DI - COSEC - Capítulos de Monografías

Permanent URI for this collection

https://hdl.handle.net/10016/5552

Browse

Now showing 1 - 20 of 26

SoNeUCON_{ABC}Pro: an access control model for social networks with translucent user provenance
(Springer, 2018-01) González Manzano, Lorena; Slaymaker, Mark; Fuentes García-Romero de Tejada, José María de; Vayenas, Dimitris
Web-Based Social Networks (WBSNs) are used by millions of people worldwide. While WBSNs provide many benefits, privacy preservation is a concern. The management of access control can help to assure data is accessed by authorized users. However, it is critical to provide sufficient flexibility so that a rich set of conditions may be imposed by users. In this paper we coin the term user provenance to refer to tracing users actions to supplement the authorisation decision when users request access. For example restricting access to a particular photograph to those which have “liked” the owners profile. However, such a tracing of actions has the potential to impact the privacy of users requesting access. To mitigate this potential privacy loss the concept of translucency is applied. This paper extends SoNeUCONABC model and presents SoNeUCONABCPro, an access control model which includes translucent user provenance. Entities and access control policies along with their enforcement procedure are formally defined. The evaluation demonstrates that the system satisfies the imposed goals and supports the feasibility of this model in different scenarios.
TriFlow: Triaging Android Applications using Speculative Information Flows
(ACM, 2017-04-02) Mirzaei, Omid; Suarez-Tangil, Guillermo; Estévez Tapiador, Juan Manuel; Fuentes García-Romero de Tejada, José María de
Information flows in Android can be effectively used to give an informative summary of an application’s behavior, showing how and for what purpose apps use specific pieces of information. This has been shown to be extremely useful to characterize risky behaviors and, ultimately, to identify unwanted or malicious applications in Android. However, identifying information flows in an application is computationally highly expensive and, with more than one million apps in the Google Play market, it is critical to prioritize applications that are likely to pose a risk. In this work, we develop a triage mechanism to rank applications considering their potential risk. Our approach, called TRIFLOW, relies on static features that are quick to obtain. TRIFLOW combines a probabilistic model to predict the existence of information flows with a metric of how significant a flow is in benign and malicious apps. Based on this, TRIFLOW provides a score for each application that can be used to prioritize analysis. TRIFLOW also provides an explanatory report of the associated risk. We evaluate our tool with a representative dataset of benign and malicious Android apps. Our results show that it can predict the presence of information flows very accurately and that the overall triage mechanism enables significant resource saving.
Analysis of the alignment of Spanish Master’s programs to US National Cybersecurity Workforce Framework
(Universidad de Granada, 2016) González-Tablas Ferreres, Ana Isabel
Building an adequate cybersecurity workforce is an strategic goal of main international stakeholders. Addressing this task passes through adapting graduate and undergraduate curricula so they are aligned to professional and research needs. In this work we present the preliminary results of analyzing the alignment of 25 Spanish cybersecurity Master’s programs to the cyber roles specified in the US National Cybersecurity Workforce Framework. Our results suggest that there is no significant alignment between both data sets.
L–PEP: a logic to reason about privacy–enhancing cryptography protocols
(Springer, 2011) Alcaide Raya, Almudena; Abdallah, Ali; González-Tablas Ferreres, Ana Isabel; Fuentes, José María de
In recent years, many cryptography protocols have been designed, for many different scenarios, with the purpose of preserving security of communications as well as privacy and anonymity of participant entities. In general, every proposed solution has possed a real challenge to the existing formal methods of protocol analysis and verification. The main goal of this work is the proposal of a logic to reason about privacy-enhancing monotonic and non-monotonic cryptography protocols. The new logic will be called L-PEP and it extends the existing Rubin's logic of beliefs.
Nature-inspired synthesis of rational protocols
(Springer, 2008) Alcaide Raya, Almudena; Estévez Tapiador, Juan Manuel; Hernández-Castro, Julio C.; Ribagorda Garnacho, Arturo
Rational cryptography is an emerging field which combines aspects traditionally related to security with concepts described in economic theoretical frameworks. For example, it applies game theory concepts to address security problems arising when executing cryptographic protocols. The aim is to replace the assumption of a worst-case attacker by the notion of rational agents that try to maximize their payoffs. In this work, we define a formal framework and a meta--heuristic technique for the automated synthesis of multi-party rational exchange security (M-RES) protocols. We provide experimental results for a simple scenario where a 3-party rational exchange protocol is automatically designed.
Towards a privacy-respectful telematic verification system for vehicle & driver authorizations
(Springer, 2011) González-Tablas Ferreres, Ana Isabel; Alcaide Raya, Almudena; Suárez-Tangil, Guillermo; Fuentes, José María de; Barroso-Pérez, Israel
The use of ubiquitous technologies to implement a telematic on-the-road verification of driver and vehicle authorizations would provide significant benefits regarding road safety, economic costs and convenience. Privacy-aware digital credentials would enable such a service although some challenges exist. The goal of this on-going work is to address these challenges. The first contribution herein presented is an enhanced data model of driver and vehicle authorizations. Secondly, we provide an analysis of existing privacy-aware digital credential systems that may support the implementation of the system.
A functional framework to evade network IDS
(IEEE, 2011-01) Pastrana, Sergio; Orfila, Agustín; Ribagorda Garnacho, Arturo
Signature based Network Intrusion Detection Systems (NIDS) apply a set of rules to identify hostile traffic in network segments. Currently they are so effective detecting known attacks that hackers seek new techniques to go unnoticed. Some of these techniques consist of exploiting network protocols ambiguities. Nowadays NIDS are prepared against most of these evasive techniques, as they are recognized and sorted out. The emergence of new evasive forms may cause NIDS to fail. In this paper we present an innovative functional framework to evade NIDS. Primary, NIDS are modeled accurately by means of Genetic Programming (GP). Then, we show that looking for evasions on models is simpler than directly trying to understand the behavior of NIDS. We present a proof of concept showing how to evade a self-built NIDS regarding two publicly available datasets. Our framework can be used to audit NIDS.
A multi-agent scanner to detect stored-XSS vulnerabilities
(IEEE, 2010-11) Galán, Eduardo; Alcaide Raya, Almudena; Orfila Díaz-Pabon, Agustín; Blasco Alís, Jorge
The cross-site scripting (XSS) has become a common vulnerability of many web sites and web applications. XSS consists in the exploitation of input validation ﬂaws, with the purpose of injecting arbitrary script code which is later executed at the web browser of the victim. One interesting possibility to prevent this type of vulnerability is the use of vulnerability scanners. However, current scanners are capable of detecting just one of the two main modalities of XSS attacks. This paper introduces a novel multi–agent system for the automated scanning of web sites to detect the presence of XSS vulnerabilities exploitable by an stored–XSS attack. The rate of detection of the system is evaluated in two different scenarios.
Labelling IDS clusters by means of the silhouette index
(Jordi Herrera Joancomarti, 2006-09) Petrovic, Slovodan; Álvarez, Gonzalo; Orfila, Agustín; Carbó Rubiera, Javier Ignacio
One of the most difficult problems in the design of an anomaly based intrusion detection system (IDS) that uses clustering is that of labelling the ob- tained clusters, i.e. determining which of them correspond to ”good” behaviour on the network/host and which to ”bad” behaviour. In this paper, a new clusters’ labelling strategy, which makes use of the Silhouette clustering quality index is proposed for application in such an IDS. The aim of the new labelling algorithm is to detect compact clusters containing very similar vectors and these are highly likely to be attack vectors. The effectiveness of a multiple classifier IDS with the Silhouette index implemented is compared to the effectiveness of a system em- ploying a classical cardinality-based labelling strategy. Experimental results show that the system using the Silhouette index produces much more accurate results than the system that uses the classical cardinality-based labelling. Possibilities of improving the overall efficiency of an IDS using the new labelling algorithm are also discussed.
Modeling NIDS evasion with genetic programming
(CSREA Press, 2010-07) Pastrana, Sergio; Orfila, Agustín; Ribagorda Garnacho, Arturo
Nowadays, Network Intrusion Detection Systems are quickly updated in order to prevent systems against new attacks. This situation has provoked that attackers focus their efforts on new sophisticated evasive techniques when trying to attack a system. Unfortunately, most of these techniques are based on network protocols ambiguities [1], so NIDS designers must take them into account when updating their tools. In this paper, we present a new approach to improve the task of looking for new evasive techniques. The core of our work is to model existing NIDS using the Genetic Pro- gramming paradigm. Thus, we obtain models that simulate the behavior of NIDS with great precision, but with a much simpler semantics than the one of the NIDS. Looking for this easier semantics allows us to easily construct evasions on the model, and therefore on the NIDS, as their behavior is quite similar. Our results show how precisely GP can model a NIDS behavior.
Robust new method in frequency domain watermarking
(Springer, 2001-10) Sánchez, David; Orfila, Agustín; Hernández-Castro, Julio C.; Sierra, José M.
This article presents a new and robust watermarking method in the frequency domain that improves over the existing ones. It is robust to JPEG compression, very configurable, simple, efficient and very easy to implement. Apart from JPEG test, it shows very good results in all tests applied.
Printers are dangerous
(IEEE, 2001-10) Hernández-Castro, Julio C.; Sierra, José M.; González-Tablas, Ana Isabel; Orfila, Agustín
In the last years, many new intelligent full-featured peripherals that assist information systems have appeared. Those peripherals, such as printers, copiers, PDA organizers, Web cameras, etc. usually have a very friendly way of configuration and management (via http, ftp or telnet servers) and offer more networked services everyday. Their computation, memory and networking capabilities have also increased in the last years. Nowadays, many of them are comparable to workstations and run complete operating systems such as Linux or Solaris. All those factors imply that these devices could represent a real threat to the security of information systems. This problem is even worse because most of those peripherals have been considered inoffensive and not many administrators are aware of their security risks. The most representative example is printers, which have been traditionally considered totally harmless devices. At the present time, that idea is difficult to defend because many security incidents related with networked printers have arisen in the last years. System and security administrators have traditionally focused their efforts in fortifying servers and hosts only, but it seems that this view is not enough for assuring security nowadays.
Labelling clusters in an intrusion detection system using a combination of clustering evaluation techniques
(IEEE, 2006-01) Petrovic, Slovodan; Álvarez, Gonzalo; Orfila, Agustín; Carbó Rubiera, Javier Ignacio
A new clusters labelling strategy, which combines the computation of the Davies-Bouldin index of the clustering and the centroid diameters of the clusters is proposed for application in anomaly based intrusion detection systems (IDS). The aim of such a strategy is to detect compact clusters containing very similar vectors and these are highly likely to be attack vectors. Experimental results comparing the effectiveness of a multiple classifier IDS with such a labelling strategy and that of the classical cardinality labelling based IDS show that the proposed strategy behaves much better in a heavily attacked environment where massive attacks are present. The parameters of the labelling algorithm can be varied in order to adapt to the conditions in the monitored network.
Adaptive agents applied to intrusion detection
(Springer, 2003-06) Carbó Rubiera, Javier Ignacio; Orfila Díaz-Pabon, Agustín; Ribagorda Garnacho, Arturo
This paper proposes a system of agents that make predictions over the presence of intrusions. Some of the agents act as predictors implementing a given Intrusion Detection model, sniffing out the same traffic. An assessment agent weights the forecasts of such predictor agents, giving a final binary conclusion using a probabilistic model. These weights are continuously adapted according to the previous performance of each predictor agent. Other agent establishes if the prediction from the assessor agent was right or not, sending him back the results. This process is continually repeated and runs without human interaction. The effectiveness of our proposal is measured with the usual method applied in Intrusion Detection domain: Receiver Operating Characteristic curves (detection rate versus false alarm rate). Results of the adaptive agents applied to intrusion detection improve ROC curves as it is shown in this paper.
Improving network intrusion detection by means of domain-aware genetic programming
(IEEE, 2010-02) Blasco Alís, Jorge; Orfila Díaz-Pabon, Agustín; Ribagorda Garnacho, Arturo
One of the central areas in network intrusion detection is how to build effective systems that are able to distinguish normal from intrusive traffic. In this paper we explore the use of Genetic Programming (GP) for such a purpose. Although GP has already been studied for this task, the inner features of network intrusion detection have been systematically ignored. To avoid the blind use of GP shown in previous research, we guide the search by means of a fitness function based on recent advances on IDS evaluation. For the experimental work we use a well-known dataset (i.e. KDD- 99) that has become a standard to compare research although its drawbacks. Results clearly show that an intelligent use of GP achieves systems that are comparable (and even better in realistic conditions) to top state-of-the-art proposals in terms of effectiveness, improving them in efficiency and simplicity.
Fuzzy logic on decision model for IDS
(IEEE, 2003-05) Orfila, Agustín; Carbó Rubiera, Javier Ignacio; Ribagorda Garnacho, Arturo
Nowadays one of the main problems of Intrusion Detection Systems (IDS) is the high rate of false positives that they show. The number of alerts that an IDS launches are clearly higher than the number of real attacks. This paper tries to introduce a measure of the IDS prediction skill in close relationship with these false positives. So the prediction skill of an IDS is then computed according to the false positives produced. The problem faced is how to make an accurate prediction from the results of different IDS. The fraction of IDS over the total number of them that predicts a given event will determine whether such event is predicted or not. The performance obtained from the application of fuzzy thresholds over such fraction is compared with the corresponding crisp thresholds. The results of these comparisons allow us to conclude a relevant improvement when fuzzy thresholds are involved.
Effectiveness evaluation of data mining based IDS
(Springer, 2006-07) Orfila, Agustín; Carbó Rubiera, Javier Ignacio; Ribagorda Garnacho, Arturo
Data mining has been widely applied to the problem of Intrusion Detection in computer networks. However, the misconception of the underlying problem has led to out of context results. This paper shows that factors such as the probability of intrusion and the costs of responding to detected intrusions must be taken into account in order to compare the effectiveness of machine learning algorithms over the intrusion detection domain. Furthermore, we show the advantages of combining different detection techniques. Results regarding the well known 1999 KDD dataset are shown.
Evolving high-speed, easy-to-understand network intrusion detection rules with genetic programming
(Springer, 2009-04) Orfila Díaz-Pabon, Agustín; Estévez Tapiador, Juan Manuel; Ribagorda Garnacho, Arturo
An ever-present problem in intrusion detection technology is how to construct the patterns of (good, bad or anomalous) behaviour upon which an engine have to make decisions regarding the nature of the activity observed in a system. This has traditionally been one of the central areas of research in the field, and most of the solutions proposed so far have relied in one way or another upon some form of data mining–with the exception, of course, of human-constructed patterns. In this paper, we explore the use of Genetic Programming (GP) for such a purpose. Our approach is not new in some aspects, as GP has already been partially explored in the past. Here we show that GP can offer at least two advantages over other classical mechanisms: it can produce very lightweight detection rules (something of extreme importance for high-speed networks or resource-constrained applications) and the simplicity of the patterns generated allows to easily understand the semantics of the underlying attack.
Fast predictor-corrector intrusion detection system based on clustering
(Díaz de Santos, 2004-09) Petrovic, Slovodan; Álvarez, Gonzalo; Orfila, Agustín; Carbó Rubiera, Javier Ignacio
A predictor-corrector intrusion detection system is proposed, whose predictors are various clustering algorithms with different initial parameters that operate in parallel on the current data set. The decisions whether abnormal behaviour is detected in the current data set are made by a number of assessors that implement various clustering quality evaluation techniques. The manager of the system estimates the quality of decision making from the pieces of information obtained a posteriori and then varies the parameters of the predictors and/or the assessors in order to achieve better overall performance of the system. In such a way, the intelligence of the system is delegated to higher decision making levels, which improves the effectiveness. Experimental results regarding the effectiveness of the system are given with the KDD CUP 1999 test data as the reference data set. These results show that very good overall performance can be achieved by selecting properly various system parameters.
Negotiation of network security policy by means of agents
(Springer, 2009-03) Martín, Pablo; Orfila, Agustín; Carbó Rubiera, Javier Ignacio
Nowadays many intranets are deployed without enforcing any network security policy and just relying on security technologies such as firewalls or antivirus. In addition, the number and type of network entities are no longer fixed. Typically, laptops, PDAs or mobile phones need to have access to network resources occasionally. Therefore, it is important to design flexible systems that allow an easy administration of connectivity without compromising security. This article shows how software agents may provide secure configurations to a computer network in a distributed, autonomous and dynamic manner. Thus, here we describe the system architecture of a prototype, the negotiation protocol it uses and how it works in a sample scenario.

Browse

Recent Submissions