Syftet med den här studien är att bedöma säkerheten och motståndskraften hos ett Matter-protokoll som används av ett multinationellt företag. Protokollet används för att möjliggöra kommunikation mellan en gateway och en applikation för styrning av smarta produkter. Utvärderingen inleddes genom att ansluta en gateway till ett nätverk och installera operativsystemet Kali Linux på datorn. Därefter utfördes flera DoS-attacker med varierande intervall, antal paket och paketstorlekar. Dessutom genomfördes en Man in the Middle-attack för att bedöma säkerheten och försöka attackera protokollet för att uppnå säkrare resultat. Resultaten från de första DoS-attackerna visade att applikationen kopplades bort från företagets gateway efter att den attackerats med ett specifikt TCP-paket. Applikationen tappade kontakten med gateway när den utsattes för en viss mängd skickade paket. Vid de efterföljande DoS-attackerna visade resultaten att gatewayen tog tid innan den reagerade. Studiens slutsats indikerar således att Matter-protokollet uppvisar dröjsmålseffekt vid DoS-attacker där gatewayen inte omedelbart reagerar. Dessa observationer har betydelse för protokollets säkerhetsaspekter och kan leda till rekommendationer för att förbättra dess motståndskraft mot olika attacker. / The purpose of this study is to assess the security and resilience of a Matter protocol used by a multinational company. The protocol is employed to facilitate communication between a gateway and an application for the control of smart products. The evaluation commenced by connecting a gateway to a network and installing the Kali Linux operating system on the computer. Subsequently, multiple Denial-of-Service (DoS) attacks were conducted with varying intervals, packet quantities, and packet sizes. Additionally, a Man-in-the-Middle attack was executed to assess security and attempt to compromise the protocol for more secure results. The results from the initial DoS attacks revealed that the application was disconnected from the company's gateway after being targeted with a specific TCP packet. The application lost contact with the gateway when subjected to a certain number of transmitted packets. In the subsequent DoS attacks, the results indicated a delay in the gateway's response. The study's conclusion suggests that the Matter protocol exhibits a latency effect during DoS attacks, where the gateway does not respond immediately. These observations have implications for the security aspects of the protocol and may lead to recommendations for enhancing its resilience against various attacks.

The aim of this Master thesis is a testing of Cisco ASA\,5510 firewall with affect of Denial of Service attacks. Part of the thesis is a teoretical description some of the attacks and practical tests. Practical part covers basic testing of Cisco ASA with Spirent Avalanche 3100B. Number of TCP connections per second and firewalls throughput on 7th layer of ISO/OSI model were tested. Also the effect of Denial of Service attacks on the throughput. In a next part there is described one possible way how to generate Denial of Service attacks from a Linux server to the firewall. Python scripts were used for generation DoS packets. With those scripts it is possible to generate five types of attacks.

På grund av Covid 19 har de flesta människor valt att jobba hemifrån och de flesta hushåll har en accesspunkt som möjliggör kommunikation mellan flera enheter. Attacker mot Wi-Fi accesspunkter har ökat under de senaste åren på grund av sårbarheter som kan finnas i accesspunkten. När en sårbar väg hittas i accesspunkt kan detta ledda till att angriparen använder den sårbara vägen för att göra ett intrång och skada en eller flera enheter i hemnätverket och även företagens enheter. Teknikens framsteg har hjälpt oss att implementera flera säkerhetsåtgärder som kan skydda accesspunkten vid intrångsförsök. Syftet med detta arbete är att lägga fokus på att ge rätt kunskap för nya nätverkstekniker för att öka medvetenhet inom säkerheten i hemnätverk. Målet med detta examensarbete är att ge en djupare kunskap för nya nätverkstekniker för att kunna förhindra eller minimera attacker som orsakas av sårbarheter i ett hemnätverk med Wi-Fi accesspunkt och ta fram en rutin för hur det ska skyddas. Efter vi har identifierat en mängd attacker och själva utfört dem, visade resultatet att det var lätt att manipulera en sårbar accesspunkt med de valda attacksverktygen i detta arbete och experimenten har påvisat oss vikten av att implementera rätt säkerhetsåtgärder och hur väl de skyddar accesspunkten mot ett intrångsförsök. / Due to Covid 19, most people have chosen to work from home and most households have an access point that enables communication between several devices. Attacks against Wi-Fi access points have increased in recent years due to vulnerabilities that may exist in the access point. When a vulnerable path is found in the access point, this can lead to the attacker using the vulnerable path to breach and damage one or more devices in the home network and even corporate devices. Advances in technology have helped us implement several security measures that can protect the access point in case of intrusion attempts. The purpose of this work is to focus on providing the right knowledge for new network technicians to increase awareness in home network security. The goal of this thesis is to provide a deeper knowledge for new network technicians to be able to prevent or minimize attacks caused by vulnerabilities in a home network with a Wi-Fi access point and develop a routine for how to protect it. After we have identified several attacks and performed it ourselves, the result showed that it was easy to manipulate a vulnerable access point with the selected attack tools in this work and the experiments have shown us the importance of implementing the right security measures and how well they protect the access point against an intrusion attempt.

This diploma thesis explains the principle of SCADA systems and describes the DLMS/COSEM protocol. In the next part, it shortly describes the Modbus protocol and details the pros and cons of the Modbus protocol in comparison with the DLMS/COSEM protocol. In the next part, an open-source automated scanner was created. This scanner detects devices in a laboratory network. As the next step, the automated scanner finds out open ports and active services, which run on these devices, and tries to attack HTTP, SSH, and Telnet services. Next, the program checks, whether the found device is a smart-meter device and if it is compatible with DLMS/COSEM protocol. If yes, it checks, if the service is vulnerable to DOS attack and breaker disconnection. Scanner’s findings are presented in a newly created web application. NMAP, Masscan, and Metasploit open-source programs are used in the automated scanner. The whole automated scanner is optimized for the HW device Raspberry Pi with the operating system Raspbian Buster Lite installed. This work also describes the testing of the scanner on the laboratory environment and the results are evaluated afterwards.

The work's main topic is a recently published slow DoS attack called SlowDrop. The work focuses on the subject of describing the current state of the DoS problem as a whole and the SlowDrop attack as well. It works with this theoretical basis during the implementation of it's own SlowDrop attack model. This model is tested in various scenarios and the outcome results are analyzed and constructively discussed. Furthermore defensive mechanisms against this threat and DoS attacks in general are proposed, specific methods shown and configurations recommended. These methods are followingly tested and evaluated. Last but not least the traffic of a SlowDrop attacker and a legitimate client with bad connection, which the SlowDrop attack is trying to immitate, are compared. From this comparison final conclusions of this work are drawn.

The use of the Internet of Things (IoT) devices has surged in recent years. However, due to the lack of substantial security, IoT devices are vulnerable to cyber-attacks like Denial-of-Service (DoS) attacks. Most of the current security solutions are either computationally expensive or unscalable as they require known attack signatures or full packet inspection. In this paper, we introduce a novel Graph-based Outlier Detection in Internet of Things (GODIT) approach that (i) represents smart home IoT traffic as a real-time graph stream, (ii) efficiently processes graph data, and (iii) detects DoS attack in real-time. The experimental results on real-world data collected from IoT-equipped smart home show that GODIT is more effective than the traditional machine learning approaches, and is able to outperform current graph-stream anomaly detection approaches.

Network-On-Chip (NoC) architecture forms the new design framework in extending single processor to multiprocessor SoC. Similar to other SoCs and systems, NoCs are also susceptible to Denial of Service (DoS) attacks which degrade the performance by limiting the availability of resources to the processing cores. The stability of NoC is maintained by employing hardware monitors to detect illegal/abnormal activity or by congestion aware arbitration to obfuscate and balance the network load. Typical DoS attack model selects a random target resource and injects multiple flooding flits to reduce its functionality. The random DoS attack will not be practically effective on congestion aware NoC as the flooding path flow changes dynamically based on the congestion in network and the same victim node selection will not be effectual on different traffic profiles. Thus this paper proposes an effective DoS attack model to dynamically synthesize the selection of target node in NoC, arbitrating on congestion information. We describe the design and implementation of the proposed attack model and compare the performance degradation for different synthetic traffic profiles against random target selection. We also put forth a novel design of an effective offline congestion aware routing algorithm by exploiting the advantages of deterministic and adaptive routing. The proposed routing technique showed better latency saturation compared to adaptive (DyAD) and deterministic (OE) protocol.

This study was carried out with the intention of examining the defensive mechanism employed against the latest cyber espionage methods including both insider and outsider attacks. The main focus of this study was on web servers as the targets of the cyber attacks. Information in connection to the study was obtained from researchers’ online articles. A survey was also conducted at MidSweden University in order to obtain information about the latest cyber attacks on web servers and about the existing defensive mechanism against such attacks. The existing defensive mechanism was surveyed and a simple design was created to assist in the investigation of the efficiency of the system. Some simple implementations of the existing defensive mechanism were made in order to provide some practical results that were used for the study. The existing defensive mechanism was surveyed and improved upon where possible. The improved defensive mechanism was designed and implemented and its results were compared with the results from the existing defensive mechanism. Due to the fact that the majority of the attackers use defensive mechanisms’ vulnerability in order to find their way into devices such as web servers, it was felt that, even with the most sophisticated improved defensive mechanism in place, it would not be entirely correct to claim that it is possible to fully protect web servers against such attacks.

<p>Denial of Service and the Distributed Denial of Service Attacks have recently emerged as one of the most newsworthy, if not the greatest, weaknesses of the Internet. This paper attempt to explain how they work, why they are hard to combat today, and what will need to happen if they are to be brought under control. It is divided into eight sections. The first is an overview of the current situation and also brief explanatory of the rest of the chapters being covered. The second is a detailed description of exactly how this attack works, and why it is hard to cope with today; of necessity it includes a description of how the Internet works today. The third section is totally about the different attacks in recent years and how they affected the people or the bigorganizations. The fourth section describes the short-term prospects, the tools which are used to rectify these attacks. The fifth is problems being faced with an explanatory of the percentage of attack in recent years and comparing the problems. The sixth is what can be done today to help alleviate this problem. The seventh section describes the legal actions and also legal actions that can be followed against the attack by the victim; and the eighth section describes the long-term picture, what will change to bring this class of problem under control, if not eliminate it entirely. And finally there are some appendices: a bibliography, giving references to original research work and announcements; a brief article on securing servers; and acknowledgments for the many people who helped make this paper possible.</p>

Denial of Service and the Distributed Denial of Service Attacks have recently emerged as one of the most newsworthy, if not the greatest, weaknesses of the Internet. This paper attempt to explain how they work, why they are hard to combat today, and what will need to happen if they are to be brought under control. It is divided into eight sections. The first is an overview of the current situation and also brief explanatory of the rest of the chapters being covered. The second is a detailed description of exactly how this attack works, and why it is hard to cope with today; of necessity it includes a description of how the Internet works today. The third section is totally about the different attacks in recent years and how they affected the people or the bigorganizations. The fourth section describes the short-term prospects, the tools which are used to rectify these attacks. The fifth is problems being faced with an explanatory of the percentage of attack in recent years and comparing the problems. The sixth is what can be done today to help alleviate this problem. The seventh section describes the legal actions and also legal actions that can be followed against the attack by the victim; and the eighth section describes the long-term picture, what will change to bring this class of problem under control, if not eliminate it entirely. And finally there are some appendices: a bibliography, giving references to original research work and announcements; a brief article on securing servers; and acknowledgments for the many people who helped make this paper possible.