Self-Protecting Systems (SPS) rely on an autonomic manager to detect and mitigate cyber threats. However, a major challenge in SPS design is ensuring the security of the autonomic manager itself, as its compromise could lead to complete control of the system by an attacker. In this work, we propose a cyber-resilient SPS architecture that leverages permissioned blockchain technology to enhance the trustworthiness of both Intrusion Detection (ID) and Intrusion Response (IR). The proposed architecture is technology-agnostic and adaptable to various ID and IR techniques. We implement a prototype using Quorum and a smart contract and evaluate its performance in terms of overhead and scalability. Experimental results show that the proposed architecture is technically feasible and that it introduces a minimal overhead with respect to non-smart contract-based transactions, and that it can be used on production systems with high event rates despite the inherent scalability issues deriving from the usage of the chosen blockchain technology.

Blockchain, like any other complex technology, needs a strong testing methodology to support its evolution in both research and development contexts. Setting up meaningful tests for permissionless blockchain technology is a notoriously complex task for several reasons: software is complex, large number of nodes are involved, network is non ideal, etc. Developers usually adopt small virtual laboratories or costly real devnets, based on real software. Researchers usually prefer simulations of a large number of nodes, based on simplified models. In this paper, we aim to obtain the advantages of both approaches, i.e., performing large, realistic, inexpensive, and flexible experiments, using real blockchain software within a virtual environment. To do that, we tackle the challenge of running large blockchain networks in a single physical machine, leveraging Linux and Docker. We analyze a number of problems that arise when large blockchain networks are emulated and we provide technical solutions for all of them. Finally, we describe two experiences of emulating fairly large blockchain networks on a single machine, adopting both research oriented and production oriented software, and involving up to more than 3000 containers.

Industrial Control Systems (ICS) are sensible targets for high profile attackers and advanced persistent threats, which are known to exploit USB thumb drives as an effective spreading vector. In ICSes, thumb drives are widely used to transfer files among disconnected systems and represent a serious security risks, since, they may be promiscuously used in both critical and regular systems. The threats come both from malware hidden in files stored in the thumb drives and from BadUSB attacks. BadUSB leverages the modification of firmware of USB devices in order to mimic the behaviour of a keyboard and send malicious commands to the host. We present a solution that allows a promiscuous use of USB thumbs drives while protecting critical machines from malware, that spreads by regular file infection or by firmware infection. The main component of the architecture we propose is an hardware, called USBCaptchaIn, intended to be in the middle between critical machines and connected USB devices. We do not require users to change the way they use thumb drives. To avoid human-errors, we do not require users to take any decision. The proposed approach is highly compatible with already deployed products of a ICS environment and proactively blocks malware before they reach their targets. We describe our solution, provide a thorough analysis of the security of our approach in the ICS context, and report the informal feedback of some experts regarding our first prototypes.

In many applications, identity management (IdM) is used to associate a subject public key with an endpoint at which the subject can be contacted (telephone number, email, etc.). In decentralized applications based on blockchains, it is desirable for the IdM to be decentralized as well. In certain applications, it is paramount to be certain that an endpoint actually belong to a specific subject. Currently, when this is needed, endpoints are either verified by who needs it, which is impractical in blockchain-based applications, or by a centralized authority, which contrasts with the spirit of the blockchain.In this paper, we show two layer-two blockchain-based protocols to prove the association between a subject and an endpoint in a decentralized manner. Our protocols are compatible with a wide variety of endpoints and contribute to fill the gap of the current self sovereign IdM approaches with respect to decentralization. We analyze the security of our proposals and evaluate performances and costs against the common approaches.

With the increasing diffusion of Internet probing technologies, a large amount of regularly collected traceroutes are available for Internet service providers (ISPs) at low cost. We show how it is possible, given solely an arbitrary set of traceroutes, to spot routing paths that change similarly over time and aggregate them into inferred routing events. With respect to previous works, our approach does not require any knowledge of the network, does not need complex integration of several data sources, and exploits the asynchronicity of measurements to accurately position events in time. The formal model at the basis of our methodology revolves around the notion of empathy, a relation that binds similarly behaving traceroutes. The correctness and completeness of our approach are based on structural properties that are easily expressed in terms of empathic measurements. We perform experiments with data from public measurement infrastructures like RIPE Atlas, showing the effectiveness of our algorithm in distilling significant events from a large amount of traceroute data. We also validate the accuracy of the inferred events against ground-truth knowledge of routing changes originating from induced and spontaneous routing events. Given these promising results, we believe that our methodology can be an effective aid for troubleshooting at the ISPs level. The source code of our algorithm is publicly available at https://github.com/empadig.

In critical infrastructures, communication networks are used to exchange vital data among elements of Industrial Control Systems (ICSes). Due to the criticality of such systems and the increase of the cybersecurity risks in these contexts, best practices recommend the adoption of Intrusion Detection Systems (IDSes) as monitoring facilities. The choice of the positions of IDSes is crucial to monitor as many streams of data traffic as possible. This is especially true for the traffic patterns of ICS networks, mostly confined in many subnetworks, which are geographically distributed and largely autonomous. We introduce a methodology and a software architecture that allow an ICS operator to use the spare bandwidth that might be available in over-provisioned networks to forward replicas of traffic streams towards a single IDS placed at an arbitrary location. We leverage certain characteristics of ICS networks, like stability of topology and bandwidth needs predictability, and make use of the Software-Defined Networking (SDN) paradigm. We fulfill strict requirements about packet loss, for both functional and security aspects. Finally, we evaluate our approach on network topologies derived from real networks.

Network operators invest significant resources in monitoring and troubleshooting the infrastructure they run. Currently, the availability of large networks of probing devices, like, for example, RIPE Atlas, dramatically increases the amount of data an operator can rely on. In particular, the large amount of traceroutes they can produce are both an opportunity and a challenge. In this paper we provide a detailed description of RoutingWatch, a visual tool for interactively performing searches and analysis of routing events inferred from a large set of traceroutes. The key design choices of RoutingWatch are based on discussions with network operators. We evaluate the effectiveness of our approach by conducting a preliminary user study.

Industrial Control Systems (ICS) are sensible targets for high profile attackers and advanced persistent threats, which are known to exploit USB thumb drives as an effective spreading vector. In ICSes, these devices are widely used to transfer files among disconnected systems and represent a serious security risks, since, they may be promiscuously used in both critical and regular systems. We show a method that adopts cryptographic techniques to inhibit critical machines from reading possibly malicious files coming from regular machines on untrusted USB thumb drives. Our approach exposes limited attack surface for any malware, even those based on zero-days. We do not require users to change the way they use removable storage devices, or to authenticate. Our approach can be adopted for disconnected machines and does not need complex key management. We describe the architecture of our solution and provide a thorough analysis of the security of our approach in the ICS context.

The BadUSB attack leverages the modification of firmware of USB devices in order to mimic the behaviour of a keyboard or a mouse and send malicious commands to the host. This is a new and dreadful threat for any organization. Current countermeasures either require special USB devices or ask the user to decide if the device can be used. We propose a new approach that, before allowing the device to be used, forces the user to interact with it physically, to ensure that a real human-interface device is attached. Our implementation is hardware-based and, hence, can be used with any host, comprising embedded devices, and also during boot, i.e., before any operating system is running. Our approach does not require any special feature from USB devices.

Summary In the era of virtualization, virtual networking plays an important role. Besides production use, virtual networking can be effectively adopted in many other contexts where accurate emulation of functionalities is important, like testing before deployment, evaluation of what‐if scenarios, research, and, increasingly, didactics. In this paper, we describe our 10‐year experience in designing, implementing, using, and maintaining Netkit, an environment for simple, inexpensive, and lightweight network emulation targeted at didactics. We analyze the peculiar requirements in this context and discuss how the architecture chosen for Netkit is tailored to fulfill them. We show that Netkit is particularly well suited for a quick preparation of complex network scenarios comprising a wide range of networking technologies. These scenarios can be specified using configuration languages that are similar to those used on real devices and, once set up, can be easily distributed via email or published on the Web. Netkit comes with a rich set of ready‐to‐use pre‐configured networks, accompanied by lecture slides that enable users to immediately experiment with specific case studies. To complete the picture, we report our experience in supporting and fostering the growth of the community of users revolving around Netkit: more than 15 educational institutions worldwide take advantage of Netkit, allowing teachers and students to practice with realistic networks without the need of expensive laboratories. We also detail how we profitably use Netkit within advanced academic‐level networking courses and related examinations at the Roma Tre University. Copyright © 2014 John Wiley & Sons, Ltd.

With the increasing diffusion of Internet probing technologies, a large amount of regularly collected traceroutes are available for Internet Service Providers (ISPs) at low cost. We introduce a practically applicable methodology and algorithm that, given solely an arbitrary set of traceroutes, spot routing paths that change similarly over time, aggregate them into inferred events, and report each event along with the impacted observation points and a small set of IP addresses that can help identify its cause. The formal model at the basis of our methodology revolves around the notion of empathy, a relation that binds similarly behaving traceroutes. The correctness and completeness of our approach are based on structural properties that are easily expressed in terms of empathic measurements. We perform experiments with data from public measurement infrastructures like RIPE Atlas, showing the effectiveness of our algorithm in distilling events from a large amount of traceroute data. We also validate the accuracy of the inferred events against ground-truth knowledge of routing changes originating from induced and spontaneous routing events. Given these promising results, we believe our methodology can be an effective aid for ISPs to detect and track routing changes affecting many users (with potentially adverse effects on their connection quality).

Bitcoin is a digital currency whose transactions are stored into a public ledger, called blockchain, that can be viewed as a directed graph with more than 70 million nodes, where each node represents a transaction and each edge represents Bitcoins flowing from one transaction to another one. We describe a system for the visual analysis of how and when a flow of Bitcoins mixes with other flows in the transaction graph. Such a system relies on high-level metaphors for the representation of the graph and the size and characteristics of transactions, allowing for high level analysis of big portions of it.

For an Internet Service Provider (ISP), the knowledge of which interdomain paths could be traversed by its BGP announcements - and thus traffic flows - is essential to predict the impact of network faults, to develop effective traffic engineering and peering strategies, and to assess the quality of upstream providers. However, current methodologies do not provide this information. We present methodologies to discover how the BGP announcements for an ISP’s prefix are propagated through the Internet using withdrawals and specially crafted AS-sets. The techniques allow an ISP to determine which paths could be traversed in the presence of network faults or different routing policies on the ISP’s part and to deduce the routing policies of other ISPs with respect to its network. We validate our techniques through experimentation in the IPv6 and IPv4 Internet, showing that they can be safely and effectively applied in real-world situations.

We propose a new metaphor for the visualization of prefixes propagation in the Internet. Such a metaphor is based on the concept of topographic map and allows to put in evidence the relative importance of the Internet Service Providers (ISPs) involved in the routing of the prefix. Based on the new metaphor we propose an algorithm for computing layouts and experiment with such algorithm on a test suite taken from the real Internet. The paper extends the visualization approach of the BGPlay service, which is an Internet routing monitoring tool widely used by ISP operators.

The problem of computing the types of the relationships between Internet autonomous systems is investigated. We refer to the model introduced in (ref.1), (ref.2) that bases the discovery of such relationships on the analysis of the AS paths extracted from the BGP routing tables. We characterize the time complexity of the above problem, showing both NP-completeness results and efficient algorithms for solving specific cases. Motivated by the hardness of the general problem, we propose heuristics based on a novel paradigm and show their effectiveness against publicly available data sets. The experiments put in evidence that our heuristics performs significantly better than state of the art heuristics.

Abstract A wide number of practical applications would benefit from automatically generated graphical representations of database schemas, in which tables are represented by boxes, and table attributes correspond to distinct stripes inside each table. Links, connecting attributes of two different tables, represent referential constraints or join relationships, and may attach arbitrarily to the left‐ or to the right‐hand side of the stripes representing the attributes. To our knowledge no drawing technique is available to automatically produce diagrams in such a strongly constrained drawing convention. In this paper we provide a polynomial time algorithm for solving this problem, and test its efficiency and effectiveness against a large test suite. Also, we describe an implementation of a system that uses such an algorithm and we study the main methodological problems we faced in developing such a technology. Copyright © 2002 John Wiley & Sons, Ltd.