbon impact and promote efficient techniques for energy use. There is a consistent effort of designing distinctive security structures to address vulnerabilities and attacks. However, most of the existing schemes are not energy efficient. To bridge the gap, we propose the hybrid logical security framework (HLSF), which offers authentication and data confidentiality in IoT. HLSF uses a lightweight cryptographic mechanism for unique authentication. It enhances the level of security and provides better network functionalities using energy-efficient schemes. With extensive simulation, we compare HLSF with two existing popular security schemes, namely, constrained application protocol (CoAP) and object security architecture for IoT (OSCAR). The result shows that HLSF outperforms CoAP and OSCAR in terms of throughput with low computational, storage and energy overhead, even in the presence of attackers.

Embedded terminal devices are widely used in security-critical systems such as financial payments, and the security of their confidential data is becoming a concern for people. This paper presents a design method of embedded secure dual-core processor for smart terminal devices. The method uses a combination of physical security design and logical security design to protect the confidential data. In the physical security design, a physical isolation between the two cores is implemented through the interconnection network and the dual-core communication module, so that the confidential data runs in a closed environment completely isolated from the actual application to prevent the possibility of the confidential data being drawn at the application development terminal. In the logical security design, using the advantages of dual core, a combination of software and hardware is adopted to implement two-core cooperative encryption to prevent side-channel attacks from leaking confidential data. The proposed processor has very little hardware overhead and performance penalty.

The adoption of the cloud paradigm to access IT resources and services has posed many security issues which need to be cared of. Security becomes even a much bigger concern when services built on top of many commercial clouds have to interoperate. Among others, the value of the service delivered to end customers is strongly affected by the security of network which providers are able to build in typical SOA contexts. Currently, every provider advertises its own security strategy by means of proprietary policies, which are sometimes ambiguous and very often address the security problem from a non-uniform perspective. Even policies expressed in standardized languages do not appear to fit a dynamic scenario like the SOA's, where services need to be sought and composed on the fly in a way that is compatible with the end-to-end security requirements. We then propose an approach that leverages on the semantic technology to enrich standardized security policies with an ad-hoc content. The semantic annotation of policies enables machine reasoning which is then used for both the discovery and the composition of security-enabled services. In the presented approach the semantic enrichment of policies is enforced by an automatic procedure. We further developed a semantic framework capable of matchmaking in a smart way security capabilities of providers and security requirements of customers, and tested it on a use case scenario. Semantic matchmaking of security policies in cloud environments.Security ontology for modeling security concepts.Automatic semantic annotation of WS-SecurityPolicy policies.

Due to extensive use of Cloud services and newly evolving security threats, most cloud service providers (CSP) deploy varieties of security devices such as, firewalls, IPSec, IDS, etc. for controlling resource accesses based on the data centre security requirements. Today CSPs are looking for systematically hardening the security by incorporating multiple security devices in the network in a cost-effective way. In this paper, we present an automated framework for synthesizing data centre security configurations. We take a dummy data centre topology, CSP security (connectivity and isolation) requirements and business constraints (usability and cost) as input; and then synthesizes the correct and optimal data centre security. It determines the optimal placement of different security devices in the data centre.

We exhaustively discuss the security threats of LTE access network.The scheme boosts the security level and improves performance of the network.We contribute to the methods of security protocols verification.The bandwidth consumption of exchange of authentication vectors is reduced by 79%.The computational, communication and storage overheads are significantly reduced. Display Omitted In recent years, Long Term Evolution has been one of the promising technologies of current wireless communication systems. Quality of service and data rate contribute for the robustness of the field. These two factors are the sum up of transmission rate, security delay, delay variation and some other communication factors. Despite its high data rate and quality of service, Long Term Evolution has some drawbacks as far as the security of this technology is concerned. Particularly, there are some security holes in authenticating users for access in the domain of Access Network. For instance, when User Equipment requests for attachment, the International Mobile Subscriber Identity (IMSI) is sent over network without security protection, hence privacy does not hold. In addition, many parameters are generated by invoking a function with only one input key by which compromising this key results in the whole failure of the system security. So as to mitigate these and some other huge security problems, the researchers, propose an improved approach without adding extra cost so that it can be implemented within the same environment as the existing security system (Evolved Packet System Authentication and Key agreement). As one of the performance enhancements, fetching authentication vectors from foreign network is enabled instead of fetching from home network, which significantly reduces the authentication delay and message overhead. Generally, the purpose is to boost the security level and performance of the protocol keeping the architecture of the system as similar as the conventional security system. These has been exhaustively analyzed and verified under network as well as security verification and simulation tools.

Real-time multimedia sharing in Consumer-centric Multimedia Network (CMN) requires usability anywhere, anytime and from any device. However, CMNs are usually located or implemented on application layer, which makes CMNs subjected to their fixed substrate security framework. A fundamental diversifying attribute for the customized security experiences of CMNs is pressing. This paper proposes a programmable network structure which is named Service Processing Chain (SPC) based on network function combination. The SPC is established by the ordinal combination of network functions in substrate switches dynamically, and therefore constructs a special channel for each CMN with required security. The construction and reconfiguration algorithms of SPC are also discussed in this paper. Evaluations and implementation show that above approaches are effective in providing multilevel security with flexibility and expansibility. It is believed that the SPC could provide customized security service and drive participative real-time multimedia sharing for CMNs.

The main objective of this work is to analyze and extend security model of mobile devices running on Android OS. Provided security extension is a Linux kernel security module that allows the system administrator to restrict program's capabilities with per-program profiles. Profiles can allow capabilities like network access, raw socket access, and the permission to read, write, or execute files on matching paths. Module supplements the traditional Android capability access control model by providing mandatory access control (MAC) based on path. This extension increases security of access to system objects in a device and allows creating security sandboxes per application.

The history of computing shows simple ideas that caught on: personal computers, the Internet, cloud computing, and smartphones were timely inventions that became successful, sometimes beyond the expectations of their original designers and developers. But ideas that work for one mode of use sometimes show serious limitations in other environments. Creators must anticipate unintended uses, even though predicting change is difficult. Designers must document expectations and limitations of products so that adapters will know when an expanded use threatens security. And developers must accept responsibility for the security of their products. The relatively small group of security professionals can no longer be assumed responsible for anticipating and countering all security threats.

Cloud computing emerges as a way to dynamically increase the capacity or capabilities in infrastructure architectures, software delivery, and development models. However, security is one of the major issues with mobile applications as they can be attacked by malicious users which reduces the growth of cloud computing and complications with data privacy and data protection. In this paper, a mobile-based security agent is presented which provides security mechanisms to security agents as well as hosts. This type of security agent is significant in providing security mechanism to security risks in cloud computing due to its ability to migrate from one host to another where it can resume its processing and service provisioning. Additionally, some of the current attacks are created that attackers may initiate. A fault tolerance at a high level was enabled for mobile-based distributed transaction processing in the cloud. The results show that most of the attack messages were detected and identified, and the type of attack was identified within a specific period of time.

Network security management is becoming more and more complicated in recent years, considering the need of deploying more and more network security devices/middle-boxes at various locations inside the already complicated networks. A grand challenge in this situation is that current management is inflexible and the security resource utilization is not efficient. The flexible deployment and utilization of proper security devices at reasonable places at needed time with low management cost is extremely difficult. In this paper, we present a new concept of network security virtualization, which virtualizes security resources/functions to network administrators/users, and thus maximally utilizing existing security devices/middle-boxes. In addition, it enables security protection to desirable networks with minimal management cost. To verify this concept, we further design and implement a prototype system, NETSECVISOR, which can utilize existing pre-installed (fixed-location) security devices and leverage software-defined networking technology to virtualize network security functions. At its core, NETSECVISOR contains: 1) a simple script language to register security services and policies; 2) a set of routing algorithms to determine optimal routing paths for different security policies based on different needs; and 3) a set of security response functions/strategies to handle security incidents. We deploy NETSECVISOR in both virtual test networks and a commercial switch environment to evaluate its performance and feasibility. The evaluation results show that our prototype only adds a very small overhead while providing desired network security virtualization to network users/administrators.

The Internet of Things (IoT) will feature pervasive sensing and control capabilities via a massive deployment of machine-type communication (MTC) devices. The limited hardware, low-complexity, and severe energy constraints of MTC devices present unique communication and security challenges. As a result, robust physical-layer security methods that can supplement or even replace lightweight cryptographic protocols are appealing solutions. In this paper, we present an overview of low-complexity physical-layer security schemes that are suitable for the IoT. A local IoT deployment is modeled as a composition of multiple sensor and data subnetworks, with uplink communications from sensors to controllers, and downlink communications from controllers to actuators. The state of the art in physical-layer security for sensor networks is reviewed, followed by an overview of communication network security techniques. We then pinpoint the most energy-efficient and low-complexity security techniques that are best suited for IoT sensing applications. This is followed by a discussion of candidate low-complexity schemes for communication security, such as on–off switching and space-time block codes. The paper concludes by discussing open research issues and avenues for further work, especially the need for a theoretically well-founded and holistic approach for incorporating complexity constraints in physical-layer security designs.

Software Defined Networking (SDN) has emerged as a new network architecture for dealing with network dynamics through software-enabled control. While SDN is promoting many new network applications, security has become an important concern. This paper provides an extensive survey on SDN security. We discuss the security threats to SDN according to their effects, i.e., Spoofing, Tampering, Repudiation, Information disclosure, Denial of Service, and Elevation of Privilege. We also review a wide range of SDN security controls, such as firewalls, IDS/IPS, access control, auditing, and policy management. We describe several pathways of how SDN is evolving. We presented an extensive survey on Software Defined Networks with focus on security.We majorly divided survey in two categories or perspectives; security attacks and controls or countermeasures.We presented our own vision on how security may evolve in future based on SDN.

Searching and Security plays a major role in cloud computing. Providing encryption for the outsourced data is security concern in cloud computing. Service providers will take care of security for the data stored by the users. In this paper, the new security is provided by the service providers and data is authorized by the data owners and finally encrypted data searched by the users and decrypt the data for usage. In this paper, advanced attribute keyword search is used to provide security and data can access only by owner's permission. Results will show the performance of the data security.

Regarding countless network disorders or invasions happening nowadays from 2014 until 2015, illegal access intended to attack through the communication line provided by ISP (Internet Service Provider) appears to be the source of the problem. As a defensive way to prevent such network-based attacks, not only stabilization structures for network communication but various policies as well as physical security devices and solutions corresponding to those have been realized and established. Therefore, now is the time to gain foundational research data to secure network security sections by producing logical area on communication bandwidth or such, suggest tasks to expand the communication line which is another research topic in the network security market, and recognize the fact that the active communication bandwidth linkage paradigm using network communication bandwidth is needed as one of the areas that can realize physical security. Additionally, it is necessary to limit the data in the forms of organizing visible security structures into a certain range of physical information by re-dividing communication capacity being currently provided by telecommunicators into subdivided organizational areas and applying the logical virtualization of communication capacity in each of the areas divided. By proposing a network security section based on a logical field application in place of the existing physical structure, basic data that designs a stable physical network communication structure will be provided.

In this paper, a method to identify components per unit task system is expressed with node, module, and interface. We define security subject per unit task system and explain node, module, and interface per component. According to the defined security standard in design phase, we also perform to design and elaborate security attributes for node and module as identified security subjects in their defined tables. And then we describe the composition standard for security attribute design with some examples, after classifying it into security subject, access subject, access control area, identification or verification area, and encryption.

In this paper, we present a novel method to verify the financial site and prevent sensitive information disclosure with financial security card and smart phone. This method allows homepage access when user accesses to the valid site with right security card and smart phone. Furthermore, traditional OTP method cannot be secure against to Man in the middle attack, but out method presents the countermeasure of this. User can readily recognize the phishing and pharming sites and even avoid Man in the middle attack by malicious users.

To make cloud computing environments more secure, this paper focuses on the security of virtualized server systems. A security layer is introduced to the secure architecture of a virtualized server as an abstraction. Because the security layer will play a key role in securing the virtualized server, there is a need for it to be sufficiently robust to tackle the most common security threats associated with cloud computing. First, security threats to cloud computing are analysed based on a publication from an international organization and the security issues surrounding virtualized servers are clarified. Following this, the security elements and their functions for each of the security requirements for virtualized servers are defined. The relationship between the security issues and security elements is then presented to verify the effectiveness of the security layer. It is shown that, using the proposed security elements, the security issues facing virtualized server systems in cloud computing are adequately mitigated. Therefore, our research will be helpful in the development of virtualized servers by making cloud computing more secure.

Intelligent transportation systems and the advent of smart cities have created a renewed research interest in vehicular networks (VANET). These ad-hoc networks are the key technology for new collaborative approaches to increase the efficiency and safety of our roads. In effect, city-scale field trials are being conducted by major high-tech companies to explore the capabilities and limitations of vehicle-to-infrastructure and vehicle-to-vehicle communication. Initial advances have led to safety enhancing applications like the electronic emergency brake light, cooperative collision avoidance and cooperative adaptive cruise control. In IEEE standard 1609.2, security measures to guarantee the integrity and authenticity of VANET messages are specified. However, physical properties like spatial proximity and driving direction are not considered. These become notably important when vehicles make decisions that concern the safety of users for example to avoid a collision. We propose a novel approach to verify the ongoing copresence of two vehicles. Our method is based on the observation that the trajectory through a road network can be used to uniquely define a vehicle's location as well as its driving direction. Our system provides a protocol to authenticate VANET messages for a group of vehicles driving in succession and to de-authenticate vehicles that have left the formation. To demonstrate the feasibility of trajectories as proof for co-presence, we implemented a smartphone application and conducted driving experiments under real-world conditions. We analyze the road network of several major cities from different continents to show the generalizability of our approach. Additionally, we systematically evaluate the security properties of our system by performing city-scale simulations under realistic conditions.

Password cracking tools have given hackers the ability to solve hashes in minutes. These same tools can also be used for penetration testing to determine weak passwords within our own infrastructure. In using products, such as, Cain and Abel or Ophcrack, organizations can gain insight and awareness that could be the stronghold in keeping accounts and personal health information (PHI) safe. Cain and Abel, and Ophcrack, which are the two password cracking tools tested, can be both useful and very dangerous at the same time. While many can learn from these products, so can their adversaries. In using these products to test our own password strengths we can foresee vulnerabilities that we may have been overlooked. As new software is created, passwords will become easier to crack. Technology knows no boundaries in many aspects, which is why securing our networks, strengthening our physical and logical security, and mitigating every risk possible, becomes of utmost importance in this technology-ridden world.

There have been various security measures that deal with data security in wired or wireless network, where these measures help to make sure that data from one point to another is intact, by identifying, authenticating, authorizing the right users and also encrypting the data over the network. Data communication between computers has brought about countless benefits to users, but the same information technologies have created a gap, a vulnerable space in the communication medium, where the data that’s been exchanged or transferred, thereby causing threats to the data. Especially data on wireless networks are much exposed to threats since the network has been broadcasted unlike a wired network. Data security in the past dealth with integrity, confidentiality and ensuring authorized usage of the data and the system. Less or no focus was placed on the reactive approach or measures to data security which is capable of responding properly to mitigate an attacker and avoid harm and also to prevent future attacks. This research is going to expose the mechanisms and measures of data security in wireless networks from the reactive security approaches point of view and exposes the reactive approaches used to enhance data security.

© 2017 IEEE. The logically-centralized controllers have largely operated as the coordination points in software-defined networking(SDN), through which applications submit network operations to manage the global network resource. Therefore, the validity of these network operations from SDN applications are critical for the security of SDN. In this paper, we analyze the mechanism that generates network operations in SDN, and present a fine-grained access control model, called Access Control Protector(AC-PROT),that employs an attribute-based signature scheme for network applications. The simulation result demonstrates that AC-PROT can efficiently identify and reject unauthorized network operations generated by applications.

For computer software, our security models, policies, mechanisms, and means of assurance were primarily conceived and developed before the end of the 1970's. However, since that time, software has changed radically: it is thousands of times larger, comprises countless libraries, layers, and services, and is used for more purposes, in far more complex ways. As a consequence, it is necessary to revisit many of our core computer security concepts. For example, it is unclear how the Principle of Least Privilege can be applied to set security policy, when software is too complex for either its developers or its users to explain its intended behavior in detail.One possibility is to take an empirical, data-driven approach to modern software, and determine its exact, concrete behavior via comprehensive, online monitoring. Such an approach can be a practical, effective basis for security--as demonstrated by its success in spam and abuse fighting--but its use to constrain software behavior raises many questions. In particular, two questions seem critical. First, is it possible to learn the details of how software *is* behaving, without intruding on the privacy of its users' Second, are those details a good foundation for deriving security policies that constrain how software *should* behave? This talk answers both these questions in the affirmative, as part of an overall approach to data-driven security. It also considers what hardware support is necessary to perform comprehensive software monitoring, with privacy, and without prohibitive overhead.

Computer security is one of the most important current tasks in digital applications. However, from the best of our knowledge, there is little research for designing effective interfaces in the context of security management systems. Security problems for these systems include vulnerabilities, due to difficulty using the systems and poor user interfaces because of their security constraints. Nowadays, finding a good trade-off between security and usability is a challenge, mainly for user authentication services. This paper presents a preliminary process for designing secure and usable systems using a user-centered approach. According to the above, the researchers and development team could have a process for designing and carrying out security and usability solutions for users. For the development of this process, the MPIu+a methodology to implement highly usable and accessible interactive applications is used.

This paper focuses on security of data exchange and supervisory control according to IEC 61850. The existing security measures standardized by IEC 62351 are described and compared with similar systems that are widely used in industry automation, i.e. the OPC Unified Architecture. These security measures are not sufficient because they cover the communication only and do not respect the contained data, which specify the transactions to be processed. This paper presents extensions of existing security measures by the introduction of transaction oriented security mechanisms, which are independent of the data exchange and communication protocols. This allows a very fine-grained level of security, which considers the individual level of sensitivity of each transaction.

The security protocol is proposed as a security solution for end-to-end communication between smart grid applications in the EU FP7 project C-DAX. Since the importance and widespread use of the security protocol, it is of great significance to formally analyze and verify relevant security properties of this security protocol. In this paper, we apply Communicating Sequential Processes (CSP) to model the security protocol. Further, we use the model checker Process Analysis Toolkit (PAT) to automatically simulate the developed model, and verify whether the model caters for the specification and relevant secure properties, e.g. reachability of the fake goal. Our modeling and verification show that a risk may exist in the security protocol.

In this paper we present the design, development and preliminary tests of Robotman, a robot that combines qualities for interaction with humans, and security patrolling services. The robot is inspired by the information obtained from a security company in which their personnel not only perform security patrolling services, but have to interact with people, providing additional information about the area they safeguard. The robot is able to perform security patrols during the night while functioning as a guide during the day. We designed and implemented a robust, easy to assemble, anthropomorphic security robot aiming to patrol large indoor areas, interact with humans, welcome, provide information and guide clients to their destination, as well as function as a telepresence platform for the human security guards. Our results suggest that Robotman is user friendly and pleasing to the people, it can perform security tasks and interact with them.

This paper introduces a multi-factors security key generation mechanism for self-organising Internet of Things (IoT) network and nodes. The mechanism enables users to generate unique set of security keys to enhance IoT security while meeting various business needs. The multi-factor security keys presents an additional security layer to existing security standards and practices currently being adopted by the IoT community. The proposed security key generation mechanism enables user to define and choose any physical and logical parameters he/she prefers, in generating a set of security keys to be encrypted and distributed to registered IoT nodes. IoT applications and services will only be activated after verifying that all security keys are present. Multiple levels of authorisation for different user groups can be easily created through the mix and match of the generated multi-factors security keys. A use case, covering indoor and outdoor field tests was conducted. The results of the tests showed that the mechanism is easily adaptable to meet diverse multi-vendor IoT devices and is scalable for various applications.

With new technologies such as SDN(Software-Defined Networking) and NFV(Network Function Virtualization), network transformation is inevitable for network operators to make network programmable as well as to save cost. Consequently, applications can be deployed rapidly and automatically based on SDN and NFV. Correspondingly, security as one of key features for application also has to be provided dynamically and adaptively to meet different security requirements for today's rapid-increasing and evolving applications. However, traditional security appliances such as firewall are implemented as hardware-based middleboxes and placed on fixed locations in the network, so it is difficult to meet security requirements for today's applications. This paper proposes a new security service model based on security chain (i.e. security on demand) to provide customized security services dynamically and adaptively for today's applications. How to apply security on demand to the application (i.e. special vehicle speedup) is also elaborated.

Mobile Devices offer enriched services and information for the end users. Achieving security in such a dynamic and heterogeneous environment is a challenging task. Hence, adaptive security is an applicable solution for this challenge. It is able to automatically select security mechanisms and their parameters at runtime in order to preserve the required security level in a changing environment. In this paper, we propose a self-adaptive security solution for Mobile Devices (Smartphone, Tablets,...) based on the combination of the MAPE-K reference model to dynamic negotiate and deploy of security policies, and DSPL approach to reconfigure the security level of the applications at runtime and monitor the changes in the context. The novelty of our approach comes from dynamic negotiation of security policies and automatic reconfiguration of security level to instantiate the new security policies at runtime in order to be capable of deploying adaptive security mechanisms to satisfy different security needs at different conditions.

In the era of Big Data, software systems can be affected by its growing complexity, both with respect to functional and non-functional requirements. As more and more people use software applications over the web, the ability to recognize if some of this traffic is malicious or legitimate is a challenge. The traffic load of security controllers, as well as the complexity of security rules to detect attacks can grow to levels where current solutions may not suffice. In this work, we propose a hierarchical distributed architecture for security control in order to partition responsibility and workload among many security controllers. In addition, our architecture proposes a more simplified way of defining security rules to allow security to be enforced on an operational level, rather than a development level.

It is well acknowledged that one of the key enabling factors for the realization of future 5G networks will be the small cell (SC) technology. Furthermore, recent advances in the fields of network functions virtualization (NFV) and software-defined networking (SDN) open up the possibility of deploying advanced services at the network edge. In the context of mobile/cellular networks this is referred to as mobile edge computing (MEC). Within the scope of the EU-funded research project SESAME we perform a comprehensive security modelling of MEC-assisted quality-of-experience (QoE) enhancement of fast moving users in a virtualized SC wireless network, and demonstrate it through a representative scenario toward 5G. Our modelling and analysis is based on a formal security requirements engineering methodology called Secure Tropos which has been extended to support MEC-based SC networks. In the proposed model, critical resources which need protection, and potential security threats are identified. Furthermore, we identify appropriate security constraints and suitable security mechanisms for 5G networks. Thus, we reveal that existing security mechanisms need adaptation to face emerging security threats in 5G networks.

In many Internet of Thing (IoT) application domains security is a critical requirement, because malicious parties can undermine the effectiveness of IoT-based systems by compromising single components and/or communication channels. Thus, a security infrastructure is needed to ensure the proper functioning of such systems even under attack. However, it is also critical that security be at a reasonable resource and energy cost, as many IoT devices may not have sufficient resources to host expensive security tools. In this paper, we focus on the problem of efficiently and effectively securing IoT networks by carefully allocating security tools. We model our problem according to game theory, and provide a Pareto-optimal solution, in which the cost of the security infrastructure, its energy consumption, and the probability of a successful attack, are minimized. Our experimental evaluation shows that our technique improves the system robustness in terms of packet delivery rate for different network topologies.

For a Software Defined Network (SDN), security is an important factor affecting its large-scale deployment. The existing security solutions for SDN mainly focus on the controller itself, which has to handle all the security protection tasks by using the programmability of the network. This will undoubtedly involve a heavy burden for the controller. More devastatingly, once the controller itself is attacked, the entire network will be paralyzed. Motivated by this, this paper proposes a novel security protection architecture for SDN. We design a security service orchestration center in the control plane of SDN, and this center physically decouples from the SDN controller and constructs SDN security services. We adopt virtualization technology to construct a security meta-function library, and propose a dynamic security service composition construction algorithm based on web service composition technology. The rule-combining method is used to combine security meta-functions to construct security services which meet the requirements of users. Moreover, the RETE algorithm is introduced to improve the efficiency of the rule-combining method. We evaluate our solutions in a realistic scenario based on OpenStack. Substantial experimental results demonstrate the effectiveness of our solutions that contribute to achieve the effective security protection with a small burden of the SDN controller.

Access control is a means to implement within an information system to ensure its security. The development of two distinct themes which are: Access control and networking, to improve one by using the other. It is a vision that motivated us to look for existing methods to combine the two for the benefit of computer security [5, 23, 28, 31]. In fact, our work focuses on the paradigm of access control and its application. First, we studied the best-known access control models existing in the literature. Moreover, we defined the security concept network and protocol, by choosing a cloud system as a case study in order to apply a policy Access control at the level of a firewall to secure our system. Finally, the most appropriate model is presented for implementation based on the security policies and requirements of organizations and the specifications of each access control model.

Technology specific expert knowledge is often required to analyse security configurations and determine potential vulnerabilities, but it becomes difficult when it is a new technology such as Fog computing. Furthermore, additional knowledge is also required regarding how the security configuration has been constructed in respect to an organisation's security policies. Traditionally, organisations will often manage their access control permissions relative to their employees needs, posing challenges to administrators. This problem is even exacerbated in Fog computing systems where security configurations are implemented on a large amount of devices at the edges of Internet, and the administrators are required to retain adequate knowledge on how to perform complex administrative tasks. In this paper, a novel approach of translating object-based security configurations in to a graph model is presented. A technique is then developed to autonomously identify vulnerabilities and perform security auditing of large systems without the need for expert knowledge. Throughout the paper, access control configuration data is used as a case study, and empirical analysis is performed on synthetically generated access control permissions.

An integrated electricity information security monitoring platform is presented, electrical information security integrated real-time monitoring of the state power applied information security systems, security equipment, network equipment, network boundaries, desktop computers, to improve information security monitoring, early warning, emergency response and defense capabilities to protect IT hardware, software and network security, which can guarantee continuous, reliable and efficient operation.