Search

Many Security Operations Centers (SOCs) today still heavily rely on signature-based Network Intrusion Detection Systems (NIDS) such as Suricata. The specificity of intrusion detection rules and the coverage provided by rulesets are common concerns within the professional community surrounding SOCs, which impact the effectiveness of automated alert post-processing approaches. We postulate a better understanding of factors influencing the quality of rules can help address current SOC issues. In this paper, we characterize the rules in use at a collaborating commercial (managed) SOC serving customers in sectors including education and IT management. During this process, we discover six relevant design principles, which we consolidate through interviews with experienced rule designers at the SOC.We then validate our design principles by quantitatively assessing their effect on rule specificity. We find that several of these design considerations significantly impact unnecessary workload caused by rules. For instance, rules that leverage proxies for detection, and rules that do not employ alert throttling or do not distinguish (un)successful malicious actions, cause significantly more workload for SOC analysts. Moreover, rules that match a generalized characteristic to detect malicious behavior, which is believed to increase coverage, also significantly increase workload, suggesting a tradeoff must be struck between rule specificity and coverage. We show that these design principles can be applied successfully at a SOC to reduce workload whilst maintaining coverage despite the prevalence of violations of the principles.

One of the possible approaches to decrease the demand for critical elements such as rare earths is to develop new sustainable magnets. Iron-based materials are suitable for gap magnets applications since iron is the most abundant ferromagnetic element on Earth. Fe$_5$SiB$_2$ is a candidate as gap magnet thanks to its high Curie temperature (T$_{\text{C}} \sim$ 800 K) and saturation magnetization (M$_{\text{S}}\sim$ 140 Am$^2$kg$^{-1}$). However its anisotropy field is too low for applications (H$_{\text{A}} \sim$ 0.8 T). In order to increase the anisotropy value, we synthesized a series of Ge, Re and Cr substituted Fe$_5$SiB$_2$ samples and studied their magnetic properties. They all crystallize in the Cr$_5$B$_3$-type tetragonal structure with the $I4/mcm$ space group. Curie temperature (T$_{\text{C}}$ = 803 K) and saturation magnetization (M$_{\text{S}}$ = 138 Am$^2$kg$^{-1}$) are slightly decreased by elemental substitution with Re having the largest effect. Despite being reduced, T$_{\text{C}}$ and M$_{\text{S}}$ still maintain significant values (T$_{\text{C}}>$ 750 K and M$_{\text{S}}$ = 118 Am$^2$kg$^{-1}$). The room temperature anisotropy field has been measured by Singular Point Detection (SPD) and increases by about 15% upon Re substitution, reaching 0.92 T for Fe$_{4.75}$Re$_{0.25}$SiB$_2$. We have also used Nuclear Magnetic Resonance and SPD measurements to study the spin reorientation transition which takes place at 172 K and we have found that it is partially suppressed by substitution of Ge from 172 K to 140 K and completely suppressed upon Cr and Re substitution., Comment: The paper consists of a main section and supplementary materials. The main section includes 15 pages, featuring 6 figures and 2 tables. The supplementary materials, appended at the end of the main section, span 4 pages and contain 6 figures

The cybercriminal underground consists of hundreds of forum communities that function as marketplaces and information-exchange platforms for both established and wannabe cybercriminals. The ecosystem is continuously evolving, with users migrating between forums and platforms. The emergence of cybercrime communities in Telegram and Discord only highlights the rising fragmentation and adaptability of the ecosystem. In this position paper, we explore the economic incentives and trust-building mechanisms that may drive a participant (hereafter, Dmitry) of the cybercriminal underground ecosystem to migrate from one forum or platform to another. What are the market signals that matter to Dmitry's decision of joining a specific community, and what roles and purposes do these communities or platforms play within the broader ecosystem? Ultimately, we build towards our thesis that by studying these mechanisms we could explain, and therefore act upon, Dmitry's choice of joining a criminal community rather than another. To build this argument, we first discuss previous work evaluating differences in trust signals depicted in criminal forums. We then present preliminary results evaluating criminal channels on Telegram using those same lenses. Further, we analyze the different roles these channels play in the criminal ecosystem. We then discuss implications for future research.

The discovery of chiral helical magnetism (CHM) in Cr$_{1/3}$NbS$_2$ and the stabilization of a chiral soliton lattice (CSL) has attracted considerable interest in view of their potential technological applications. However, there is an ongoing debate regarding whether the sister compound, Mn$_{1/3}$NbS$_2$, which shares the same crystal structure, exhibits similar nontrivial properties which rely on the stabilization of the lack of inversion symmetry at the magnetic ion. In this study, we conduct a comprehensive investigation of the magnetically ordered states of both compounds, using $^{53}$Cr, $^{55}$Mn and $^{93}$Nb nuclear magnetic resonance. Our results, supported by density functional calculations, detect in a high-quality single crystal of Cr$_{1/3}$NbS$_2$ all the signatures of the monoaxial CHM in a magnetic field, identifying it as a textbook NMR case. The detailed understanding of this prototypic behavior provides a reference for Mn$_{1/3}$NbS$_2$. Despite the much larger density of specific defects in this second single crystal, we confirm the presence of a CHM phase in the Mn compound, characterized by a very large critical field for the forced ferromagnetic phase ($\approx 5$ T for H$\parallel\hat c$)., Comment: 10 pages, 7 figures, Supplemental MAterial

Magnetic topological insulators (TIs) herald a wealth of applications in spin-based technologies, relying on the novel quantum phenomena provided by their topological properties. Particularly promising is the (MnBi$_2$Te$_4$)(Bi$_2$Te$_3$)$_n$ layered family of established intrinsic magnetic TIs that can flexibly realize various magnetic orders and topological states. High tunability of this material platform is enabled by manganese-pnictogen intermixing, whose amounts and distribution patterns are controlled by synthetic conditions. Positive implication of the strong intermixing in MnSb$_2$Te$_4$ is the interlayer exchange coupling switching from antiferromagnetic to ferromagnetic, and the increasing magnetic critical temperature. On the other side, intermixing also implies atomic disorder which may be detrimental for applications. Here, we employ nuclear magnetic resonance and muon spin spectroscopy, sensitive local probe techniques, to scrutinize the impact of the intermixing on the magnetic properties of (MnBi$_2$Te$_4$)(Bi$_2$Te$_3$)$_n$ and MnSb$_2$Te$_4$. Our measurements not only confirm the opposite alignment between the Mn magnetic moments on native sites and antisites in the ground state of MnSb$_2$Te$_4$, but for the first time directly show the same alignment in (MnBi$_2$Te$_4$)(Bi$_2$Te$_3$)$_n$ with n = 0, 1 and 2. Moreover, for all compounds, we find the static magnetic moment of the Mn antisite sublattice to disappear well below the intrinsic magnetic transition temperature, leaving a homogeneous magnetic structure undisturbed by the intermixing. Our findings provide a microscopic understanding of the crucial role played by Mn-Bi intermixing in (MnBi$_2$Te$_4$)(Bi$_2$Te$_3$)$_n$ and offer pathways to optimizing the magnetic gap in its surface states., Comment: 13 pages, 4 figures (Main) and 8 pages, 10 figures (Supplemental)

The use of $d$-level qudits instead of two-level qubits can largely increase the power of quantum logic for many applications, ranging from quantum simulations to quantum error correction. Molecular Nanomagnets are ideal spin systems to realize these large-dimensional qudits. Indeed, their Hamiltonian can be engineered to an unparalleled extent and can yield a spectrum with many low-energy states. In particular, in the last decade intense theoretical, experimental and synthesis efforts have been devoted to develop quantum simulators based on Molecular Nanomagnets. However, this remarkable potential is practically unexpressed, because no quantum simulation has ever been experimentally demonstrated with these systems. Here we show the first prototype quantum simulator based on an ensemble of molecular qudits and a radiofrequency broadband spectrometer. To demonstrate the operativity of the device, we have simulated quantum tunneling of the magnetization and the transverse-field Ising model, representative of two different classes of problems. These results represent an important step towards the actual use of molecular spin qudits in quantum technologies.

The criminal underground is populated with forum marketplaces where, allegedly, cybercriminals share and trade knowledge, skills, and cybercrime products. However, it is still unclear whether all marketplaces matter the same in the overall threat landscape. To effectively support trade and avoid degenerating into scams-for-scammers places, underground markets must address fundamental economic problems (such as moral hazard, adverse selection) that enable the exchange of actual technology and cybercrime products (as opposed to repackaged malware or years-old password databases). From the relevant literature and manual investigation, we identify several mechanisms that marketplaces implement to mitigate these problems, and we condense them into a market evaluation framework based on the Business Model Canvas. We use this framework to evaluate which mechanisms `successful' marketplaces have in place, and whether these differ from those employed by `unsuccessful' marketplaces. We test the framework on 23 underground forum markets by searching 836 aliases of indicted cybercriminals to identify `successful' marketplaces. We find evidence that marketplaces whose administrators are impartial in trade, verify their sellers, and have the right economic incentives to keep the market functional are more likely to be credible sources of threat., Comment: The 22nd Workshop on the Economics of Information Security (WEIS'23), July 05--08, 2023, Geneva, Switzerland

In this paper we exploit market features proper of a leading Russian cybercrime market for user impersonation at scale to evaluate attacker preferences when purchasing stolen user profiles, and the overall economic activity of the market. We run our data collection over a period of $161$ days and collect data on a sample of $1'193$ sold user profiles out of $11'357$ advertised products in that period and their characteristics. We estimate a market trade volume of up to approximately $700$ profiles per day, corresponding to estimated daily sales of up to $4'000$ USD and an overall market revenue within the observation period between $540k$ and $715k$ USD. We find profile provision to be rather stable over time and mainly focused on European profiles, whereas actual profile acquisition varies significantly depending on other profile characteristics. Attackers' interests focus disproportionally on profiles of certain types, including those originating in North America and featuring $crypto$ resources. We model and evaluate the relative importance of different profile characteristics in the final decision of an attacker to purchase a profile, and discuss implications for defenses and risk evaluation., Comment: To be published in the Proceedings of the 32nd USENIX Security Symposium (USENIX Security '23)

Heusler compounds have been intensively studied owing to the important technological advancements that they provide in the field of shape memory, thermomagnetic energy conversion and spintronics. Many of their intriguing properties are ultimately governed by their magnetic states and understanding and possibly tuning them is evidently of utmost importance. In this work we examine the \alloys alloys with Density Functional Theory simulations and $^{55}$Mn Nuclear Magnetic Resonance and combine these two methods to carefully describe their ground state magnetic order. In addition, we compare the results obtained with the conventional generalized gradient approximation with the ones of strongly constrained and appropriately normed (SCAN) semilocal functionals for exchange and correlation. Experimental results eventually allow to discriminate between two different scenarios identified by ab initio simulations.

Collecting data on underground criminal communities is highly valuable both for security research and security operations. Unfortunately these communities live within a constellation of diverse online forums that are difficult to infiltrate, may adopt crawling monitoring countermeasures, and require the development of ad-hoc scrapers for each different community, making the endeavour increasingly technically challenging, and potentially expensive. To address this problem we propose THREAT/crawl, a method and prototype tool for a highly reusable crawler that can learn a wide range of (arbitrary) forum structures, can remain under-the-radar during the crawling activity and can be extended and configured at the user will. We showcase THREAT/crawl capabilities and provide prime evaluation of our prototype against a range of active, live, underground communities., Comment: To be published in the Proceedings of the 17th Symposium on Electronic Crime Research (APWG eCrime 2022). Source code of the implemented solution available at https://gitlab.tue.nl/threat-crawl/THREATcrawl/

The recently discovered vanadium-based kagome metals AV$_3$Sb$_5$ (A = K, Rb, Cs) offer the possibility to study the interplay between competing electronic orderings, such as charge density order and superconductivity. We focus on the former and provide a comprehensive set of $^{51}$V, $^{87}$Rb, and $^{121}$Sb magnetic resonance measurements on an RbV$_3$Sb$_5$ single crystal. Elucidating the symmetries and properties of the CDW phase is essential to understanding the unconventional electronic orderings occurring in this material. We establish the structure of the $2\times 2 \times 2$ superlattice that describes the system below the charge density wave transition by combining both experimental and computational methods, with a methodology that can be readily applied to the remaining compounds of the same family. Our results give compelling evidence that the CDW structure occurring below 103 K for RbV$_3$Sb$_5$ is the so-called Inverse Start of David pattern $\pi$-shifted along the c axis (also known as staggered tri-hexagonal).

The effects of doping on the electronic evolution of the Mott insulating state have been extensively studied in efforts to understand mechanisms of emergent quantum phases of materials. The study of these effects becomes ever more intriguing in the presence of entanglement between spin and orbital degrees of freedom. Here, we present a comprehensive investigation of charge doping in the double perovskite Ba$_2$NaOsO$_6$, a a complex Mott insulator where such entanglement plays an important role. We establish that the insulating magnetic ground state evolves from canted antiferromagnet (cAF)to N\'eel order for dopant levels exceeding ~ 10 %. Furthermore, we determine that a broken local point symmetry (BLPS) phase, precursor to the magnetically ordered state, occupies an extended portion of the (H-T) phase diagram with increased doping. This finding reveals that the breaking of the local cubic symmetry is driven by a multipolar order, most-likely of the antiferro-quadrupolar type.

Magnetic frustration in ferromagnetic metallic systems is unusual due to the long-range and symmetric nature of the exchange interactions. In this work we prove that it is possible to obtain a highly frustrated ferromagnetic phase in a multi-sublattices cubic structure through a fine tuning of the magnetic interactions. This peculiar state is achieved in Ni-Mn-(In, Sn) Heusler alloys and results in the effective decoupling of their two intertwined ferromagnetic sublattices. One sublattice is ferromagnetic long range ordered below the macroscopic Curie temperature (TC ) whereas the second one remains disordered until a crossover to a polarized state occurs at T << TC . This result points out that a fine engineering of the magnetic interactions in metallic systems can lead to interesting novel and emergent phenomena.

We show that [VO(TPP)] (vanadyl tetraphenylporphyrinate) is a promising system suitable to implement quantum computation algorithms based on encoding information in multi-level (qudit) units. Indeed, it embeds an electronic spin 1/2 coupled through hyperfine interaction to a nuclear spin 7/2, both characterized by remarkable coherence. We demonstrate this by an extensive broadband nuclear magnetic resonance study, which allow us to characterize the nuclear spin-Hamiltonian and to measure the spin dephasing time as a function of the magnetic field. In addition, we combine targeted measurements and numerical simulations to show that nuclear spin transitions conditioned by the state of the electronic qubit can be individually addressed and coherently manipulated by resonant radio-frequency pulses, thanks to the remarkably long coherence times and the effective quadrupolar coupling induced by the strong hyperfine coupling. This approach may open new perspectives for developing new molecular qubit-qudit systems.

An accurate experimental characterization of finite antiferromagnetic (AF) spin chains is crucial for controlling and manipulating their magnetic properties and quantum states for potential applications in spintronics or quantum computation. In particular, finite AF chains are expected to show a different magnetic behaviour depending on their length and topology. Molecular AF rings are able to combine the quantum-magnetic behaviour of AF chains with a very remarkable tunability of their topological and geometrical properties. In this work we measure the $^{53}$Cr-NMR spectra of the Cr$_{8}$Cd ring to study the local spin densities on the Cr sites. Cr$_{8}$Cd can in fact be considered a model system of a finite AF open chain with an even number of spins. The NMR resonant frequencies are in good agreement with the theoretical local spin densities, by assuming a core polarization feld AC = -12.7 T/$\mu_B$. Moreover, these NMR results confirm the theoretically predicted non-collinear spin arrangement along the Cr$_{8}$Cd ring, which is typical of an even-open AF spin chain.

Fe$_2$P alloys have been identified as promising candidates for magnetic refrigeration at room-temperature and for custom magnetostatic applications. The intent of this study is to accurately characterize the magnetic ground state of the parent compound, Fe$_2$P, with two spectroscopic techniques, $\mu$SR and NMR, in order to provide solid bases for further experimental analysis of Fe$_2$P-type transition metal based alloys. We perform zero applied field measurements using both techniques below the ferromagnetic transition $T_C=220~\mathrm K$. The experimental results are reproduced and interpreted using first principles simulations validating this approach for quantitative estimates in alloys of interest for technological applications., Comment: 10 pages, 2 figures

In this paper we introduce SAIBERSOC, a tool and methodology enabling security researchers and operators to evaluate the performance of deployed and operational Security Operation Centers (SOCs) (or any other security monitoring infrastructure). The methodology relies on the MITRE ATT&CK Framework to define a procedure to generate and automatically inject synthetic attacks in an operational SOC to evaluate any output metric of interest (e.g., detection accuracy, time-to-investigation, etc.). To evaluate the effectiveness of the proposed methodology, we devise an experiment with $n=124$ students playing the role of SOC analysts. The experiment relies on a real SOC infrastructure and assigns students to either a BADSOC or a GOODSOC experimental condition. Our results show that the proposed methodology is effective in identifying variations in SOC performance caused by (minimal) changes in SOC configuration. We release the SAIBERSOC tool implementation as free and open source software., Comment: To be published in Annual Computer Security Applications Conference (ACSAC 2020), December 7-11, 2020, Austin, USA. ACM, New York, NY, USA, 13 pages. https://doi.org/10.1145/3427228.3427233, ISBN: 978-1-4503-8858-0/20/12 Artifact repository: https://gitlab.tue.nl/saibersoc/acsac2020-artifacts

The monitoring of underground criminal activities is often automated to maximize the data collection and to train ML models to automatically adapt data collection tools to different communities. On the other hand, sophisticated adversaries may adopt crawling-detection capabilities that may significantly jeopardize researchers' opportunities to perform the data collection, for example by putting their accounts under the spotlight and being expelled from the community. This is particularly undesirable in prominent and high-profile criminal communities where entry costs are significant (either monetarily or for example for background checking or other trust-building mechanisms). This paper presents CARONTE, a tool to semi-automatically learn virtually any forum structure for parsing and data-extraction, while maintaining a low profile for the data collection and avoiding the requirement of collecting massive datasets to maintain tool scalability. We showcase the tool against four underground forums, and compare the network traffic it generates (as seen from the adversary's position, i.e. the underground community's server) against state-of-the-art tools for web-crawling as well as human users.

In this paper we provide evidence of an emerging criminal infrastructure enabling impersonation attacks at scale. Impersonation-as-a-Service (ImpaaS) allows attackers to systematically collect and enforce user profiles (consisting of user credentials, cookies, device and behavioural fingerprints, and other metadata) to circumvent risk-based authentication system and effectively bypass multi-factor authentication mechanisms. We present the ImpaaS model and evaluate its implementation by analysing the operation of a large, invite-only, Russian ImpaaS platform providing user profiles for more than $260'000$ Internet users worldwide. Our findings suggest that the ImpaaS model is growing, and provides the mechanisms needed to systematically evade authentication controls across multiple platforms, while providing attackers with a reliable, up-to-date, and semi-automated environment enabling target selection and user impersonation against Internet users as scale., Comment: Presented at ACM CCS 2020. Appendix on "Deriving a Threat Model from Observation" available at https://michelecampobasso.github.io/publication/2020-11-10-impaas

We demonstrate that the [Yb(trensal)] molecule is a prototypical coupled electronic qubit-nuclear qudit system. The combination of noise-resilient nuclear degrees of freedom and large reduction of nutation time induced by electron-nuclear mixing enables coherent manipulation of this qudit by radio-frequency pulses. Moreover, the multi-level structure of the qudit is exploited to encode and operate a qubit with embedded basic quantum error correction.

Lane detection is extremely important for autonomous vehicles. For this reason, many approaches use lane boundary information to locate the vehicle inside the street, or to integrate GPS-based localization. As many other computer vision based tasks, convolutional neural networks (CNNs) represent the state-of-the-art technology to indentify lane boundaries. However, the position of the lane boundaries w.r.t. the vehicle may not suffice for a reliable positioning, as for path planning or localization information regarding lane types may also be needed. In this work, we present an end-to-end system for lane boundary identification, clustering and classification, based on two cascaded neural networks, that runs in real-time. To build the system, 14336 lane boundaries instances of the TuSimple dataset for lane detection have been labelled using 8 different classes. Our dataset and the code for inference are available online., Comment: Presented at Eurocast 2019

In this paper we employ quantitative measurements of cognitive vulnerability triggers in phishing emails to predict the degree of success of an attack. To achieve this we rely on the cognitive psychology literature and develop an automated and fully quantitative method based on machine learning and econometrics to construct a triaging mechanism built around the cognitive features of a phishing email; we showcase our approach relying on data from the anti-phishing division of a large financial organization in Europe. Our evaluation shows empirically that an effective triaging mechanism for phishing success can be put in place by response teams to effectively prioritize remediation efforts (e.g. domain takedowns), by first acting on those attacks that are more likely to collect high response rates from potential victims., Comment: To appear in USENIX Security 2019

We report on a study on a representative set of Fe$_{2}$P-based MnFePSi samples by means of $^{55}$Mn NMR in both zero and applied magnetic field. The first-order nature of the magnetic transition is demonstrated by truncated order parameter curves with a large value of the local ordered moment at the Curie point, even at compositions where the transition appears second order from magnetic measurements. No weak ferromagnetic order could be detected at Si-poor compositions showing the kinetic arrest phenomenon, but rather the phase separation of fully ferromagnetic domains from volume fractions where Mn spins are fluctuating. The more pronounced decrease of the ordered moment at the $3f$ sites on approaching $T_C$, characteristic of the mixed magnetism of these materials, is demonstrated to be driven by a vanishing spin density rather than enhanced spin fluctuations at the $3f$ site. An upper limit of 0.03~$\mu_B$ is set for the fluctuating Mn moment at the $3f$ site by the direct detection of a $^{55}$Mn NMR resonance peak in the Mn-rich samples above $T_C$, showing nearly temperature-independent frequency shifts. A sharper secondary peak observed at the same compositions reveals however the disproportionation of a significant $3f$-Mn fraction with negligible hyperfine couplings, which retains its diamagnetic character across the transition, down to the lowest available temperatures. Such a diamagnetic fraction qualitatively accounts for the reduced average $3f$ moment previously reported at large Mn concentrations., Comment: 12 pages, 13 figures. Submitted to Phys. Rev. B