Microarchitecture’s optimizations have increased the performance but lowered the security. Speculative execution is one of the optimizations that was thought to be secure, but it is exploitable to leak information. The problem with these exploits is that there is no easy software defence and many exploits could be unexplored due to it being a fairly recent discovery. This thesis explores a way to find code that is vulnerable to this. The solution to the problem is to use the tool Side Channel Abstract Model Validator (SCAMV) which implements the method Model-Based Testing (MBT). We examine the core CVA6, which is a RISCV Central Processing Unit (CPU). Test cases are generated by program generators and interesting ones are selected by applying an observational model to them. The observational model abstracts side-channel leakage of the microarchitecture. The selected test cases are executed on the platform to validate the used observational models. The results of the test cases showed no indication of modifying the side channels under speculative execution. The results showed that SCAMV can examine timing-based channels. The conclusion is that our findings indicate that the CVA6 core is not vulnerable to speculative cache or timing-based side-channel attacks. / Optimeringar på mikroarkitektur nivåer har ökat prestandan men minskat säkerheten. Spekulativt utförande (speculative execution) är en av de optimeringar som har ansetts vara säkert, men det har visats att det kan utnyttjas för att läcka information. Problemet med dessa sårbarheter är att det inte finns något enkelt mjukvaruförsvar och att många sårbarheter fortfarande kan vara outforskade. Denna avhandling undersöker ett sätt att försöka hitta kod som är sårbar för detta. Lösningen på problemet är att använda verktyget SCAMV som använder sig av metoden Model-Baserad Testning. Vi undersöker CVA6, vilket är en RISCV CPU. Testfall genereras av programgeneratorer och intressanta testfall väljs genom att tillämpa en observationsmodell på dem. Observationsmodellen abstraherar sidokanalläckage i mikroarkitekturen. De valda testprogrammen verkställs på plattformen för att validera de använda observationsmodellerna. Resultatet från testfallen visade ingen indikation på att det går att modifiera sidokanalerna under spekulativt utförande. Resultatet visade att SCAMV kan undersöka tidsbaserade kanaler. Slutsatsen är att våra resultat indikerar att CVA6 inte är sårbar för spekulativa cache eller tidsbaserade sidokanalattacker.

Man-made materials such as fiber-reinforced composites (FRCs) can be tailored for optimum performance in product design applications in terms of strength and weight. The current work is aimed at studying the behaviors of composite laminates based on E-glass CSM (Chopped Strand Mat) or WRM (Woven Roving Mat) plies with a polyester resin for impact protection applications. Detailed mechanical characterization of CSM and WRM laminates till failure is carried out for tensile, compressive and shear loads by varying manufacturing process, number of plies, and laminate thickness. The effect of fiber volume fraction on mechanical properties is shown. The efficacy of CSM and WRM laminates as energy- absorbing countermeasures is studied by performing quasi-static and axial impact tests on cylindrical tubes made of the stated FRCs. In addition to load-displacement and specific energy absorption attributes, failure modes are of interest in such studies. The potential of FRC laminates for protection against projectile impact is investigated by performing low velocity impact perforation tests with a falling tup fitted with an indentor, and medium to high velocity projectile impact tests in a gas gun-based device. The valuable results generated are used for the validation of nonlinear finite element-based CAE (Computer-Aided Engineering) procedures including application of a multi-modal failure criterion for explicit dynamic analysis. The present study not only throws light on complex mechanical behavior of an important class of lightweight materials under static and dynamic loads, but also simulation tools for the design of impact safety countermeasures such as bullet-proof laminates and energy–absorbing components for automotive body structures.

Esta tese busca analisar os limites e possibilidades do regime da responsabilidade internacional do Estado como garantia da Ordem Pública Internacional, procurando demonstrar os riscos da implementação unilateral da responsabilidade. Inicialmente, através da análise do desenvolvimento normativo do instituto da responsabilidade internacional do Estado, a partir do pós-Segunda Guerra Mundial, buscamos apontar os principais indicadores do momento de transição paradigmática do sistema internacional contemporâneo, ao revelarem-se tanto as bases de identidade desse sistema quanto os traços de transformação que o atravessam. Partimos da hipótese de que as mudanças normativas operadas no instituto da responsabilidade internacional, no período em estudo, têm sido orientadas, em sua maioria, no mesmo sentido das transformações valorativas verificadas no âmbito do Direito Internacional Público como um todo. O que, já adiantamos, significa dizer, em apertada síntese, mudanças no sentido de um direito interestatal ? relacional e bilateral ? para um direito da comunidade internacional no seu conjunto. Tendo, então, em mente a realidade de descentralização em que se concretizam as normas internacionais, nossa segunda hipótese é de que esses avanços normativos não têm par no plano institucional e que essa lacuna gera à comunidade internacional os riscos da implementação unilateral da responsabilidade. Especificamente, analisamos o conceito, os valores, a legitimidade e as consequências substanciais e instrumentais do instituto da responsabilidade internacional do Estado como garantia da ordem pública internacional, focando a projeção da noção de comunidade internacional no seu regime, e os obstáculos normativos e sistêmicos que a sua proteção enfrenta em um sistema internacional descentralizado.

Nurses are largely unaware of the problems of night-shift-nurse sleepiness and available strategies to manage night-shift sleepiness. The purpose of this project was to examine nurses' self-perception, awareness of sleepiness, and current strategies to manage this problem in the emergency medicine department of a major academic hospital in the western United States. The validated de-identified Karolinska Sleepiness Scale (KSS) was used to measure the prevalence and intensity of night shift nurses' sleepiness prior to the development of an educational program on strategies to manage sleepiness. Of the 164 registered nurses surveyed, 72 (43.9%) reported sleepiness greater than 7 on the KSS. An educational program was developed and evaluated by a panel of 6 experts who were selected on their clinical, educational, quality improvement, and research in sleep studies. Expert reviews indicated that the education program was 100% relevant, appropriate, and understandable, and provided adequate information on the topic with no recommended changes. The education program was presented to 16 night shift nurses with a pre/posttest survey completed by 14 nurses. Results indicated that participating nurses increased their knowledge of managing strategies for sleepiness from 69% (agree or strongly agree) preintervention to 92% postintervention. Postintervention, there was a 50% increase in the number of nurses who reported benefits from the education intervention. The findings of this project contribute to positive social change by improving nurses' health and quality patient care by advancing nurses' awareness of night shift sleepiness and countermeasure management strategies.

Current Security Information and Event Management systems (SIEMs) constitute the central platform of modern security operating centers. They gather events from various sensors (intrusion detection systems, anti-virus, firewalls, etc.), correlate these events, and deliver synthetic views for threat handling and security reporting. Research in SIEM technologies has traditionally focused on providing a comprehensive interpretation of threats, in particular to evaluate their importance and prioritize responses accordingly. However, in many cases, threat responses still require humans to carry out the analysis and decision tasks e.g., understanding the threats, defining the appropriate countermeasures and deploying them. This is a slow and costly process, requiring a high level of expertise, and remaining error-prone nonetheless. Thus, recent research in SIEM technology has focused on the ability to automate the process of selecting and deploying countermeasures. Several authors have proposed automatic response mechanisms, such as the adaptation of security policies, to overcome the limitations of static or manual response. Although these approaches improve the reaction process (making it faster and/or more efficient), they remain limited since these solutions do not analyze the impact of the countermeasures selected to mitigate the attacks. In this thesis, we propose a novel and systematic process to select the optimal countermeasure from a pool of candidates, by ranking them based on a trade-off between their efficiency in stopping the attack and their ability to preserve, at the same time, the best service to normal users. In addition, we propose a model to represent graphically attacks and countermeasures, so as to determine the volume of each element in a scenario of multiple attacks. The coordinates of each element are derived from a URI. This latter is mainly composed of three axes: user, channel, and resource. We use the CARVER methodology to give an appropriate weight to each element composing the axes in our coordinate system. This approach allows us to connect the volumes with the risks (i.e. big volumes are equivalent to high risk, whereas small volumes are equivalent to low risk). Two concepts are considered while comparing two or more risk volumes: Residual risk, which results when the risk volume is higher than the countermeasure volume; and Collateral damage, which results when the countermeasure volume is higher than the risk volume. As a result, we are able to evaluate countermeasures for single and multiple attack scenarios, making it possible to select the countermeasure or group of countermeasures that provides the highest benefit to the organization

自由貿易有利有弊，一方面為國內經濟的出口優勢產業開拓新市場，另一方面伴隨著撤除各種貿易壁壘措施，將會使國內弱勢、內需產業遭到衝擊，無法避免國外進口不斷增加帶來的傷害。因此在自由貿易過程中，政府如何制訂對進口競爭引起衝擊的相關救濟問題與貿易調整協助措施，或是補償措施逐漸受到重視，例如美國自1962年開始採取的貿易援助法案(Trade Adjustment Assistance, TAA)，後改為貿易調整協助方案，旨在透過協助方式協助貿易自由化下容易受到衝擊的產業與勞工，而韓國也因簽訂美韓 FTA 而制定相似的救濟政策。 本文以韓美FTA作為個案討論，研究發現以韓國角度來看，韓美FTA簽訂快速的原因包含政府及人民的大多數支持、韓國政府對受衝擊產業制定各項因應措施等因素。而這些因應措施無論是在談判階段或是協議簽訂後，都不斷在修正與制定，以達到符合協助受衝擊產業之目的。 / Free trade is accompanied by advantages and disadvantages, it could expand new markets for the export advantageous industries; on the other hand, it could affect the disadvantageous minority industries while removing trade barriers.　Thus, it is important how the government sets up the countermeasures or the indemnify measures to ease the harm that foreign import products bring. For instance, the United States have adopted Trade Adjustment Assistance (TAA) since 1962, it is meant to assist industries and workers that are affected by free trade. South Korea has established similar countermeasures since KORUS FTA was concluded. This study is a case study of KORUS FTA . It shows that from South Korea’s perspective, it has support among government and people, Korean government has established countermeasures for the affected industries, and all these factors made KOURS FTA took less time to sign than South Korea’s most FTAs. These countermeasures were being amended during the negotiation process and after the FTA was concluded, in order to achieve the goal of assisting affected industries.

Esta tese busca analisar os limites e possibilidades do regime da responsabilidade internacional do Estado como garantia da Ordem Pública Internacional, procurando demonstrar os riscos da implementação unilateral da responsabilidade. Inicialmente, através da análise do desenvolvimento normativo do instituto da responsabilidade internacional do Estado, a partir do pós-Segunda Guerra Mundial, buscamos apontar os principais indicadores do momento de transição paradigmática do sistema internacional contemporâneo, ao revelarem-se tanto as bases de identidade desse sistema quanto os traços de transformação que o atravessam. Partimos da hipótese de que as mudanças normativas operadas no instituto da responsabilidade internacional, no período em estudo, têm sido orientadas, em sua maioria, no mesmo sentido das transformações valorativas verificadas no âmbito do Direito Internacional Público como um todo. O que, já adiantamos, significa dizer, em apertada síntese, mudanças no sentido de um direito interestatal ? relacional e bilateral ? para um direito da comunidade internacional no seu conjunto. Tendo, então, em mente a realidade de descentralização em que se concretizam as normas internacionais, nossa segunda hipótese é de que esses avanços normativos não têm par no plano institucional e que essa lacuna gera à comunidade internacional os riscos da implementação unilateral da responsabilidade. Especificamente, analisamos o conceito, os valores, a legitimidade e as consequências substanciais e instrumentais do instituto da responsabilidade internacional do Estado como garantia da ordem pública internacional, focando a projeção da noção de comunidade internacional no seu regime, e os obstáculos normativos e sistêmicos que a sua proteção enfrenta em um sistema internacional descentralizado.

L'accroissement et la diversification des services offerts par les systèmes informatiques modernes rendent la tâche de sécuriser ces systèmes encore plus complexe. D'une part, l'évolution du nombre de services système accroît le nombre des vulnérabilités qui peuvent être exploitées par des attaquants afin d'atteindre certains objectifs d'intrusion. D'autre part, un système de sécurité moderne doit assurer un certain niveau de performance et de qualité de service tout en maintenant l'état de sécurité. Ainsi, les systèmes de sécurité modernes doivent tenir compte des exigences de l'utilisateur au cours du processus de sécurité. En outre, la réaction dans des contextes critiques contre une attaque après son exécution ne peut pas toujours remédier à ses effets néfastes. Dans certains cas, il est essentiel que le système de sécurité soit en avance de phase par rapport à l'attaquant et de prendre les mesures nécessaires pour l'empêcher d'atteindre son objectif d'intrusion. Nous soutenons dans cette thèse que le processus de sécurité doit suivre un raisonnement intelligent qui permet au système de prévoir les attaques qui peuvent se produire par corrélation à une alerte détectée et d'appliquer les meilleures contre-mesures possibles. Nous proposons une approche qui génère des scénarios potentiels d'attaque qui correspondent à une alerte détectée. Ensuite, nous nous concentrons sur le processus de génération d'un ensemble approprié de contre-mesures contre les scénarios d'attaque générés. Un ensemble généré des contre-mesures est considéré comme approprié dans l'approche proposée s'il présente un ensemble cohérent et il satisfait les exigences de l'administrateur de sécurité (par exemple, la disponibilité). Nous soutenons dans cette thèse que le processus de réaction peut être considéré comme un débat entre deux agents. D'un côté, l'attaquant choisit ses arguments comme étant un ensemble d'actions pour essayer d'atteindre un objectif d'intrusion, et de l'autre côté l'agent défendant la cible choisit ses arguments comme étant un ensemble de contre-mesures pour bloquer la progression de l'attaquant ou atténuer les effets de l'attaque. D'autre part, nous proposons une approche basée sur une méthode d'aide à la décision multicritère. Cette approche assiste l'administrateur de sécurité lors de la sélection des contre-mesures parmi l'ensemble approprié des contre-mesures générées à partir de la première approche. Le processus d'assistance est basé sur l'historique des décisions de l'administrateur de sécurité. Cette approche permet également de sélectionner automatiquement des contre-mesures appropriées lorsque l'administrateur de sécurité est dans l'incapacité de les sélectionner (par exemple, en dehors des heures de travail, par manque de connaissances sur l'attaque). Enfin, notre approche est implémentée et testée dans le cadre des systèmes automobiles / The growth and diversity of services offered by modern systems make the task of securing these systems a complex exercise. On the one hand, the evolution of the number of system services increases the risk of causing vulnerabilities. These vulnerabilities can be exploited by malicious users to reach some intrusion objectives. On the other hand, the most recent competitive systems are those that ensure a certain level of performance and quality of service while maintaining the safety state. Thus, modern security systems must consider the user requirements during the security process.In addition, reacting in critical contexts against an attack after its execution can not always mitigate the adverse effects of the attack. In these cases, security systems should be in a phase ahead of the attacker in order to take necessary measures to prevent him/her from reaching his/her intrusion objective. To address those problems, we argue in this thesis that the reaction process must follow a smart reasoning. This reasoning allows the system, according to a detected attack, to preview the related attacks that may occur and to apply the best possible countermeasures. On the one hand, we propose an approach that generates potential attack scenarios given a detected alert. Then, we focus on the generation process of an appropriate set of countermeasures against attack scenarios generated among all system responses defined for the system. A generated set of countermeasures is considered as appropriate in the proposed approach if it presents a coherent set (i.e., it does not contain conflictual countermeasures) and it satisfies security administrator requirements (e.g., performance, availability). We argue in this thesis that the reaction process can be seen as two agents arguing against each other. On one side the attacker chooses his arguments as a set of actions to try to reach an intrusion objective, and on the other side the agent defending the target chooses his arguments as a set of countermeasures to block the attacker's progress or mitigate the attack effects. On the other hand, we propose an approach based on a recommender system using Multi-Criteria Decision Making (MCDM) method. This approach assists security administrators while selecting countermeasures among the appropriate set of countermeasures generated from the first approach. The assistance process is based on the security administrator decisions historic. This approach permits also, to automatically select appropriate system responses in critical cases where the security administrator is unable to select them (e.g., outside working hours, lack of knowledge about the ongoing attack). Finally, our approaches are implemented and tested in the automotive system use case to ensure that our approaches implementation successfully responded to real-time constraints.

Dans cette thèse nous développons et améliorons des attaques de systèmes cryptographiques. Un nouvel algorithme de décomposition de signal appelé transformation de Hilbert-Huang a été adapté pour améliorer l’efficacité des attaques parcanaux auxiliaires. Cette technique permet de contrecarrer certaines contre-mesures telles que la permutation d’opérations ou l’ajout de bruit à la consommation de courant. La seconde contribution de ce travail est l’application de certaines distributions statistiques de poids de Hamming à l’attaque d’algorithmes de chiffrement par bloc tels que AES, DES ou LED. Ces distributions sont distinctes pour chaque valeur de sous-clef permettent donc de les utiliser comme modèles intrinsèques. Les poids de Hamming peuvent être découverts par des analyses de canaux auxiliaires sans que les clairs ni les chiffrés ne soient accessibles. Cette thèse montre que certaines contremesures peuvent parfois faciliter des attaques. Les contre-mesures contagieuses proposées pour RSA protègent contre les attaques par faute mais ce faisant et moyennant des calculs additionnels facilitent la découverte de la clef. Finalement, des contre-mesures à faible complexité calculatoire sont proposées. Elles sont basées sur le masquage antagoniste, c’est-à-dire, l’exécution d’une opération d’équilibrage sur des données sensibles pour masquer la consommation de courant. / The goal of the thesis is to develop and improve methods for defeating protected cryptosystems. A new signal decompositionalgorithm, called Hilbert Huang Transform, was adapted to increase the efficiency of side-channel attacks. This technique attempts to overcome hiding countermeasures, such as operation shuffling or the adding of noise to the power consumption. The second contribution of this work is the application of specific Hamming weight distributions of block cipher algorithms, including AES, DES, and LED. These distributions are distinct for each subkey value, thus they serve as intrinsic templates. Hamming weight data can be revealed by side-channel and fault attacks without plaintext and ciphertext. Therefore these distributions can be applied against implementations where plaintext and ciphertext are inaccessible. This thesis shows that some countermeasures serve for attacks. Certain infective RSA countermeasures should protect against single fault injection. However, additional computations facilitate key discovery. Finally, several lightweight countermeasures are proposed. The proposed countermeasures are based on the antagonist masking, which is an operation occurring when targeting data processing, to intelligently mask the overall power consumption.

The master’s thesis focuses on GAP analysis of information security management system. The thesis consists of theoretical, analytical and practical part. The first part discusses the theoretical background of the issue of information and cyber security. The analytical part describes the current condition of the researched company. The thesis’s output is the draft of risk register and draft of security countermeasures implementation. The draft targets on countermeasures leading to increase information security in company.