Question: Distributed privacy-preserving collaborative intrusion detection systems for vehicular ad-hoc networks (VANETs).

This paper introduces innovative algorithms and establishes tight error bounds for private empirical risk minimization, a fundamental technique in machine learning and statistical analysis. Assuming that individual data points' contributions to the loss function are Lipschitz continuous and the optimization domain is bounded, we propose new algorithms that operate efficiently under differential privacy constraints. Our algorithms are tailored for both (ε, 0) and (ε, δ)-differential privacy, each employing distinct techniques to achieve optimal performance. Remarkably, for some scenarios, these algorithms match the non-private optimal running time in terms of oracle complexity. We also provide a separate set of algorithms designed specifically for scenarios where the loss functions exhibit strong convexity. Our lower bounds, applicable even to simple and smooth function families like linear and quadratic functions, underscore the challenges in achieving privacy while maintaining statistical accuracy. This implies that, for certain smooth loss functions, previous methods can indeed yield optimal error rates. However, for non-smooth loss functions, such as those encountered in training support vector machines or computing the high-dimensional median, optimal algorithms were not previously available. Our findings reveal that straightforward smoothing approaches to adapt these loss functions for privacy-preserving techniques do not result in optimal error rates, highlighting the need for specialized algorithms in these contexts.

In the realm of distributed privacy-preserving collaborative intrusion detection systems for VANETs (Vehicular Ad Hoc Networks), this research contributes significantly by addressing the challenges of privacy and efficiency in the context of empirical risk minimization. The algorithms and bounds presented herein can be adapted to enhance privacy while maintaining the effectiveness of collaborative intrusion detection systems in VANETs, ensuring that vehicles can securely share information to detect and respond to potential security threats without compromising individual privacy.

Attribute based encryption (ABE) [13] determines decryption ability based on a user's attributes. In a multi-authority ABE scheme, multiple attribute-authorities monitor different sets of attributes and issue corresponding decryption keys to users, and encryptors can require that a user obtain keys for appropriate attributes from each authority before decrypting a message. Chase [5] gave a multi-authority ABE scheme using the concepts of a trusted central authority (CA) and global identifiers (GID). However, the CA in that construction has the power to decrypt every ciphertext, which seems somehow contradictory to the original goal of distributing control over many potentially untrusted authorities. Moreover, in that construction, the use of a consistent GID allowed the authorities to combine their information to build a full profile with all of a user's attributes, which unnecessarily compromises the privacy of the user. In this paper, we propose a solution which removes the trusted central authority, and protects the users' privacy by preventing the authorities from pooling their information on particular users, thus making ABE more usable in practice.

Hyperledger Fabric is a "permissioned" blockchain architecture, providing a consistent distributed ledger, shared by a set of "peers." As with every blockchain architecture, the core principle of Hyperledger Fabric is that all the peers must have the same view of the shared ledger, making it challenging to support private data for the different peers. Extending Hyperledger Fabric to support private data (that can influence transactions) would open the door to many exciting new applications, in areas from healthcare to commerce, insurance, finance, and more. In this work we explored adding private-data support to Hyperledger Fabric using secure multiparty computation (MPC). Specifically, in our solution the peers store on the chain encryption of their private data, and use secure MPC whenever such private data is needed in a transaction. This solution is very general, allowing in principle to base transactions on any combination of public and private data. We created a demo of our solution over Hyperledger Fabric v1.0, implementing a bidding system where sellers can list assets on the ledger with a secret reserve price, and bidders publish their bids on the ledger but keep secret the bidding price itself. We implemented a smart contract (aka "chaincode") that runs the auction on this secret data, using a simple secure-MPC protocol that was built using the EMP-toolkit library. The chaincode itself was written in Go, and we used the SWIG library to make it possible to call our protocol implementation in C++. We identified two basic services that should be added to Hyperledger Fabric to support our solution, and are now working on implementing them.

Direct radio-based vehicle-to-vehicle communication can help prevent accidents by providing accurate and up-to-date local status and hazard information to the driver. In this paper, we assume that two types of messages are used for traffic safety-related communication: 1) Periodic messages (ldquobeaconsrdquo) that are sent by all vehicles to inform their neighbors about their current status (i.e., position) and 2) event-driven messages that are sent whenever a hazard has been detected. In IEEE 802.11 distributed-coordination-function-based vehicular networks, interferences and packet collisions can lead to the failure of the reception of safety-critical information, in particular when the beaconing load leads to an almost-saturated channel, as it could easily happen in many critical vehicular traffic conditions. In this paper, we demonstrate the importance of transmit power control to avoid saturated channel conditions and ensure the best use of the channel for safety-related purposes. We propose a distributed transmit power control method based on a strict fairness criterion, i.e., distributed fair power adjustment for vehicular environments (D-FPAV), to control the load of periodic messages on the channel. The benefits are twofold: 1) The bandwidth is made available for higher priority data like dissemination of warnings, and 2) beacons from different vehicles are treated with ldquoequal rights,rdquo and therefore, the best possible reception under the available bandwidth constraints is ensured. We formally prove the fairness of the proposed approach. Then, we make use of the ns-2 simulator that was significantly enhanced by realistic highway mobility patterns, improved radio propagation, receiver models, and the IEEE 802.11p specifications to show the beneficial impact of D-FPAV for safety-related communications. We finally put forward a method, i.e., emergency message dissemination for vehicular environments (EMDV), for fast and effective multihop information dissemination of event-driven messages and show that EMDV benefits of the beaconing load control provided by D-FPAV with respect to both probability of reception and latency.

Modern mobile phones and PDAs are equipped with positioning capabilities (e.g., GPS). Users can access public location-based services (e.g., Google Maps) and ask spatial queries. Although communication is encrypted, privacy and confidentiality remain major concerns, since the queries may disclose the location and identity of the user. Commonly, spatial K-anonymity is employed to hide the query initiator among a group of K users. However, existing work either fails to guarantee privacy, or exhibits unacceptably long response time. In this paper we propose MobiHide, a Peer-to-Peer system for anonymous location-based queries, which addresses these problems. MobiHide employs the Hilbert space-filling curve to map the 2-D locations of mobile users to 1-D space. The transformed locations are indexed by a Chord-based distributed hash table, which is formed by the mobile devices. The resulting Peer-to-Peer system is used to anonymize a query by mapping it to a random group of K users that are consecutive in the 1-D space. Compared to existing state-of-the-art, MobiHide does not provide theoretical anonymity guarantees for skewed query distributions. Nevertheless, it achieves strong anonymity in practice, and it eliminates system hotspots. Our experimental evaluation shows that MobiHide has good load balancing and fault tolerance properties, and is applicable to real-life scenarios with numerous mobile users.

Outsourcing an image classification task raises privacy concerns, both from the image provider’s perspective, who wishes to keep their images confidential, and from the classification algorithm provider’s perspective, who wishes to protect the intellectual property of their classifier. We propose EPIC, an efficient private image classification system based on support vector machine (SVM) learning, secure against malicious adversaries. EPIC builds upon transfer learning techniques known from the Machine Learning (ML) literature and minimizes the load on the privacy-preserving part. Our solution is based on Multiparty Computation (MPC), it is 34 times faster than Gazelle (USENIX’18) –the state-of-the-art in private image classification– and it improves the communication cost by 50 times, with a 7% higher accuracy on CIFAR-10 dataset. For the same accuracy as Gazelle achieves on CIFAR-10, EPIC is 700 times faster and the communication cost is reduced by 500 times.

In smart cities, wireless sensor networks (WSNs) act as a type of core infrastructure that collects data from the city to implement smart services. The security of WSNs is one of the key issues of smart cities. In resource-restrained WSNs, dynamic ongoing or unknown attacks usually steer clear of isolated defense components. Therefore, to resolve this problem, we propose a hierarchical framework based on chance discovery and usage control (UCON) technologies to improve the security of WSNs while still taking the low-complexity and high security requirements of WSNs into account. The features of continuous decision and dynamic attributes in UCON can address ongoing attacks using advanced persistent threat detection. In addition, we use a dynamic adaptive chance discovery mechanism to detect unknown attacks. To design and implement a system using the mechanism described above, a unified framework is proposed in which low-level attack detection with simple rules is performed in sensors, and high-level attack detection with complex rules is performed in sinks and at the base station. Moreover, software-defined networking and network function virtualization technologies are used to perform attack mitigation when either low-level or high-level attacks are detected. An experiment was performed to acquire an attack data set for evaluation. Then, a simulation was created to evaluate the resource consumption and attack detection rate. The results demonstrate the feasibility and efficiency of the proposed scheme.

In the Big Data era, personal metadata may will become a new type of corporate asset, however there have already been a growing public concern about user’s privacy mined from metadata. In this paper we address the problem of implementing the self-sovereignty of personal metadata on the existing OpenPDS/SafeAnswers framework according to the Windhover Principle. In order to do that, we propose a new framework, called BlocakChain-based Personal Data Store (BCPDS), to realize two basic properties: notary and autonomy. This framework, firstly introduces the BlockChain as a notary, into OpenPDS/SafeAnswers for secure storage of personal meta-data instead of the original database. Next, we present an AutoNomybased Access Control (ANAC) to improve the SafeAnswers module, where ANAC is a new mechanism that enforces access based on the relationship among all authorized users and metadata’s owner. In addition, we also propose General Access Structure (GAS) and threshold secret sharing scheme in BlockChain as an implementation method for our BC-PDS framework.

The ubiquity of sensors-equipped mobile devices has enabled citizens to contribute data via participatory sensing systems. This emergent paradigm comes with various applications to improve users' quality of life. However, the data collection process may compromise the participants' privacy when reporting data tagged or correlated with their sensitive information. Therefore, anonymization and location cloaking techniques have been designed to provide privacy protection, yet to some cost of data utility which is a major concern for queriers. Different from past works, we assess simultaneously the two competing goals of ensuring the queriers' required data utility and protecting the participants' privacy. First, we introduce a trust worthy entity to the participatory sensing traditional system. Also, we propose a general privacy-preserving mechanism that runs on this entity to release a distorted version of the sensed data in order to minimize the information leakage with its associated private information. We demonstrate how to identify a near-optimal solution to the privacy-utility tradeoff by maximizing a privacy score while considering a utility metric set by data queriers (service providers). Furthermore, we tackle the challenge of data with large size alphabets by investigating quantization techniques. Finally, we evaluate the proposed model on three different real datasets while varying the prior knowledge and the obfuscation type. The obtained results demonstrate that, for different applications, a limited distortion may ensure the participants' privacy while maintaining about 98% of the required data utility.

Communication network is facilitated with different protocol .Each protocol supported to increase the network performance in a secured manner. In communication process, user’s connectivity, violations of policy on access of information are handles through intrusion. Intrusion prevention is the process of performing intrusion detection and attempting to stop detected possible incidents. It focused on identifying possible incidents, logging information about them, attempting to stop them, and reporting them to security administrators. However, organizations use Intrusion detection and prevention system (IDPS) for other purposes, such as identifying problems with security policies, documenting existing threats, and determining individuals from violating security policies. Communication architecture is built up on IP.Internet Control Message Protocol (ICMP ) protocol is tightly integrated with IP. ICMP messages, delivered in IP packets, are used for out-of-band messages related to network operation or mis-operation.In this paper describes about HDLC , ICMP protocol sequences which is used to detect the intrusion on hybrid network and its attributes are recommend the standardized protocol for the intrusion detection process. This standardization protocol compare the previous part of the research of HDLC and ICMP protocols.

By regularly querying Web search engines, users (unconsciously) disclose large amounts of their personal data as part of their search queries, among which some might reveal sensitive information (e.g. health issues, sexual, political or religious preferences). Several solutions exist to allow users querying search engines while improving privacy protection. However, these solutions suffer from a number of limitations: some are subject to user re-identification attacks, while others lack scalability or are unable to provide accurate results. This paper presents CYCLOSA, a secure, scalable and accurate private Web search solution. CYCLOSA improves security by relying on trusted execution environments (TEEs) as provided by Intel SGX. Further, CYCLOSA proposes a novel adaptive privacy protection solution that reduces the risk of user re-identification. CYCLOSA sends fake queries to the search engine and dynamically adapts their count according to the sensitivity of the user query. In addition, CYCLOSA meets scalability as it is fully decentralized, spreading the load for distributing fake queries among other nodes. Finally, CYCLOSA achieves accuracy of Web search as it handles the real query and the fake queries separately, in contrast to other existing solutions that mix fake and real query results.


Question: Distributed collaborative intrusion detection systems for VANETs with privacy preservation.

This paper introduces EXPOSURE, a sophisticated passive DNS analysis service developed to identify and report domains engaged in malicious activities. Given the critical role of DNS in managing extensive networks of compromised devices for various nefarious purposes, such as phishing, spam, and botnet command-and-control, monitoring DNS queries has emerged as a potent strategy for blacklisting malicious domains. EXPOSURE is uniquely designed to detect such domains in real-time, utilizing a comprehensive set of 15 distinctive features categorized into four main groups. To validate its effectiveness, we conducted a rigorous experiment employing a vast, real-world dataset encompassing billions of DNS requests. The overwhelmingly positive outcomes from these tests spurred us to actualize our techniques and launch them as a complimentary, online service. Herein, we detail the EXPOSURE system, sharing insights and findings garnered from its 17-month operational period. Throughout this duration, the service successfully identified over 100,000 malicious domains. Furthermore, daily updates on the service's webpage provide detailed statistics regarding domain usage times, query volumes, and target IP addresses. This comprehensive approach not only enhances the detection of malicious domains but also contributes to the broader cybersecurity community by offering actionable insights and data.

This paper studies the feasibility of privacy-preservingdata mining in epidemiological study. As for the data-miningalgorithm, we focus to a linear multiple regression thatcan be used to identify the most significant factorsamong many possible variables, such as the historyof many diseases. We try to identify the linear model to estimate a lengthof hospital stay from distributed dataset related tothe patient and the disease information. In this paper, we have done experiment usingthe real medical dataset related to stroke andattempt to apply multiple regression with sixpredictors of age, sex, the medical scales, e.g., Japan Coma Scale, and the modified Rankin Scale. Our contributions of this paper include(1) to propose a practical privacy-preserving protocols for linear multiple regressionwith vertically partitioned datasets, and(2) to show the feasibility of the proposed system usingthe real medical dataset distributed into two parties, the hospital who knows the technical details of diseasesduring the patients are in the hospital, and the local government who knows the residence even afterthe patients left hospital. (3) to show the accuracy and the performance of thePPDM system which allows us to estimate the expectedprocessing time with arbitrary number of predictors.

S ensor networks hold the promise of facilitating large-scale, real-time data processing in complex environments. Their foreseeable applications will help protect and monitor critical military, environmental, safety-critical , or domestic infrastructures and resources. In these and other vital or security-sensitive deployments, keeping the network available for its intended use is essential. The stakes are high: Denial of service attacks against such networks may permit real-world damage to the health and safety of people. Without proper security mechanisms, networks will be confined to limited, controlled environments , negating much of the promise they hold. The limited ability of individual sensor nodes to thwart failure or attack makes ensuring network availability more difficult. To identify denial of service vulnerabilities, we analyze two effective sensor network protocols that did not initially consider security. These examples demonstrate that consideration of security at design time is the best way to ensure successful network deployment. Advances in miniaturization combined with an insatiable appetite for previously unrealizable information gathering have lead to the development of new kinds of networks. In many areas, static infrastruc-tures are giving way to dynamic ad-hoc networks. One manifestation of these trends is the development of highly application-dependent sensor networks. Developers build sensor networks to collect and analyze low-level data from an environment of interest. Accomplishing the network's goal often depends on local cooperation, aggregation, or data processing because individual nodes have limited capabilities. Physically small, nodes have tiny or irreplaceable power reserves, communicate wirelessly, and may not possess unique identifiers. Further, they must form ad hoc relationships in a dense network with little or no preexisting infrastructure. Protocols and algorithms operating in the network must support large-scale distribution, often with only localized interactions among nodes. The network must continue operating even after significant node failure, and it must meet real-time requirements. In addition to the limitations imposed by application-dependent deadlines, because it reflects a changing environment, the data the network gathers may intrinsically be valid for only a short time. Sensor networks may be deployed in a host of different environments, and they often figure into military scenarios. These networks may gather intelligence in battlefield conditions, track enemy troop movements, monitor a secured zone for activity , or measure damage and casualties. An airplane or artillery 1 could deploy these networks to otherwise unreachable regions. Although military applications may be the easiest to imagine, much broader opportunities await. Sensor networks could form …

Jimmy Lin, Adam Roegiest, Luchen Tan, Richard McCreadie, Ellen Voorhees, and Fernando Diaz 1 David R. Cheriton School of Computer Science, University of Waterloo, Ontario, Canada 2 School of Computing Science, University of Glasgow, Scotland, the United Kingdom 3 National Institute for Standards and Technology, Maryland, USA 4 Microsoft Research, New York, USA {jimmylin, aroegies, luchen.tan}@uwaterloo.ca richard.mccreadie@glasgow.ac.uk, ellen.voorhees@nist.gov, fdiaz@microsoft.com

The large-scale automated transaction systems of the near future can be designed to protect the privacy and maintain the security of both individuals and organizations.

Nowadays, the many traffic information are extracted from CCTV. The road occupancy, vehicle speed, accident detection, traffic collision and weather information are calculated in CCTV. These are big data comes from varying sources, such as, social sites or mobile phone GPS signals and so on. The Hadoop and HBase can store and analyze these real-time big data in a distributed processing framework. This framework can be designed as flexible and scalable framework using distributed CEP that process massive real-time traffic data and ESB that integrates other services. In this paper, we propose a new architecture for distributed processing that enables big data processing on the road traffic data with specially weather information and its related information analysis. We tested the proposed framework on road traffic data gathering 41 CCTV from Icheon to Gangneung freeway section in Korea. And the forecasting method is introduced at intermediate local area between CCTV.

In modern societies, the number of mobile users has dramatically risen in recent years. In this paper, an efficient authentication scheme for distributed mobile cloud computing services is proposed. The proposed scheme provides security and convenience for mobile users to access multiple mobile cloud computing services from multiple service providers using only a single private key. The security strength of the proposed scheme is based on bilinear pairing cryptosystem and dynamic nonce generation. In addition, the scheme supports mutual authentication, key exchange, user anonymity, and user untraceability. From system implementation point of view, verification tables are not required for the trusted smart card generator (SCG) service and cloud computing service providers when adopting the proposed scheme. In consequence, this scheme reduces the usage of memory spaces on these corresponding service providers. In one mobile user authentication session, only the targeted cloud service provider needs to interact with the service requestor (user). The trusted SCG serves as the secure key distributor for distributed cloud service providers and mobile clients. In the proposed scheme, the trusted SCG service is not involved in individual user authentication process. With this design, our scheme reduces authentication processing time required by communication and computation between cloud service providers and traditional trusted third party service. Formal security proof and performance analyses are conducted to show that the scheme is both secure and efficient.

The continuous increase in complexity in automotive electronics has led to cars that include up to 80 Electronic Control Units (ECUs). As a consequence, in-car networks are currently up to their limit in terms of data load, flexibility and bandwidth. The Ethernet backbone is thus considered as the best performing solution. On the other hand, the growing interconnection of cars with the external world requires high security standards in order to prevent safety risks for car passengers. The IEEE 802.1AE MAC Security Standard (MACSec) solves the security issues of Ethernet networks by providing confidentiality, authenticity and integrity of data. This paper presents an efficient hardware implementation of the MACSec standard for the automotive world. The system was synthesized on a Stratix V FPGA and on a 28nm standard-cell CMOS technology. In terms of maximum throughput, the FPGA results in 1.1 Gbps while the standard-cell technology reaches 3.9 Gbps. The FPGA implementation occupies 4.5% of the Adaptive Logic Modules (ALMs) while the standard-cell one gives a 285 kgate size. The proposed architecture represents a suitable implementation for a low area and high-performance solution as usually required by in-car network controllers.

Modern vehicles are evolving with more electronic components than ever before (In this paper, “vehicle” means “automotive vehicle.” It is also equal to “car.”) One notable example is graphical processing unit (GPU), which is a key component to implement a digital cluster. To implement the digital cluster that displays all the meters (such as speed and fuel gauge) together with infotainment services (such as navigator and browser), the GPU needs to be virtualized; however, GPU virtualization for the digital cluster has not been addressed yet. This paper presents a Virtualized Automotive DIsplay (VADI) system to virtualize a GPU and its attached display device. VADI manages two execution domains: one for the automotive control software and the other for the in-vehicle infotainment (IVI) software. Through GPU virtualization, VADI provides GPU rendering to both execution domains, and it simultaneously displays their images on a digital cluster. In addition, VADI isolates GPU from the IVI software in order to protect it from potential failures of the IVI software. We implement VADI with Vivante GC2000 GPU and perform experiments to ensure requirements of International Standard Organization (ISO) safety standards. The results show that VADI guarantees 30 frames per second (fps), which is the minimum frame rate for digital cluster mandated by ISO safety standards even with the failure of the IVI software. It also achieves 60 fps in a synthetic workload.

With the advancement of information and communication technology, data are being generated at an exponential rate via various instruments and collected at an unprecedented scale. Such large volume of data generated is referred to as big data, which now are revolutionizing all aspects of our life ranging from enterprises to individuals, from science communities to governments, as they exhibit great potentials to improve efficiency of enterprises and the quality of life. To obtain nontrivial patterns and derive valuable information from big data, a fundamental problem is how to properly place the collected data by different users to distributed clouds and to efficiently analyze the collected data to save user costs in data storage and processing, particularly the cost savings of users who share data. By doing so, it needs the close collaborations among the users, by sharing and utilizing the big data in distributed clouds due to the complexity and volume of big data. Since computing, storage and bandwidth resources in a distributed cloud usually are limited, and such resource provisioning typically is expensive, the collaborative users require to make use of the resources fairly. In this paper, we study a novel collaboration- and fairness-aware big data management problem in distributed cloud environments that aims to maximize the system throughout, while minimizing the operational cost of service providers to achieve the system throughput, subject to resource capacity and user fairness constraints. We first propose a novel optimization framework for the problem. We then devise a fast yet scalable approximation algorithm based on the built optimization framework. We also analyze the time complexity and approximation ratio of the proposed algorithm. We finally conduct experiments by simulations to evaluate the performance of the proposed algorithm. Experimental results demonstrate that the proposed algorithm is promising, and outperforms other heuristics.

Electronic toll collection transponders, e.g., E-ZPass, are a widely-used wireless technology. About 70% to 89% of the cars in US have these devices, and some states plan to make them mandatory. As wireless devices however, they lack a basic function: a MAC protocol that prevents collisions. Hence, today, they can be queried only with directional antennas in isolated spots. However, if one could interact with e-toll transponders anywhere in the city despite collisions, it would enable many smart applications. For example, the city can query the transponders to estimate the vehicle flow at every intersection. It can also localize the cars using their wireless signals, and detect those that run a red-light. The same infrastructure can also deliver smart street-parking, where a user parks anywhere on the street, the city localizes his car, and automatically charges his account. This paper presents Caraoke, a networked system for delivering smart services using e-toll transponders. Our design operates with existing unmodified transponders, allowing for applications that communicate with, localize, and count transponders, despite wireless collisions. To do so, Caraoke exploits the structure of the transponders' signal and its properties in the frequency domain. We built Caraoke reader into a small PCB that harvests solar energy and can be easily deployed on street lamps. We also evaluated Caraoke on four streets on our campus and demonstrated its capabilities.


Question: Distributed collaborative intrusion detection systems for VANETs with privacy preservation.

This paper explores a practical framework for maintaining privacy in statistical databases, focusing on the SuLQ (Sub-Linear Queries) method. In a SuLQ database, a trusted administrator adds noise to query responses to protect the privacy of individual entries. A query is defined by a set S of database rows and a function f that maps rows to binary values. The true answer to the query is the sum of f(di) for all i in S, and a slightly noisy version is released as the response. Previous work by Dinur, Dwork, and Nissim demonstrated that a high level of privacy can be achieved with minimal noise, much less than the sampling error, assuming the number of queries is less than the number of database rows. This assumption becomes more plausible as databases grow larger. Building upon this, the paper refines the privacy analysis to accommodate real-valued functions and arbitrary row types, resulting in significantly improved bounds on the noise needed for privacy. Additionally, the paper investigates the computational capabilities of the SuLQ primitive. It finds that, with only a few invocations of the primitive, slightly noisy versions of complex computations such as principal component analysis, k-means clustering, the Perceptron Algorithm, the ID3 algorithm, and even all algorithms operating in the statistical query learning model can be effectively carried out. This showcases the remarkable computational power of the SuLQ framework in privacy-preserving settings.

In these days an increasing number of public and commercial services are used through the Internet, so that security of information becomes more important issue in the society information Intrusion Detection System (IDS) used against attacks for protected to the Computer networks. On another way, some data mining techniques also contribute to intrusion detection. Some data mining techniques used for intrusion detection can be classified into two classes: misuse intrusion detection and anomaly intrusion detection. Misuse always refers to known attacks and harmful activities that exploit the known sensitivity of the system. Anomaly generally means a generally activity that is able to indicate an intrusion. In this paper, comparison made between 23 related papers of using data mining techniques for intrusion detection. Our work provide an overview on data mining and soft computing techniques such as Artificial Neural Network (ANN), Support Vector Machine (SVM) and Multivariate Adaptive Regression Spline (MARS), etc. In this paper comparison shown between IDS data mining techniques and tuples used for intrusion detection. In those 23 related papers, 7 research papers use ANN and 4 ones use SVM, because of ANN and SVM are more reliable than other models and structures. In addition, 8 researches use the DARPA1998 tuples and 13 researches use the KDDCup1999, because the standard tuples are much more credible than others. There is no best intrusion detection model in present time. However, future research directions for intrusion detection should be explored in this paper. Keywords— intrusion detection, data mining, ANN

The security event correlation scalability has become a major concern for security analysts and IT administrators when considering complex IT infrastructures that need to handle gargantuan amounts of events or wide correlation window spans. The current correlation capabilities of Security Information and Event Management (SIEM), based on a single node in centralized servers, have proved to be insufficient to process large event streams. This paper introduces a step forward in the current state of the art to address the aforementioned problems. The proposed model takes into account the two main aspects of this field: distributed correlation and query parallelization. We present a case study of a multiple-step attack on the Olympic Games IT infrastructure to illustrate the applicability of our approach.

Intelligent transportation systems (ITS) are becoming a crucial component of our society, whereas reliable and efficient vehicular communications consist of a key enabler of a well-functioning ITS. To meet a wide variety of ITS application needs, vehicular-to-vehicular and vehicular-to-infrastructure communications have to be jointly considered, configured, and optimized. The effective and efficient coexistence and cooperation of the two give rise to a dynamic spectrum management problem. One recently emerged and rapidly adopted solution of a similar problem in cellular networks is the so-termed device-to-device (D2D) communications. Its potential in the vehicular scenarios with unique challenges, however, has not been thoroughly investigated to date. In this paper, we for the first time carry out a feasibility study of D2D for ITS based on both the features of D2D and the nature of vehicular networks. In addition to demonstrating the promising potential of this technology, we will also propose novel remedies necessary to make D2D technology practical as well as beneficial for ITS.

The increasing network throughput challenges the current Network Intrusion Detection Systems (NIDS) to have compatible highperformance data processing. In this paper, we describe an in-depth research on the related techniques of high-performance network intrusion detection and an implementation of a Rule-based High-performance Network Intrusion Detection System (RHPNIDS) for high-speed networks. By integrating several performance optimizing methods, the performance of RHPNIDS is very impressive compared with the popular open source NIDS Snort. q 2004 Elsevier B.V. All rights reserved.

Increasing need for people to be "connected"; while at the same time remain as mobile as ever poses several interesting issues in wireless networks. It is conceivable in the near-future that wireless "hotspots" experience flash crowds-like traffic arrival pattern. A common phenomena in the Internet today characterized by sudden and unpredicted increase in popularity of on-line content. In this paper, we propose SPAWN, a cooperative strategy for content delivery and sharing in future vehicular networks. We study the issues involved in using such a strategy from the standpoint of vehicular ad-hoc networks. In particular, we show that not only content server but also wireless access network load reduction is critical. We propose a "communication efficient" swarming protocol which uses a gossip mechanism that leverages the inherent broadcast nature of the wireless medium, and a piece-selection strategy that takes proximity into account in decisions to exchange pieces. We show through simulation that gossip incorporates location-awareness into peer selection, while incurring low messaging overhead, and consequently enhancing the swarming protocol performance. We develop an analytical model to characterize the performance of SPAWN.

The Controller-Area Network (CAN) bus protocol [1] is a bus protocol invented in 1986 by Robert Bosch GmbH, originally intended for automotive use. By now, the bus can be found in devices ranging from cars and trucks, over lightning setups to industrial looms. Due to its nature, it is a system very much focused on safety, i.e., reliability. Unfortunately, there is no build-in way to enforce security, such as encryption or authentication. In this paper, we investigate the problems associated with implementing a backward compatible message authentication protocol on the CAN bus. We show which constraints such a protocol has to meet and why this eliminates, to the best of our knowledge, all the authentication protocols published so far. Furthermore, we present a message authentication protocol, CANAuth, that meets all of the requirements set forth and does not violate any constraint of the CAN bus. Keywords—CAN bus, embedded networks, broadcast authentication, symmetric cryptography

Traditionally, the vehicle has been the extension of the man's ambulatory system, docile to the driver's commands. Recent advances in communications, controls and embedded systems have changed this model, paving the way to the Intelligent Vehicle Grid. The car is now a formidable sensor platform, absorbing information from the environment (and from other cars) and feeding it to drivers and infrastructure to assist in safe navigation, pollution control and traffic management. The next step in this evolution is just around the corner: the Internet of Autonomous Vehicles. Pioneered by the Google car, the Internet of Vehicles will be a distributed transport fabric capable to make its own decisions about driving customers to their destinations. Like other important instantiations of the Internet of Things (e.g., the smart building), the Internet of Vehicles will have communications, storage, intelligence, and learning capabilities to anticipate the customers' intentions. The concept that will help transition to the Internet of Vehicles is the Vehicular Cloud, the equivalent of Internet cloud for vehicles, providing all the services required by the autonomous vehicles. In this article, we discuss the evolution from Intelligent Vehicle Grid to Autonomous, Internet-connected Vehicles, and Vehicular Cloud.

For the last two decades, intelligent transportation systems (ITS) have emerged as an efficient way of improving the performance of transportation systems, enhancing travel security, and providing more choices to travelers. A significant change in ITS in recent years is that much more data are collected from a variety of sources and can be processed into various forms for different stakeholders. The availability of a large amount of data can potentially lead to a revolution in ITS development, changing an ITS from a conventional technology-driven system into a more powerful multifunctional data-driven intelligent transportation system (D2ITS) : a system that is vision, multisource, and learning algorithm driven to optimize its performance. Furthermore, D2ITS is trending to become a privacy-aware people-centric more intelligent system. In this paper, we provide a survey on the development of D2ITS, discussing the functionality of its key components and some deployment issues associated with D2ITS Future research directions for the development of D2ITS is also presented.

Development of the cloud computing in recent years is increasing rapidly and gained great success, its security issues have got more and more attention. Many challenges in cloud computation increase the threat of data and service availability. There is need of many security services in order to improve cloud security for users as well as providers. In this paper, we propose a Anomaly Intrusion Detection System using machine learning approach for virtual machines on cloud computing. Our proposal is feature selection over events from Virtual Machine Monitor to detect anomaly in parallel to training the system so it will learn new threats and update the model. The experiment has been carried out on NSL-KDD'99 datasets using Naïve Bayes Tree (NB Tree) Classifier and hybrid approach of NB Tree and Random Forest.

In this work we propose a secure electronic voting protocol that is suitable for large scale voting over the Internet. The protocol allows a voter to cast his or her ballot anonymously, by exchanging untraceable yet authentic messages. The protocol ensures that (i) only eligible voters are able to cast votes, (ii) a voter is able to cast only one vote, (iii) a voter is able to verify that his or her vote is counted in the final tally, (iv) nobody, other than the voter, is able to link a cast vote with a voter, and (v) if a voter decides not to cast a vote, nobody is able to cast a fraudulent vote in place of the voter. The protocol does not require the cooperation of all registered voters. Neither does it require the use of complex cryptographic techniques like threshold cryptosystems or anonymous channels for casting votes. This is in contrast to other voting protocols that have been proposed in the literature. The protocol uses three agents, other than the voters, for successful operation. However, we do not require any of these agents to be trusted. That is, the agents may be physically co-located or may collude with one another to try to commit a fraud. If a fraud is committed, it can be easily detected and proven, so that the vote can be declared null and void. Although we propose the protocol with electronic voting in mind, the protocol can be used in other applications that involve exchanging an untraceable yet authentic message. Examples of such applications are answering confidential questionnaire anonymously or anonymous financial transactions.


Question: Distributed privacy-preserving collaborative intrusion detection systems for vehicular ad-hoc networks (VANETs).

In the realm of privacy-preserving machine learning, where the handling of sensitive personal data like medical or financial records is paramount, we present a suite of methods to create privacy-preserving approximations of classifiers derived through (regularized) empirical risk minimization (ERM). These techniques are designed to ensure privacy under the ε-differential privacy framework introduced by Dwork et al. (2006). Initially, we leverage the output perturbation method proposed by Dwork et al. (2006) for ERM classification tasks. Subsequently, we introduce a novel approach, objective perturbation, which involves adding noise to the objective function prior to the optimization process over classifiers. Provided the loss and regularization terms adhere to certain convexity and differentiability conditions, we establish theoretical guarantees for privacy preservation and provide generalization bounds for both linear and nonlinear kernels. Additionally, we propose a privacy-preserving methodology for tuning parameters in machine learning algorithms, ensuring comprehensive privacy protection throughout the training phase. Applying these techniques, we develop privacy-preserving versions of regularized logistic regression and support vector machines. Our empirical evaluations on real-world demographic and benchmark datasets yield promising results, demonstrating that objective perturbation outperforms output perturbation in balancing privacy and learning performance, both theoretically and in practical scenarios. This approach is particularly relevant for distributed privacy-preserving collaborative intrusion detection systems in VANETs, where the secure exchange of information is critical.

The use of wireless technology based on Vehicular Ad hoc Networks (VANETs) for information exchange can influence the drivers' behavior towards improving driving performance and reducing road accidents. This information can even be more relevant if it is presented as a video stream. In this paper we propose a system that relies on VANET and video-streaming technology: the See-Through System (STS). The system enhances driver's visibility and supports the driver's overtaking decision in challenging situations, such as overtaking a vision-obstructing vehicle. The use of the See-Through System provides the driver with an additional tool for determining if traffic conditions permit starting an overtaking maneuver thus reducing the risk of overtaking. We tested the See-Through System on an experimental vehicle on the road as well as in the context of a driving simulator for real world environment. Results are promising, since the use of the 802.11p standard wireless communication protocol allows a vehicle-to-vehicle connection without significant delay and the totality of the participants regarded the information provided by the STS as useful.

We propose a novel scheme for selective distribution of content, encoded as documents, that preserves the privacy of the users to whom the documents are delivered and is based on an efficient and novel group key management scheme. Our document broadcasting approach is based on access control policies specifying which users can access which documents, or subdocuments. Based on such policies, a broadcast document is segmented into multiple subdocuments, each encrypted with a different key. In line with modern attribute-based access control, policies are specified against identity attributes of users. However our broadcasting approach is privacy-preserving in that users are granted access to a specific document, or subdocument, according to the policies without the need of providing in clear information about their identity attributes to the document publisher. Under our approach, not only does the document publisher not learn the values of the identity attributes of users, but it also does not learn which policy conditions are verified by which users, thus inferences about the values of identity attributes are prevented. Moreover, our key management scheme on which the proposed broadcasting approach is based is efficient in that it does not require to send the decryption keys to the users along with the encrypted document. Users are able to reconstruct the keys to decrypt the authorized portions of a document based on subscription information they have received from the document publisher. The scheme also efficiently handles new subscription of users and revocation of subscriptions.

The modern automobile is controlled by networked computers. The security of these networks was historically of little concern, but researchers have in recent years demonstrated their many vulnerabilities to attack. As part of a defence against these attacks, we evaluate an anomaly detector for the automotive controller area network (CAN) bus. The majority of attacks are based on inserting extra packets onto the network. But most normal packets arrive at a strict frequency. This motivates an anomaly detector that compares current and historical packet timing. We present an algorithm that measures inter-packet timing over a sliding window. The average times are compared to historical averages to yield an anomaly signal. We evaluate this approach over a range of insertion frequencies and demonstrate the limits of its effectiveness. We also show how a similar measure of the data contents of packets is not effective for identifying anomalies. Finally we show how a one-class support vector machine can use the same information to detect anomalies with high confidence.

The IT security of automotive systems is an evolving area of research. To analyse the current situation and the potentially growing tendency of arising threats we performed several practical tests on recent automotive technology. With a focus on automotive systems based on CAN bus technology, this article summarises the results of four selected tests performed on the control systems for the window lift, warning light and airbag control system as well as the central gateway. These results are supplemented in this article by a classification of these four attack scenarios using the established CERT taxonomy and an analysis of underlying security vulnerabilities, and especially, potential safety implications. With respect to the results of these tests, in this article we further discuss two selected countermeasures to address basic weaknesses exploited in our tests. These are adaptations of intrusion detection (discussing three exemplary detection patterns) and IT-forensic measures (proposing proactive measures based on a forensic model). This article discusses both looking at the four attack scenarios introduced before, covering their capabilities and restrictions. While these reactive approaches are short-term measures, which could already be added to today’s automotive IT architecture, long-term concepts also are shortly introduced, which are mainly preventive but will require a major redesign. Beneath a short overview on respective research approaches, we discuss their individual requirements, potential and restrictions. & 2010 Elsevier Ltd. All rights reserved.

In recent years, the aspect of vehicular ad hoc network (VANET) is becoming an interesting research area; VANET is a mobile ad hoc network considered as a special case of mobile ad hoc network (MANET). Similar to MANET, VANET is characterized as autonomous and self-configured wireless network. However, VANET has very dynamic topology, large and variable network size, and constrained mobility; these characteristics led to the need for efficient routing and resource saving VANET protocols, to fit with different VANET environments. These differences render traditional MANET’s protocols unsuitable for VANET. The aim of this work is to give a survey of the VANETs routing mechanisms, this paper gives an overview of Vehicular ad hoc networks (VANETs) and the existing VANET routing protocols; mainly it focused on vehicle to vehicle (V2V) communication and protocols. The paper also represents the general outlines and goals of VANETs, investigates different routing schemes that have been developed for VANETs, as well as providing classifications of VANET routing protocols (focusing on two classification forms), and gives summarized comparisons between different classes in the context of their methodologies used, strengths, and limitations of each class scheme compared to other classes. Finally, it extracts the current trends and the challenges for efficient routing mechanisms in VANETs.

Cyber security methods are continually being developed. To test these methods many organizations utilize both virtual and physical networks which can be costly and time consuming. As an alternative, in this paper, we present a simulation modeling approach to represent computer networks and intrusion detection systems (IDS) to efficiently simulate cyber attack scenarios. The outcome of the simulation model is a set of IDS alerts that can be used to test and evaluate cyber security systems. In particular, the simulation methodology is designed to test information fusion systems for cyber security that are under development.

Hyperledger Fabric is a "permissioned" blockchain architecture, providing a consistent distributed ledger, shared by a set of "peers." As with every blockchain architecture, the core principle of Hyperledger Fabric is that all the peers must have the same view of the shared ledger, making it challenging to support private data for the different peers. Extending Hyperledger Fabric to support private data (that can influence transactions) would open the door to many exciting new applications, in areas from healthcare to commerce, insurance, finance, and more. In this work we explored adding private-data support to Hyperledger Fabric using secure multiparty computation (MPC). Specifically, in our solution the peers store on the chain encryption of their private data, and use secure MPC whenever such private data is needed in a transaction. This solution is very general, allowing in principle to base transactions on any combination of public and private data. We created a demo of our solution over Hyperledger Fabric v1.0, implementing a bidding system where sellers can list assets on the ledger with a secret reserve price, and bidders publish their bids on the ledger but keep secret the bidding price itself. We implemented a smart contract (aka "chaincode") that runs the auction on this secret data, using a simple secure-MPC protocol that was built using the EMP-toolkit library. The chaincode itself was written in Go, and we used the SWIG library to make it possible to call our protocol implementation in C++. We identified two basic services that should be added to Hyperledger Fabric to support our solution, and are now working on implementing them.

Cloud-enabled vehicular networks are a new paradigm to improve the quality of vehicular services, which have drawn considerable attention in industry and academia. In this paper, we consider the resource management and sharing problem for bandwidth and computing resources to support mobile applications in cloud-enabled vehicular networks. In such an environment, cloud service providers (SPs) can cooperate to form coalitions to share their idle resources with each other. We propose a coalition game model based on two-sided matching theory for cooperation among cloud SPs to share their idle resources. As a result, the resources can be better utilized, and the QoS for users can be improved. Numerical results indicate that our scheme can improve resource utilization and increase by 75% the QoS of the applications compared with that without cooperation. Moreover, the higher service cost of cooperation brings negative effect on coalition formation. The higher cooperation willingness of cloud SPs and the lower service cost support more service applications.

Intrusion detection is a process of identifying the Attacks. The main aim of IDS is to identify the Normal and Intrusive activities. In recent years, many researchers are using data mining techniques for building IDS. Here we propose a new approach using data mining technique such as SVM and Particle swarm optimization for attaining higher detection rate. The propose technique has major steps: Preprocessing, Training using PSO, clustering using K-means to generate different training subsets. Then based on the subsequent training subsets a vector for SVM classification is formed and in the end, classification using PSO is performed to detect Intrusion has happened or not. This paper contains summarization study and identification of the drawbacks of formerly surveyed works. Keywords-Intrusion detection system; Neuro-fuzzy; Support Vector Machine (SVM); PSO; K-means

Wireless communication networks are highly prone to security threats. The major applications of wireless communication networks are in military, business, healthcare, retail, and transportations. These systems use wired, cellular, or adhoc networks. Wireless sensor networks, actuator networks, and vehicular networks have received a great attention in society and industry. In recent years, the Internet of Things (IoT) has received considerable research attention. The IoT is considered as future of the internet. In future, IoT will play a vital role and will change our living styles, standards, as well as business models. The usage of IoT in different applications is expected to rise rapidly in the coming years. The IoT allows billions of devices, peoples, and services to connect with others and exchange information. Due to the increased usage of IoT devices, the IoT networks are prone to various security attacks. The deployment of efficient security and privacy protocols in IoT networks is extremely needed to ensure confidentiality, authentication, access control, and integrity, among others. In this paper, an extensive comprehensive study on security and privacy issues in IoT networks is provided. Keywords—Internet of Things (IoT); security issues in IoT; security; privacy


Question: Distributed privacy-preserving collaborative intrusion detection systems for vehicular ad hoc networks (VANETs).

This work introduces a novel approach for addressing resource allocation problems in a distributed setting while preserving the privacy of individual participants. Specifically, it focuses on optimization problems where the objective function is determined by the aggregate allocation (the sum of allocations for each participant), and where the constraints may contain sensitive information. The aim is to develop distributed algorithms that can solve these problems while safeguarding user privacy. In conventional settings, distributed algorithms often involve a central entity that calculates and disseminates coordination signals to all participants. However, these signals can potentially reveal sensitive information about individual users if intercepted by an adversary. To mitigate this risk, we propose a differentially private distributed optimization algorithm. Differentially private algorithms ensure a high level of privacy protection, guaranteeing that the privacy of users remains intact even if an adversary has access to auxiliary information. Our algorithm achieves privacy by adding controlled noise to the coordination signals, the scale of which is determined by the sensitivity of the projection operation onto the user-defined constraints. By treating the differentially private algorithm as an instantiation of stochastic gradient descent, we establish a bound for the algorithm's suboptimality. To demonstrate the practical implementation of our algorithm, we conduct a case study on electric vehicle charging. We calculate the sensitivity of the algorithm and present simulation results to explore various practical aspects, such as the selection of step size, the number of iterations required, and the balance between privacy and suboptimality. Through these simulations, we gain insights into how the algorithm performs in real-world scenarios.

Intrusion detection is an alternative to the situation of the security violation.Security mechanism of the network is necessary against the threat to the system. There are two types of intruders: external intruders, who are unauthorized users of the machines they attack, and internal intruders, who have permission to access the system with some restrictions. This paper describes a brief overview of various intrusion detection techniques such as fuzzy logic, neural network, pattern recognition methods, genetic algorithms and related techniques is presented. Among the several soft computing paradigms, fuzzy rule-based classifiers, decision trees, support vector machines, linear genetic programming is model fast and efficient intrusion detection systems. KeywordsIntroduction, intrusion detection methods, misuse detection techniques, anomaly detection techniques, genetic algorithms.

Advance in information and communication technologies, force us to keep most of the information electronically, consequently, the security of information has become a fundamental issue. The traditional intrusion detection systems look for unusual or suspicious activity, such as patterns of network traffic that are likely indicators of unauthorized activity. However, normal operation often produces traffic that matches likely "attack signature", resulting in false alarms. One main drawback is the inability of detecting new attacks which do not have known signatures. In this paper particle swarm optimization (PSO) is used to implement a feature selection, and support vector machine (SVMs) with the one-versus-rest method serve as a fitness function of PSO for classification problems from the literature. Experimental result shows that our method allows us to recognize not only known attacks but also to detect suspicious activity that may be the result of a new, unknown attack. Our method simplifies features effectively and obtains a higher classification accuracy compared to other methods

Wireless communication networks are highly prone to security threats. The major applications of wireless communication networks are in military, business, healthcare, retail, and transportations. These systems use wired, cellular, or adhoc networks. Wireless sensor networks, actuator networks, and vehicular networks have received a great attention in society and industry. In recent years, the Internet of Things (IoT) has received considerable research attention. The IoT is considered as future of the internet. In future, IoT will play a vital role and will change our living styles, standards, as well as business models. The usage of IoT in different applications is expected to rise rapidly in the coming years. The IoT allows billions of devices, peoples, and services to connect with others and exchange information. Due to the increased usage of IoT devices, the IoT networks are prone to various security attacks. The deployment of efficient security and privacy protocols in IoT networks is extremely needed to ensure confidentiality, authentication, access control, and integrity, among others. In this paper, an extensive comprehensive study on security and privacy issues in IoT networks is provided. Keywords—Internet of Things (IoT); security issues in IoT; security; privacy

In Vehicular Ad Hoc Networks (VANETs), moving vehicles are considered as mobile nodes in the network and they are connected to each other via wireless links when they are within the communication radius of each other. Efficient message delivery in VANETs is still a very challenging research issue. In this paper, a Q-learning based routing protocol (i.e., QGrid) is introduced to help to improve the message delivery from mobile vehicles to a specific location. QGrid considers both macroscopic and microscopic aspects when making the routing decision, while the traditional routing methods focus on computing meeting information between different vehicles. QGrid divides the region into different grids. The macroscopic aspect determines the optimal next-hop grid and the microscopic aspect determines the specific vehicle in the optimal next-hop grid to be selected as next-hop vehicle. QGrid computes the Q-values of different movements between neighboring grids for a given destination via Q-learning. Each vehicle stores Q-value table learned offline, then selects optimal next-hop grid by querying Q-value table. Inside the selected next-hop grid, we either greedily select the nearest neighboring vehicle to the destination or select the neighboring vehicle with highest probability of moving to the optimal next-hop grid predicted by the two-order Markov chain. The performance of QGrid is evaluated by using real life trajectory GPS data of Shanghai taxies. Simulation comparison among QGrid and other existing position-based routing protocols confirms the advantages of proposed QGrid routing protocol for VANETs.

Distributed Data Mining (DDM) has become one of the promising areas of Data Mining. DDM techniques include classifier approach and agent-approach. Classifier approach plays a vital role in mining distributed data, having homogeneous and heterogeneous approaches depend on data sites. Homogeneous classifier approach involves ensemble learning, distributed association rule mining, meta-learning and knowledge probing. Heterogeneous classifier approach involves collective principle component analysis, distributed clustering, collective decision tree and collective bayesian learning model. In this paper, classifier approach for DDM is summarized and an architectural model based on clustered-collaborative filtering for Electronic Health Records (EHR) is proposed.

The automotive industry is moving aggressively in the direction of advanced active safety. Dedicated short-range communication (DSRC) is a key enabling technology for the next generation of communication-based safety applications. One aspect of vehicular safety communication is the routine broadcast of messages among all equipped vehicles. Therefore, channel congestion control and broadcast performance improvement are of particular concern and need to be addressed in the overall protocol design. Furthermore, the explicit multichannel nature of DSRC necessitates a concurrent multichannel operational scheme for safety and non-safety applications. This article provides an overview of DSRC based vehicular safety communications and proposes a coherent set of protocols to address these requirements

Intrusion detection plays a vital role in maintaining the stability of any network. The major requirements for any intrusion detection system are speed, accuracy and less memory. Though various intrusion detection methods are available, they excel at some points while lack in the others. This paper presents a comprehensive survey of the technologies that are used for detecting intrusions. It analyzes the pros and cons of each technology and the literature works that utilizes these technologies. Challenges faced by the current IDS and the requirements for IDS in the current network scenario are discussed in detail. A detailed study on the datasets that can be used for effective building of an IDS is discussed. The research framework is proposed and a discussion of the various technologies that can be used for improving the efficiency of the IDS is provided.

Communication network is facilitated with different protocol .Each protocol supported to increase the network performance in a secured manner. In communication process, user’s connectivity, violations of policy on access of information are handles through intrusion. Intrusion prevention is the process of performing intrusion detection and attempting to stop detected possible incidents. It focused on identifying possible incidents, logging information about them, attempting to stop them, and reporting them to security administrators. However, organizations use Intrusion detection and prevention system (IDPS) for other purposes, such as identifying problems with security policies, documenting existing threats, and determining individuals from violating security policies. Communication architecture is built up on IP.Internet Control Message Protocol (ICMP ) protocol is tightly integrated with IP. ICMP messages, delivered in IP packets, are used for out-of-band messages related to network operation or mis-operation.In this paper describes about HDLC , ICMP protocol sequences which is used to detect the intrusion on hybrid network and its attributes are recommend the standardized protocol for the intrusion detection process. This standardization protocol compare the previous part of the research of HDLC and ICMP protocols.

The increase in the population of cities and the number of vehicles leads to increase in congestion on roads and accidents. The lack of quick medical service on road accidents is the major cause of death. In such situation, an automatic accident detection can help to save the loss of life. In this paper, a prototype is designed for an automatic accident detection using Vehicular Adhoc Network (VANET) and Internet of Things (IoT). The application is able to detect accident and severity of the emergency level with the help of mechanical and medical sensors deployed in the vehicle. In case of emergency, the message is sent to a hospital using VANET, where our central server is able to find out the location of the accident and nearest medical center. It sends a message for an ambulance after detecting basic information. In order to clear the path on the way to accident's location, the client application on the ambulance generates alert messages.

This paper describes a cooperative overlay network that provides anonymous communication services for participating users. The Anonymizing Peer-to-Peer Proxy (AP3) system provides clients with three primitives: (i) anonymous message delivery, (ii) anonymous channels, and (iii) secure pseudonyms. AP3 is designed to be lightweight, low-cost and provides "probable innocence" anonymity to participating users, even under a large-scale coordinated attack by a limited fraction of malicious overlay nodes. Additionally, we use AP3's primitives to build novel anonymous group communication facilities (multicast and anycast), which shield the identity of both publishers and subscribers.


Question: A framework for understanding and responding to social engineering attacks.

In recent times, the creation of ontologies—precise, formal definitions of domain-specific terms and their interrelations—has transitioned from the specialized domain of Artificial Intelligence research to the hands of domain experts. Ontologies have become ubiquitous on the World Wide Web, ranging from extensive taxonomies that categorize websites (e.g., Yahoo!) to detailed classifications of products and their attributes for online sales (e.g., Amazon.com). The World Wide Web Consortium (W3C) is currently working on the Resource Description Framework (RDF), a language designed to encode information on web pages in a manner that can be understood by automated agents searching for data. The Defense Advanced Research Projects Agency (DARPA) is also collaborating with the W3C to develop DAML (DARPA Agent Markup Language), an extension of RDF with enhanced features to support agent interaction on the web. Various fields have begun to create standardized ontologies that enable experts to share and annotate information within their disciplines. For instance, the medical field has developed comprehensive, structured vocabularies such as SNOMED and the Unified Medical Language System's semantic network. Additionally, broad, general-purpose ontologies are emerging, such as the UNSPSC ontology, a collaborative effort between the United Nations Development Program and Dun & Bradstreet, which offers standardized terminology for products and services.

Why might someone be interested in developing an ontology? Here are several motivating factors:

1. **Shared Understanding**: An ontology provides a common vocabulary for researchers and practitioners to communicate and share information effectively within a specific domain. It includes machine-interpretable definitions of fundamental concepts and the relationships between them, facilitating the exchange of data across different systems and platforms.

2. **Enhanced Data Integration**: By standardizing terminology and relationships, ontologies enable the seamless integration of data from various sources, enhancing the interoperability of information systems.

3. **Improved Information Retrieval**: Ontologies can improve the accuracy and relevance of search results by allowing search engines and other automated systems to understand the meaning and context of the data they are indexing.

4. **Support for Decision-Making**: In complex domains, ontologies can assist in decision-making processes by providing a structured framework for understanding and analyzing information.

5. **Facilitation of Knowledge Management**: Ontologies play a crucial role in knowledge management, helping organizations to capture, organize, and utilize knowledge in a systematic and efficient manner.

6. **Enhancement of Machine Learning and AI**: Ontologies can serve as a knowledge base for machine learning algorithms and artificial intelligence systems, enabling

We are currently living in an age, where the use of the Internet has become second nature to millions of people. Not only do businesses depend on the Internet for all types of electronic transactions, but more and more home users are experiencing the immense benefit of the Internet. However, this dependence and use of the Internet bring new and dangerous risks. This is due to increasing attempts from unauthorised third parties to compromise private information for their own benefit – the whole wide area of cyber crime. It is therefore essential that all users understand the risks of using the Internet, the importance of securing their personal information and the consequences if this is not done properly. It is well known that home users are specifically vulnerable, and that cyber criminals have such users squarely in their target. This vulnerability of home users are due to many factors, but one of the most important ones is the fact that such home users are in many cases not aware of the risks of using the Internet, and often venture into cyber space without any awareness preparation for this journey. This paper specifically investigates the position of the home user, and proposes a new model, The E-Awareness Model (E-AM), in which home users can be forced to acquaint themselves with the risks involved in venturing into cyber space. The E-AM consists of two components : the awareness component housed in the E-Awareness Portal, and the enforcement component. This model proposes a way to improve information security awareness amongst home users by presenting some information security content and enforcing the absorption of this content. The main difference between the presented model and other existing information security awareness models, is that in the presented model the acquiring/absorption of the awareness content is compulsory the user is forced to proceed via the E-Awareness Portal without the option of bypassing it.

Intelligent systems rely on pattern recognition and signaturebased approaches for a wide range of sensors enhancing situational awareness. For example, autonomous systems depend on environmental sensors to perform their tasks and secure systems depend on anomaly detection methods. The availability of large amount of data requires the processing of data in a “streaming” fashion with online algorithms. Yet, just as online learning can enhance adaptability to a non-stationary environment, it introduces vulnerabilities that can be manipulated by adversaries to achieve their goals while evading detection. Although human intelligence might have evolved from social interactions, machine intelligence has evolved as a human intelligence artifact and been kept isolated to avoid ethical dilemmas. As our adversaries become sophisticated, it might be time to revisit this question and examine how we can combine online learning and reasoning leading to the science of deceptive and counter-deceptive machines.

This report surveys the landscape of potential security threats from malicious uses of AI, and proposes ways to better forecast, prevent, and mitigate these threats. After analyzing the ways in which AI may influence the threat landscape in the digital, physical, and political domains, we make four high-level recommendations for AI researchers and other stakeholders. We also suggest several promising areas for further research that could expand the portfolio of defenses, or make attacks less effective or harder to execute. Finally, we discuss, but do not conclusively resolve, the long-term equilibrium of attackers and defenders.

Firms invest millions of dollars in the introduction of new information systems for long-term benefit. If employees are not willing to accept a new information system, such investments may be wasted. Employee acceptance of a new information system is in part determined by external influences. However, previous research has neglected the paths of persuasive strategies and external social influences on information system acceptance. Linkages between persuasive strategies and external social influences are also scarce. By integrating social influence theory and an elaboration likelihood model, this study explores the influence of persuasive messages (source credibility and argument quality) on social influence, affective response and cognitive response. This study also investigates the interrelationships among affective response, cognitive response and behavior intention. Furthermore, the moderating roles of social influences on the impact of affective response and cognitive response on behavior intention are identified. 2012 Elsevier Ltd. All rights reserved.

We present Aardvark, a social search engine. With Aardvark, users ask a question, either by instant message, email, web input, text message, or voice. Aardvark then routes the question to the person in the user's extended social network most likely to be able to answer that question. As compared to a traditional web search engine, where the challenge lies in finding the right document to satisfy a user's information need, the challenge in a social search engine like Aardvark lies in finding the right person to satisfy a user's information need. Further, while trust in a traditional search engine is based on authority, in a social search engine like Aardvark, trust is based on intimacy. We describe how these considerations inform the architecture, algorithms, and user interface of Aardvark, and how they are reflected in the behavior of Aardvark users.

Machine learning (ML) techniques are increasingly common in security applications, such as malware and intrusion detection. However, there is increasing evidence that machine learning models are susceptible to evasion attacks, in which an adversary makes small changes to the input (such as malware) in order to cause erroneous predictions (for example, to avoid being detected). Evasion attacks on ML fall into two broad categories: 1) those which generate actual malicious instances and demonstrate both evasion of ML and efficacy of attack (we call these problem space attacks), and 2) attacks which directly manipulate features used by ML, abstracting efficacy of attack into a mathematical cost function (we call these feature space attacks). Central to our inquiry is the following fundamental question: are feature space models of attacks useful proxies for real attacks? In the process of answering this question, we make two major contributions: 1) a general methodology for evaluating validity of mathematical models of ML evasion attacks, and 2) an application of this methodology as a systematic hypothesis-driven evaluation of feature space evasion attacks on ML-based PDF malware detectors. Specific to our case study, we find that a) feature space evasion models are in general not adequate in representing real attacks, b) such models can be significantly improved by identifying conserved features (features that are invariant in real attacks) whenever these exist, and c) ML hardened using the improved feature space models remains robust to alternative attacks, in contrast to ML hardened using a very powerful class of problem space attacks, which does not.

Protecting social norms as confidentiality wanes.

In recent years, online social media information has been the subject of study in several data science fields due to its impact on users as a communication and expression channel. Data gathered from online platforms such as Twitter has the potential to facilitate research over social phenomena based on sentiment analysis, which usually employs Natural Language Processing and Machine Learning techniques to interpret sentimental tendencies related to users’ opinions and make predictions about real events. Cyber-attacks are not isolated from opinion subjectivity on online social networks. Various security attacks are performed by hacker activists motivated by reactions from polemic social events. In this paper, a methodology for tracking social data that can trigger cyber-attacks is developed. Our main contribution lies in the monthly prediction of tweets with content related to security attacks and the incidents detected based on ℓ 1 regularization.

National critical infrastructure and industrial processes are heavily reliant on automation, monitoring and control technologies, including the widely used Supervisory Control and Data Acquisition (SCADA) systems. The growing interconnection of these systems with corporate networks exposes them to cyber attacks, with several security incidents reported over the last few decades. This study provides a classification scheme for categorising security incidents related to critical infrastructure and industrial control systems. The classification scheme is applied to analyse 242 security incidents on critical infrastructure and industrial control networks, which were reported between 1982 and 2014. The results show interesting patterns, with key points highlighted for the purpose of improving the way we plan for and direct efforts toward protecting critical infrastructure and industrial networks.

We trace in pragmatic terms some of what we know about knowledge, information technology, knowledge management practice and research, and provide two complementary frameworks that highlight potential opportunities for building a research agenda in this area. The papers in this special issue are then discussed.


Question: A framework for understanding and responding to social engineering attacks.

A Comprehensive Framework for Social Engineering Assault Categorization

Social engineering assaults are a sophisticated class of attacks designed to exploit human psychology to gain unauthorized access to systems or data. The primary goal of these attacks is often to extract sensitive information from the victim. Successful social engineering strategies can include direct interaction with the target, such as dumpster diving—searching through discarded documents—or shoulder surfing—peeking at screens or written notes to obtain passwords. Conversely, technical methods can also be employed, involving deceptive pop-up windows, emails, or websites to trick victims into divulging passwords and other confidential data. This study undertakes an in-depth analysis, focusing on the taxonomy of technical-based social engineering attacks. The findings from this analysis serve as a blueprint for the development of a novel, comprehensive taxonomy for Social Engineering Assaults (SEA), aiming to provide a clearer understanding and categorization of these deceptive tactics.

With the widespread adoption of electronic government services, there has been a need to ensure a seamless flow of information across public sector organizations, while at the same time, maintaining confidentiality, integrity and availability. Governments have put in place various initiatives and programs including information security awareness to provide the needed understanding on how public sector employees can maintain security and privacy. Nonetheless, the implementation of such initiatives often faces a number of challenges that impede further take-up of e-government services. This paper aims to provide a better understanding of the challenges contributing towards the success of information security awareness initiatives implementation in the context of e-government. Political, organizational, social as well as technological challenges have been utilized in a conceptual framework to signify such challenges in e-government projects. An empirical case study conducted in a public sector organization in Greece was exploited in this research to reflect on these challenges. While, the results from this empirical study confirm the role of the identified challenges for the implementation of security awareness programs in e-government, it has been noticed that awareness programmers often pursue different targets of preserving security and privacy, which sometimes results in adding more complexity to the organization.

QR (Quick Response) codes are two-dimensional barcodes with the ability to encode different types of information. Because of their high information density and robustness, QR codes have gained popularity in various fields of application. Even though they offer a broad range of advantages, QR codes pose significant security risks. Attackers can encode malicious links that lead e.g. to phishing sites. Such malicious QR codes can be printed on small stickers and replace benign ones on billboard advertisements. Although many real world examples of QR code based attacks have been reported in the media, only little research has been conducted in this field and almost no attention has been paid on the interplay of security and human-computer interaction. In this work, we describe the manifold use cases of QR codes. Furthermore, we analyze the most significant attack scenarios with respect to the specific use cases. Additionally, we systemize the research that has already been conducted and identified usable security and security awareness as the main research challenges. Finally we propose design requirements with respect to the QR code itself, the reader application and usability aspects in order to support further research into to making QR code processing both secure and usable.

1 Qatar Computing Research Institute (QCRI), Qatar Foundation, Doha, Qatar; E-Mail: ikhalil@uaeu.ac.ae 2 Department of Electrical and Computer Engineering, Newark College of Engineering, New Jersey Institute of Technology, University Heights, Newark, NJ 07102, USA; E-Mail: abdallah@njit.edu 3 College of Information Technology, United Arab Emirates University, PO Box 15551, Al Ain, United Arab Emirates; E-Mail: azeemsamma@hotmail.com

Most computers today are insecure because security is costly in terms of user inconvenience and foregone features, and people are unwilling to pay the price. Real-world security depends more on punishment than on locks, but it's hard to even find network attackers, much less punish them. The basic elements of security are authentication, authorization, and auditing: the gold standard. The idea of one principal speaking for another is the key to doing these uniformly across the Internet.

Information technology has become an integral part of modern life. Today, the use of information permeates every aspect of both business and private lives. Most organizations need information systems to survive and prosper and thus need to be serious about protecting their information assets. Many of the processes needed to protect these information assets are, to a large extent, dependent on human cooperated behavior. Employees, whether intentionally or through negligence, often due to a lack of knowledge, are the greatest threat to information security. It has become widely accepted that the establishment of an organizational sub-culture of information security is key to managing the human factors involved in information security. This paper briefly examines the generic concept of corporate culture and then borrows from the management and economical sciences to present a conceptual model of information security culture. The presented model incorporates the concept of elasticity from the economical sciences in order to show how various variables in an information security culture influence each other. The purpose of the presented model is to facilitate conceptual thinking and argumentation about information security culture. a 2009 Elsevier Ltd. All rights reserved.

Financial fraud is commonly represented by the use of illegal practices where they can intervene from senior managers until payroll employees, becoming a crime punishable by law. There are many techniques developed to analyze, detect and prevent this behavior, being the most important the fraud triangle theory associated with the classic financial audit model. In order to perform this research, a survey of the related works in the existing literature was carried out, with the purpose of establishing our own framework. In this context, this paper presents FraudFind, a conceptual framework that allows to identify and outline a group of people inside an banking organization who commit fraud, supported by the fraud triangle theory. FraudFind works in the approach of continuous audit that will be in charge of collecting information of agents installed in user's equipment. It is based on semantic techniques applied through the collection of phrases typed by the users under study for later being transferred to a repository for later analysis. This proposal encourages to contribute with the field of cybersecurity, in the reduction of cases of financial fraud.

The continued growth and diversification of the Internet has been accompanied by an increasing prevalence of attacks and intrusions [40]. It can be argued, however, that a significant change in motivation for malicious activi ty has taken place over the past several years: from vandalism and recognition in th e hacker community, to attacks and intrusions for financial gain. This shift has bee n marked by a growing sophistication in the tools and methods used to conduct atta cks, thereby escalating the network security arms race. Our thesis is that the reactivemethods for network security that are predominant today are ultimately insufficient and that more proactivemethods are required. One such approach is to develop a foundational understanding of the mechanisms employed by malicious software (malware) which is often readi ly available in source form on the Internet. While it is well known that large IT secu rity companies maintain detailed databases of this information, these are not o penly available and we are not aware of any such open repository. In this paper we begin t he process of codifying the capabilities of malware by dissecting four widely-u sed Internet Relay Chat (IRC) botnet codebases. Each codebase is classified along se ven k y dimensions including botnet control mechanisms, host control mechani sms, propagation mechanisms, exploits, delivery mechanisms, obfuscation and de ception mechanisms. Our study reveals the complexity of botnet software, and we disc us es implications for defense strategies based on our analysis.

One of the key features of social networks is that users are able to share information, and through cascades of sharing information, this information may reach a large number of individuals. The high availability of user-provided contents on online social media facilitates people aggregation around shared beliefs, interests, worldviews and narratives. With lack of means to verify information, social media has been accused of becoming a hot bed for sharing of misinformation. Facebook, as one of the largest social networking services, has been facing widespread criticism on how its newsfeed algorithm is designed thus amplifying dissemination of misinformation. In late 2016, Facebook revealed plans to address fake news on Facebook newsfeeds. In this work, we study the methods Facebook has proposed to combat the spread of misinformation and compare it with our previously proposed approach called ‘Right-click Authenticate’. By analyzing the Business Process Modeling and Notation of both approaches, this paper suggests some key weaknesses and improvements social media companies need to consider when tackling the spread of misinformation online.

Gamification is the use of game design elements in non-game context platforms such as services and marketing to motivate people to participate in planned activities to increase engagement and loyalty to achieve goals.
 Gamification has been applied to academic fields including software engineering in recent years. Some studies show that gamification can motivate engineers in Software Engineering (SE) if applied appropriately. However, most gamification implementations are lacking well-defined frameworks or models.
 This paper develops a software gamification model (SGM) with a well-defined framework that provides a robust process for implementing gamification for SE. This model also contains elements from applied psychology, Social Software Engineering (SSE), and the Capability Maturity Model (CMM). Having those elements ensures that the model has a solid foundation in gamification and SE disciplines. The model is further tailored for cross-cultural software development teams (CCSDT).
 CCSDT have been popular in recent years due to the fact that software development has become a global business. However, as more and more CCSDT are formed, many challenges and issues have been raised in those cross-cultural environments stemming from miscommunication, misunderstanding, cultural differences and conflicts. This paper uses the SGM to help resolve the issues.

We identify three types of attack on the intellectual property contained in software, and three corresponding technical defenses. A potent defense against reverse engineering is obfuscation, a process that renders software unintelligible but still functional. A defense against software piracy is watermarking, a process that makes it possible to determine the origin of software. A defense against tampering is tamper-proofing, so that unauthorized modifications to software (for example to remove a watermark) will result in non-functional code. We briefly survey the available technology for each type of defense.