Yes / The advances in the Internet of Things (IoT) has substantially contributed to the automation of modern societies by making physical things around us more interconnected and remotely controllable over the internet. This technological progress has inevitably created an intelligent society where various mechatronic systems are becoming increasingly efficient, innovative, and convenient. Undoubtedly, the IoT paradigm will continue to impact human life by providing efficient control of the environment with minimum human intervention. However, despite the ubiquity of IoT devices in modern society, the dependability of IoT applications remains a crucial challenge. Accordingly, this paper systematically reviews the current status and challenges of IoT dependability frameworks. Based on the review, existing IoT dependability frameworks are mainly based on informal reliability models. These informal reliability models are unable to effectively evaluate the unified treatment safety faults and cyber-security threats of IoT systems. Additionally, the existing frameworks are also unable to deal with the conflicting interaction between co-located IoT devices and the dynamic features of self-adaptive, reconfigurable, and other autonomous IoT systems. To this end, this paper suggested the design of a novel model-based dependability framework for quantifying safety faults and cyber-security threats as well as interdependencies between safety and cyber-security in IoT ecosystems. Additionally, robust approaches dealing with conflicting interactions between co-located IoT systems and the dynamic behaviours of IoT systems in reconfigurable and other autonomous systems are required.

No description available.

Cryptocurrencies are one of the most prominent applications of blockchain systems. While cryptocurrencies promise many features and advantages, such as decentralization, anonymity, and ease of access, those very features can be abused. For instance, as documented in various recent works, cryptocurrencies have been frequently abused in many different forms of cybercrime. Despite the plethora of works on measuring and understanding the abuse of cryptocurrencies in the digital space, there has been no work on systemizing this knowledge by comprehensively understanding those contributions, contrasting them based on their merit, and understanding the gap in this research space. This thesis initiates the systematic review and understanding of the literature on cryptocurrencies and their utilization in cybercrime. Starting with a rich set of research efforts published exclusively at some of the most highly selective avenues in the cyber security research community, we built a taxonomy of cryptocurrencies, enumerating the most prominent ones based on their use. We then categorize the literature in this space based on the objectives of the tools built and the blockchain systems they target. We then extend our effort by categorizing the reviewed work on cybercrime based on the type of attacks (coordinated vs. individual fraud) and targeted entity (marketplace vs. exchange). Each of those elements in our taxonomy enumerates various aspects of abuse, including their use in underground forums, the trade of drugs, weapons, and stolen credentials, money laundering, malware distribution, ransomware, etc. Accompanying our review, we discuss the gaps in research that call for further investigation.

Background. With the increase in cyberattacks and cyber related threats, it is of great concern that the area still lacks the needed amount of practitioners. Open-source threat intelligence platforms are free platforms hosting related information to cyber threats. These platforms can act as a gateway for new practitioners and be of use during research on all levels. For this to be the case, they need to be up-to-date, active user base and show a correlation to commercial companies and platforms. Objectives. In the research, data will be gathered from a multitude of open-source threat intelligence platforms to determine if they have increased usage and correlation to other sources. Furthermore, the research will look at if there are overrepresentations for certain countries and if the platforms are affected by real world events. Methods. Platforms were gathered using articles and user curated lists, they were filtered based on if the data could be used and if they were free or partially free. The data was then, and processed to only include information from after 2017 and all be unique entries. It was then filtered through a tool to remove potential false positives. For IP addresses and domains, a WHOIS query was done for each entry to get additional information. Results. There was a noticeable increase in the amount of unique submission for the categories CVE and IP addresses, the other categories showed no clear increase or decrease. The United States was the most represented country when analyzing domains and IP addresses. The WannaCry ransomware had a notable effect on the platforms, with an increase in submission during the month of the attack and after, and samples of the malware making out 7.03\% of the yearly submissions. The Russian invasion of Ukraine did not show any effect on the platforms. Comparing the result to the annual Microsoft security reports, there was a clear correlation for some years and sources, while others showed none at all. This was the case for all the statistic applicable to, reported countries, noticeable trend increases and most prominent malware. Conclusions. While some results showed that there was an increase in cyberattacks and correlation to real world event, others did not. Open-Source threat intelligence platforms often provides the necessary data, but problems starts showing up when analyzing it. The data itself is extremely sensitive depending on what processing methods are used, which in turn can lead to varying results. / Bakgrund. Med den stora ökningen av cyberattecker och hot har det uppmärksammats att cybersäkerhets omårdet fortfarande saknar nog med utbildade individer. Open-source threat intelligence plattformar är gratis tjänster som innehåller information om cyberhot. Dessa platformar kan fungera som en inkörsport till cybersäkerhets området och ett stöd till alla nivåer av forskning samt utbildning. För att detta ska fungera, måste de vara uppdaterade, ha en aktiv användarbas och data ha liknande resultat som betaltjänster och stora företagsrapporter. Syfte. I arbetet kommer data samlas in från flertal open-source threat intelligence plattformar i syftet att avgöra om deras använding och bidrag har ökat. Vidare om informationen är liknande till det som rapporteras av företag. Utöver så kommer det undersökas om några länder är överrepresenterade bland datan och om verkliga händelser påverkade plattformarna. Metod. Möjliga plattformar samlades in genom artiklar och användarskapade listor. De filtrerades sedan baserat på om data kunde användas i arbetet och om det var gratis eller delvis gratis. Datan hämtades från plattformarna och filtrerades så enbart allt rapporterat efter 2017 och unika bidrag kvarstod. All data bearbetades genom ett verktyg för att få bort eventuella falskt positiva bidrag. Slutligen så gjordes WHOIS uppslag för IP adresser och domäner. Resultat. CVEs och IP-adresser visade en märkbar ökning av antalet unika bidrag. Resterande kategorier visade ingen direkt ökning eller minskning. Det mest överrepresenterade landet var USA för båda domäner och IP adresser. WannaCry viruset hade en märkbar påverkan på pattformarna, där månaden under attacken och efter hade ökningar av bidrag. Viruset utgjorde 7.03\% av de total årliga bidragen. Den ryska invasionen av Ukraina visade ingen direkt påverkan på plattformarna. När resultatet jämfördes med Microsots årliga säkerhetsrapporter fanns det en tydlig liknelse i resultat för vissa år och källor. Andra källor och år hade ingen liknande statistik. Den information från rapporten som kunde tillämpas var länder, märkbara ökningar i specifika kategorier och högst förekommande virus. Slutsatser. Vissa resultat visade att det fanns ökning av cyberattacker och att plattformarna hade en tydlig koppling till verkliga händelser, för andra resultat stämde det ej överrens. Open-source threat intelligence plattformar innehåller viktig och relevant data. Problem börjar dock uppstå när man ska analysera datan. Detta är eftersom datan är extremt känslig till hur den bearbetas den, som i tur kan leda till varierande resultat.

Enterprise data systems are continuously growing in complexity and size. The attack area of these systems has increased and introduced new vulnerabilities a potential adversary could exploit. Evaluating cyber security in enterprise IT infrastructure is difficult and expensive. Recently, a new threat modeling language was proposed for enterprise systems based on the MITRE Enterprise ATT&CK Matrix, namely enterpriseLang. This language is a domain- specific language built on the Meta Attack Language (MAL) framework. The purpose of enterpriseLang is to enable a simplified and cost- effective environment for enterprises to evaluate the security of their systems without disturbing the data flow of the actual system. However, how can we be sure that enterpriseLang is correct and effective enough to be used in practice? The language needs to be thoroughly validated to be used by companies for cyber security evaluation of enterprise systems. We have validated enterpriseLang by implementing it to model and simulate three real- world cyber attacks against, Equifax, National Health Service (NHS) and Garmin. The validation method was mainly based on the evaluation of two specific issues. Based on our results we concluded that we consider enterpriseLang to be correct and effective enough to be used in practice. On the contrary, we identified some aspects of the language that should be improved. / Företags datasystem växer kontinuerligt i komplexitet och storlek. Attackarean för dessa system har därmed ökat och infört nya sårbarheter som en potentiell angripare kan utnyttja. Att utvärdera cybersäkerhet i företags IT- infrastruktur är svårt och kostsamt. Nyligen föreslogs ett nytt språk för hotmodellering av företagssystem baserat på MITRE Enterprise ATT&CK matrix, nämligen enterpriseLang. Detta språk är ett domänspecifikt språk byggt på MAL- ramverket. Syftet med enterpriseLang är att möjliggöra ett förenklat och kostnadseffektivt modelleringsverktyg för företag att utvärdera säkerheten av sina system i, utan behovet av att störa dataflödet i det faktiska systemet. Hur kan vi dock vara säkra på att enterpriseLang är korrekt och tillräckligt effektivt för att användas i praktiken? Språket måste valideras grundligt för att kunna användas för evaluering av cybersäkerhet i företagssystem. Vi har validerat enterpriseLang genom att använda språket till att modellera och simulera tre verkliga cyberattacker mot Equifax, National Health Service och Garmin. Valideringsmetoden grundades i evalueringen av två huvudfrågor. Baserat på vårt resultat drog vi slutsatsen att vi anser enterpriseLang som korrekt och tillräckligt effektivt för att användas i praktiken. Däremot, identifierade vi några aspekter inom språket som bör förbättras.

No description available.

No description available.

Many organizations turn to the promise of artificial intelligence and machine learning (ML) as its use gains traction in many disciplines. However, developing high-performing ML models is often expensive. The design work can be complicated. Collecting large training datasets is often costly and can contain sensitive or proprietary information. For many reasons, machine learning models make for an appetizing target to an adversary interested in stealing data, model properties, or model behavior.  This work explores model extraction attacks and aims at designing an approximation-based monitor for tracking the progress of a potential adversary. When triggered, action can be taken to address the threat. The proposed monitor utilizes the interaction with a targeted model, continuously training a monitor model as a proxy for what the attacker could achieve, given the data gathered from the target.  The usefulness of the proposed monitoring approach is shown for two experimental attack scenarios. One explores the use of parametric and Bayesian models for a regression case, while the other explores commonly used neural network architectures for image classification.  The experiments expand current monitoring research to include ridge regression, Gaussian process regression, and a set of standard variants of convolutional neural networks: ResNet, VGG, and DenseNet. It also explores model and dataset similarity using metrics from statistical analysis, linear algebra, optimal transport, and a rank score. / Många organisationer vänder sig till löftet om artificiell intelligens och maskininlärning (ML) då dess användning vinner mark inom allt fler discipliner. Att utveckla högpresterande ML-modeller är dock ofta kostsamt. Designarbetet kan vara komplicerat. Att samla in stora träningsdataset är ofta dyrt och kan innehålla känslig eller proprietär information. Det finns många skäl till att maskininlärningsmodeller kan vara lockande mål för en motståndare som är ute efter att stjäla data, modellparametrar eller modellbeteende. Det här arbetet utforskar modellextraktionsattacker och syftar till att utforma en approximationsbaserad monitorering som följer framstegen för en potentiell motståndare. När en attack är konstaterad kan åtgärder vidtas för att hantera hotet. Den föreslagna monitorn utnyttjar interaktionen med målmodellen. Den tränar kontinuerligt en monitor-modell som en fungerar som en approximation för vad angriparen skulle kunna uppnå med de data som samlats in från målmodellen. Nyttan av den föreslagna övervakningsansatsen visas för två experimentella attackscenarier. Det ena utforskar användningen av parametriska och Bayesianska modeller för ett regressionsfall, medan det andra utforskar vanligt använda neurala nätverksarkitekturer för ett bildklassificeringsfall. Experimenten utvidgar aktuell forskning kring monitorer till att att inkludera Ridge regression, Gauassian process regression och en uppsättning standardvarianter av convolutional neural networks: ResNet, VGG och DenseNet. Experimenten utforskar även likhet mellan ML-modeller och dataset med hjälp av mått från statistisk analys, linjär algebra, optimal transport samt rangapproximation.

Inverter-based Distributed Energy Resources (DERs) have experienced a significant rise in popularity due to their distinct advantages, such as improved power quality, advanced functionalities, and rapid response capabilities. These attributes make them particularly well-suited for modern power systems, where the growing demand for efficiency, flexibility, and reliability is crucial. As a result, the integration of inverter-based DERs into distribution networks has been steadily increasing, as they play a critical role in enhancing system performance and meeting the evolving requirements of contemporary power infrastructures. However, the integration of inverter-based DERs presents several challenges that must be addressed for effective implementation. One significant challenge is the accurate modeling of DERs. Currently, these resources are generally represented as traditional PQ or PV buses at the system level. This approach, however, fails to capture their dynamic characteristics and capabilities, potentially leading to a failure in reflecting the actual behavior of DERs during system-level analysis. Therefore, it is essential to develop models that are able to accurately represent the functionality of inverter-based DERs to enhance the effectiveness of system analysis. Another major challenge involves the cybersecurity of DER communication networks. These networks rely on numerous sensors and actuators for real-time monitoring and control, which increases their vulnerability to cyber threats. Given the low inertia of inverters, such threats can result in severe consequences, including disconnections of DERs or even large-scale outages. Consequently, it is crucial to assess the cyber risks associated with DER cyber networks and implement robust security measures to ensure reliable operation and enhance the overall resilience of distribution systems. This dissertation presents a series of research works aimed at addressing the challenges discussed previously. The first work develops a hierarchical restoration framework that integrates grid-edge DERs, clarifying DER control functionality from the system level down to the device level. The second work proposes a risk assessment framework specifically designed for networks with high DER penetration. This framework assesses attack probability based on component vulnerability and criticality, and quantifies the potential impact according to DER control applications and the communication network’s propagation patterns. This work identifies the most vulnerable components and provides guidelines for future security enhancements. The third work creates a co-simulation platform for cyber-physical power systems, facilitating security analyses of these systems. Finally, the fourth work introduces a post-attack restoration model that manages system recovery while accounting for potential compromises within the cyber network. Simulation results demonstrate the effectiveness of these proposed approaches, indicating their functionality in strengthening the cyber-physical resilience of active distribution systems.

The thesis looks into the act No. 181/2014 Coll. Cyber Security Act (hereinafter referred to as "CSA") and its impact on obliged entities with focus on the regional authorities of the Czech Republic. The thesis starts with introduction into the issue of the CSA and cybersecurity from the point of view of the state, subsequently it refocuses on the level of regulated organizations. The main pillar and contribution of the thesis is the CSA analysis with the aim to identify impact of the CSA in the obliged entities. Based on this analysis author designed the questionnaire survey of the CSA impact on the regional authorities. The survey relates to information security management system, kinds of burden stemmed from the CSA implementation, willingness to use funding from the European Regional Development Fund (ERDF) to implement the CSA, a possibility to outsource the cybersecurity and also opinions of the county council staff about the CSA. The survey shows that in spite of a pressure on standardization stemming from legal framework, county councils differs significantly in regard to information security management systems. On the other hand, respondents agreed on positive impact of the CSA on improvement of information and the cyber security although the CSA brings significant financial and organizational load to the organization. The survey also shows that some regional authorities only start to implement cybersecurity currently. The cybersecurity evolves in the researched organization quite dynamically and it would be beneficial to repeat the impact analyses again, after first wave of the CSA implementation will be finished.