Indiana University-Purdue University Indianapolis (IUPUI) / Temporal point processes (TPP) are mathematical approaches for modeling asynchronous event sequences by considering the temporal dependency of each event on past events and its instantaneous rate. Temporal point processes can model various problems, from earthquake aftershocks, trade orders, gang violence, and reported crime patterns, to network analysis, infectious disease transmissions, and virus spread forecasting. In each of these cases, the entity’s behavior with the corresponding information is noted over time as an asynchronous event sequence, and the analysis is done using temporal point processes, which provides a means to define the generative mechanism of the sequence of events and ultimately predict events and investigate causality. Among point processes, Hawkes process as a stochastic point process is able to model a wide range of contagious and self-exciting patterns. One of Hawkes process’s well-known applications is predicting the evolution of viral processes on networks, which is an important problem in biology, the social sciences, and the study of the Internet. In existing works, mean-field analysis based upon degree distribution is used to predict viral spreading across networks of different types. However, it has been shown that degree distribution alone fails to predict the behavior of viruses on some real-world networks. Recent attempts have been made to use assortativity to address this shortcoming. This thesis illustrates how the evolution of such a viral process is sensitive to the underlying network’s structure. In Chapter 3 , we show that adding assortativity does not fully explain the variance in the spread of viruses for a number of real-world networks. We propose using the graphlet frequency distribution combined with assortativity to explain variations in the evolution of viral processes across networks with identical degree distribution. Using a data-driven approach, by coupling predictive modeling with viral process simulation on real-world networks, we show that simple regression models based on graphlet frequency distribution can explain over 95% of the variance in virality on networks with the same degree distribution but different network topologies. Our results highlight the importance of graphlets and identify a small collection of graphlets that may have the most significant influence over the viral processes on a network. Due to the flexibility and expressiveness of deep learning techniques, several neural network-based approaches have recently shown promise for modeling point process intensities. However, there is a lack of research on the possible adversarial attacks and the robustness of such models regarding adversarial attacks and natural shocks to systems. Furthermore, while neural point processes may outperform simpler parametric models on in-sample tests, how these models perform when encountering adversarial examples or sharp non-stationary trends remains unknown. In Chapter 4 , we propose several white-box and black-box adversarial attacks against deep temporal point processes. Additionally, we investigate the transferability of whitebox adversarial attacks against point processes modeled by deep neural networks, which are considered a more elevated risk. Extensive experiments confirm that neural point processes are vulnerable to adversarial attacks. Such a vulnerability is illustrated both in terms of predictive metrics and the effect of attacks on the underlying point process’s parameters. Expressly, adversarial attacks successfully transform the temporal Hawkes process regime from sub-critical to into a super-critical and manipulate the modeled parameters that is considered a risk against parametric modeling approaches. Additionally, we evaluate the vulnerability and performance of these models in the presence of non-stationary abrupt changes, using the crimes and Covid-19 pandemic dataset as an example. Considering the security vulnerability of deep-learning models, including deep temporal point processes, to adversarial attacks, it is essential to ensure the robustness of the deployed algorithms that is despite the success of deep learning techniques in modeling temporal point processes. In Chapter 5 , we study the robustness of deep temporal point processes against several proposed adversarial attacks from the adversarial defense viewpoint. Specifically, we investigate the effectiveness of adversarial training using universal adversarial samples in improving the robustness of the deep point processes. Additionally, we propose a general point process domain-adopted (GPDA) regularization, which is strictly applicable to temporal point processes, to reduce the effect of adversarial attacks and acquire an empirically robust model. In this approach, unlike other computationally expensive approaches, there is no need for additional back-propagation in the training step, and no further network isrequired. Ultimately, we propose an adversarial detection framework that has been trained in the Generative Adversarial Network (GAN) manner and solely on clean training data. Finally, in Chapter 6 , we discuss implications of the research and future research directions.

No description available.

High speed data from Wide Area Measurement Systems (WAMS) with Phasor Measurement Units (PMU) enables real and non-real time monitoring and control of power systems. The information and communication infrastructure used in WAMS efficiently transports information but introduces cyber security vulnerabilities. Adversaries may exploit such vulnerabilities to create cyber-attacks against the electric power grid. Control centers need to be updated to be resilient not only to well-known power system contingencies but also to cyber-attacks. Therefore, a combined event and intrusion detection systems (EIDS) is required that can provide precise classification for optimal response. This dissertation describes a WAMS cyber-physical power system test bed that was developed to generate datasets and perform cyber-physical power system research related to cyber-physical system vulnerabilities, cyber-attack impact studies, and machine learning algorithms for EIDS. The test bed integrates WAMS components with a Real Time Digital Simulator (RTDS) with hardware in the loop (HIL) and includes various sized power systems with a wide variety of implemented power system and cyber-attack scenarios. This work developed a novel data processing and compression method to address the WAMS big data problem. The State Tracking and Extraction Method (STEM) tracks system states from measurements and creates a compressed sequence of states for each observed scenario. Experiments showed STEM reduces data size significantly without losing key event information in the dataset that is useful to train EIDS and classify events. Two EIDS are proposed and evaluated in this dissertation. Non-Nested Generalized Exemplars (NNGE) is a rule based classifier that creates rules in the form of hyperrectangles to classify events. NNGE uses rule generalization to create a model that has high accuracy and fast classification time. Hoeffding adaptive trees (HAT) is a decision tree classifier and uses incremental learning which is suitable for data stream mining. HAT creates decision trees on the fly from limited number of instances, uses low memory, has fast evaluation time, and adapts to concept changes. The experiments showed NNGE and HAT with STEM make effective EIDS that have high classification accuracy, low false positives, low memory usage, and fast classification times.

No description available.

No description available.

Advanced Encryption Standard (AES) is a widely accepted encryption algorithm used in Internet-of-Things (IoT) devices such as Bluetooth devices. Although the implementation of AES is complicated enough, attackers can still acquire the cryptographic information generated from the AES execution to perform Side-Channel Attack (SCA). There are two commonly used types of SCA, which are power based attack and Electromagnetic (EM) based attack. However, the acquisition of both power traces and EM near-field traces require close physical contact to the victim devices, which is difficult to attack a well-protected system. In this thesis, we exploit the far-field EM propagation property and train several Deep Learning (DL) models to attack tinyAES algorithm implemented on the victim Bluetooth chip nRF52832 mounted on Nordic nRF52 DK at the distance up to 50cm. To simulate the real attacking scenario, we train our DL models on one nRF52 DK at 30cm and attack another same board at the distance 5cm, 15cm, 30cm and 50cm respectively in an office environment. We restrict the number of attacking traces to 7000. The key byte of all of cases can be recovered successfully by Convolution Neuron Network (CNN) and the best test only need 1848 traces. Our contributions are: (1).We prove it is feasible to attack Bluetooth chip running AES at variation distance by DL; (2).We compare our DL model performance with the classical correlation analysis and find correlation analysis takes far more traces than DL; (3).We propose several countermeasures to protect against the far-field EM SCA. / Advanced Encryption Standard (AES) är en allmänt accepterad krypteringsalgoritm som används i Internet-of-Things (IoT) -enheter som Bluetooth-enheter. Även om implementeringen av AES är tillräckligt komplicerad kan angriparna fortfarande förvärva den kryptografiska informationen som genererats från AES-utförandet för att utföra Side-Channel Attack (SCA). Det finns två vanligt förekommande typer av SCA, som är kraftbaserad attack och elektro-magnetisk (EM) baserad attack. Emellertid kräver förvärv av både strömspår och EM-fältspår nära fysisk kontakt med offeranordningarna, vilket är omöjligt att attackera ett välskyddat system. I den här avhandlingen utnyttjar vi EM-förökningsegenskapen för fjärrfältet och utbildar flera Deep Learning (DL) -modeller för att attackera litenAES- algoritm implementerad på offret Bluetooth-chip nRF52832 monterat på Nordic nRF52 DK på avståndet upp till 50 cm. För att simulera det verkliga angreppsscenariot utbildar vi våra DL-modeller på en nRF52 DK vid 30 cm och attackerar en annan samma skiva på avståndet 5 cm, 15 cm, 30 cm respektive 50 cm i en kontorsmiljö. Vi begränsar antalet attackerande spår till 7000. Nyckelbyte i alla fall kan framgångsrikt återvinnas av Convolution Neuron Network (CNN) och det bästa testet behöver endast 1848 spår. Våra bidrag är: (1). Vi bevisar att det är möjligt att attackera Bluetooth-chip som kör AES på variation avstånd av DL; (2). Vi jämför våra DL-modellprestanda med den klassiska korrelationsanalysen och finner korrelationsanalys tar mycket fler spår än DL;(3). Vi tillhandahåller flera motåtgärder mot EM-SCA.

No description available.

Ethereum is one of the top blockchain platforms that represents this second generation of blockchain technology. However, the security vulnerabilities associated with smart contracts pose significant risks to confidentiality, integrity, and availability of applications supported by Ethereum. While several studies have enumerated various security issues in smart contracts, only a handful have identified the factors that determine the severity and potential of these issues to pose significant risks in practice. As its first contribution, this thesis presents a framework that identifies such factors and highlights the most critical security threats and vulnerabilities of Ethereum smart contracts. To achieve this, we conduct a comprehensive literature review to identify and categorize the vulnerabilities, assess their potential impact, and evaluate the likelihood of exploitation in real-life contracts. We classify the identified vulnerabilities based on their nature and severity and proposed mitigation recommendations. Our theoretical contribution is to establish a correlation between the security vulnerabilities of smart contracts and their potential impact on the security of smart contracts by identifying factors that pose a (practical) threat. Our practical contribution involves developing a tool based on staticanalysis that can automatically detect at least one critical securityissue with the highest threat factor. For the target vulnerability, wechoose the usage of input from external users without any validation.This vulnerability, as we call it, Missing Input Validation (MIV), actsas a root cause for further (well-known and well-researched) issues,for instance, the flow of tainted values into sensitive operations suchas the transfer of cryptocurrencies and self destruct instruction. Weimplement the tool MIV Checker and evaluate its efficacy on a test setof 36 smart contracts. Our evaluation results show that MIV Checkercorrectly detects 87.6 % of instances of MIV in the dataset.

Control-flow hijack attacks on software exploit vulnerabilities in the software’s memory handling. Over the years, various security mitigations have been developed to counter these attacks. However, compatibility issues have hindered the adoption of such measures in some legacy systems. This thesis focuses on the case of the legacy DOS system and examines whether a DOS system running the DOS/4GW protected mode extender can provide control-flow protection against an attack exploiting a buffer overflow vulnerability in the well-known retro game Duke Nukem3D. To investigate this, three model programs were created, and designed with memory models that share memory layout characteristics with the target retro game’s executable. Experimental attacks were then conducted on these models, aiming to identify an effective attack vector for the target vulnerability. The underlying theory suggests that memory models that segregate application data into distinct memory segments could potentially safeguard against the demonstrated attack. However, attempts to implement such a memory model within an application proved unsuccessful. The challenge that remains is to prove the existence of memory models under DOSprotected mode that can effectively shield Duke Nukem 3D, or other legacy games, from the control-flow hijack attack demonstrated in this thesis.

No description available.