Under åren har intensiv forskning pågått för att förbättra maskininlärningsmodellers förmåga att förutse marknadsrörelser. Trots detta har det, under finanshistorien, inträffat flera händelser, såsom "Flash-crash", som har påverkat marknaden och haft dramatiska konsekvenser för prisrörelserna. Därför är det viktigt att undersöka hur modellerna påverkas av manipulativa handlingar på finansmarknaden för att säkerställa deras robusthet och tillförlitlighet i sådana situationer.  För att genomföra detta arbete har processen delats upp i tre steg. Först har en undersökning av tidigare arbeten gjorts för att identifiera de mest robusta modellerna inom området. Detta gjordes genom att träna modellerna på FI-2010 datasetet, som är ett offentligt tillgängligt dataset för högfrekvent handel med aktier på NASDAQ Nordic-börsen. De modeller som undersöktes inkluderade DeepLOB, DeepLOB-Attention, DeepLOB-seq2seq, DTNN och TCN. Det andra steget innefattade att köpa det svenska datasetet från Nasdaq Nordic, vilket tillhandahåller data om svenska aktier Limit Order Book (LOB). De två modellerna som visade bäst resultat i det första steget tränades sedan med detta dataset. Slutligen genomfördes en manipulation på de svenska orderböckerna för att undersöka hur dessa modeller påverkas. Resultatet utgjorde en tydlig bedömning av modellernas robusthet och pålitlighet när det gäller att förutse marknadsrörelser genom en omfattande jämförelse och analys av samtliga tester och deras resultat. Arbetet belyser även hur modellernas resultat påverkas av manipulativa handlingar. Dessutom framgår det hur valet av normaliseringsmetod påverkar modellernas resultat. / Over the years, intensive research has been conducted to enhance the capability of machine learning models to predict market movements. Despite this, during financial history, several events, such as the "Flash-crash," have impacted the market and had dramatic consequences for price movements. Therefore, it is crucial to examine how the models are affected by manipulative actions in the financial market to ensure their robustness and reliability in such situations. To carry out this work, the process has been divided into three steps. Firstly, a review of previous studies was conducted to identify the most robust models in the field. This was achieved by training the models on the FI-2010 dataset, which is a publicly available dataset for high-frequency trading of stocks on the NASDAQ Nordic stock exchange. The examined models included DeepLOB, DeepLOB-Attention, DeepLOB-seq2seq, DTNN, and TCN. The second step involved acquiring the Swedish dataset from Nasdaq Nordic, providing data on Swedish stock Limit Order Books (LOB). The two models that demonstrated the best results in the first step were then trained with this dataset. Finally, a manipulation was performed on the Swedish order books to investigate how these models would be affected. The result constituted a clear assessment of the models' robustness and reliability in predicting market movements through a comprehensive comparison and analysis of all tests and their results. The work also highlights how the models' outcomes are affected by manipulative actions. Furthermore, it becomes evident how the choice of normalization method affects the models' results.

In modern society, Global Navigation Satellite Systems (GNSSs) are ubiquitously relied upon by many systems, among others in critical infrastructure, for navigation and time synchronization. To overcome the prevailing vulnerable state of civilian GNSSs, many detection schemes for different attack types (i.e., jamming and spoofing) have been proposed in literature over the last decades. With the launch of Galileo Open Service Navigation Message Authentication (OS­NMA), certain, but not all, types of GNSS spoofing are prevented. We therefore analyze the remaining attack surface of relay/replay attacks in order to identify a suitable and effective combination of detection schemes against these. One shortcoming in the evaluation of countermeasures is the lack of available test platforms, commonly limiting evaluation to mathematical description, simulation and/or test against a well defined set of recorded spoofing incidents. In order to allow researchers to test countermeasures against more diverse threats, this degree project investigates relay/replay attacks against GNSS signals in real­world setups. For this, we consider colluding adversaries, relaying/replaying on signal­ and on message­level in real­time, over consumer grade Internet, and with Commercially off the Shelf (COTS) hardware. We thereby highlight how effective and simple relay/replay attacks can be on existent and likely on upcoming authenticated signals. We investigate the requirements for such colluding attacks and present their limitations and impact, as well as highlight possible detection points. / Det moderna samhället förlitar sig på ständigt tillgängliga satellitnavigeringssystem (GNSSs) för navigering och tidssynkronisering i bland annat kritisk infrastruktur. För att åtgärda det rådande såbara tillståndet i civila GNSSs har många detektionssystem för olika attacktyper (dvs. jamming och förfalskning) blivit förslagna i den vetenskapliga litteraturen under de senaste årtiondena. Införandet av Galileo Open Service Navigation Message Authentication (OS NMA) förhindrar vissa, men inte alla typer av förfalskningsattacker. Därför analyserar vi den övriga angreppsytan för replay attacker för att identifiera en kvalificerad och effektiv kombination av detektionssystem emot dem. Ett tillkortakommande i utvärdering av detektionssystemen är bristen på tillgängliga testplattformar, vilket får konsekvensen att utvärderingen ofta är begränsad till matematiska beskrivningar, simuleringar, och/eller testning mot ett väldefinierat set av genererad förfalskningsattacker. För att hjälpa forskarna testa detektionssystemen mot mer varierade angrepp undersöker detta examensarbete replay attacker mot GNSS signaler i realistiska situationer. För dessa syften betraktar vi kollaborerande angripare som utför replay attacker på signal ­ och meddelandennivå i realtid över konsument­kvalité Internet med vanlig hårdvara. Vi framhäver därmed hur effektiva och enkla replay attacker kan vara mot befintliga och kommande autentiserade signaler. Vi undersöker förutsättningar för sådana kollaborerande attacker och presenterar deras begränsningar och verkan, samt möjliga kännetecken.

With the intensively increasing of digital media new challenges has been created for authentication and protection of digital intellectual property. A hash function extracts certain features of a multimedia object e.g. an image and maps it to a fixed string of bits. A perceptual hash function unlike normal cryptographic hash is change tolerant for image processing techniques. Perceptual hash function also referred to as robust hash, like any other algorithm is prone to errors. These errors are false negative and false positive, of which false positive error is neglected compared to false negative errors. False positive occurs when an unknown object is identified as known. In this work a new method for raising false alarms in robust hash function is devised for evaluation purposes i.e. this algorithm modifies hash key of a target image to resemble a different image’s hash key without any significant loss of quality to the modified image. This algorithm is implemented in MATLAB using block mean value based hash function and successfully reduces hamming distance between target image and modified image with a good result and without significant loss to attacked imaged quality.

Denna rapport beskriver de behov vilka ligger tillgrund för att skapa en IT-säkerhetsdatabas. Rapporten tar även upp olika IT-säkerhetsproblem och för en diskussion om vad som är faran med dessa problem. Diskussionen förs inom två områden rörande IT-säkerhet.Det ena området är om IT-säkerhet i allmänhet och tar upp begreppet CIA. CIA står för de engelska begreppen Confidentiality, Integrity och Availability och på svenska, sekretess, integritet och tillgänglighet.Den andra delen handlar om lite mer specifika IT-säkerhetsproblem, som till exempel virus och sniffing.På uppdrag av FOI är en databas, vilken är avsedd för att lagra information rörande IT-säkerhet, skapad. Rapporten tar upp en del grundläggande databasteori och beskriver designen och implementationen av databasen. Även hur databasen fungerar beskrivs.Slutligen förs en diskussion om uppnådda resultat och om möjlig framtida utveckling av databasen. / This report describes the needs which are the basis for creating an IT security database.The report also discusses various IT security issues and a discussion of what are the dangers of these problems. The discussion conducted in two areas relating to IT security.The first part is about IT security in general and addresses the concept of the CIA. CIA stands for the English concepts of Confidentiality, Integrity and Availability. The terms in Swedish are sekretess, integritet and tillgänglighet.The second part deals with some more specific IT security problems, such as viruses and sniffing.On behalf of FOI a database is created, which is designed to store information relating to IT security. It outlines some basic database theory and describes the design and implementation of the database. Also the functions in the database are described.Finally a discussion over the results achieved and the possible future development of database is carried out.

In a time where general technology is progressing at a rapid rate, this thesis aims to present possible advancements to security in regard to air traffic communication. By highlighting how data can be extracted using simple hardware and open-source software the transparency and lack of authentication is showcased. The research is specifically narrowed down to discovering vulnerabilities of the ADS-B protocol in order to apply countermeasures. Through fetching live aircraft data with OpenSky-Network and through fetching simulated ADS-B attack data with OpenScope, this thesis develops a data set with both authentic and malicious ADS-B messages. The data set was cleaned in order to remove outliers and other improper data. A machine learning model was later trained with the data set in order to detect malicious ADS-B messages. With the use of Support Vector Machine (SVM), it was possible to produce a model that can detect four different types of aviation communications attacks as well as allow authentic messages to pass through the IDS. The finished model was able to detect incoming ADS-B attacks with an overall accuracy of 83.10%.

This diploma thesis deals with the evaluation of a security solution that was recently deployed by a British company renting office space. This validation system is based on a database of MAC addresses, a database of clients and active filtering of connected devices. The first part explains the concepts of computer network, VLAN and basic concepts needed to understand the function of dynamic assignment of VLAN and IP addresses. The second part is devoted to measurements based on hypotheses, according to which measures are proposed in the last part to solve these security problems.

Localization of nodes is an important aspect in a vehicular ad-hoc network (VANET). Research has been done on various localization methods. Some are more apt for a specific purpose than others. To begin with, we give an overview of a vehicular ad-hoc network, localization methods, and how they can be classified. The distance bounding and verifiable trilateration methods are explained further with their corresponding algorithms and steps used for localization. Distance bounding is a range-based distance estimation algorithm. Verifiable trilateration is a popular geometric method of localization. A dedicated automated highway infrastructure can use distance bounding and/or trilateration to localize an automated vehicle on the highway. We describe a highway infrastructure for our analysis and test how well each of the methods performs, according to a security measure defined as spoofing probability. The spoofing probability is, simply put, the probability that a given point on the highway will be successfully spoofed by an attacker that is located at any random position along the highway. Spoofing probability depends on different quantities depending on the method of localization used. We compare the distance bounding and trilateration methods to a novel method using friendly jamming for localization. Friendly jamming works by creating an interference around the region whenever communication takes place between a vehicle and a verifier (belonging to the highway infrastructure, which is involved in the localization process using a given algorithm and localization method). In case of friendly jamming, the spoofing probability depends both on the position and velocity of the attacker and those of the target vehicle (which the attacker aims to spoof). This makes the spoofing probability much less for friendly jamming. On the other hand, the distance bounding and trilateration methods have spoofing probabilities depending only on their position. The results are summarized at the end of the last chapter to give an idea about how the three localization methods, i.e. distance bounding, verifiable trilateration, and friendly jamming, compare against each other for a dedicated automated highway infrastructure. We observe that the spoofing probability of the friendly jamming infrastructure is less than 2% while the spoofing probabilities of distance bounding and trilateration are 25% and 11%, respectively. This means that the friendly jamming method is more secure for the corresponding automated transportation system (ATS) infrastructure than distance bounding and trilateration. However, one drawback of friendly jamming is that it has a high standard deviation because the range of positions that are most vulnerable is high. Even though the spoofing probability is much less, the friendly jamming method is vulnerable to an attack over a large range of distances along the highway. This can be overcome by defining a more robust infrastructure and using the infrastructure's resources judiciously. This can be the future scope of our research. Infrastructures that use the radio resources in a cost effective manner to reduce the vulnerability of the friendly jamming method are a promising choice for the localization of vehicles on an ATS highway.

Location-based services have grown in importance as smartphones, and location-based applications have become an integral part of everyday life. While Global Navigation Satellite Systems (GNSSs) provide the most accurate position determination, open service GNSS signals remain unprotected and susceptible to spoofing attacks. Previous work within the domain highlighted this issue, with many smartphone receivers shown susceptible to GPS L1 spoofing, suggesting that their resilience experiments should be extended to include other GNSS signals in the future. Given that multi-GNSS receivers now have become the norm in smartphones, this thesis investigates whether smartphone GNSS receiver spoofing resilience depends on the type of signal; by conducting a series of comparative spoofing experiments involving GPS L1 and Galileo E1-B/C signals. To conduct the experiments, we developed a Galileo E1-B/C signal simulator that, together with the open-source GPS-SDR-SIM signal simulator, was the basis for conducting a series of experiments designed to identify the potential presence of anti-spoofing measures. The result of our experiments indicates that smartphone multi-GNSS receivers were significantly more resilient towards Galileo E1-B/C spoofing attacks, often accepting GPS L1 signals with significant position, time, and data errors, while refusing to accept corresponding Galileo E1-B/C signals. While we never observed cases of E1-B/C signals being accepted while rejecting GPS L1 signals, external factors limited the scope of the investigation and do not allow a generalized conclusion. As such, to deepen our understanding of these issues and how they relate to the development of anti-spoofing measures and trust in different signals, it is essential to extend this research to include more devices and other GNSS signals. / Positionstjänster har växt i betydelse allteftersom smarttelefoner och positionsapplikationer har blivit en integral del av våran vardag. Även om satellitpositionering utger det mest precisa och vedertagna positionsbestämningen av tillgängliga positionstjänser så är de publika satellitnavigeringssignalarna oskyddade och sårbara för förfalskningsattacker. Tidigare forskning inom området har evaluerat dessa sårbarheter och visat att ett betydande antal smarttelefoner var sårbara för GPS-L1 förfalskningsattacker och att denna forskning borde utökas i framtiden allteftersom satellitnavigeringsmottagare med förmåga att mottaga olika satellitsignaler integreras i smarttelefoner. Givet att en majoritet av nya smarttelefoner nu integrerar denna typ av mottagare så utvärderar detta arbete hur sårbarheten mot förfalskningsattacker beror på typ av satellitsignal genom en komparativ jämförelse av sårbarhet mellan GPS-L1 och den nyare Galileo E1-B/C signalen. För att genomföra utvärderingen så utvecklade vi en Galileo E1-B/C signalsimulator som tillsammans med GPS-L1 signalsimulatorn (GPS-SDR-SIM) utgjorde grunden för en serie av experiment designade för att identifiera och utvärdera sårbarheter och potentiella motåtgärder i smarttelefoner. Våra resultat indikerar att smarttelefoner är betydligt mer sårbara for GPS-L1 forfalskningsattacker då de accepterade GPS-L1 signaler med betydande position, tid, och datafel medans motsvarande Galileo E1-B/C signaler ej accepterades. Trots resultaten så är det viktigt att inte dra för starka slutsatser då underlaget var kraftigt begränsat givet rådande omständigheter (Covid), som gjorde det svårt/omöjligt att på ett säkert sätt samla volontärer med olika smarttelefoner för våra experiment. Därav så är det viktigt att i framtiden utöka arbetet med ett större underlag och fler signaltyper.

The usage of drones is steadily increasing as drones are becoming more available and useful to the general public, but drone usage also leads to problems as for example airports have had to shutdown due to drone sightings. It has become clear that a counter-drone system must be in place to neutralize intruding drones. However, neutralizing a drone is not an easy task, the risk of causing collateral damage and interfering with other radio systems must be highly considered when designing a counter-drone system. In this thesis a set of consumer drones was selected based on market popularity. By studying the wireless communication links of the selected drones a set of drone neutralization methods was identified. For each neutralization method a set of jamming and spoofing techniques was selected from current research. The techniques was used in practise by subjecting the drones to the techniques in a series of drone behaviour experiments. The results was used to evaluate the techniques in four criteria based on avoiding collateral damage, mitigating radio interference, identification requirement and handling multiple intruding drones. The evaluation was then summarized to discuss suitable drone neutralization methods and jamming & spoofing techniques. The results showed that there are neutralization methods that could potentially avoid causing col- lateral damage for certain drones. A full-band barrage jamming technique was shown to best the best performing based on the evaluation criteria, but was also the technique that theoretically induced the most radio interference. Furthermore, drones operating in way-point mode can only be neutralized using a GNSS jamming or spoofing neutralization method. Also using a GPS spoofing neutralization method was shown to be difficult to implement in practise. / Populariteten av att flyga drönare ökar stadigt i och med att drönartekniken blir mer tillgänglig och an- vändbart för allmänheten. Men användningen av drönare leder också till problem när till exempel flyg- platser har varit tvungna att stänga av på grund av drönar observationer. Det har blivit tydligt att ett anti-drönarsystem måste vara på plats för att neutralisera inkräktande drönare. Men att neutralisera en drönare är inte en enkel uppgift, risken för att orsaka sido-skador på personer, byggander eller objekt; eller störa andra radiosystem måste beaktas starkt när man utformar ett anti-drönarsystem. I detta examensarbete valdes en uppsättning konsumentdrönare ut baserat på marknadens popularitet. Genom att studera de trådlösa kommunikationslänkarna för de valda drönarna identifierades en uppsättning av drönar-neutraliseringsmetoder. För varje neutraliseringsmetod valdes en uppsättning av störnings- och spoofing-tekniker ut från aktuell forskning. Teknikerna användes i praktiken genom att utsätta drönarna för teknikerna i en serie drönar-beteendeexperiment. Resultaten användes sedan för att utvärdera teknikerna i fyra utvärderingskriterier baserade på att undvika sido-skador, mildra radiostörningar, identifieringsbehov och hantering av flera inkräktande drönare. Utvärderingen sammanfattades sedan för att diskutera lämpliga drönar-neutraliseringsmetoder och störnings- spoofing-tekniker. Resultaten visade att det finns neutraliseringsmetoder som potentiellt kan undvika att orsaka sido- skador eller radio-störningar för vissa typer av drönare. En full-bands störningsteknik visade sig vara bäst presterande baserat på utvärderingskriterierna, men var också den teknik som teoretiskt inducerade mest radiostörningar. Dessutom visades det att drönare som flyger i navigeringsläge endast kan neutraliseras med hjälp av en GNSS-störnings- eller spoofing metoder. Att använda en GPS-spoofing metod visade sig också vara svår att implementera i praktiken.

The dissertation investigates the promises and challenges for application of cardiac signals in biometrics and affective computing, and noninvasive measurement of cardiac signals. We have mainly discussed two major cardiac signals: electrocardiogram (ECG), and photoplethysmogram (PPG). ECG and PPG signals hold strong potential for biometric authentications and identifications. We have shown that by mapping each cardiac beat from time domain to an angular domain using a limit cycle, intra-class variability can be significantly minimized. This is in contrary to conventional time domain analysis. Our experiments with both ECG and PPG signal shows that the proposed method eliminates the effect of instantaneous heart rate on the shape morphology and improves authentication accuracy. For noninvasive measurement of PPG beats, we have developed a systematic algorithm to extract pulse rate from face video in diverse situations using video magnification. We have extracted signals from skin patches and then used frequency domain correlation to filter out non-cardiac signals. We have developed a novel entropy based method to automatically select skin patches from face. We report beat-to-beat accuracy of remote PPG (rPPG) in comparison to conventional average heart rate. The beat-to-beat accuracy is required for applications related to heart rate variability (HRV) and affective computing. The algorithm has been tested on two datasets, one with static illumination condition and the other with unrestricted ambient illumination condition. Automatic skin detection is an intermediate step for rPPG. Existing methods always depend on color information to detect human skin. We have developed a novel standalone skin detection method to show that it is not necessary to have color cues for skin detection. We have used LBP lacunarity based micro-textures features and a region growing algorithm to find skin pixels in an image. Our experiment shows that the proposed method is applicable universally to any image including near infra-red images. This finding helps to extend the domain of many application including rPPG. To the best of our knowledge, this is first such method that is independent of color cues. / Ph. D.