Existing research suggests that it is possible to detect dictionary attacks using IP flows. This type of detection was successfully implemented for SSH, LDAP and RDP protocols. To determine whether it is possible to use the same methods of detection for e-mail protocols virtual test environment was created. I deduced the characteristics of attacks in flows from the data, which I gained from this virtual environment. Than I chose the statistical value that separates the attacks from legitimate traffic. Variance of specific flow parameters was chosen as main characteristic of attacks. IP addresses with flows that have small variance of chosen parameters and high frequency of packet arrival are considered untrustworthy. Variance is calculated from IP history to rule out false positives. The IP history of legitimate user contains variation of flows which prevents marking this IP address as dangerous. On the basis of this principal the script, which detects the attacks from the nfdump output, was created. The success of detection of the attacks was tested on classificated data from the real environment. The results of tests showed, that with good configuration of marginal values the percentage of detected attacks is high and there are no false positives. Detection is not limited only on mail protocols. With regard to universal design, the script is able to detect dictionary attacks on SSH, LDAP, SIP, RDP, SQL, telnet and some other attacks.

Anotation Diploma Thesis Terrorist profiling in Europe between 2004 and 2017 Bc. Kryštof Rygl Terrorism has never been so brutal and unexpected as it is now in the era of Islamic terrorism. This era initiated by series of attacks in the United States in 2001. Behind these attacks, as well as three years later during the bombings in Madrid in Spain, has been Al- Qaeda, the terrorist organization, headed by Osama bin Laden. Al-Qaeda maintained its importance on organizing of terrorist attacks until 2014 when the Islamic State, replaced Al- Qaeda's significance and dominated until 2017. Many academics have been devoted to research of Islamic terrorism and a wide range of studies have been written to explain this phenomenon from the perspective of ideology, possible causes, motivation of attackers, how to carry out attacks, the influence of socio-economic factors and many other factors causing, enhancing or suppressing the phenomenon. The aim of this work is to link the topics of the research that has been done, so far, by selecting several relevant categories that can influence the terrorist's profile or the nature of the attack. Based on the completion of these categories by the relevant data for each terrorist attack that was committed during the reference period between 2004 and 2017, a general profile of...

Terrorism - criminological aspects Abstract The submitted diploma thesis deals with criminological aspects of terrorism. The thesis aims to introduce the reader to the concept of terrorism as well as to present its various criminological issues. The thesis seeks to provide plausible answers, especially to the following questions: what terrorism is, who is its perpetrator, what is the process of radicalization, and most importantly, what causes terrorism. Besides, it deals with the specifics of the fight against terrorism and current issues related to terrorism and its current global state. The work provides a comprehensive insight into the criminology of terrorism, both group and individually perpetrated. In the beginning, the thesis deals with the very concept of terrorism, its definition and typology. It thus provides the necessary basis for the following chapters of the thesis. The work continues with analysis of terrorism from the Czech criminal law point of view, and therefore provides practical insight into the possible punishment of perpetrator in the Czech Republic. The thesis then demonstrates the application of the law on one of the cases concerning Czech offender convicted of terrorism in the Czech Republic. At its core, the thesis deals with the criminological aspects of terrorism. It offers...

Thesis (M.Sc.Eng.) PLEASE NOTE: Boston University Libraries did not receive an Authorization To Manage form for this thesis or dissertation. It is therefore not openly accessible, though it may be available by request. If you are the author or principal advisor of this work and would like to request open access for it, please contact us at open-help@bu.edu. Thank you. / In this thesis, we firstly present the secure multipliers protected by the AMD codes, and demonstrate that the fault masking probabilities are not worse than the results based on the theoretical analysis of error masking probabilities, if the attacker injects faults at outputs of the inside logic gates of the protected devices. Single-errorcorrecting, double-error-detecting (SEC-DED) codes are widely used for the design of errors, thus they are not suitable for memories used in cryptographic devices. Algebraic Manipulation Detection (AMD) codes provide strong protection against fault injection attacks. But traditional AMD codes can not be used for correcting errors. In this thesis, we also present the constructions of the strongly secure algebraic manipulation correction (AMC) codes. The estimation for a probability for miscorrection of multiple errors is given. Hardware implementations of strongly secure SEC-DED memories based on the proposed codes are presented. Comparison with other codes which have been used for SEC-DED memories with security or weak security are given in terms of numbers of undetected errors, sizes of security kernels and miscorrection probabilities as well as latency, area and power consumption for encoders and decoders. An error handling method to distinguish between random errors and fault injection attacks is presented as well. The proposed code can be applied to most secure-critical memories in cryptographic devices. As far as we know, this is the only efficient approach to provide both high reliability for single and double random errors, and high security for strong fault attack when an attacker has a control of both on the messages (outputs of the memories) and the errors. / 2031-01-01

Biometric identification has already been applied to society today, as today’s mobile phones use fingerprints and other methods like iris and the face itself. With growth for technologies like computer vision, the Internet of Things, Artificial Intelligence, The use of face recognition as a biometric identification on ordinary doors has become increasingly common. This thesis studies is looking into the possibility of replacing regular door locks with face recognition or supplement the locks to increase security by using a pre-trained state-of-the-art face recognition method based on a convolution neural network. A subsequent investigation concluded that a networks based face recognition are is highly vulnerable to attacks in the form of presentation attacks. This study investigates protection mechanisms against these forms of attack by developing a presentation attack detection and analyzing its performance. The obtained results from the proof of concept  showed that local binary patterns histograms as a presentation attack detection could help the state of art face recognition to avoid attacks up to 88\% of the attacks the convolution neural network approved without the presentation attack detection. However, to replace traditional locks, more work must be done to detect more attacks in form of both higher percentage of attacks blocked by the system and the types of attack that can be done. Nevertheless, as a supplement face recognition represents a promising technology to supplement traditional door locks, enchaining their security by complementing the authorization with biometric authentication. So the main contributions is that  by using simple older methods LBPH can help modern state of the art face regognition to detect presentation attacks according to the results of the tests. This study also worked to adapt this PAD to be suitable for low end edge devices to be able to adapt in an environment where modern solutions are used, which LBPH have.

Networks have an increasing influence on our modern life, making Cybersecurity an important field of research. Cybersecurity techniques mainly focus on antivirus software, firewalls and intrusion detection systems (IDSs), etc. These techniques protect networks from both internal and external attacks. This research is composed of three different essays. It highlights and improves the applications of machine learning techniques in the Cybersecurity domain. Since the feature size and observations of the cyber incident data are increasing with the growth of internet usage, conventional defense strategies against cyberattacks are getting invalid most of the time. On the other hand, the applications of machine learning tasks are getting better consistently to prevent cyber risks in a timely manner. For the last decade, machine learning and Cybersecurity have converged to enhance risk elimination. Since the cyber domain knowledge and adopting machine learning techniques do not align on the same page in the case of deployment of data-driven intelligent systems, there are inconsistencies where it is needed to bridge the gap. We have studied the most recent research works in this field and documented the most common issues regarding the implementation of machine learning algorithms in Cybersecurity. According to these findings, we have conducted research and experiments to improve the quality of service and security strength by discovering new approaches.

The ongoing miniaturization of semiconductor manufacturing technologies has enabled the integration of tens to hundreds of processing cores on a single chip. Unlike frequency-scaling where performance is increased equally across the board, core-scaling and hardware thread-scaling harness the additional processing power through the concurrent execution of multiple processes or programs. This approach of mingling or interleaving process executions has engendered a new set of security challenges that risks to undermine nearly three decades’ worth of computer architecture design efforts. The complexity of the runtime interactions and aggressive resource sharing among processes, e.g., caches or interconnect network paths, have created a fertile ground to mount attacks of ever-increasing acuteness against these computer systems. One such class of attacks is cache side-channel attacks. While caches are vital to the performance of current processors, they have also been the target of numerous side-channel attacks. As a result, a few cache architectures have been proposed to defend against these attacks. However, these designs tend to provide security at the expense of performance, area and power. Therefore, the design of secure, high-performance cache architectures is still a pressing research challenge. In this thesis, we examine the viability of self-aware adaptive caches as a defense mechanism against cache side-channel attacks. We define an adaptive cache as a caching structure with (i) run-time reconfiguration capability, and (ii) intelligent built-in logic to monitor itself and determine its parameter settings. Since the success of most cache side-channel attacks depend on the attacker’s knowledge of the key cache parameters such as associativity, set count, replacement policy, among others, an adaptive cache can provide a moving target defense approach against many of these cache side-channel attacks. Therefore, we hypothesize that the runtime changes in certain cache parameters should render some of the side-channel attacks less effective due to their dependence on knowing the exact configuration of the caches. / 2020-06-03T00:00:00Z

Supervisory Control and Data Acquisition (SCADA) systems monitor and control industrial control systems in many industrials and economic sectors which are considered critical infrastructure. In the past, most SCADA systems were isolated from all other networks, but recently connections to corporate enterprise networks and the Internet have increased. Security concerns have risen from this new found connectivity. This thesis makes one primary contribution to researchers and industry. Two datasets have been introduced to support intrusion detection system research for SCADA systems. The datasets include network traffic captured on a gas pipeline SCADA system in Mississippi State University’s SCADA lab. IDS researchers lack a common framework to train and test proposed algorithms. This leads to an inability to properly compare IDS presented in literature and limits research progress. The datasets created for this thesis are available to be used to aid researchers in assessing the performance of SCADA IDS systems.

No description available.

No description available.