Gartners presenterar External Attack Surface Management (EASM) som är en framväxande cybersäkerhetsdisciplin som identifierar och hanterar de risker som internetbaserade tillgångar och system utgör. Dock är ramverket vagt definierat och har gett författaren intrycket av att fungera som ett komplement till ett mer tekniskt ramverk för säkerhetsövervakning. Syftet med denna studie är att definiera Gartners EASM-ramverket och undersöka om elementen i ramverket har olika vikt av betydelse, samt ifall ramverket behövs omdefinieras för att göra den mer användbar mot IoT-teknologi, specifikt Smart Home. En litteraturstudie har genomförts för att definiera EASM-ramverket och en kvantitativ enkät har skickats elektroniskt och besvarats av åtta olika respondenter för att värdera betydelsen av de olika elementen inom ramverket och om de skulle kunna använda ramverket för Smart Home teknologier inom sina nuvarande organisationer. Respondenterna jobbar inom Smart Homes när denna studie genomfördes och är handplockade på grund av sin erfarenhet och kompetens inom branschen.Respondenterna angav att de olika elementen av EASM-ramverket är av olika vikt och att respondenterna har en osäkerhet om att de skulle använda den nuvarande tillämpningen av EASM-ramverket i sin organisation. Olika faktorer påverkade respondenternas beslut, inklusive deras erfarenhetsnivå, positioner och de företagsstorlekar de arbetar för. Även om de olika elementen i ramverket har olika vikt/betydelse, har elementen ett sekventiellt beroende vilket gör det svårt att ta bort eller byta ut ett element. Analysen tyder på att EASM-ramverket inte är tillräckligt för att vara en komplett försvarslösning inom Smart Homes, utan bör i stället användas tillsammans med Confidentiality, Integrity & Availablity (CIA-triaden) och Autentisering, Auktorisering och Redovisning (AAA-ramverket). Den fysiska aspekten av säkerhet inom Smart Homes behöver också inkluderas för att anpassa EASM-ramverket ytterligare mot Smart Homes.

Side-channel attacks avoid complex analysis of cryptographic algorithms, instead they use side-channel signals captured from a software or a hardware implementation of the algorithm to recover its secret key. Recently, deep learning models, especially Convolutional Neural Networks (CNN), have been shown successful in assisting side-channel analysis. The attacker first trains a CNN model on a large set of power traces captured from a device with a known key. The trained model is then used to recover the unknown key from a few power traces captured from a victim device. However, previous work had three important limitations: (1) little attention is paid to the effects of training and testing on traces captured from different devices; (2) the effect of different power models on the attack’s efficiency has not been thoroughly evaluated; (3) it is believed that, in order to recover all bytes of a key, the CNN model must be trained as many times as the number of bytes in the key.This thesis aims to address these limitations. First, we show that it is easy to overestimate the attack’s efficiency if the CNN model is trained and tested on the same device. Second, we evaluate the effect of two common power models, identity and Hamming weight, on CNN-based side-channel attack’s efficiency. The results show that the identity power model is more effective under the same training conditions. Finally, we show that it is possible to recover all key bytes using the CNN model trained only once. / Sidokanalattacker undviker komplex analys av kryptografiska algoritmer, utan använder sig av sidokanalssignaler som tagits från en mjukvara eller en hårdvaruimplementering av algoritmen för att återställa sin hemliga nyckel. Nyligen har djupa inlärningsmodeller, särskilt konvolutionella neurala nätverk (CNN), visats framgångsrika för att bistå sidokanalanalys. Anfallaren tränar först en CNN-modell på en stor uppsättning strömspår som tagits från en enhet med en känd nyckel. Den utbildade modellen används sedan för att återställa den okända nyckeln från några kraftspår som fångats från en offeranordning. Tidigare arbete hade dock tre viktiga begränsningar: (1) Liten uppmärksamhet ägnas åt effekterna av träning och testning på spår som fångats från olika enheter; (2) Effekten av olika kraftmodeller på attackerens effektivitet har inte utvärderats noggrant. (3) man tror att CNN-modellen måste utbildas så många gånger som antalet byte i nyckeln för att återställa alla bitgrupper av en nyckel.Denna avhandling syftar till att hantera dessa begränsningar. Först visar vi att det är lätt att överskatta attackens effektivitet om CNN-modellen är utbildad och testad på samma enhet. För det andra utvärderar vi effekten av två gemensamma kraftmodeller, identitet och Hamming-vikt, på CNN-baserad sidokanalangrepps effektivitet. Resultaten visar att identitetsmaktmodellen är effektivare under samma träningsförhållanden. Slutligen visar vi att det är möjligt att återställa alla nyckelbyte med hjälp av CNN-modellen som utbildats en gång.

Nyligen har stora framsteg gjorts i att tillämpa djupinlärning på sidokanalat- tacker. Detta medför ett hot mot säkerheten för implementationer av kryp- tografiska algoritmer. Konceptuellt är tanken att övervaka ett chip medan det kör kryptering för informationsläckage av ett visst slag, t.ex. Energiförbrukning. Man använder då kunskap om den underliggande krypteringsalgoritmen för att träna en modell för att känna igen nyckeln som används för kryptering. Modellen appliceras sedan på mätningar som samlats in från ett chip under attack för att återskapa krypteringsnyckeln. Vi försökte förbättra modeller från ett tidigare arbete som kan finna en byte av en 16-bytes krypteringsnyckel för Advanced Advanced Standard (AES)-128 från över 250 mätningar. Vår modell kan finna en byte av nyckeln från en enda mätning. Vi har även tränat ytterligare modeller som kan finna inte bara en enda nyckelbyte, men hela nyckeln. Vi uppnådde detta genom att ställa in vissa parametrar för bättre modellprecision. Vi samlade vår egen tränings- data genom att fånga en stor mängd strömmätningar från ett Xmega 128D4 mikrokontrollerchip. Vi samlade också mätningar från ett annat chip - som vi inte tränade på - för att fungera som en opartisk referens för testning. När vi uppnådde förbättrad precision märkte vi också ett intressant fenomen: vissa labels var mycket enklare att identifiera än andra. Vi fann också en stor varians i modellprecision och undersökte dess orsak. / Recently, substantial progress has been made in applying deep learning to side channel attacks. This imposes a threat to the security of implementations of cryptographic algorithms. Conceptually, the idea is to monitor a chip while it’s running encryption for information leakage of a certain kind, e.g. power consumption. One then uses knowledge of the underlying encryption algorithm to train a model to recognize the key used for encryption. The model is then applied to traces gathered from a victim chip in order to recover the encryption key.We sought to improve upon models from previous work that can recover one byte of the 16-byte encryption key of Advanced Encryption Standard (AES)-128 from over 250 traces. Our model can recover one byte of the key from a single trace. We also trained additional models that can recover not only a single keybyte, but the entire key. We accomplished this by tuning certain parameters for better model accuracy. We gathered our own training data by capturing a large amount of power traces from an Xmega 128D4 microcontroller chip. We also gathered traces from a second chip - that we did not train on - to serve as an unbiased set for testing. Upon achieving improved accuracy we also noticed an interesting phenomenon: certain labels were much easier to identify than others. We also found large variance in model accuracy and investigated its cause.

No description available.

Smart grid architecture and Software-defined Networking (SDN) have evolved into a centrally controlled infrastructure that captures and extracts data in real-time through sensors, smart-meters, and virtual machines. These advances pose a risk and increase the vulnerabilities of these infrastructures to sophisticated cyberattacks like distributed denial of service (DDoS), false data injection attack (FDIA), and Data replay. Integrating machine learning with a network intrusion detection system (NIDS) can improve the system's accuracy and precision when detecting suspicious signatures and network anomalies. Analyzing data in real-time using trained and tested hyperparameters on a network traffic dataset applies to most network infrastructures. The NSL-KDD dataset implemented holds various classes, attack types, protocol suites like TCP, HTTP, and POP, which are critical to packet transmission on a smart grid network. In this paper, we leveraged existing machine learning (ML) algorithms, Support vector machine (SVM), K-nearest neighbor (KNN), Random Forest (RF), Naïve Bayes (NB), and Bagging; to perform a detailed performance comparison of selected classifiers. We propose a multi-level hybrid model of SVM integrated with RF for improved accuracy and precision during network filtering. The hybrid model SVM-RF returned an average accuracy of 94% in 10-fold cross-validation and 92.75%in an 80-20% split during class classification.

A Laser Inertial Fusion Energy (LIFE) target’s flight through a low Reynolds number and high Mach number regime was analyzed with computational fluid dynamics software. This regime consisted of xenon gas at 1,050 K and approximately 6,670 Pa. Simulations with similar flow conditions were performed over a sphere and compared with experimental data and published correlations for validation purposes. Transient considerations of the developing flow around the target were explored. Simulations of the target at different velocities were used to determine correlations for the drag coefficient and Nusselt number as functions of the Reynolds number. Simulations with different target angles of attack were used to determine the aerodynamic coefficients of drag, lift, Magnus moment, and overturning moment as well as target stability. The drag force, lift force, and overturning moment changed minimally with spin. Above an angle of attack of 15°, the overturning moment would be destabilizing. At angles of attack less than 15°, the overturning moment would tend to decrease the target’s angle of attack, indicating the lack of a need for spin for stability at these small angles. This stabilizing moment would cause the target to move in a mildly damped oscillation about the axis parallel to the free-stream velocity vector through the target’s center of gravity.

Secure Shell, a tool to securely access and run programs on a remote machine, is an important tool for both system administrators and developers alike. The technology landscape is becoming increasingly distributed and reliant on tools such as Secure Shell to protect information as a user works on a system remotely. While Secure Shell accounts for the abuses the security of older tools such as telnet overlook, it still has fundamental vulnerabilities which leak information about both the user and their activities through timing attacks. The OpenSSH client, the implementation included in all Linux, Mac, and Windows computers, sends each keystroke entered to the server as soon as it becomes available. As a result, an attacker can observe the network patterns to know when a user presses a key and draw conclusions based on that information such as what a user is typing or who they are. In this thesis, we demonstrate that such an attack allows a malicious observer to identify a user with a concerning level of accuracy without having direct access to either the client or server systems. Using machine learning classifiers, we identify individual users in a crowd based solely on the size and timing of packets traveling across the network. We find that our classifiers were able to identify users with 20\% accuracy using as little as one hour of network traffic. Two of them promise to scale well to the number of users.

This project explores how a Meta Attack Language based Domain Specific Language for web applications can be used to threat model web applications in order to evaluate and improve web application security. Organizations and individuals are targeted by cyberattacks every day where malicious actors could gain access to sensitive information. These malicious actors are also developing new and innovative ways to exploit the many different components of web applications. Web applications are becoming more and more complex and the increasingly complex architecture gives malicious actors more components to target with exploits. In order to develop a secure web application, developers have to know the ins and outs of web application components and web application security. The Meta Attack Language, a framework for developing domain specific languages, was recently developed and has been used to create languages for domains such as Amazon Web Services and smart cars but no language previously existed for web applications. This project presents a prototype web application language delimited to the first vulnerability in the top ten list provided by Open Worldwide Application Security Project (OWASP), which is broken access control, and tests it against the OWASP juice shop, which is an insecure web application developed by OWASP to test new tools. Based on the results it is concluded that the prototype can be used to model web application vulnerabilities but more work needs to be done in order for the language to work on any given web application and vulnerability. / Detta projekt utforskar hur ett Meta Attack Language baserat Domän Specifikt Språk för webbapplikationer kan användas för att hotmodellera samt undersöka och förbättra webbapplikationssäkerhet. Organisationer och individer utsätts dagligen för cyberattacker där en hackare kan få tillgång till känslig information. Dessa hackare utverklar nya och innovativa sätt att utnyttja dem många olika komponenterna som finns i webbapplikationer. Webbapplikationer blir mer och mer komplexa och denna ökande komplexa arkitekturen leder till att det finns mer mål för en hackare att utnyttja. För att utveckla en säker webbapplikation måste utvecklare veta allt som finns om webbapplikations komponenter och webbapplikations säkerhet. Meta Attack Language är ett ramverk för att utveckla nya språk för domäner som till exempel Amazon Web Services och smarta fordon men innan detta existerade inget språk för webbapplikationer. Detta projekt presenterar en webbapplikations språk prototyp som är avgränsad till den första sårbarheten i top tio listan av Open Worldwide Application Security Project (OWASP) vilket är broken access control, och testar den mot OWASP juice shop, vilket är en sårbar webapplikation som utveckalts av OWASP för att testa nya verktyg. Baserat på resultaten dras slutsatsen att prototypen kan användas för att modellera webbapplikations sårbarheter men att det behövs mer arbete för att språket ska fungera på vilken webbapplikation och sårbarhet som helst.

The objective of the present research is to investigate unsteady aerodynamic models with state equation representations that are valid up to the high angle of attack regime with the purpose of evaluating them as computationally affordable models that can be used in conjunction with the equations of motion to simulate wing rock. The unsteady aerodynamic models with state equation representations investigated are functional approaches to modeling aerodynamic phenomena, not directly derived from the physical principles of the problem. They are thought to have advantages with respect to the physical modeling methods mainly because of the lower computational cost involved in the calculations. The unsteady aerodynamic multi-axis models with state equation representations investigated in this report assume the decomposition of the airplane into lifting surfaces or panels that have their particular aerodynamic force coefficients modeled as dynamic state-space models. These coefficients are summed up to find the total aircraft force coefficients. The products of the panel force coefficients and their moment arms with reference to a given axis are summed up to find the global aircraft moment coefficients. Two proposed variations of the state space representation of the basic unsteady aerodynamic model are identified using experimental aerodynamic data available in the open literature for slender delta wings, and tested in order to investigate their ability to represent the wing rock phenomenon. The identifications for the second proposed formulation are found to match the experimental data well. The simulations revealed that even though it was constructed with scarce data, the model presented the expected qualitative behavior and that the concept is able to simulate wing rock. / Ph. D.

Critical Infrastructures (CIs) such as water treatment plants, power grids and telecommunication networks are critical to the daily activities and well-being of our society. Disruption of such CIs would have catastrophic consequences for public safety and the national economy. Hence, these infrastructures have become major targets in the upsurge of cyberattacks. Defending against such attacks often depends on an arsenal of cyber-defence tools, including Machine Learning (ML)-based Anomaly Detection Systems (ADSs). These detection systems use ML models to learn the profile of the normal behaviour of a CI and classify deviations that go well beyond the normality profile as anomalies. However, ML methods are vulnerable to both adversarial and non-adversarial input perturbations. Adversarial perturbations are imperceptible noises added to the input data by an attacker to evade the classification mechanism. Non-adversarial perturbations can be a normal behaviour evolution as a result of changes in usage patterns or other characteristics and noisy data from normally degrading devices, generating a high rate of false positives. We first study the problem of ML-based ADSs being vulnerable to non-adversarial perturbations, which causes a high rate of false alarms. To address this problem, we propose an ADS called DAICS, based on a wide and deep learning model that is both adaptive to evolving normality and robust to noisy data normally emerging from the system. DAICS adapts the pre-trained model to new normality with a small number of data samples and a few gradient updates based on feedback from the operator on false alarms. The DAICS was evaluated on two datasets collected from real-world Industrial Control System (ICS) testbeds. The results show that the adaptation process is fast and that DAICS has an improved robustness compared to state-of-the-art approaches. We further investigated the problem of false-positive alarms in the ADSs. To address this problem, an extension of DAICS, called the SiFA framework, is proposed. The SiFA collects a buffer of historical false alarms and suppresses every new alarm that is similar to these false alarms. The proposed framework is evaluated using a dataset collected from a real-world ICS testbed. The evaluation results show that the SiFA can decrease the false alarm rate of DAICS by more than 80%. We also investigate the problem of ML-based network ADSs that are vulnerable to adversarial perturbations. In the case of network ADSs, attackers may use their knowledge of anomaly detection logic to generate malicious traffic that remains undetected. One way to solve this issue is to adopt adversarial training in which the training set is augmented with adversarially perturbed samples. This thesis presents an adversarial training approach called GADoT that leverages a Generative Adversarial Network (GAN) to generate adversarial samples for training. GADoT is validated in the scenario of an ADS detecting Distributed Denial of Service (DDoS) attacks, which have been witnessing an increase in volume and complexity. For a practical evaluation, the DDoS network traffic was perturbed to generate two datasets while fully preserving the semantics of the attack. The results show that adversaries can exploit their domain expertise to craft adversarial attacks without requiring knowledge of the underlying detection model. We then demonstrate that adversarial training using GADoT renders ML models more robust to adversarial perturbations. However, the evaluation of adversarial robustness is often susceptible to errors, leading to robustness overestimation. We investigate the problem of robustness overestimation in network ADSs and propose an adversarial attack called UPAS to evaluate the robustness of such ADSs. The UPAS attack perturbs the inter-arrival time between packets by injecting a random time delay before packets from the attacker. The attack is validated by perturbing malicious network traffic in a multi-attack dataset and used to evaluate the robustness of two robust ADSs, which are based on a denoising autoencoder and an adversarially trained ML model. The results demonstrate that the robustness of both ADSs is overestimated and that a standardised evaluation of robustness is needed.