Publication aims to propose and apply new metrics for intrusion detection in network traffic according to analysis of existing metrics, analysis of network traffic and behavioral characteristics of known attacks. The main goal of the thesis is to propose and implement new collection of metrics which will be capable to detect zero day attacks.

No description available.

In this paper, system of automatic processing of attacks using honeypots is discussed. The first goal of the thesis is to become familiar with the issue of signatures to detect malware on the network, especially the analysis and description of existing methods for automatic generation of signatures using honeypots. The main goal is to use the acquired knowledge to the design and implementation of tool which will perform the detection of new malicious software on the network or end user's workstation.

<p>Due to the invention of automated hacking tools, Hacking is not a black art anymore. Even script kiddies can launch attacks in few seconds. Therefore, there is a great emphasize on the Security to protect the resources from camouflage. Intrusion Detection System is also one weapon in the security arsenal. It is the process of monitoring and analyzing information sources in order to detect vicious traffic. With its unique capabilities like monitoring, analyzing, detecting and archiving, IDS assists the organizations to combat against threats, to have a snap-shot of the networks, and to conduct Forensic Analysis. Unfortunately there are myriad products inthe market. Selecting a right product at time is difficult. Due to the wide spread rumors and paranoia, in this work I have presented the state-of-the-art IDS technologies, assessed the products, and evaluated. I have also presented some of the novel challenges that IDS products are suffering. This work will be a great help for pursuing IDS technology and to deploy Intrusion Detection Systems in an organization. It also gives in-depth knowledge of the present IDS challenges.</p>

Doctor of Philosophy / Department of Computing and Information Sciences / Xinming Ou / If you cannot measure it, you cannot improve it. Quantifying security with metrics is important not only because we want to have a scoring system to track our efforts in hardening cyber environments, but also because current labor resources cannot administrate the exponentially enlarged network without a feasible risk prioritization methodology. Unlike height, weight or temperature, risk from vulnerabilities is sophisticated to assess and the assessment is heavily context-dependent. Existing vulnerability assessment methodologies (e.g. CVSS scoring system, etc) mainly focus on the evaluation over intrinsic risk of individual vulnerabilities without taking their contexts into consideration. Vulnerability assessment over network usually output one aggregated metric indicating the security level of each host. However, none of these work captures the severity change of each individual vulnerabilities under different contexts. I have captured a number of such contexts for vulnerability assessment. For example, the correlation of vulnerabilities belonging to the same application should be considered while aggregating their risk scores. At system level, a vulnerability detected on a highly depended library code should be assigned with a higher risk metric than a vulnerability on a rarely used client side application, even when the two have the same intrinsic risk. Similarly at cloud environment, vulnerabilities with higher prevalences deserve more attention. Besides, zero-day vulnerabilities are largely utilized by attackers therefore should not be ignored while assessing the risks. Historical vulnerability information at application level can be used to predict underground risks. To assess vulnerability with a higher accuracy, feasibility, scalability and efficiency, I developed a systematic vulnerability assessment approach under each of these contexts. ​

Due to the invention of automated hacking tools, Hacking is not a black art anymore. Even script kiddies can launch attacks in few seconds. Therefore, there is a great emphasize on the Security to protect the resources from camouflage. Intrusion Detection System is also one weapon in the security arsenal. It is the process of monitoring and analyzing information sources in order to detect vicious traffic. With its unique capabilities like monitoring, analyzing, detecting and archiving, IDS assists the organizations to combat against threats, to have a snap-shot of the networks, and to conduct Forensic Analysis. Unfortunately there are myriad products inthe market. Selecting a right product at time is difficult. Due to the wide spread rumors and paranoia, in this work I have presented the state-of-the-art IDS technologies, assessed the products, and evaluated. I have also presented some of the novel challenges that IDS products are suffering. This work will be a great help for pursuing IDS technology and to deploy Intrusion Detection Systems in an organization. It also gives in-depth knowledge of the present IDS challenges.

Zero-days are vulnerabilities that the software vendor does not know about and thus cannot provide a patch for. Their value has caused markets to develop, divided by the purchase intention. This thesis focuses on the white and grey markets, that is those buying to patch and those buying to exploit. While states generally have an interest in both, they currently spend money to exploit zerodays, keeping software insecure. The lack of knowledge and awareness surrounding this practice is the problem targeted in this thesis. Serious games, aiming to be both entertaining and educational, represent one opportunity to create awareness. They fit our circumstances particularly well because understanding the problem space requires adversarial thinking and lots of different concepts. Our research goal has thus been to create a serious game that accurately illuminates the dilemma experienced by states. Design science was the research strategy employed to reach the stated goal. Our main contribution is Minimator, a multiplayer, web-based game in which players, acting as states, have to protect their infrastructure and deal with zero-day markets. Additionally, we present a formal model of states’ treatment of zero-day markets developed using game theory and shown to resemble the n-players prisoners’ dilemma. An expert evaluation was conducted, delivering promising results in terms of gameplay appeal, and accuracy. A naturalistic evaluation remains, but is suggested in detail for future endeavours. Minimator is original as, to our knowledge, no similar artefact exists. It provides value by potentially creating a starting point for and encouraging an informed, public debate about the trade-off between national and infrastructure security, which is inherently political.

Globaliseringen och digitalisering har drivit på utvecklingen av cyberhot och innebär en ökad säkerhetsrisk. Cyberangrepp sker dagligen i Sverige av hotaktörer som utgörs av främmande makt, svensk och internationell organiserad brottslighet samt fristående aktörer. Branschen omsätter enorma belopp och det har uppstått en ny marknad av cyberbrottstjänster, Crime-as-a-Service (CaaS). Det svenska teknikförsprånget innebär att hotaktörer även använder Sverige som en testmarknad för okända, zero-day, digitala säkerhetshål. Cyberhotet är en utmaning för kriminologin, kriminalpolitiken och brottsbekämpning eftersom cyberdomänen sträcker sig utanför nationella polis- och rättsväsenden samtidigt som den brottsliga verksamheten sker på de krypterade delarna av internet, darkweb. Dessutom finns det begränsat med kriminologiska teorier på cyberområdet vilket i sin tur försvårar utvecklingen av policy för att avvärja cyberhotet. Kriminologer och brottsförebyggande aktörer har tenderat till att fastna i ett globalt perspektiv trots att cyberhotet har en lokal förankring. Genom en kvalitativ innehållsanalys undersöker uppsatsen hur brottsförebyggande aktörer uppfattar utvecklingen av cyberbrottsligheten genom att analysera svenska policydokument på cybersäkerhetsområdet med förankring i EU-policy utifrån Dick Hobbs och Katja Frankos teorier om så kallad glokalisering. Studien indikerar att den svenska policyutvecklingen på cyberhotsområdet nyligen rivstartat med etableringen av Nationellt cybersäkerhetscenter (NCSC) och införandet av Budapestkonvention. Resultatet tyder på att svenska brottsförebyggande aktörer inkorporerar ett glokalt perspektiv som drivs på av Polisen i jakten på hotaktörerna. Den kriminologiska forskningen på cyberhotsområdet är begränsad och uppsatsen är ett första steg för en ökad förståelse av cyberhotet ur ett svenskt policyperspektiv. Studien identifierar även en riktning för nästa steg av empirisk forskning och utveckling av kriminologisk teori för att analysera säkerhetshot och brottslighet i cyberdomänen med hjälp av nätverksteori.