The surge in global digitalization triggered by COVID-19 has led to a significant increase in internet traffic and has precipitated a rapid transformation of the network security landscape. Despite being increasingly difficult, accurate traffic inspection is vital for ensuring productivity while reliably protecting internal assets. Endpoint application identification enables high accuracy inspection and detection by providing network security solutions with specific context on individual connections. However, achieving it in real-time with standard fingerprinting methods based only on client-side traffic has proven to be a challenging problem with no comprehensive solution thus far. In this article, we present a new methodology for identifying endpoint applications from network traffic, utilising machine learning. Our methodology leverages similarities in the pre-hash string of the JA3 algorithm for fingerprinting application specific TLS Client Hello messages. By utilising well-known clustering algorithms it is possible to identify the underlying TLS libraries and the application from the traffic remarkably better than with simple string-based matching. Our model can categorize 99,5% of the traffic in a controlled network, and 93,8% in an uncontrolled network, compared to 0,1% and 0,2% using simple string matching. Our methodology is especially effective for enhancing Zero Trust models, calculating a risk score for network events, and improving threat detection accuracy in network security solutions.

Given the global increase in remote work with the COVID-19 pandemic and deperimeterization due to cloud deployment of next generation firewalls, the concept of a next generation firewall is at a breaking point. It is becoming more difficult to define the barrier between the good and the bad. To provide the best security for an endpoint with minimal false positives or false negatives it is often necessary to identify the communicating endpoint application. In this study, we present an analysis of key research and methods for providing endpoint aware protection in the context of a next generation firewall. We examine both academic research as well as state-of-the-art of the existing next generation firewall implementations. We divide endpoint application identification into passive and active methods. For passive endpoint application identification, we study several traffic fingerprinting methods for different protocols. For active methods we consider active scanning, endpoint metadata analysis and content injection and reference existing implementations. We conclude that there are several open areas for future research, and that none of the considered methods is a silver bullet solution for endpoint aware inspection in the context of a next generation firewall. To our best knowledge, this is the first study to examine current research and existing implementations of endpoint aware inspection.

We present a solution to data ownership in the surveillance age in the form of an ethically sustainable framework for managing personal and person-derived data. This framework is based on the concept of Datenherrschaft – mastery over data that all natural persons should have on data they themselves produce or is derived thereof. We give numerous examples and tie cases to robust ethical analysis, and also discuss technological dimensions.

In this paper, we present a systematic methodology for continuous surveying and analysis of 802.11 Wireless Local Area Network (WLAN) abundance and security, based on the passive wireless network scanning technique called wardriving. The objective is to provide an efficient, scalable, and easily accessible methodology for collecting, analysing and storing WLAN survey data. To adhere to these set requirements, the presented survey and analysis processes can be carried out with freely available open-source software and common off-the-shelf hardware. While extensive literature has been produced on wardriving and numerous WLAN survey studies have been documented in previous works, to our knowledge, no similar comprehensive methodology for systematic WLAN surveying and analysis has been previously presented. To further rationalise the need for surveying and analysing WLAN networks, an investigation on the related literature and the current state of the WLAN networking landscape has been conducted. Furthermore, as surveying WLAN networks via the wardriving technique undoubtedly raises legal and moral concerns, the legitimacy and ethics of wardriving have been examined. To test the effectiveness of the proposed methodology, a primary test and calibration WLAN survey was conducted in three separate locations within a middle-sized city located in Southwest Finland. Based on the survey results, WLAN security in Finland is in a relatively good state. During the test survey, we successfully collected and analysed data from 720 WLAN networks, proving the effectiveness of the proposed methodology. From the 720 detected WLAN networks, 6% used insecure encryption protocols, 12.8% were unencrypted and a clear majority of 81.3% used the WPA2 encryption protocol. Results also show that wireless network device owners in the surveyed areas are not inclined to alter the factory-set default settings of their wireless networks. It was noted that roughly 40% of the surveyed networks used easily identifiable factory-set SSIDs and only 5.4% of the networks had a cloaked SSID. Furthermore, the survey data shows that WLAN devices from 38 different manufacturers were detected. Three of the most popular manufacturers in the surveyed area were Cisco with 28.3%, Huawei with 15.7% and Ruckus Networks with 9.7%.

Designing a cybersecurity course for a big cohort of students from the different educational background is a challenging job. Examined in this study are the perceptions, preferences and performance of students who have participated in a strategic blended learning initiative aimed at preparing students for their working lives. For this purpose, both self-reported and observational data were collected from 115 students who voluntarily registered for the pilot run of the course. Self-reported data was used to measure students’ preferences as well as perceptions related to satisfaction, engagement, convenience, interaction and views on learning. Observational data measuring students’ performance was directly extracted from the collaborative learning platform on which the course was hosted. The results show that overall students liked the blended design of the course. They were satisfied with the format of the course, they felt engaged, and most of them secured good grades. Moreover, no significant difference in perceptions and preferences were found when controlled for gender, educational discipline, and overall performance, showing that the blended design of the course was accepted across the board.

The on-going AI revolution has disrupted several industry sectors and will keep having an unprecedented impact on all areas of society. This is predicted to force a major proportion of the workforce to re-educate itself during the next few decades. Consequently, this has led to a growing demand for multidisciplinary AI education also for students outside computer science. Therefore, a 25 credit (ECTS) cross-disciplinary study module on AI, targeting students in all faculties, was designed. We present findings from the design and implementation of the study module as well as students' initial perceptions towards AI at the beginning of the study module. Enrollment for the first implementation of the study module began in autumn 2019. The student distribution (N=144) between faculties was the following: natural sciences (n=37), social sciences (n=23), law (n=17), education (n=17), economics (n=16), medicine (n=10), humanities (n=10) and open university (n=14). Based on a survey distributed to students (N=34), the primary reason for enrolling to study AI was interest towards the subject, followed by the need of AI skills at work and relevance of AI in society.

Machine learning (ML) techniques are changing both the offensive and defensive aspects of cybersecurity. The implications are especially strong for privacy, as ML approaches provide unprecedented opportunities to make use of collected data. Thus, education on cybersecurity and AI is needed. To investigate how AI and cybersecurity should be taught together, we look at previous studies on cybersecurity MOOCs by conducting a systematic literature review. The initial search resulted in 72 items and after screening for only peer-reviewed publications on cybersecurity online courses, 15 studies remained. Three of the studies concerned multiple cybersecurity MOOCs whereas 12 focused on individual courses. The number of published work evaluating specific cybersecurity MOOCs was found to be small compared to all available cybersecurity MOOCs. Analysis of the studies revealed that cybersecurity education is, in almost all cases, organised based on the topic instead of used tools, making it difficult for learners to find focused information on AI applications in cybersecurity. Furthermore, there is a gab in academic literature on how AI applications in cybersecurity should be taught in online courses.

We present a work in progress of an adaptive security management scheme for wireless sensor networks. The unique characteristics of these networks place great demands on their design and operation in terms of resource and security management. Resource and security adaptability achieved through self- and context-awareness will take the feasibility of the networks to a new level. The scheme has self- and context-awareness in addition to a holistic view of security services at each layer of the communication stack. It uses distributed agents and intrusion detection systems to monitor the security threats and then dynamically adapts its security level by jointly considering several dimensions. This translates into optimal security-energy under a given resource and context. The key dimensions are energy budget, computing power and memory size of nodes, location-based security threat levels, data coherence, and data lifetime. Trust management is used to test the integrity of untrusted nodes which further assist the adaptation decision.