The growing need for integrating security through out the software development lifecycle leads to the adoption of various security activities. Threat modeling is widely recognized as a process that helps assess security issues, especially architectural flaws, due to insecure design, thereby supporting the security-by-design mindset. While many research and industry sources advocate for threat modeling, others highlight issues such as the lack of motivation, its time-consuming nature, and practical difficulties, leading to questions about its overall effectiveness.In this study, we conduct a comprehensive multivocal literature review to systematically examine the empirical evidence for the effectiveness of threat modeling. In short, by analyzing 109 sources from both white and gray literature, we did not encounter any direct, causal evidence (e.g., a controlled experiment) for the effectiveness of threat modeling as a technique to improve the security of a software application. This absence of causal evidence should not be interpreted as evidence that threat modeling is ineffective, though. The existing literature does describe several benefits and challenges related to threat modeling, as well as suggestions for improving the effectiveness of threat modeling activities. Studies on threat modeling often concentrate on benefits such as improved performance, effectiveness, efficiency, and usability of specific tools and methods. Recurring challenges, on the other hand, include a perceived lack of benefits, tool limitations, usability issues, and difficulties integrating threat modeling into the secure software development lifecycle. Suggestions for improvements include providing clear checklists or guidance, defining a clear scope, and involving different stakeholders during threat modeling activities.Based on this review of the literature, researchers are invited to conduct rigorous empirical studies to address the underexplored aspects of threat modeling, thereby strengthening its evidence base and increasing its impact in the real world.

OAuth 2.0 is a widely adopted authorization framework enabling secure, delegated access to resources on behalf of a user. While the protocol is robust when implemented correctly, real-world deployments often exhibit vulnerabilities due to misconfigurations, incomplete mitigations, or misunderstandings of its intricacies. (Semi-)automated testing is therefore essential to identify and address these security flaws. Among available tools, OAuch offers the most comprehensive benchmark for assessing OAuth IdP implementations by identifying potential threats based on the OAuth threat model and related standards. However, OAuch has notable limitations, including an incomplete threat model, ambiguous threat classifications, and a lack of support for multi-vulnerability attack scenarios. This paper presents enhancements to OAuch that improve the tool's usability, including enriched metadata, the introduction of attack scenarios for multi-threat analyses, and a likelihood assessment to prioritize mitigation efforts.

The emergence of DevOps is accompanied by an increased use of Infrastructure as Code (IaC) to specify and manage deployment configurations, infrastructure, and associated resources. Terraform is one such IaC solution. However, improper configurations can lead to serious security threats. This paper introduces an approach, implemented as TerrARA, that provides a systematic and structured way for automatically eliciting security threats based on Terraform configuration files. Specifically, TerrARA: (1) automates the construction of an abstract model-an enriched Data Flow Diagram (DFD)-from Terraform configuration files for Amazon Web Services (AWS), and it can be extended to other resources and cloud providers via profiles; (2) encodes cloud computing threat patterns, which are utilized by the SPARTA threat modeling engine to automatically identify security threats; and (3) demonstrates its capability in accurately extracting DFDs from Terraform projects and eliciting relevant cloud computing security threats, achieving high accuracy and reasonable performance compared to existing tools and approaches like StartLeft and GPT-4o. By integrating it into CI/CD pipelines, the automated reconstruction and analysis enable continuous security assessments that systematically incorporate cloud infrastructure artifacts into the threat modeling process.

Despite considerable efforts on making them robust, real-world AI-based systems remain vulnerable to decision based attacks, as definitive proofs of their operational robustness have so far proven intractable. Canonical robustness evaluation relies on adaptive attacks, which leverage complete knowledge of the defense and are tailored to bypass it. This work broadens the notion of adaptivity, which we employ to enhance both attacks and defenses, showing how they can benefit from mutual learning through interaction. We introduce a framework for adaptively optimizing black-box attacks and defenses under the competitive game they form. To assess robustness reliably, it is essential to evaluate against realistic and worst-case attacks. We thus enhance attacks and their evasive arsenal together using reinforcement learning (RL), apply the same principle to defenses, and evaluate them first independently and then jointly under a multi-agent perspective. We find that active defenses, those that dynamically control system responses, are an essential complement to model hardening against decision-based attacks; that these defenses can be circumvented by adaptive attacks, something that elicits defenses being adaptive too. Our findings, supported by an extensive theoretical and empirical investigation, confirm that adaptive adversaries pose a serious threat to black-box AI-based systems, rekindling the proverbial arms race. Notably, our approach outperforms the state-of-the-art black-box attacks and defenses, while bringing them together to render effective insights into the robustness of real-world deployed ML-based systems.

Packaging applications in Containers, dynamically managed using a cluster orchestrator, is the de-facto approach for deployment of cloud-native applications. When Containers run inside Virtual Machines (VMs) to protect infrastructural assets, Network Policies at the Container layer and Security Groups at the VM layer provide complementary firewall mechanisms that strengthen defenses against lateral movement of attackers. However, least-privilege network policies at the Container layer may not always be consistent with statically defined, over-permissive Security Groups at the VM layer. This is especially a problem with low-latency configuration of Container networking solutions that requires every opened Container protocol, port and traffic direction also to be opened at the VM layer. In any post-exploitation scenario where attackers escape from within an already compromised or infected Container, such over-permissive Security Groups do not prevent the attacker from spreading across VMs to find powerful tokens for accessing the cluster orchestrator. In this paper, we introduce GrassHopper, a fast and dynamic cross-layer enforcement approach for Network Policies, which automatically generates Security Group configurations from dynamically verified Network Policies and Container scheduling decisions. Given the low-latency context, the design of GrassHopper must ensure that dynamically generated Security Group rules come in a timely manner to effect before the newly scheduled Containers become ready to serve traffic. We evaluate the performance of GrassHopper on a Kubernetes cluster running on OpenStack at the network and application level. In comparison to a Security Group management approach that is not scheduling-aware, our findings show that for low-latency applications GrassHopper can reduce the network attack surface between VMs at a ratio of 78-to-99%, while causing no network performance overhead at the application level with respect to latency and throughput.

The OAuth 2.0 protocol is a widely adopted standard for online authorization. Given its widespread use, it has received substantial attention from the research community towards assessing its security. Earlier research has primarily focused on the security of the protocol itself, or the implementation quality of popular online OAuth-based services. However, despite the numerous flaws that have been discovered in public OAuth services, there has only been limited research that directly studied the underlying OAuth middleware. In this study, we address this gap by conducting a systematic evaluation of eight popular open-source identity providers. In our analysis, we identified ten important types of security flaws among these providers. We further explore the root causes of these problems and discuss why certain parts of the OAuth standard are poorly implemented. Our findings reveal an alarming reality: we uncovered security weaknesses and vulnerabilities in seven out of eight examined middle-wares, with an average of three security issues per provider. While these weaknesses have been addressed, resulting in two CVEs, our results emphasize the importance of continued research efforts to improve the security of OAuth implementations.

This work investigates the application of federated learning for detecting web bots in edge computing settings. The key challenge lies in developing machine learning models that are not only accurate but also robust against evasion attacks, where adversarial actors attempt to bypass detection. Addition-ally, the models must be privacy-preserving to protect sensitive information, ensuring that confidential data is not exposed to third parties during the learning process. By leveraging federated learning, the proposed approach enables collaborative model training across distributed edge nodes without sharing raw data, maintaining user privacy while enhancing detection capabilities against sophisticated web bot attacks.

ML-based malware detection on dynamic analysis reports is vulnerable to both evasion and spurious correlations. In this work, we investigate a specific ML architecture employed in the pipeline of a widely-known commercial antivirus, with the goal to harden it against adversarial malware. Adversarial training, the most reliable defensive technique that can confer empirical robustness, is not applicable out of the box in this domain, for the principal reason that gradient-based perturbations rarely map back to feasible problem-space programs. We introduce a novel Reinforcement Learning approach for constructing adversarial examples, a constituent part of adversarially training a model against evasion. Our approach comes with multiple advantages. It performs modifications that are feasible in the problem-space, and only those; thus it circumvents the inverse mapping problem. It also makes it possible to provide theoretical guarantees on the robustness of the model against a well-defined set of adversarial capabilities. Our empirical exploration validates our theoretical insights, where we can consistently reach 0% Attack Success Rate after a few adversarial retraining iterations.

In this paper, we introduce a new decentralized access control framework with transitive delegation capabilities that tackles the performance and scalability limitations of the existing state-of-the-art solutions. In order to accomplish this, the proposed solution is anchored in the self-sovereign identity (SSI) paradigm, which embodies a distributed identity management system. By adopting this paradigm, we obviate slow cryptographic premises such as identity-based encryption (IBE) that were used in prior work. Furthermore, we enhance the existing verifiable credentials (VCs) from this paradigm by introducing our own decentralized permission objects to support the concept of transitive delegations. This concept allows delegates to further delegate their access to resources with the same or fewer privileges to other entities within the framework. This renders our solution suitable for diverse scenarios, including applications in decentralized building access management. To the best of our knowledge, we are the first to introduce the concept of transitive delegations in this paradigm. Finally, our performance experiments show a performance enhancement of three orders of magnitude compared to the prevailing state-of-the-art solutions.

Biometric authentication systems have traditionally relied on the False Match Rate (FMR) to evaluate security against impersonation threats. However, this metric alone is insufficient for assessing vulnerabilities to statistical attacks because it cannot account for the non-uniformity of mismatches and atypical inputs that adversaries may manipulate. To address this issue, we propose a new evaluation framework that overcomes these limitations. The framework includes an estimate of the effective key space of biometrics and metrics that consider non-uniformity in the biometric embedding space. Our findings demonstrate that our framework provides a nuanced understanding of biometric security. Moreover, optimizing for the proposed metric leads to better security against statistical attacks than optimizing the FMR. Furthermore, the framework provides a comparative security analysis with traditional methods like passwords and PIN codes. It also quantifies the impact on security when adversaries partially know their victims, e.g., demographics.

Biometric authentication has made great strides throughout the years thanks to better hardware and software support. However, attackers are unrelenting in finding new ways to spoof a subject, hereby breaking existing presentation attack detection schemes. Similar to combining multiple authentication factors, a combination of liveness detection defenses is expected to strengthen security against spoofing attacks. The problem that we address is that many defenses have only been evaluated in isolation or in ideal circumstances. In this work, we demonstrate how different liveness components for face authentication can interfere with one another, thereby jeopardizing security. Furthermore, contextual and environmental influences can endanger their robustness. In this work, we propose a security framework for biometric authentication that supports adaptive liveness detection by reasoning upon undesired interactions between defenses, the impact of new attacks, and the context in which they emerge. We validate the flexibility of our framework to account for both historic and novel interplays between attacks and defenses. Our experiments show that our framework effectively accounts for undesired interactions while only incurring a limited and acceptable performance overhead.

Biometric recognition systems typically use a fixed threshold to differentiate between legitimate users and imposters. Yet, this method can be problematic due to differences in individual user performance, whereas some users are more easily recognizable than others. Furthermore, fixed thresholds require extensive tuning on a large test set a priori to determine an optimal threshold value. Adaptive thresholds address these shortcomings by adjusting threshold values based on population characteristics. However, our research demonstrates that adaptive thresholds suffer from a significant weakness as they inadvertently increase the attack surface against face recognition systems. We do so by introducing a novel attack, the doppelgänger attack, where a malicious actor inserts adversarial examples that mimic legitimate users and increase the false rejection rate for these legitimate users by 70%.

Packaging applications in containers and managing them dynamically using a cluster orchestrator is the de-facto approach for deployment of cloud-native applications. When containers run inside virtual machines (VMs) to protect infrastructural assets, network policies (NPs) at the container layer and security groups (SGs) at the VM layer provide complementary firewall mechanisms that strengthen defenses against lateral movement of attackers. However, least-privilege NPs at the container layer may not always be consistent with statically defined, over-permissive SGs at the VM layer. This is especially a problem with low-latency configuration of container networking solutions that requires every opened container protocol, port and traffic direction also to be opened at the VM layer. In any post-exploitation scenario where attackers escape from within an already compromised or infected container, such over-permissive SGs do not prevent the attacker from spreading across VMs to find powerful tokens for accessing the cluster orchestrator. In this paper, we introduce GrassHopper (GH), a fast and dynamic cross-layer enforcement approach for NPs, which automatically generates SG configurations from dynamically verified NPs. Given the low-latency context, the design of GH must ensure that dynamically generated SG rules are applied fast before the newly scheduled containers become ready to serve traffic. We evaluate GH on a Kubernetes cluster running on OpenStack. For a wide range of relevant low-latency applications and cluster setups, GH can reduce the network attack surface between VMs at a ratio of 75-to-99% while causing no application level performance overhead with respect to latency, throughput, and CPU utilization.

This paper presents and systematically evaluates the first masterkey attack against free-text keystroke dynamics. A masterkey is a typing sequence that matches, hence successfully impersonates, a large part of the population. Therefore, masterkeys are effective tools for an adversary who aims to impersonate someone without knowledge of their typing behavior. On top of the attack itself, we present a new unifying evaluation framework for masterkey attacks that allow for the comparison with knowledge-based authentication factors. In other words, we unify the evaluation of password security with that of masterkey attacks and demonstrate that typing biometrics is approximately 20 times less secure than passwords and approximately two times less secure than a 4-digit pin. Lastly, we study the effect of demographics on typing biometrics, which, among others, provides novel insights into the effect of being a well-versed typist on security.

The attack surface of an Android application captures the set of ways in which attackers can penetrate and compromise the application. Determining the attack surface serves multiple purposes, including assessing the security of the application, identifying weak points, and prioritizing mitigation efforts. In practice, determining the attack surface of an application is still a manual effort, and can be time-consuming and error-prone. This paper introduces AndrAS, a tool for automatically extracting the attack surface of an Android app by using static analysis to identify the entry and exit points associated with five different Android artifact types. To illustrate a potential usage scenario, this study shows how an automated threat modeling technique can be driven by the obtained attack surface to generate a threat model for an Android application. The performance of AndrAS is evaluated on 390 popular apps, and its accuracy and effectiveness using two benchmarks and a real-world case study.

The management of many different login credentials can be tricky for the average web user. OAuth eases this process by invoking identity providers (IdPs) as intermediaries, which identify the users and access their data on behalf of the website, without sharing their credentials. However, the information that IdPs share with websites is not always limited to basic data. Our work observes and documents that IdPs make a variety of resources (scopes) available to be requested by websites, most of which are not necessary for user identification (e.g., location, interests). By performing a large-scale analysis on OAuth-based login on the web, we show that 18.53% of websites using OAuth request at least one non-minimal scope. Additionally, our findings show that at least part of the requested information is redundant since websites provide alternative login methods that require less information from the user. Moreover, through a manual analysis we observe that revoking access to these scopes seems not to hinder the functionality of the website. Finally, when comparing OAuth-based login with registering a new account, we find that OAuth is often the more privacy-friendly option in terms of the amount of personal data being shared with the website.

Low-power wide-area networks enable large-scale deployments of low-power wireless devices. LoRaWAN is a long-range wireless technology that has emerged as a low-power and low data rate solution to support Internet of Things applications. Although LoRaWAN provides a low-power and cost-efficient networking solution, recent literature shows that it performs poorly in terms of reliability and security in dense deployments due to the uncoordinated (ALOHA-based) nature of the MAC (medium access control) protocol. Furthermore, LoRaWAN is not robust against selective jamming attacks. This article proposes CRAM: a time-synchronized cryptographic frequency hopping MAC protocol designed for the LoRa physical layer. CRAM reduces the contention by fairly exploiting the available frequency space and maximizes the entropy of the channel hopping algorithm. We develop a large physical testbed and a simulator to thoroughly evaluate the proposed protocol. Our evaluations show that CRAM significantly improves reliability and scalability and increases channel utilization while making selective jamming difficult to perform compared to the standard LoRaWAN protocol.

In recent years, part of the web is shifting to a client-centric, decentralized model where web clients become the leading execution environment for application logic and data storage. However, current solutions to build decentralized web applications with multiple distrusting parties often involve a decentralized backend of servers running a BFT protocol between them. Existing consensus protocols using either all-to-all communication, or leader-based gossip suffer from performance degradation in unstable network conditions. In this paper, we present BeauForT, a purely browser-based platform for decentralized BFT consensus in client-centric, community-driven applications. We propose a novel, optimistic, leaderless, gossip-based consensus protocol, tolerating Byzantine replicas, combined with a robust and efficient state-based synchronization protocol. This protocol makes BeauForT well suited for the decentralized client-centric web and its dynamic nature with many network disruptions or node failures.

Software developers use web application vulnerability scanners to automatically identify security weaknesses in their web applications. The scanners inspect source code or analyze the running application, and look for specific vulnerability types. While it can be expected that a scanner will not discover every vulnerability, no information is available on the expected efficacy of currently available vulnerability scanners for a given vulnerability type. We present an analysis of 24 web vulnerability scanners and determine their effectiveness on 11 vulnerability types. Our study offers insights into the trade-offs when selecting a specific type of scanner. We show that for some vulnerability types, most vulnerability scanners perform poorly.

Sharing cyber threat intelligence helps organizations analyze and protect against a growing number and sophistication of security threats. However, organizations are reluctant to share their locally collected cyber threat intelligence with third parties because of the the risk of incidentally disclosing sensitive business data or personally identifiable information, and the subsequent reputational harm or even financial repercussions imposed by the GDPR. To address the different confidentiality needs of threat intelligence producers and consumers, we present and evaluate a practical polyglot solution for privacy-preserving sharing and analysis of confidential or private information, and this on top of a contemporary cyber threat intelligence platform. Additionally, we investigate the security impact and computational overhead of these techniques to analyze correlations between threat events in a privacy-preserving manner and across sharing organizations.

A web visit typically consists of the browser rendering a dynamically generated response that is specifically tailored to the user. This generation of responses based on the currently authenticated user, whose authentication credentials are automatically included via cookies in all (including cross-site) requests, have led to a multitude of issues. Through cross-site leaks (XS-Leaks), an adversary can try to circumvent the same-origin policy and extract information about responses, which in turn can reveal potentially sensitive information about the user. As research on this class of vulnerabilities only recently gained traction, and the attacks affect many different components of the web platform, the intrinsic characteristics and underlying causes remain largely unexplored.

Fitness tracking social networks such as Strava allow users to record sports activities and share them publicly. Sharing encourages peer interaction but also constitutes a risk, because an activity's start or finish may inadvertently reveal privacy-sensitive locations such as a home or workplace. To mitigate this risk, networks introduced endpoint privacy zones (EPZs), which hide track portions around protected locations. In this paper, we show that EPZ implementations of major services remain vulnerable to inference attacks that significantly reduce the effective anonymity provided by the EPZ, and even reveal the protected location. Our attack leverages distance information leaked in activity metadata, street grid data, and the locations of the entry points into the EPZ. This yields a constrained search space where we use regression analysis to predict protected locations. Our evaluation on 1.4 million Strava activities shows that our attack discovers the protected location for up to 85% of EPZs. Larger EPZs reduce the performance of our attack, while geographically dispersed activities in sparser street grids yield better performance. We propose six countermeasures, that, however, come with a usability trade-off, and responsibly disclosed our findings and countermeasures to the major networks.

Low Power Wide Area Networks (LPWANs) provide the Internet of Things (IoT) with energy-efficient, low cost, and long-range networking. LoRaWAN is one of the most widely deployed and studied LPWAN technologies due to its license-free operation and open standard, which has enabled 3rd parties to deploy millions of networks worldwide. LoRa allows transmission range and speed to be traded off by configuring the Spreading Factor (SF) setting. By tuning this parameter, the performance envelope of the network can be configured to favor a higher speed or longer range. While the SF of LoRA provides a simple and elegant means to tailor performance, at the highest spreading factor, maximum throughput drops to a few bits per second, dramatically increasing data extraction times. In this paper, we address this problem by proposing Smart-Hop, a novel multi-hop MAC layer protocol for LoRa which implements low-overhead routing. In contrast to prior work, Smart-Hop exploits the variable range afforded by different SFs to eliminate much of the complexity and overhead of traditional multi-hop mesh networking. Smart-Hop reduces the number of end-devices operating at high SFs while implementing low overhead routing in order to reduce data extraction times. These improvements are achieved while preserving the maximum range offered by LoRa in its highest SF configuration.

Since their inception, Captchas have been widely used as reverse Turing tests for combating bot proliferation on the web. This has resulted in an arms race between bot developers that automate Captcha solvers and Captcha services that adjust the challenges accordingly or come up with new ones altogether. Ultimately, older generations could be bypassed consistently, and thus in the third version of reCAPTCHA, Google offers zero user friction. The intent in the new system is not only to avoid interrupting user experience but to also obfuscate the nature of the challenge itself, being much less prominent than a text or image recognition task. We introduce a methodology that learns through interaction how to evade detection, while collecting and analyzing reCAPTCHA v3 scores over fifteen months and various web environments. With reinforcement learning as the backbone, we build models that can simulate human-like web browsing behaviour by using the returned score as an informative signal. Our study exposes an important vulnerability: while the score is influenced by a multitude of undisclosed factors, it is easily accessible and it enables adversaries to learn and perfect evasive models. Notably, we demonstrate that our automation models, which integrate general web browsing capabilities, transfer between websites with an evasion rate up to 99.6%.

Intelligent Environments (IEs) enrich the physical world by connecting it to software applications in order to increase user comfort, safety and efficiency. IEs are often supported by wireless networks of smart sensors and actuators, which offer multi-year battery life within small packages. However, existing radio mesh networks suffer from high latency, which precludes their use in many user interface systems such as real-time speech, touch or positioning. While recent advances in optical networks promise low end-to-end latency through symbol-synchronous transmission, current approaches are power hungry and therefore cannot be battery powered. We tackle this problem by introducing BoboLink, a mesh network that delivers low-power and low-latency optical networking through a combination of symbol-synchronous transmission and a novel wake-up technology. BoboLink delivers mesh-wide wake-up in 1.13ms, with a quiescent power consumption of 237µW. This enables building-wide human computer interfaces to be seamlessly delivered using wireless mesh networks for the first time.

Faults in industrial equipment lead to significant costs due to down-time and unplanned maintenance interventions. Acoustic Internet of Things (IoT) sensors combined with machine learning offers the possibility of early fault detection to mitigate these costs. How-ever, prior approaches to Acoustic Anomaly Detection (AAD) are poorly suited to operating within the resource constraints of IoT systems as they require the acquisition of large volumes of data to train models from scratch for different machine types or oper-ating environments. To overcome the limitations, we introduce a system utilizing pretrained low-dimensional features and Gaussian mixture models. Preliminary results on real-world datasets show that our proposed approach outperforms state-of-the-art solutions based on the area under the curve (AUC) score with an average of 4 different machine types. Furthermore, our approach requires far less training data, making it more suitable to operate within the power and network constraints of IoT devices.

Trusted execution environments (TEEs) gained significant traction in recent years. They have become the foundation of Confidential Computing in cloud services, where certain security properties can be guaranteed on untrusted servers. Despite this adoption, writing code to target TEEs remains challenging. The SDKs for popular TEE implementations, like Intel SGX, are aimed at low-level languages like C/C++. Previous research has introduced support for developing and running programs written in managed programming languages in a TEE environment. However, in these works, the language runtime is embedded into the TEE, increasing the Trusted Computing Base (TCB) and thus inherently reducing trust into the TEE itself. To solve this problem, we propose a new approach to integrate the development of TEE code in managed languages, without the need to embed the full language runtime inside the TEE. It allows developers to write the TEE logic as part of their program in a managed programming language. Using the existing compiler infrastructure, the TEE logic is extracted and passed to a source-to-source compiler that transforms it into a low-level unmanaged equivalent. The resulting low-level code is then compiled by the compiler toolchain targeting the TEE platform. This paper reports on the design and the first results of our work-in-progress implementation of SecSharp, a tool to enable TEE development in C#.

The OAuth 2.0 protocol is a popular and widely adopted authorization protocol. It has been proven secure in a comprehensive formal security analysis, yet new vulnerabilities continue to appear in popular OAuth implementations.

We propose, design, and evaluate PIVOT, a privacy-enhancing and effective contact tracing solution that aims to strike a balance between utility and privacy: one that does not collect sensitive information yet allowing effective tracing and notifying the close contacts of diagnosed users. PIVOT requires a considerably low degree of trust in the entities involved compared to centralized alternatives while retaining the necessary utility. To protect users’ privacy, it uses local proximity tracing based on broadcasting and recording constantly changing anonymous public keys via short-range communication. These public keys are used to establish a shared secret key between two people in close contact. The three keys (i.e., the two public keys and the established shared key) are then used to generate two unique per-user-per-contact hashes: one for infection registration and one for exposure score query. These hashes are never revealed to the public. To improve utility, user exposure score computation is performed centrally, which provides health authorities with minimal, yet insightful and actionable data. Data minimization is achieved by the use of per-user-per-contact hashes and by enforcing role separation: the health authority act as a mixing node, while the matching between reported and queried hashes is outsourced to a third entity, an independent matching service (MS). This separation ensures that out-of-scope information, such as users’ social interactions, is hidden from the health authorities, whereas the MS does not learn users’ sensitive information. To sustain our claims, we conduct a practical evaluation that encompasses anonymity guarantees and energy requirements.

Traffic analysis attacks against encrypted web traffic are a persisting problem. However, there is a large gap between the scientific estimate of attack threats and the real-world situation. As traffic analysis attacks depend on very specific metadata information, they are sensitive to artificial changes in the transmission characteristics. While the advent of deep learning greatly improves the performance rates of traffic analysis attacks on Tor in research settings, deep neural networks are known for being implicitly vulnerable to artifacts in data. Removing artifacts from our experimental setups is essential to minimizing the risk of evaluation bias. In this work, we study a state-of-the-art end-to-end traffic correlation attack on Tor and propose a novel data collection setup. Our design addresses the key constraint of prior work: instead of using a single proxy node for collecting exit traffic, we deploy multiple proxies. Our extensive analysis shows that in the multi-proxy design (i) end-to-end round-trip times are more realistic than in the original design, and that (ii) traffic correlation attack performance degrades significantly on realistic timings. For a reliable and informative evaluation, we develop a general scientific methodology for replication and comparison of machine and deep-learning attacks on Tor. Our evaluation indicates high relevance of the multi-proxy data collection setup and the novel dataset.

Battery-free Internet-of-Things devices equipped with energy harvesting hold the promise of extended operational lifetime, reduced maintenance costs, and lower environmental impact. Despite this clear potential, it remains complex to develop applications that deliver sustainable operation in the face of variable energy availability and dynamic energy demands. This article aims to reduce this complexity by introducing AsTAR, an energy-aware task scheduler that automatically adapts task execution rates to match available environmental energy. AsTAR enables the developer to prioritize tasks based upon their importance, energy consumption, or a weighted combination thereof. In contrast to prior approaches, AsTAR is autonomous and self-adaptive, requiring no a priori modeling of the environment or hardware platforms. We evaluate AsTAR based on its capability to efficiently deliver sustainable operation for multiple tasks on heterogeneous platforms under dynamic environmental conditions. Our evaluation shows that (1) comparing to conventional approaches, AsTAR guarantees Sustainability by maintaining a user-defined optimum level of charge, and (2) AsTAR reacts quickly to environmental and platform changes, and achieves Efficiency by allocating all the surplus resources following the developer-specified task priorities. (3) Last, the benefits of AsTAR are achieved with minimal performance overhead in terms of memory, computation, and energy.

Modern streaming analytics platforms, such as Apache Flink, can receive, process, and act on real-time streaming data from various sources to take immediate action as events occur in the real world. Combined with the emergence of the Internet of Things (IoT), these platforms have revolutionized many application domains by deriving strategic insights from incoming sensor data. For instance, manufacturers can retrofit production lines with sensors, enabling them to rapidly detect and correct problems by analyzing incoming sensor data in real-time. However, when sensors generate data too slowly, the application produces incorrect results due to insufficient information. Conversely, generating data too fast rapidly decreases sensor battery lifetime and wastes storage resources. Consequently, the data generation rate of the IoT infrastructure must match the data processing rate of the application(s) at all times, which is a challenging task due to the several facets of IoT dynamism: sensor mobility, sensor failure, changing application data requirements, varying message inter-generation and transmission delay. Currently, application developers are required to manually configure sensor sampling periods to match these rates; a time-consuming process that is inefficient, if not ineffective, due to the dynamism of the IoT infrastructure. In this paper, we tackle this problem by introducing Ermis, a novel middleware that runs on the gateway and automatically adapts sensor sampling periods at runtime to match application requirements, without relying on any previous knowledge about the underlying IoT infrastructure. To the best of our knowledge, this is the first solution that can ensure the presence of sufficient data for the IoT applications under various sources of dynamism, while minimizing unnecessary transmissions to extend sensor battery lifetime. Extensive evaluation on real-time data from a physical testbed demonstrated a ~34% increase in the expected battery lifetime, while consistently ensuring data sufficiency, compared to state-of-the-art.

Vibration monitoring uses data gathered from accelerometers to study kinetic phenomena in applications such as: structural health monitoring and predictive maintenance. The Internet of Things (IoT) has the potential to greatly expand the range and scope of vibration monitoring applications by delivering long-life wireless sensors that can be cost-effectively embedded in hard to reach places such as; within machines, infrastructure or the built environment. However, achieving this vision is difficult due to the stringent resource constraints of contemporary IoT devices and networks. This has led the research community to develop a creative range of application-specific near-sensor processing firmware. However, systematic support for generic vibration monitoring on resource-poor IoT networks remains an open problem. We tackle this challenge by introducing ReFrAEN, a software framework that efficiently enables a wide range of vibration monitoring applications on IoT networks. ReFrAEN achieves this through a deeply configurable combination of compression techniques and data processing algorithms. These features allow end-users to effectively trade-off between resource consumption and data resolution in order to meet battery life constraints while preserving sufficient data quality to support the target application. Our evaluation shows that ReFrAEN is capable of identifying bearing faults, while dramatically improving battery lifetime and reducing latency in comparison to prior approaches.

NoSQL technology provides specialized solutions for specific data models and is as such often combined in polyglot persistence implementations. The technological heterogeneity in monitoring APIs and inspection capabilities complicates the management of such storage architectures, and this is further exacerbated by their distributed deployment. More specifically, (i) the use of a combination, e.g., in a multi-cloud context, requires extensive knowledge of these technologies and their APIs, which results in increased application complexity and further leads to technology or vendor lock-in, and (ii) relying solely on a generalistic approach for monitoring different databases falls short in providing in-depth inspection of an individual database.In this paper, we present MonitDB, a uniform API that uses a hybrid approach (a combination of both generalistic and specialistic) for monitoring different types of databases. The approach adopted by MonitDB covers a broad range of databases in terms of a set of common monitoring metrics and also gives more detailed visibility and insights into key metrics for each specific database. At its core, MonitDB is (i) extensible both in terms of new database technologies and monitoring metrics, (ii) configurable (through policies) in scheduling specific monitoring metrics from each of the supported databases, and (iii) customizable in terms of the type of data monitored (i.e. monitoring metrics) and also a performance by simply changing parameters, and as such without storing the measurements in the underlying database of MonitDB.We have validated MonitDB in a working prototype implementation and conducted an extensive evaluation, the results of which confirm the extensibility and configurability benefits, which are achieved with an acceptable performance overhead (around 1% for insert and 9% for read operations).

Multi-tenant Software-as-a-Service (SaaS) providers allow tenants to customize the application at different levels. When the customization involves tenant custom code and a single application instance is shared among multiple tenants, the issue of tenant isolation becomes critical. In common practice, tenant isolation, which amounts to protection of tenants against any interference and disturbance from each other, is performed by isolating tenant custom code in either a dedicated Virtual Machine (VM) or a dedicated container.

Recent innovations in energy harvesting promise extended operational life and reduced maintenance costs for the next generation of Internet of Things (IoT) platforms. However, energy management in these platforms remains problematic due to dynamism in energy supply and demand, inefficiency in storing and converting energy and a lack of per-task charge isolation. This paper tackles this problem by proposing a software defined charge storage module called Morphy, which combines a polymorphic capacitor array with intelligent power management software. Morphy delivers energy to application tasks in a flexible, efficient, and isolated manner. Morphy provides two software extensions to the Operating System scheduler: the energy semaphore blocks the execution of tasks until sufficient charge is available to safely run them, and the energy watchdog monitors and mitigates energy management bugs. We have realized a prototype of Morphy with the hardware form factor of a standard 9V (PP3) battery package and a software library that integrates with the FreeRTOS scheduler. Our evaluation shows that, in comparison to standard energy storage and management approaches, our prototype reaches an operational voltage more quickly, sustains operation longer in the case of power failure and effectively isolates charge storage for dedicated tasks with minimal compute, memory and energy overhead.

In recent years, e-books have proven to be a very appealing alternative to physical books; nowadays, almost every written book is published in an electronic format next to its physical copy. In an attempt to promote consensus and to offer an alternative to emerging proprietary e-book formats, the Open eBook format was introduced, now known as the EPUB format. Building on existing web functionalities, this open format relies primarily on XHTML and CSS to construct e-books. As such, browser engines are often employed to render the contents of EPUBs. However, this implies that reading systems may face similar vulnerabilities as web browsers.In this paper, we report on a semi-automated evaluation of the security and privacy aspects of EPUB reading systems. This evaluation, which was performed on 97 EPUB reading systems covering seven platforms and five physical reading devices, revealed that almost none of the JavaScript-supporting reading systems sufficiently adhere to the EPUB specification’s security recommendations. Furthermore, our results indicate that 16 reading systems even allow an EPUB to leak information about the user’s file system, and in eight cases extract file contents. In addition to the semi-automated evaluation, we demonstrate that an attacker can launch even more potent attacks that may lead to a full compromise of a user’s system, by exploiting aspects specific to the implementation of reading systems used by millions of users. Finally, we investigate the root cause of the identified security and privacy issues, uncovering several flaws in both the implementation of EPUB reading system, as well as shortcomings of the EPUB specification.

Low Power Wide Area Network (LPWAN) technologies offer the advantage of wide coverage areas and low power consumption for low data-rate Internet-of-Things (IoT) applications. LoRaWAN, the Long Range Wide Area Network is a key technology in this space, with a growing worldwide presence. LoRa devices are expected to operate autonomously for extended periods in order to support diverse IoT applications. Despite being energy efficient, frequent battery replacements are typically required over the lifetime of a LoRa device. This increases maintenance costs and furthermore, disposing of large numbers of dead batteries is damaging to the environment. Energy harvesting offers a potential solution, but it is difficult to ensure sustainability. In this paper, we propose EH-CRAM, a centralised Kalman filter-based optimisation algorithm where the gateway is responsible for controlling End-Device configurations (i.e: data transmission rates, spreading factors and energy harvesting period) based upon incoming traffic and solar energy, thus balancing energy supply and demand. In addition, by using a time-synchronised cryptographic frequency hopping scheme, EH-CRAM also tackles the issues of energy efficiency and performance. Our evaluation shows that EH-CRAM significantly reduces contention, while maximising reliability and energy efficiency to support sustainable energy-harvesting for LoRa EndDevices (ED's).

Electronic consent (e-consent) has the potential to solve many paper-based consent approaches. Existing approaches, however, face challenges regarding privacy and security. This literature review aims to provide an overview of privacy and security challenges and requirements proposed by papers discussing e-consent implementations, as well as the manner in which state-of-the-art solutions address them. We conducted a systematic literature search using ACM Digital Library, IEEE Xplore, and PubMed Central. We included papers providing comprehensive discussions of one or more technical aspects of e-consent systems. Thirty-one papers met our inclusion criteria. Two distinct topics were identified, the first being discussions of e-consent representations and the second being implementations of e-consent in data sharing systems. The main challenge for e-consent representations is gathering the requirements for a “valid” consent. For the implementation papers, many provided some requirements but none provided a comprehensive overview. Blockchain is identified as a solution to transparency and trust issues in traditional client-server systems, but several challenges hinder it from being applied in practice. E-consent has the potential to grant data subjects control over their data. However, there is no agreed-upon set of security and privacy requirements that must be addressed by an e-consent platform. Therefore, security- and privacy-by-design techniques should be an essential part of the development lifecycle for such a platform.

Abstract Online tracking is a whack-a-mole game between trackers who build and monetize behavioral user profiles through intrusive data collection, and anti-tracking mechanisms that are deployed as browser extensions, DNS resolvers, or built-in to the browser. As a response to pervasive and opaque online tracking, more and more users adopt anti-tracking measures to preserve their privacy. Consequently, as the information that trackers can gather on users is being curbed, some trackers are looking for ways to evade these protections. In this paper we report on a large-scale longitudinal evaluation of an anti-tracking evasion scheme that leverages CNAME records to include tracker resources in a same-site context, which effectively bypasses anti-tracking measures that rely on fixed hostname-based block lists. Using historical HTTP Archive data we find that this tracking scheme is rapidly gaining traction, especially among high-traffic websites. Furthermore, we report on several privacy and security issues inherent to the technical setup of CNAME-based tracking that we detected through a combination of automated and manual analyses. We find that some trackers are using the technique against the Safari browser, which is known to include strict anti-tracking configurations. Our findings show that websites using CNAME trackers must take extra precautions to avoid leaking sensitive information to third parties.

Application-level access control is a top priority when hardening software applications. In particular, run-time customization of access control policies and separation for concerns are becoming increasingly important. While these requirements are generally well-supported for request-response applications, there is a lack of support for data-focused operations, such as search or data aggregation, in a multi-tier architecture. Moreover, an ability to specify fine-grained access control policies is generally lacking for such applications. This puts at risk the security of organizations that employ existing and emerging database technologies and requires solutions that alleviate this issue. This paper approaches this issue through query rewriting. We present Sequoia, a data access middleware that enables attribute-based, application-level access control in data-driven applications. The middleware enforces external access control policies on data-focused operations such as search and aggregation queries by means of query rewriting based on dynamic run-time conditions. Sequoia provides run-time enforcement of policies that is scalable with regard to the database size. This paper presents an extensible architecture for both relational databases and document stores. It discusses the rewriting approach, and provides a formal verification of equivalencyand an extensive evaluation that shows that this approach scales better than the current state of practice and is an important track for future research.

As biometric templates consist of highly correlated features, the real security level offered by biometric authentication systems remains an open research question. In this work we provide new approximations and a lower bound of the security offered by fuzzy commitment schemes. Fuzzy commitment cryptosystems and in general biometric template protection schemes play an important role in allowing for remote storage and processing of biometric data, as they mitigate the threat of biometric template leakage. The use of such schemes would alleviate some of the usability constraints imposed by the state-of-practice local use of biometrics. As such we conduct an in-depth security analysis for IMU based gait authentication systems, where we evaluate the effectiveness of attacks within the scope of two well-defined threat models that target both unprotected and protected systems. A pivotal enabler of our analysis is the development of nine different approaches to gait authentication, which allows us to perform intramodal fusion on these distinct, yet highly correlated biometric templates, and to protect them with a strengthened fuzzy commitment scheme. Our analysis clearly demonstrates the high correlation between the different biometric templates, which, among others, further showcases the threat of biometric template leakage. Furthermore, as our analysis incorporates a threat model that assumes biometric template leakage, it provides metrics for the security provided by the biometric modality itself.

The Internet of Things (IoT) is being deployed in an ever-growing range of applications, from industrial monitoring to smart buildings to wearable devices. Each of these applications has specific computational requirements arising from their networking, system security, and edge analytics functionality. This diversity in requirements motivates the need for adaptable end-devices, which can be re-configured and re-used throughout their lifetime to handle computation-intensive tasks without sacrificing battery lifetime. To tackle this problem, this article presents Chimera, a low-power platform for research and experimentation with reconfigurable hardware for the IoT end-devices. Chimera achieves flexibility and re-usability through an architecture based on a Flash Field Programmable Gate Array (FPGA) with a reconfigurable software stack that enables over-the-air hardware and software evolution at runtime. This adaptability enables low-cost hardware/software upgrades on the end-devices and an increased ability to handle computationally-intensive tasks. This article describes the design of the Chimera hardware platform and software stack, evaluates it through three application scenarios, and reviews the factors that have thus far prevented FPGAs from being utilized in IoT end-devices.

Many enterprise software services are adopting a fully web-based architecture for both internal line-of-business applications and for online customer-facing applications. Although wireless connections are becoming more ubiquitous and faster, mobile employees and customers are often offline due to expected or unexpected network disruptions. Nevertheless, continuous operation of the software is expected. This article presents OWebSync: a web-based middleware for data synchronization in interactive groupware with fast resynchronization of offline clients and continuous, interactive synchronization of online clients. To automatically resolve conflicts, OWebSync implements a fine-grained data synchronization model and leverages state-based Conflict-free Replicated Data Types. This middleware uses Merkle-trees embedded in the tree-structured data and virtual Merkle-tree levels to achieve the required interactive performance. Our comparative evaluation with available operation-based and delta-state-based middleware solutions shows that OWebSync is especially better in operating in and recovering from offline settings and network disruptions. In addition, OWebSync scales more efficiently over time, as it does not store version vectors or other meta-data for all past clients.

Information leakage through side-channels poses a serious threat to the security of distributed systems. Recent research on countermeasures against side-channel attacks show that, on embedded platforms with predictable execution times, certain classes of these vulnerabilities can be detected and mitigated automatically by means of language-based security techniques. In this paper, we propose a security type system to statically analyse MSP430 assembly programs to detecting information leakage through novel interrupt-latency attacks (a.k.a. Nemesis), timing side-channels, and undesired information flow. We have implemented our technique in a tool, Side Channel FinderMSP, which automatically verifies MSP430 object-code programs to be free of such vulnerabilities. We evaluate the effectiveness of our tool by applying it to a representative set of vulnerable and benign programs. Our experiments demonstrate that the tool is both effective in detecting vulnerabilities, and scalable to realistic applications.

Low power wide area networks (LPWANs) are being applied in many Internet of Things applications around the globe. These technologies offer economic coverage of wide areas, while retaining low power operation. LoRaWAN is a key technology in this space, with a world-wide presence and millions of devices deployed in the field. Despite this early success, recent research has shown that LoRa performs poorly in dense deployments with a high degree of contention. Furthermore, LoRa is not robust against selective jamming attacks. In this paper, we propose CRAM: a cryptographic frequency hopping MAC protocol designed for the LoRa physical layer that reduces contention by fairly exploiting all available frequency space, while making it significantly more difficult to perform selective jamming. Our evaluation shows that CRAM significantly reduces contention, thereby dramatically increasing scalability and reliability in comparison to the standard LoRa protocol.

The Internet of Things (IoT) is being deployed at large scale in a wide range of long-life applications. Examples range from Industry 4.0 to smart lighting systems. These applications have diverse requirements of non-volatile storage. However, the flash memory that is used in today's IoT devices offers limited write endurance and must therefore be carefully managed if applications are to deliver on their promises of multiyear lifetimes. Managing the health of flash memory is difficult for application developers, as it requires in-depth hardware and software knowledge, which often needs to the problem being neglected. While various techniques have been proposed to preserve the health of flash memory, prior work tends to focus on a single hardware platform and data type. Furthermore, prior work does not provide lifetime guarantees. This paper tackles this problem by proposing MicroVault, a simple and unified interface for reliable non-volatile data storage on resource-constrained IoT devices. MicroVault enforces developer-specified lifetime guarantees through a range of lifetime extension techniques, which are adaptively applied based upon the needs of the application. Evaluation shows that MicroVault dramatically extends the lifetime of flash memory while minimising overhead.

The Internet of Things (IoT) consists of embedded sensors that transmit events over a wireless network. Complex event processing provides powerful abstractions to aggregate and analyze relationships among event streams in real time, which can improve IoT application development and management. A key challenge are stream imperfections, because of the non-deterministic nature of IoT: events can be delayed due to variance in delay, or may even be missing due to packet loss. Timeouts are used to handle stream imperfections, distinguishing between delayed and lost events. For some applications, missing delayed events is costly, as the quality of the result depends on the presence of all inputs, but reacting too late to event non-arrivals can also lead to incorrect results. State-of-the-art results in timeouts that are impractically large when little to no missed events are tolerated by the application. We propose Kairos, a novel, self-configuring technique for determining event arrival timeouts in IoT that are both small and ensure that little to no events are missed, while also eliminating the overhead and complexity of user configuration. We evaluate our approach against the state-of-the-art using two representative IoT networks: SmartMesh IP and LoRaWAN. The results show that our solution is capable of reducing timeouts by up to two orders of magnitude even when little to no missed events are tolerated, thus satisfying the aforementioned application requirements.

Computer security incident response teams typically rely on threat intelligence platforms for information about sightings of cyber threat events and indicators of compromise. Other security building blocks, such as Network Intrusion Detection Systems, can leverage the information to prevent malicious adversaries from spreading malware across critical infrastructures. The effectiveness of threat intelligence platforms heavily depends on the willingness to share among organizations and the responsible use of sensitive information that may potentially harm the reputation of the reporting organization. The challenge that we address is the lack of trust in the source providing the threat intelligence and the information itself. We enhance our security framework TATIS—offering fine-grained protection for threat intelligence platform APIs—with distributed ledger capabilities to enable reliable and trustworthy threat intelligence sharing with the ability to audit the provenance of threat intelligence. We have implemented and evaluated the feasibility of our distributed framework on top of the Malware Information Sharing Platform (MISP) solution, and we evaluate the performance impact using real-world open-source threat intelligence feeds.

Application development for Cyber Physical Systems (CPS) is challenging, because the wireless network and the devices introduce latencies that vary continuously along with the load, status, or environmental conditions of the infrastructure. Reactive programming is well suited for the development of event-driven applications, yet current reactive programming frameworks require developers to predict event arrival time-boundaries at compile time, which is impractical, if not impossible, for CPS. Thus, there is a tradeoff between timeliness and completeness of complex event computations, e.g., operational efficiency in a manufacturing plant: Waiting too long until all individual events arrive can fail to produce a useful result, while not waiting long enough may lead to faults due to incomplete status information. In this article, we propose (a) a set of extensions to state-of-the-art reactive programming frameworks, which remove the burden of specifying timeouts at compile time by utilizing (b) Khronos, a middleware that automatically determines timeouts by taking into account variations in event arrival times due to the underlying infrastructure. Evaluation on a physical testbed shows that the extensions significantly decrease developer effort and that Khronos considerably improves timeliness under varying network configurations and conditions, while still satisfying the application’s tolerance to missed events.

DNS is one of the most essential components of the Internet, mapping domain names to the IP addresses behind almost every online service. Domain names are therefore also a fundamental tool for attackers to quickly locate and relocate their malicious activities on the Internet. In this paper, we design and evaluate Premadoma, a solution for DNS registries to predict malicious intent well before a domain name becomes operational. In contrast to blacklists, which only offer protection after some harm has already been done, this system can prevent domain names from being used before they can pose any threats. We advance the state of the art by leveraging recent insights into the ecosystem of malicious domain registrations, focusing explicitly on facilitators employed for bulk registration and similarity patterns in registrant information. We thoroughly evaluate the proposed prediction model's performance and adaptability on an 11 month testing set, and address complex and domain-specific dataset challenges. Moreover, we have successfully deployed Premadoma in the production environment of the .eu ccTLD registry to detect and prevent malicious registrations, and have contributed to the take down of 58,966 registrations in 2018.

For many, a browsing session starts by entering relevant keywords in a popular search engine. The websites that users thereafter land on are often determined by their position in the search results. Although little is known about the proprietary ranking algorithms employed by popular search engines, it is strongly suspected that the incoming links have a significant influence on the outcome. This has lead to the inception of various black-hat SEO techniques that aim to deceive search engines to promote a specific website. In this paper, we present the first extensive study on the ecosystem of a novel type of black-hat SEO, namely the trade of artificially created backlinks through private blog networks (PBNs). Our study is three-pronged: first, we perform an exploratory analysis, through which we capture intrinsic information of the ecosystem and measure the effectiveness of backlinks. Next, we develop and present an ML-driven methodology that detects PBN sites with an accuracy of 98.7% by leveraging various content-based and linking-based features intrinsic to the operation of the ecosystem. Finally, in a large-scale experiment involving more than 50,000 websites, we expose large networks of backlink operations, finding thousands of websites engaged in PBNs.

In the last few years, traffic generated by mobile devices has surpassed desktop visits. In order to provide users with the best browsing experience, many website owners specifically tailor their site to mobile devices. While some websites make use of reactive designs, many others opt to create an entirely new "mobile-first" website, typically hosted on a subdomain of the desktop site. These mobile-first sites provide a unique viewpoint on how organizations handle security: the mobile version of a site is typically developed several years after the desktop site by the same organization. Through a large-scale security analysis on 10,222 domains with both a desktop and mobile-first version, we find several strong indicators that security is generally applied consistently across the different parts of an organization's web estate. Overall, we find relatively few differences between the desktop and mobile versions of a website, both on the adoption and the implementation of security features, indicating that these are applied reactively rather than proactively during the design phase.

Multi-cloud storage is the practice of composing the data tier of an application with heterogeneous cloud storage technologies, resources and services. In a federated cloud storage architecture which involves multiple cloud storage providers, both the complexity and the importance of trust management increases drastically. A trust relation is established between a data owner and a cloud storage provider when the data owner subscribes to the service and service level agreements (SLAs) are established. In practice, this trust relation is seldom revised, only when serious infractions are discovered and made public. In this paper, we evaluate the potential of continuous and client-centric trust monitoring of cloud storage services. This approach leverages upon the statistical correlations between black-box performance metrics and reported white-box metrics, and identifies significant deviations between both. We evaluate in terms of (a) the effectiveness of correlating black-box and white-box measurements, and (b) the incurred performance overhead of the approach to continuously monitor for trust.

Data Protection by Design (DPbD) is a truly interdisciplinary effort that involves many stakeholders such as legal experts, requirements engineers, software architects, developers, and system operators. Building software-intensive systems that respect the fundamental rights to privacy and data protection is the result of intensive dialogue and careful trade-off decisions. In practice however, there is a dichotomy between the legal reasoning which is conducted in Data Protection Impact Assessments (DPIA) and software engineering approaches, such as threat modeling, aimed at identifying privacy requirements and privacy risks. These activities are commonly performed in total isolation, which negatively impacts (i) the compliance exercise, (ii) the ability to evolve the system over time, and (iii) the architectural trade-offs made during system design. In this article, we present an architectural viewpoint for describing software architectures from a legal, data protection perspective whose core modeling abstractions are based on an in-depth legal analysis of the EU General Data Protection Regulation. This viewpoint is tied to Data Flow Diagrams-commonly used in threat modeling-through correspondence rules. The proposed viewpoint supports the automation of a number of data protection impact assessment steps through (i) meta-model constraints, (ii) model analysis, and (iii) interaction with the involved stakeholders. This enables a streamlined compliance exercise, reconciling legal privacy and data protection notions with architecture-driven software engineering practices. We validate our approach in the context of a realistic e-health application for a number of complementary development scenarios.

De-identification is the process of removing the associations between data and identifying elements of individual data subjects. Its main purpose is to allow use of data while preserving the privacy of individual data subjects. It is thus an enabler for compliance with legal regulations such as the EU’s General Data Protection Regulation. While many de-identification methods exist, the required knowledge regarding technical implications of different de-identification methods is largely missing. In this paper, we present a data utility-driven benchmark for different de-identification methods. The proposed solution systematically compares de-identification methods while considering their nature, context and de-identified data set goal in order to provide a combination of methods that satisfies privacy requirements while minimizing losses of data utility. The benchmark is validated in a prototype implementation which is applied to a real life data set.

Container orchestration systems, such as Docker Swarm, Kubernetes and Mesos, provide automated support for deployment and management of distributed applications as sets of containers. While these systems were initially designed for running load-balanced stateless services, they have also been used for running database clusters because of improved resilience attributes such as fast auto-recovery of failed database nodes, and location transparency at the level of TCP/IP connections between database instances. In this paper we evaluate the performance overhead of Docker Swarm and Kubernetes for deploying and managing NoSQL database clusters, with MongoDB as database case study. As the baseline for comparison, we use an OpenStack IaaS cloud that also allows attaining these improved resilience attributes although in a less automated manner.

The Internet of Things (IoT) promises to tackle a range of environmental challenges and deliver large efficiency gains in industry by embedding computational intelligence, sensing and control in our physical environment. Multiple independent parties are increasingly seeking to leverage shared IoT infrastructure, using a similar model to the cloud, and thus require constrained IoT devices to become microservice-hosting platforms that can securely and concurrently execute their code and interoperate. This vision demands that heterogeneous services, peripherals and platforms are provided with an expanded set of security guarantees to prevent third-party services from hijacking the platform, resource-level access control and accounting, and strong isolation between running processes to prevent unauthorized access to third-party services and data. This paper introduces Polyglot CerberOS, a resource-secure operating system for multi-tenant IoT devices that is realised through a reconfigurable virtual machine which can simultaneously execute interoperable services, written in different languages. We evaluate Polyglot CerberOS on IETF Class-1 devices running both Java and C services. The results show that interoperability and strong security guarantees for multilingual services on multi-tenant commodity IoT devices are feasible, in terms of performance and memory overhead, and transparent for developers.

The last few years have seen a drastic increase in the amount and the heterogeneity of NoSQL data stores. Consequently, exploration and comparison of these data stores have become difficult. Once chosen, it is hard to migrate to different data stores. Recently, a number of data access middleware platforms for NoSQL have emerged that provide access to different NoSQL data stores\nfrom standardized APIs. \n\nHowever, there are two key concerns related to: (i) the performance overhead introduced by these platforms,\nand (ii) the effort required to migrate between different data stores. \n\nIn this paper, we present two complementary studies that provide answers to the above mentioned concerns for three of the most mature data access middleware platforms: Impetus Kundera, Playorm, and Spring Data. First, we evaluate the performance overhead introduced by these platforms for the CRUD operations. Second, we compare the cost of migration with and without these platforms. \n\nOur study shows that, despite their similarity in design, these platforms are still substantially different performance-wise. Both studies are complementary as they show the trade-off inherent in adopting a data access middleware platform for NoSQL: by allowing some performance overhead, the developer gain benefits in terms of portability and easy migration across heterogeneous data stores.

Contemporary storage systems increasingly offer schema flexibility and support for semi-structured data models. This is the case for document-oriented databases, which as such allow ingestion of data from heterogeneous sources (IoT, sensors, monitoring). The increased influx of data further emphasizes the necessity for horizontal and elastic scalability, which are attained in NoSQL document stores through simplifying query functionality and relaxing transactional properties, e.g. through eventual consistency. The most compelling benefits of document stores are attained when data is stored in a denormalized form (De-NF). For example, one can decide to store relationships as an embedded copy to increase read query performance and as such avoid costly cross-node consultations. In comparison to the normalized form (NF), such designs come at a cost of additional data duplication, consistency and decreased write- and update performance. Determining the most appropriate data model for an application however depends on many factors, and the application developer is faced with the complexity of designing document data models that are optimized in terms of performance, scalability, storage and memory size, all requiring in-depth knowledge on the technology, the data meta-model, query plans and expected workloads. In this paper, we first discuss factors that impact the data schema design in document stores, such as the nature of the document and its attributes, horizontal partitioning, index selection, workload variability, and data uniformity. Although some data model design support tools are in existence, there are none that systematically take into account all these factors. Then, we outline our vision and roadmap towards systematic schema design support and tooling that involves (i) leveraging heuristics and common tactics to generate a finite number of candidate data models and (ii) ranking these candidate data models by means of cost functions that express their cost-effectiveness.

Hosting providers play a key role in fighting web compromise, but their ability to prevent abuse is constrained by the security practices of their own customers. Shared hosting, offers a unique perspective since customers operate under restricted privileges and providers retain more control over configurations. We present the first empirical analysis of the distribution of web security features and software patching practices in shared hosting providers, the influence of providers on these security practices, and their impact on web compromise rates. We construct provider-level features on the global market for shared hosting -- containing 1,259 providers -- by gathering indicators from 442,684 domains. Exploratory factor analysis of 15 indicators identifies four main latent factors that capture security efforts: content security, webmaster security, web infrastructure security and web application security. We confirm, via a fixed-effect regression model, that providers exert significant influence over the latter two factors, which are both related to the software stack in their hosting environment. Finally, by means of GLM regression analysis of these factors on phishing and malware abuse, we show that the four security and software patching factors explain between 10% and 19% of the variance in abuse at providers, after controlling for size. For web-application security for instance, we found that when a provider moves from the bottom 10% to the best-performing 10%, it would experience 4 times fewer phishing incidents. We show that providers have influence over patch levels--even higher in the stack, where CMSes can run as client-side software--and that this influence is tied to a substantial reduction in abuse levels.

The functionality and security of all domain names are contingent upon their nameservers. When these nameservers, or requests to them, are compromised, all domains that rely on them are affected. In this paper, we study the exploitation of configuration issues (typosquatting and outdated WHOIS records) and hardware errors (bitsquatting) to seize control over nameservers' requests to hijack domains. We perform a large-scale analysis of 10,000 popular nameserver domains, in which we map out existing abuse and vulnerable entities. We confirm the capabilities of these attacks through real-world measurements. Overall, we find that over 12,000 domains are susceptible to near-immediate compromise, while 52.8M domains are being targeted by nameserver bitsquatters that respond with rogue IP addresses. Additionally, we determine that 1.28M domains are at risk of a denial-of-service attack by relying on an outdated nameserver.

Long range, low power networks are rapidly gaining acceptance in the Internet of Things (IoT) due to their ability to economically support long-range sensing and control applications while providing multi-year battery life. LoRa is a key example of this new class of network and is being deployed at large scale in several countries worldwide. As these networks move out of the lab and into the real world, they expose a large cyber-physical attack surface. Securing these networks is therefore both critical and urgent. This paper highlights security issues in LoRa and LoRaWAN that arise due to the choice of a robust but slow modulation type in the protocol. We exploit these issues to develop a suite of practical attacks based around selective jamming. These attacks are conducted and evaluated using commodity hardware. The paper concludes by suggesting a range of countermeasures that can be used to mitigate the attacks.

The widespread use of mobile devices has allowed the development of participatory sensing systems that capture various types of data using the existing sensors on mobile devices in order to upload the data to cloud based services for later use. Gathering data from such sources requires a mechanism to establish trust on the sensor data. For example an application may require a proof of authenticity of sensor readings originating from anonymous sources. Establishment of trust on the sensor data has been addressed in the literature. However, in many cases this sensor data needs to be preprocessed on the device itself before being uploaded to the target server. This processing could include resizing of images, hiding identifiable faces and sensitive data in images, anonymization of GPS data etc. while ensuring the chain of trust from data capture to the delivery of data to the consumer. There is a need for a framework that provides a means to implement arbitrary operations to be performed on trusted sensor data while guaranteeing the authenticity of the data. This paper presents the design and implementation of a framework that allows the capture of trusted sensor data, the development of trusted operations on sensor data, and provides a mechanism for performing predefined trusted operations on the sensor data such that the chain of trust is maintained. Evaluation shows that the performance of the proposed system is reasonable and that the trust guarantees are strong.

The state-of-practice for Internet of Things (IoT) applications is deployment on specialised networks of embedded devices connected to a cloud backend. While this paradigm has successfully supported a range of IoT systems, its power is limited by the high latency and bandwidth caused by communications with remote data servers and the inability to share specialised IoT infrastructure across applications. To improve these aspects, this paper proposes re-imagining all resources of the IoT infrastructure as microservice-hosting platforms. Applications decomposed as a set of services can then share IoT resources and run communicating modules closer together, tightening control loops and reducing latency and communications. To this end, we present Niflheim, a generic end-to-end middleware that provides modular microservice-based orchestration of applications to deploy and manage them on all resources across the tiers of the IoT, from IoT end-devices through gateways to the cloud. This enables increased flexibility in deployment and operations, while remaining efficient in terms of hardware and software requirements. We evaluate Niflheim in a smart building use case and demonstrate improved latency and bandwidth consumption for applications, while enabling efficient shared use of the IoT infrastructure resources.

The state-of-practice for Internet of Things (IoT) applications is deployment on specialised networks of embedded devices connected to a cloud backend. This paradigm is limited by the high latency and bandwidth incurred by communications with remote data servers and the inability to share specialised IoT infrastructure across applications. Efficiency can be improved by re-imagining all resources of the IoT infrastructure as micro-service hosting platforms. Applications decomposed as a set of services can then share IoT resources and run communicating modules closer together, tightening control loops and reducing latency and communications. This demo showcases Niflheim, a generic end-to-end middleware that provides modular microservice-based orchestration of applications on all resources across the tiers of the IoT, from IoT end-devices through gateways to the cloud. We demonstrate that this enables increased flexibility in application deployment and operations, while remaining efficient in terms of hardware and software requirements.

Finding security vulnerabilities in the source code as early as possible is becoming more and more essential. In this respect, vulnerability prediction models have the potential to help the security assurance activities by identifying code locations that deserve the most attention. In this paper, we investigate whether prediction models behave like milk (i.e., they turn with time) or wine (i.e., the improve with time) when used to predict future vulnerabilities. Our findings indicate that the recall values are largely in favor of predictors based on older versions. However, the better recall comes at the price of much higher file inspection ratio values.

Regression testing is a form of software quality assurance (QA) that involves comparing the behavior of a newer version of a software artifact to its earlier correct behavior, and signaling the QA engineer when deviations are detected. Given the large potential in automated generation and execution of regression test cases for business process models in the context of running systems, powerful tools are required to make this practically feasible, more specifically to limit the potential impact on production systems, and to reduce the manual effort required from QA engineers.

Due to its scale and dynamism, the Internet of Things (IoT) requires efficient and flexible communication support. At the network layer, IPv6 integrates heterogeneous technologies to provide interoperability, efficient multicast group communication and a flexible address space. At the application layer, publish-subscribe (pub-sub) middleware implements a scalable, dynamic and loosely-coupled data dissemination scheme. The pub-sub paradigm is a natural use case for IPv6 multicast but the two mechanisms are poorly integrated in the IoT. We tackle this problem by proposing a framework that integrates pub-sub middleware and multicast to reduce communication overhead. Our solution maps application-layer subscriber groups to network-layer multicast groups. Pub-sub hosts can either implicitly derive the necessary multicast address or request it from a group manager. We evaluate our framework on an IoT network testbed composed of representative hardware and demonstrate improvements in bandwidth and energy consumption that scale with the size of the network. Bandwidth consumption of a publishing sensor decreases by up to 54% for 10 subscribers and 66% for 20 subscribers. Moreover, the implementation has a minimal memory footprint, requiring only an additional 1.3% dynamic memory and 4.7% flash storage.

Context-aware systems in intelligent environments digest large amounts of data and personal information to gain situational awareness as a way to assist individuals with their daily activities, enhance their experiences and adapt to their needs and intention, whenever and wherever they are. Large amounts of data drive these environments, motivating the adoption of big data and cloud technologies. A similar digital transformation is taking place in the Factory of the Future and Industry 4.0, two paradigms on creating smart products through smart processes and procedures. As the attack surface for security and privacy threats grows, it is no surprise that new regulations and directives will be put in place to protect the privacy of individuals. In this paper, we discuss the foundational principles of Privacy by Design and key obligations of the upcoming EU General Data Protection Regulation (GDPR), and highlight how they impact the design and development of context-aware intelligent environments. We provide technical guidelines for better compliance with these regulatory frameworks.

Creating, deploying and configuring applications for Internet of Things (IoT) scenarios today remains complex and costly for many users. The MicroPnP platform addresses this complexity problem and provides a true zero-configuration and standards-based solution that radically reduces the cost of acquiring, building, and operating wireless sensing and actuation IoT systems at scale. MicroPnP combines true Plug-and-Play integration of sensing and actuation peripherals with ultra-reliable wireless mesh networking and extreme battery lifetimes. MicroPnP was awarded in an international IoT competition, and is currently being successfully used in commercial IoT scenarios.

Software product line engineering is a compelling methodology that accomplishes systematic reuse in families of systems by relying on two key principles: (i) the decomposition of complex systems into composable and reusable building blocks (often logical units called features), and (ii) on-demand construction of products and product variants by composing these building blocks.

With the increasingly pervasive role of software in society, security is becoming an important quality concern, emphasizing security by design, but it requires intensive specialization.

Abstract A growing number of deployments of wireless sensor networks (WSNs) position the nodes as multipurpose albeit limited platforms. These platforms offer services to a set of applications of different owners. This view introduces security problems complementary to protection against outsiders requiring mechanisms beyond the existing physical, base crypto and network‐level protection. Limited trust in the different applications mandates a security solution providing granular control over resources and data. Because of the constrained nature of network‐embedded systems, transferring solutions from the distributed systems domain to the embedded system requires optimization. Distributed monitors can provide adequate security but must be concise and controllable by lightweight run‐time artifacts as well as be deployed only where needed. Presented research consists of an operational model that inserts controls by instrumentation of local or remote interaction in the resource‐rich back end, subsequently enforcing control at the nodes by using scaled down policy engines. The selective injection is achieved through aspect‐oriented techniques. The solution is demonstrated for two paradigms encountered when building WSN applications, thus achieving local resource protection and protection of distributed event‐based data flow. The costs and benefits of the selective injection approach are validated and quantified through a river monitoring case and associated simulation experiments. Copyright © 2011 John Wiley & Sons, Ltd.

Access control is an important part of security that restricts the actions that users can perform on resources. Policy models specify how these restrictions are formulated in policies. Over the last decades, we have seen several such models, including role-based access control and more recently, attribute-based access control. However, these models do not take into account the relationships between users, resources and entities and their corresponding properties. This limits the expressiveness of these models. In this work, we present Entity-Based Access Control (EBAC). EBAC introduces entities as a primary concept and takes into account both attributes and relationships to evaluate policies. In addition, we present Auctoritas. Auctoritas is a authorization system that provides a practical policy language and evaluation engine for EBAC. We find that EBAC increases the expressiveness of policies and fits the application domain well. Moreover, our evaluation shows that entity-based policies described in Auctoritas can be enforced with a low policy evaluation latency.

Many of today's applications are deployed on large-scale distributed infrastructures to handle large amounts of users concurrently. When applying access control to such applications, the access control policies must be evaluated concurrently as well. However, for certain classes of policies such as history-based policies one access decision depends on the previous ones. As a result, concurrency can be exploited to achieve incorrect access decisions and privilege escalation. Moreover, general techniques for concurrency control are not able to scale to the size of current applications and at the same time provide the full consistency required for security. Therefore, we present an efficient concurrency control scheme specifically for access control. By leveraging the specific structure of a policy evaluation, this scheme is able to prevent incorrect decisions due to concurrency and at the same time scale to a large number of machines while incurring only a limited and bounded latency overhead. As such, this work facilitates the adoption of policy-based access control in realistic and large-scale applications.

Web-based timing attacks have been known for over a decade, and it has been shown that, under optimal network conditions, an adversary can use such an attack to obtain information on the state of a user in a cross-origin website. In recent years, desktop computers have given way to laptops and mobile devices, which are mostly connected over a wireless or mobile network. These connections often do not meet the optimal conditions that are required to reliably perform cross-site timing attacks. In this paper, we show that modern browsers expose new side-channels that can be used to acquire accurate timing measurements, regardless of network conditions. Using several real-world examples, we introduce four novel web-based timing attacks against modern browsers and describe how an attacker can use them to obtain personal information based on a user's state on a cross-origin website. We evaluate our proposed attacks and demonstrate that they significantly outperform current attacks in terms of speed, reliability, and accuracy. Furthermore, we show that the nature of our attacks renders traditional defenses, i.e., those based on randomly delaying responses, moot and discuss possible server-side defense mechanisms.

The increase of Distributed Denial-of-Service (DDoS) attacks in volume, frequency, and complexity, combined with the constant required alertness for mitigating web application threats, has caused many website owners to turn to Cloud-based Security Providers (CBSPs) to protect their infrastructure. These solutions typically involve the rerouting of traffic from the original website through the CBSP's network, where malicious traffic can be detected and absorbed before it ever reaches the servers of the protected website. The most popular Cloud-based Security Providers do not require the purchase of dedicated traffic-rerouting hardware, but rely solely on changing the DNS settings of a domain name to reroute a website's traffic through their security infrastructure. Consequently, this rerouting mechanism can be completely circumvented by directly attacking the website's hosting IP address. Therefore, it is crucial for the security and availability of these websites that their real IP address remains hidden from potential attackers. In this paper, we discuss existing, as well as novel "origin-exposing" attack vectors which attackers can leverage to discover the IP address of the server where a website protected by a CBSP is hosted. To assess the impact of the discussed origin-exposing vectors on the security of CBSP-protected websites, we consolidate all vectors into CloudPiercer, an automated origin-exposing tool, which we then use to conduct the first large-scale analysis of the effectiveness of the origin-exposing vectors. Our results show that the problem is severe: 71.5% of the 17,877 CBSP-protected websites that we tested, expose their real IP address through at least one of the evaluated vectors. The results of our study categorically demonstrate that a comprehensive adoption of CBSPs is harder than just changing DNS records. Our findings can steer CBSPs and site administrators towards effective countermeasures, such as proactively scanning for origin exposure and using appropriate network configurations that can greatly reduce the threat.

Web services heavily rely on passwords for user authentication. To help users chose stronger passwords, password meter and password generator facilities are becoming increasingly popular. Password meters estimate the strength of passwords provided by users. Password generators help users with generating stronger passwords. This paper turns the spotlight on the state of the art of password meters and generators on the web. Orthogonal to the large body of work on password metrics, we focus on getting password meters and generators right in the web setting. We report on the state of affairs via a large-scale empirical study of web password meters and generators. Our findings reveal pervasive trust to third-party code to have access to the passwords. We uncover three cases when this trust is abused to leak the passwords to third parties. Furthermore, we discover that often the passwords are sent out to the network, invisibly to users, and sometimes in clear. To improve the state of the art, we propose SandPass, a general web framework that allows secure and modular porting of password meter and generation modules. We demonstrate the usefulness of the framework by a reference implementation and a case study with a password meter by the Swedish Post and Telecommunication Agency.

Internet of Things (IoT) applications require diverse sensors and actuators. However, contemporary IoT devices provide limited support for the integration of third-party peripherals. To tackle this problem, we introduce μPnP: a hardware and software solution for plug-and-play integration of embedded peripherals with IoT devices. μPnP provides support for: driver development, automatic integration of third-party peripherals, discovery and remote access to peripheral services. This is achieved through a low-cost hardware identification approach, a lightweight driver language and a multicast network architecture. Evaluation shows that μPnP has a minimal memory footprint, reduces development effort and provides true plug-and-play integration at orders of magnitude less energy than USB.

Security decisions are an important part of software architecture design, and thus deserve to be explicitly represented in the design documentation. While UML is the best-known language for creating such documentation, it lacks security specific notations, which makes it difficult to represent the effect of the security decisions. Several security extensions for UML exist in the literature, but they represent security concerns at a lower level of abstraction, or only support a limited subset of security concerns. We propose a new notation, MASC, to model security concerns at the architectural level. It has been designed as an extension of UML, and is based on recurring security concepts that have been distilled from well-known security principles, goals, and patterns. By using our notation, a designer obtains a technique to express security concerns more explicitly in the architectural design documentation.

Security patterns are well-known solutions to security-specific problems. They are often claimed to benefit designers without much security expertise. We have performed an empirical study to investigate whether the usage of security patterns by such an audience leads to a more secure design, or to an increased productivity of the designers. Our study involved 32 teams of master students enrolled in a course on software architecture, working on the design of a realistically-sized banking system. Irrespective of whether the teams were using security patterns, we have not been able to detect a difference between the two treatment groups. However, the teams prefer to work with the support of security patterns.

The exponential data growth in intelligent environments fuelled by the Internet of Things is not only a major push behind distributed programming frameworks for big data, it also magnifies security and privacy concerns about unauthorized access to data. The huge diversity and the streaming nature of data raises the demand for new enabling technologies for scalable access control that can deal with the growing velocity, volume and variety of volatile data. This paper presents SparkXS, an attribute-based access control solution with the ability to define access control policies on streaming latent data, i.e. hidden information made explicit through data analytics, such as aggregation, transformation and filtering. Experimental results show that SparkXS can enforce access control in a horizontally scalable way with minimal performance overheads.

Developing reliable application for the Internet-of-Things (IoT) is challenging due to heterogenous sensors and the resource-constraints of IoT platforms. Multimedia sensors such as cameras and microphones require significant memory and bandwidth. Typically, multimedia content results in bursty traffic. It is shown in the literature that the bursty traffic degrades the performance of the network. Hence, the regulation of bursty transmission is important for achieving high reliability. In this paper, we propose Dawn, a dependable networking framework for time-synchronised IoT platforms, which uses application meta-data to derive bandwidth requirements and uses this information to optimally allocate bandwidth for the network. Dawn regulates the transmission of bursty traffic generated by multimedia sensors, while performing admission control for dynamically added sensors. Dawn guarantees end-to-end reliability for heterogenous IoT applications with minimal energy consumption. Our preliminary evaluation results show that dawn is dependable and provides 100% reliability for dynamic multimedia-enabled IoT applications while increasing the network lifetime by up to 4 years.

In the participatory sensing model, humans may serve as opportunistic sensors and flexible actuators while also consuming sensing services. Integrating humans into sensing systems has the potential to increase scale and reduce costs. However, contemporary participatory sensing software provides poor consideration of user dynamism, which includes: mobility across networks, mobility across devices and context-awareness. To address these limitations we propose the User Component and User Bindings. The former represents the user as a first class reconfigurable element of evolving and shared participatory sensing platforms. The latter allows the middleware to support multiple communications channels including Online Social Networks (OSN) to connect users with sensing applications. Our approach increases user participation, reduces out-of-context interactions and only consumes a limited amount of energy by sharing context information between applications. We support these claims by evaluating our approach on a two weeks experiment in which three participants take part in three concurrent participatory applications.

Sensor network deployments, such as smart cities and smart logistics, are evolving towards open infrastructure on top of which multiple parties deploy and make use of each other's application software. Of vital importance in such distributed settings, is an agreement on message semantics and contents. Yet, the current state-of-the-art in sensor programming typically remains low-level in terms of messaging, and lacks support for coordination across platforms and stakeholders. We present Talk Sens, a message definition framework that facilitates development of correctly interacting application logic by means of a shared data model, a message description language and serialisation code generation. Additionally, integration of Talk Sens with an existing component model results in run-time retrievable message definitions that facilitate third-party interactions. Our evaluation shows that message sizes, software sizes and middleware overhead remain well within the bounds of sensor network resource constraints.

Software product line engineering (SPLE) and variability enforcement techniques have been applied to run-time adaptive systems for quite some years, also in the context of multi-tenant Software-as-a-Service (SaaS) applications. The focus has been mainly on (1) the pre-deployment phases of the development life cycle and (2) fine-grained (tenant-level), run-time activation of specific variants. However, with upcoming trends such as DevOps and continuous delivery and deployment, operational aspects become increasingly important.

Researchers have shown that, in recent years, unwanted web tracking is on the rise, with browser-based fingerprinting being adopted by more and more websites as a viable alternative to third-party cookies. In this paper we propose PriVaricator, a solution to the problem of browser-based fingerprinting. A key insight is that when it comes to web tracking, the real problem with fingerprinting is not uniqueness of a fingerprint, it is linkability, i.e., the ability to connect the same fingerprint across multiple visits. Thus, making fingerprints non-deterministic also makes them hard to link across browsing sessions. In PriVaricator we use the power of randomization to "break" linkability by exploring a space of parameterized randomization policies. We evaluate our techniques in terms of being able to prevent fingerprinting and not breaking existing (benign) sites. The best of our randomization policies renders all the fingerprinters we tested ineffective, while causing minimal damage on a set of 1000 Alexa sites on which we tested, with no noticeable performance overhead.

In this work, we present two fundamental primitives for network security: network dialog minimization and network dialog diffing. Network dialog minimization (NDM) simplifies an original dialog with respect to a goal, so that the minimized dialog when replayed still achieves the goal, but requires minimal network communication, achieving significant time and bandwidth savings. We present network delta debugging, the first technique to solve NDM. Network dialog diffing compares two dialogs, aligns them, and identifies their common and different parts. We propose a novel dialog diffing technique that aligns two dialogs by finding a mapping that maximizes similarity.

With the constant migration of applications from the desktop to the web, power users have found ways of enhancing web applications, at the client-side, according to their needs.

In the current web of distrust, malware, and server compromises, convincing an online consumer that a website is secure, can make the difference between a visitor and a buyer. Third-party security seals position themselves as a solution to this problem, where a trusted external company vouches for the security of a website, and communicates it to visitors through a security seal which the certified website can embed in its pages. In this paper, we explore the ecosystem of third-party security seals focusing on their security claims, in an attempt to quantify the difference between the advertised guarantees of security seals, and reality. Through a series of automated and manual experiments, we discover a real lack of thoroughness from the side of the seal providers, which results in obviously insecure websites being certified as secure. Next to the incomplete protection, we demonstrate how malware can trivially evade detection by seal providers and detail a series of attacks that are actually facilitated by seal providers. Among other things, we show how seals can give more credence to phishing attacks, and how the current architecture of third-party security seals can be used as a completely passive vulnerability oracle, allowing attackers to focus their energy on websites with known vulnerabilities.

The staggering increase of malware families and their diversity poses a significant threat and creates a compelling need for automatic classification techniques. In this paper, we first analyze the role of network behavior as a powerful technique to automatically classify malware families and their polymorphic variants. Afterwards, we present a framework to efficiently classify malware families by modeling their different network behaviors (such as HTTP, SMTP, UDP, and TCP). We propose protocol-aware and state-space modeling schemes to extract features from malware network behaviors. We analyze the applicability of various evolutionary and non-evolutionary algorithms for our malware family classification framework. To evaluate our framework, we collected a real-world dataset of $6,000$ unique and active malware samples belonging to 20 different malware families. We provide a detailed analysis of network behaviors exhibited by these prevalent malware families. The results of our experiments shows that evolutionary algorithms, like sUpervised Classifier System (UCS), can effectively classify malware families through different network behaviors in real-time. To the best of our knowledge, the current work is the first malware classification framework based on evolutionary classifier that uses different network behaviors.

Multi-tenancy leads to improved efficiency, improved scalability, and lower costs. With the recent evolution of Cloud Computing and Software-as-a-Service (SaaS) in particular, a flexible and scalable multi-tenant architecture is becoming highly important. In multi-tenant applications, each tenant has its own users and administrators and tenants even tend to be divided into multiple subtenants. As the number of tenants grows, the number of users and amount of data grows, thus a scalable architecture for the access control system is needed. The question arises how to distribute the users and data over multiple database instances. In this paper we present a hierarchical data management approach, taking performance metrics into account, for structuring the storage of tenant data in large multi-tenant environments. We introduce a logical representation of the tenants, the tenant tree, and make a mapping to the physical storage by introducing three models for load-balancing. Next, we focus on how to efficiently locate the required data and introduce multiple search approaches. We characterize the impact on the performance both theoretically and experimentally. Experiments confirm that the theoretical analysis is in line with the experimental results. When the amount of data increases significantly, dividing the data over multiple datastores in an efficient way will eliminate the overhead and lead to a performance gain, especially if most of the data is located at the leaf nodes of the tenant tree.

This paper discusses the merits and challenges of adopting software product line engineering (SPLE) as the main development process for an automotive Hall Effect sensor. This versatile component is integrated into a number of automotive applications with varying safety requirements (e.g., windshield wipers and brake pedals).

URL shortening services facilitate the need of exchanging long URLs using limited space, by creating compact URL aliases that redirect users to the original URLs when followed. Some of these services show advertisements (ads) to link-clicking users and pay a commission of their advertising earnings to link-shortening users.

This paper presents an approach based on machine learning to predict which components of a software application contain security vulnerabilities. The approach is based on text mining the source code of the components. Namely, each component is characterized as a series of terms contained in its source code, with the associated frequencies. These features are used to forecast whether each component is likely to contain vulnerabilities. In an exploratory validation with 20 Android applications, we discovered that a dependable prediction model can be built. Such model could be useful to prioritize the validation activities, e.g., to identify the components needing special scrutiny.

As the web grows larger and larger and as the browser becomes the vehicle-of-choice for delivering many applications of daily use, the security and privacy of web users is under constant attack. Phishing is as prevalent as ever, with anti-phishing communities reporting thousands of new phishing campaigns each month. In 2010, tabnabbing, a variation of phishing, was introduced. In a tabnabbing attack, an innocuous-looking page, opened in a browser tab, disguises itself as the login page of a popular web application, when the user's focus is on a different tab. The attack exploits the trust of users for already opened pages and the user habit of long-lived browser tabs.

Suppose you have to assemble a security team, which is tasked with performing the security analysis of your organization's latest applications. After researching how to assess your applications, you find that the most popular techniques (also offered by most security consultancies) are automated static analysis and black box penetration testing. Under time and budget constraints, which technique would you use first? This paper compares these two techniques by means of an exploratory controlled experiment, in which 9 participants analyzed the security of two open source blogging applications. Despite its relative small size, this study shows that static analysis finds more vulnerabilities and in a shorter time than penetration testing.

Smart applications enable pervasive and informed interactions between the physical and digital worlds. These applications are deployed on resource constrained wireless sensor networks and are commonly implemented using software modularization schemes such as components and services. Composing smart applications at the abstraction level offered by embedded software modularization schemes is complex and time consuming. The complexity of composing them is derived from the need to understand many low-level issues, e.g. embedded programming languages, coordination mechanisms, software tool chains. We present an application composition service that reduces composition effort by offering a declarative specification of sense, process and consume flows. We demonstrate reduction in composition effort for three real-world smart applications deployed on a smart office environment.

Contemporary Wireless Sensor Networks like Smart Offices and Smart Cities are evolving to become multi-purpose application hosting platforms. These WSN platforms can simultaneously support multiple applications which may be managed by multiple actors. Reconfigurable component models have been shown to be viable solutions to reducing the complexity of managing and developing these applications while promoting software re-use. However, implicit parameter dependencies between components make reconfiguration complex and error-prone. Our approach achieves automatic composition-safe re-parametrization of distributed component compositions. To achieve this, we propose the use of language annotations that allow component developers to make these dependencies explicit and constraint-aware network protocols to ensure constraint propagation and enforcement.

Wireless Sensor Networks (WSN) are evolving beyond research prototypes towards real world deployments in various application domains. While prior research has resulted in a range of operating systems and associated programming languages, a comprehensive empirical analysis of WSN operating systems is missing from the literature. We address this problem through an empirical study of all actively maintained WSN operating systems for the popular Tmote Sky / TelosB platform: TinyOS, Contiki and Lorien. Our analysis considers overhead at each stage of the software life cycle. During the development phase, we measure developer effort in terms of lines of application code. During the execution phase we measure energy consumption, flash footprint and RAM usage. During the reconfiguration phase we measure artefact size and developer effort in terms of number of configuration commands. Our results indicate distinct trade-offs in terms of development effort, application performance and reconfiguration performance. We find that TinyOS performs best for static applications with tight RAM constraints, while Contiki offers the lowest development effort and Lorien performs best in dynamic applications which require reconfiguration.

The web has become an essential part of our society and is currently the main medium of information delivery. Billions of users browse the web on a daily basis, and there are single websites that have reached over one billion user accounts. In this environment, the ability to track users and their online habits can be very lucrative for advertising companies, yet very intrusive for the privacy of users. In this paper, we examine how web-based device fingerprinting currently works on the Internet. By analyzing the code of three popular browser-fingerprinting code providers, we reveal the techniques that allow websites to track users without the need of client-side identifiers. Among these techniques, we show how current commercial fingerprinting approaches use questionable practices, such as the circumvention of HTTP proxies to discover a user's real IP address and the installation of intrusive browser plugins. At the same time, we show how fragile the browser ecosystem is against fingerprinting through the use of novel browser-identifying techniques. With so many different vendors involved in browser development, we demonstrate how one can use diversions in the browsers' implementation to distinguish successfully not only the browser-family, but also specific major and minor versions. Browser extensions that help users spoof the user-agent of their browsers are also evaluated. We show that current commercial approaches can bypass the extensions, and, in addition, take advantage of their shortcomings by using them as additional fingerprinting features.

Wireless Sensor Networks (WSNs) are subject to high levels of dynamism arising from changing environmental conditions and application requirements. Reconfiguration allows software functionality to be optimized for current environmental conditions and supports software evolution to meet variable application requirements. Contemporary software modularization approaches for WSNs allow for software evolution at various granularities; from monolithic re-flashing of OS and application functionality, through replacement of complete applications, to the reconfiguration of individual software components. As the nodes that compose a WSN must typically operate for long periods on a single battery charge, estimating the energy cost of software evolution is critical. This paper contributes a generic model for calculating the energy cost of the reconfiguration in WSN. We have embedded this model in the LooCI middleware, resulting in the first energy aware reconfigurable component model for sensor networks. We evaluate our approach using two real-world WSN applications and find that (i.) our model accurately predicts the energy cost of reconfiguration and (ii.) component-based reconfiguration has a high initial cost, but provides energy savings during software evolution.

Over the last fifteen years, several types of attacks against domain names and the companies relying on them have been observed. The well-known cybersquatting of domain names gave way to typosquatting, the abuse of a user's mistakes when typing a URL in her browser's address bar. Recently, a new attack against domain names surfaced, namely bitsquatting. In bitsquatting, an attacker leverages random bit-errors occurring in the memory of commodity computers and smartphones, to redirect Internet traffic to attacker-controlled domains.

SUMMARY In a cross‐organizational context, software services are provided and consumed by different organizations. Ensuring that the non‐functional requirements of all the involved organizations are satisfied is hard to achieve in such a distributed and heterogeneous environment: the implementation of features, for example, security, is scattered across the services of multiple organizations. In this paper, we present a coordination architecture for flexible and policy‐driven composition of cross‐organizational features in distributed service systems. The underlying approach of this architecture is to specify the features and their composition at a higher level that abstracts the internal implementation mechanisms of the organizations involved. By means of feature composition policies, the organizations specify at a fine‐grained level which features are required and when they have to apply. Driven by these policies, our coordination middleware dynamically integrates the appropriate features throughout the cross‐organizational service composition in a consistent and efficient way. We have validated our architecture in a proof of concept showing limited performance overhead. Copyright © 2011 John Wiley & Sons, Ltd.

The last fifteen years have transformed the Web in ways that would seem unimaginable to anyone of the "few" Internet users of the year 1995 [8]. What began as a simple set of protocols and mechanisms facilitating the exchange of static documents between remote computers is now an everyday part of billions' of users life, technical and non-technical alike. The sum of a user's daily experience is composed of open standards, such as HTML, JavaScript and Cascading Style Sheets as well as proprietary plugins, such as Adobe's Flash [1] and Microsoft's Silverlight [6].

JavaScript is used by web developers to enhance the interactivity of their sites, offload work to the users' browsers and improve their sites' responsiveness and user-friendliness, making web pages feel and behave like traditional desktop applications. An important feature of JavaScript, is the ability to combine multiple libraries from local and remote sources into the same page, under the same namespace. While this enables the creation of more advanced web applications, it also allows for a malicious JavaScript provider to steal data from other scripts and from the page itself. Today, when developers include remote JavaScript libraries, they trust that the remote providers will not abuse the power bestowed upon them.

Security patterns can be a valuable vehicle to design secure software. Several proposals have been advanced to improve the usability of security patterns. They often describe extra annotations to be included in the pattern documentation. This paper presents an empirical study that validates whether those proposals provide any real benefit for software architects. A controlled experiment has been executed with 90 master students, who have performed several design tasks involving the hardening of a software architecture via security patterns. The results show that annotations produce benefits in terms of a reduced number of alternatives that need to be considered during the selection of a suitable pattern. However, they do not reduce the time spent in the selection process.

State of the art security research in the field of wireless sensor networks has focused on providing security in a coarse-grained, full-fledged and static fashion. This implies providing confidentiality, data authentication, data integrity and freshness to the entire spectrum of communication between the participating nodes in a network. In this paper however we advocate that as a result of a number of factors relating wireless sensor networks, providing security in similar fashion for the entire communication set isn't a pragmatic approach and does not precisely reflect the application level security requirements. We therefore propose DiFiSec, a dynamic, fine-grained and adaptable security framework that supports various levels of plug gable security for distinct data communication sets depending on the context, environment and criticality of the data. These plug gable security levels can be enacted at the levels of component wirings and receptacles, hence empowering application users to select only the most appropriate security respecting the resource-constrained nature of WSNs. Furthermore, to support system evolution and changing application requirements DiFiSec offers runtime adaptability. A prototype of this system has been implemented on SunSPOT sensor nodes where we have evaluated our approach in comparison with other network security variations.

Creating and managing applications for Wireless Sensor Networks (WSNs) is complicated by large scale, resource constraints and network dynamics. Reconfigurable component models minimize these complexities throughout the application lifecycle. However, contemporary component based middleware for WSNs is limited by its poor support for distribution. This paper introduces the Loosely-coupled Component Infrastructure (LooCI), a middleware for building distributed component-based WSN applications. LooCI advances the state-of-the-art by cleanly separating distributed concerns from component implementation, supporting application-level interoperability between heterogeneous WSN platforms and providing compatibility testing of bindings at runtime. Together, these features promote the safe and efficient composition and reconfiguration of distributed WSN applications. We evaluate the performance of LooCI on three classes of sensor nodes and demonstrate that these features can be provided with minimal overhead in terms of computation, memory and message passing.

While the use of cloud computing is on the rise, many obstacles to its adoption remain. One of the weaknesses of current cloud offerings is the difficulty of developing highly customizable applications while retaining the increased scalability and lower cost offered by the multi-tenant nature of cloud applications. In this paper we describe a Software Product Line Engineering (SPLE) approach to the modelling and deployment of customizable Software as a Service (SaaS) applications. Afterwards we define a formal feature placement problem to manage these applications, and compare several heuristic approaches to solve the problem. The scalability and performance of the algorithms is investigated in detail. Our experiments show that the heuristics scale and perform well for systems with a reasonable load.

In recent years, there has been a growing interest in cloud technologies. Using current cloud solutions, it is however difficult to create customizable multi-tenant applications, especially if the application must support varying Quality of Service (QoS) guarantees. Software Product Line Engineering (SPLE) and feature modeling techniques are commonly used to address these issues in non-cloud applications, but these techniques cannot be ported directly to a cloud context, as the common approaches are geared towards customization of on-premise deployed applications, and do not support multi-tenancy. In this paper, we propose an architecture for the development and management of customizable Software as a Service (SaaS) applications, built using SPLE techniques. In our approach, each application is a composition of services, where individual services correspond to specific application functionalities, referred to as features. A feature-based methodology is described to abstract and convert the application information required at different stages of the application life-cycle: development, customization and deployment. We specifically focus on how development feature models can be adapted ensuring a one-to-one correspondence between features and services exists, ensuring the composition of services yields an application containing the corresponding features. These runtime features can then be managed using feature placement techniques. The proposed approach enables developers to define significantly less features, while limiting the amount of automatically generated features in the application runtime stage. Conversion times between models are shown to be in the order of milliseconds, while execution times of management algorithms are shown to improve by 5 to 17% depending on the application case.

SUMMARY Achieving a clean separation of concerns is a well known approach to improving system adaptability and evolution. We propose to apply this principle to run‐time reconfigurable component models for networked embedded systems. By separating configuration properties from runtime component instances, we achieve: (i) improved support for concurrent component use, (ii) optimized resource use, and (iii) reduced effort in runtime configuration management. We demonstrate how this approach can be seamlessly implemented on existing component models for wireless sensor networks without imposing additional constraints and without changes to their API or coordination model. Furthermore, significant memory savings are achieved in concurrent scenarios. Copyright © 2012 John Wiley & Sons, Ltd.

In the last decade, the Internet landscape has transformed from a mostly static world into Web 2.0, where the use of web applications and mashups has become a daily routine for many Internet users. Web mashups are web applications that combine data and functionality from several sources or components. Ideally, these components contain benign code from trusted sources. Unfortunately, the reality is very different. Web mashup components can misbehave and perform unwanted actions on behalf of the web mashup's user.

Despite the plethora of research done in code injection countermeasures, buffer overflows still plague modern software. In 2003, Wilander and Kamkar published a comparative evaluation on runtime buffer overflow prevention technologies using a testbed of 20 attack forms and demonstrated that the best prevention tool missed 50% of the attack forms. Since then, many new prevention tools have been presented using that testbed to show that they performed better, not missing any of the attack forms. At the same time though, there have been major developments in the ways of buffer overflow exploitation.

This paper presents an empirical study comparing two alternatives for generating code from aspect-oriented models. In an aspect "disrupting" process, an object oriented implementation in Java is automatically generated from domain specific models, comprising a mix of UML (for core functionality) and DSLs (for qualities like security and perfor mance). In an aspect "preserving" process, an aspect oriented implementation in AspectJ is automatically generated from the same models. In both alternatives, a number of subjects are asked to perform several maintenance tasks requiring the addition and improvement of functionality. The results show that, in most of the cases, the AO alternative provides for shorter maintenance cycles.

In this paper, we present different modeling and execution frameworks that allow us to efficiently analyze, design and verify complex systems, mainly to cope with the specific concerns of the Real-time and embedded systems (RTE) domain. First we depict a UML /MARTE based methodology for executable RTE systems modeling with a framework and its underlying model transformations required to execute UML models conforming to the MARTE standard. The advantages of adopting a more generic action language with formal features are highlighted, in order to raise the level of abstraction with formal features. Then, we investigate how MARTE, with its Time Model facilities, can be made to represent faithfully AADL periodic/aperiodic tasks communicating through event or data ports, in an approach to end-to-end flow latency analysis. An analytical framework allows us to optimize port-based communication by generating a run time executive that utilizes shared data areas where appropriate, while ensuring the timing semantic assumed by the control application. An analysis of the AADL mode change protocol is also provided, exposing a translation process that takes as an input an AADL model and produces as an output a time Petri net. We show how an AADL model transformation provides a formal model for model checking activities and we suggest that model transformation provides useful support to improve the integration of formal verification in an industrial engineering process. As a case study we use an implementation of a UDP /IP protocol stack.

Wireless Sensor Networks are increasingly being deployed in enterprise scenarios involving multiple actors. The capabilities of sensors must be shared across many applications and sensors must cooperate across federations spanning administrative domains. This paper describes our efforts towards constructing federated wireless sensor systems. It leverages and details key building blocks designed to achieve federation and sharing: a component model with distributed event-based communication, a policy-driven control infrastructure for resources and communications, a deployment architecture and a mechanism to establish and propagate trust into the wireless sensor network. The building blocks focus on the specific and necessary in-network extensions, such as extensions to sensor run-time, middleware and programming abstractions, rather than the backend challenges. The combination of the building blocks creates a security middleware that supports multiparty federated sensor networks. An estimate of the total cost of federation in terms of footprint is provided and first experiences of application of the middleware are reported upon.

Wireless ad-hoc sensor networks in industrial settings often consist of multiple independent parties, each owning a subset of the nodes. In order to reduce costs, minimize time to market and increase coverage and functionality, these parties must share the capabilities of their individual sensor nodes; this creates a multi-owner and multi-application environment that requires advanced and secure mechanisms to control the deployment and operation of sensor applications. Although there is clear demand like in transport & logistics, state-of-the-art on secure application deployment in WSNs is lacking support for this sharing of sensor nodes. This paper presents SASHA: a proof-of-concept protocol that enables lightweight and secure deployment of multiple applications on heterogeneously owned sensor nodes.

Buffer overflows are still a significant problem in programs written in C and C++. In this paper we present a bounds checker, called PAriCheck, that inserts dynamic runtime checks to ensure that attackers are not able to abuse buffer overflow vulnerabilities. The main approach is based on checking pointer arithmetic rather than pointer dereferences when performing bounds checks. The checks are performed by assigning a unique label to each object and ensuring that the label is associated with each memory location that the object inhabits. Whenever pointer arithmetic occurs, the label of the base location is compared to the label of the resulting arithmetic. If the labels differ, an out-of-bounds calculation has occurred. Benchmarks show that PAriCheck has a very low performance overhead compared to similar bounds checkers. This paper demonstrates that using bounds checkers for programs or parts of programs running on high-security production systems is a realistic possibility.

Security analysis methods can provide correct yet meaningless results if the assumptions underlying the model do not conform to reality. We present an approach to analyze the security of software-intensive system architectures that focusses on making these underlying assumptions explicit, so that they can be taken into account. Starting from an Alloy model of a software architecture, a set of constraints is elicited by leveraging model relaxation techniques. These constraints form a minimal but sufficient condition that the system must meet in order to realise its security requirements. As the approach starts from the minimal guarantees that the system environment offers, it does not depend on an explicit attacker model and can take arbitrary attacker behaviour into account. As it is iterative, it is possible to constructively integrate the approach in a secure software development life cycle. Our results are illustrated by means of a case study.

Most work on adaptive workflows offers insufficient flexibility to enforce complex policies regarding dynamic, evolvable and robust workflows. In addition, many proposed approaches require customized workflow engines. This paper presents a portable framework for realistic enforcement of dynamic adaptation policies in business processes. The framework is based on the Model-View-Controller (MVC) pattern, commonly used for adding dynamism to web pages. To enhance reusability, our approach supports separation of adaptation logic from the functional workflow and modularization of workflow tasks in reusable aspects. The main idea is to design a workflow process as a template, where tasks can be specified on an abstract level. Concrete implementations of the tasks, modeled as aspects, are then selected from a library according to a policy-based adaptation logic. This logic is implemented using a general purpose language that offers an extensible and flexible solution to enforce any type of policy. We evaluate by means of a case study on workflow confidentiality to what extent an approach using standards-based technologies allows application-specific adaptation of running workflow instances.

Contemporary vehicles offer an advanced telematics platform with multiple applications available such as electronic road tolling, emergency call, breakdown call, or route planning. Given the sensitivity of collected driver and vehicle data and the potential use of this data by third party applications, security mechanisms are needed to protect services as well as data. Although security has been investigated in recent telematics studies, they do not consider potentially malicious or erroneous third party applications. This paper presents a secure multi-application platform that is designed as a modular software architecture with security features to support availability, confidentiality and integrity; a proof-of-concept prototype was developed on state-of-the-art hardware and software.

Wireless Sensor Networks are becoming federated and mobile environments. These new capabilities pose a lot of new possibilities and challenges. One of these challenges is to create a secure environment to allow multiple trusted companies to share and merge their sensor network infrastructure. The most basic need for a secure environment is the deployment of key material. However, most current day research assumes pre-shared secrets between the sensor nodes of most, if not all, companies in a federation. These solutions are often not scalable nor mobile enough to meet realistic business requirements. Additionally, most key deployment protocols totally omit any connectivity with back-end infrastructure. This paper proposes a novel deployment protocol for the MAnagement of Secret keYs (MASY). MASY allows secure deployment of a key to a sensor node when it enters a previously unknown network. By off-loading the trust creation process to the resource-rich back-end infrastructure, the burden on the sensor nodes remains very limited.

One of the major challenges in engineering distributed multiagent systems is the coordination necessary to align the behavior of different agents. Decentralization of control implies a style of coordination in which the agents cooperate as peers with respect to each other and no agent has global control over the system, or global knowledge about the system. The dynamic interactions and collaborations among agents are usually structured and managed by means of roles and organizations. In existing approaches agents typically have a dual responsibility: on the one hand playing roles within the organization, on the other hand managing the life-cycle of the organization itself, for example, setting up the organization and managing organization dynamics. Engineering realistic multiagent systems in which agents encapsulate this dual responsibility is a complex task. In this article, we present a middleware for context-driven dynamic agent organizations. The middleware is part of an integrated approach, called MACODO: Middleware Architecture for COntext-driven Dynamic agent Organizations. The complementary part of the MACODO approach is an organization model that defines abstractions to support application developers in describing dynamic organizations, as described in Weyns et al. [2010]. The MACODO middleware offers the life-cycle management of dynamic organizations as a reusable service separated from the agents, which makes it easier to understand, design, and manage dynamic organizations in multiagent systems. We give a detailed description of the software architecture of the MADOCO middleware. The software architecture describes the essential building blocks of a distributed middleware platform that supports the MACODO organization model. We used the middleware architecture to develop a prototype middleware platform for a traffic monitoring application. We evaluate the MACODO middeware architecture by assessing the adaptability, scalability, and robustness of the prototype platform.

Security principles, like least privilege, are among the resources in the security body of knowledge that survived the test of time. The implementation of these principles in a software architecture is difficult, as there are no systematic rules on how to apply them in practice. As a result, they are often neglected, which lowers the overall security level of the software system and increases the cost necessary to fix this later in the development life-cycle. This paper improves the support for least privilege in software architectures by (i) defining the foundations to identify potential violations of the principle herein and (ii) elicitating architectural transformations that positively impact the security properties of the architecture, while preserving the semantics thereof. These results have been implemented and validated in a number of case studies.

Architectural modelling and risk management are invaluable to increase the security of a software system. The purpose of this work is to show how both approaches can be integrated in a risk-aware architectural modelling technique. As the modelling is formal, the approach offers stronger guarantees that the resulting architecture achieves its security requirements.

Privacy is gaining importance since more and more data becomes digitalized. There is also a growing interest from the security community because of the existing synergy between security and privacy. Unfortunately, the privacy development life cycle is less advanced than the security one. A clear classification into different objectives is not available yet. This paper attempts to scope the privacy landscape for software engineering by proposing an operational definition for privacy and by describing a privacy taxonomy. The taxonomy is rooted in the definition and presents a classification of privacy objectives, which correspond to the developer's goals. Each objective can be achieved by one or more strategies. As a validation for the taxonomy, existing privacy solutions are matched to each strategy.

Many countermeasures exist to protect the stack and heap from code injection attacks, however very few countermeasures exist that will specifically protect global and static variables from attack. In this paper we suggest a way of protecting global and static variables from these type of attacks, with negligible performance and memory overheads. Our approach is based on the idea of separating data in de data segment based on its type. These separated areas are then protected from each other by a guard page. This prevents a buffer overflow from overwriting data or code pointers, in turn preventing attackers from being able to perform a code injection attack.

Code injections attacks are one of the most powerful and important classes of attacks on software. In such attacks, the attacker sends malicious input to a software application, where it is stored in memory. The malicious input is chosen in such a way that its representation in memory is also a valid representation of a machine code program that performs actions chosen by the attacker. The attacker then triggers a bug in the application to divert the control flow to this injected machine code. A typical action of the injected code is to launch a command interpreter shell, and hence the malicious input is often called shellcode.

Security principles like least privilege and attack surface reduction play an important role in the architectural phase of security engineering processes. However, the interplay between these principles and the side effects of the application of these secure design strategies on architectural qualities like maintainability have not been studied so far. Therefore it is hard to make informed trade-off decisions between security principles and between security and other qualities. This paper tackles this problem from a quantitative perspective by presenting the experimental results in the context of three case studies.

Mapping problem-space features into solution-space features is a fundamental configuration problem in software product line engineering. A configuration problem is defined as generating the most optimal combination of software features given a requirements specification and given a set of configuration rules. Current approaches however provide little support for expressing complex configuration rules between problem and solution space that support incomplete requirements specifications. In this paper, we propose an approach to model complex configuration rules based on a generalization of the concept of problem-solution feature interactions. These are interactions between solution-space features that only arise in specific problem contexts. The use of an existing tool to support our approach is also discussed: we use the DLV answer set solver to express a particular configuration problem as a logic program whose answer set corresponds to the optimal combinations of solution-space features. We motivate and illustrate our approach with a case study in the field of managing dynamic adaptations in distributed software, where the goal is to generate an optimal protocol for accommodating a given adaptation.

A lot of computer usage involves dealing with files like videos, documents, photos. Unfortunately, for most users sharing (large) files, finding files, synchronizing files between devices and backing up files is far from trivial. To address these issues, we present an alternative for traditional filesystems: CIMPLE. CIMPLE provides a content-centric storage interface with integrated search and sharing capabilities. It also relieves the user of backup and synchronization problems. CIMPLE gives each content item a secure ID and understands content metadata.

Considerable research has been performed in applying run-time reconfigurable component models to the domain of wireless sensor networks. The ability to dynamically deploy and reconfigure software components has clear advantages in sensor network deployments, which are typically large in scale and expected to operate for long periods in the face of node mobility, dynamic environmental conditions and changing application requirements. To date, research on component and binding models for sensor networks has primarily focused on the development of specialized component models that are optimized for use in resource-constrained environments. However, current approaches impose significant overhead upon developers and tend to use inflexible binding models based on remote procedure calls. To address these concerns, we introduce a novel component and binding model for networked embedded systems (LooCI). LooCI components are designed to impose minimal additional overhead on developers. Furthermore, LooCI components use a novel event-based binding model that allows developers to model rich component interactions, while providing support for easy interception, re-wiring and re-use. A prototype implementation of our component and binding model has been realised for the SunSPOT platform. Our preliminary evaluation shows that LooCI has an acceptable memory footprint and imposes minimal overhead on developers.

Measuring security is an important step in creating and deploying secure applications. In order to efficiently measure the level of security that an application provides, three problems need to be solved: obviously metrics need to be available, a suitable metrics framework needs to be chosen and implemented, and the resulting measurements need to be interpreted. This work focuses on the second and third problem. We propose an approach to facilitate the selection and integration of appropriate security metrics, and to support the aggregation and interpretation of measurements. Our approach associates security metrics to security patterns, and we exploit the relationships between security patterns and security objectives to enable the interpretation of measurements. The approach is illustrated in a case study.

Healthcare is an information-intensive domain and therefore information technologies are playing an ever-growing role in this sector. They are expected to increase the efficiency of the delivery of healthcare services in order to both improve the quality and reduce the costs. In this context, security has been identified as a priority although several gaps still exist. This paper reports on the results of assessing the threats to XDS-based architectures. Accordingly, an architectural solution to the identified threats is presented.

Automation is a very promising technique to reduce the chances of flaws happening downstream the software production line. In this context, a very challenging problem is the transformation of requirements to software architectures. The challenge is even more crucial for quality requirements, as they represent the main driver of an architecture. This paper is an initial attempt to provide an approach that supports the transition from requirements to architecture for software security: a quality of ever growing importance in today's world.

In recent trends, the Architecture Analysis and Design Language (AADL) has received increasing attention from safety-critical software development industries. Specific about the AADL is its strong syntactic and semantic support for the description of both hardware and software architectures. Considering the existing range of software architectures, we study the support AADL offers for the description of software architecture. As a case study we use an implementation of a UDP/IP protocol stack. Based on our experiences, our position is that a number of abstract concepts, e.g. a generic component concept, are missing in the AADL to make it well-suited for the high- level description of software architecture.

Web applications are widely adopted and their correct functioning is mission critical for many businesses. At the same time, Web applications tend to be error prone and implementation vulnerabilities are readily and commonly exploited by attackers. The design of countermeasures that detect or prevent such vulnerabilities or protect against their exploitation is an important research challenge for the fields of software engineering and security engineering. In this paper, we focus on one specific type of implementation vulnerability, namely, broken dependencies on session data. This vulnerability can lead to a variety of erroneous behavior at runtime and can easily be triggered by a malicious user by applying attack techniques such as forceful browsing. This paper shows how to guarantee the absence of runtime errors due to broken dependencies on session data in Web applications. The proposed solution combines development-time program annotation, static verification, and runtime checking to provably protect against broken data dependencies. We have developed a prototype implementation of our approach, building on the JML annotation language and the existing static verification tool ESC/Java2, and we successfully applied our approach to a representative J2EE-based e-commerce application. We show that the annotation overhead is very small, that the performance of the fully automatic static verification is acceptable, and that the performance overhead of the runtime checking is limited.

One of the challenges of secure software construction (and maintenance) is to get control over the multitude of threats in order to focus mitigation efforts on the most relevant ones. Risk analysis is one class of techniques for achieving threat reduction, but few studies are available that evaluate the quality of these techniques. In this paper, a selected set of risk analysis techniques have been evaluated and compared based on a realistic case study. The foundations for this analysis were threefold: we defined a set of high-level criteria, we compared the results of the different methods and we used statistical analysis techniques for studying additional characteristics. This analysis was performed on an independently developed case study of a significant size. For this experiment, the benefits of applying of these methods were limited for the categorization and the reduction of threats. Therefore, we also suggest ways to improve or complement these methods.

Abstract — Although various publications confirm the need for a generic DRM software architecture, we observe that current efforts to define a DRM architecture do not always provide sufficient support to enable the creation and management of DRM systems and content distribution applications. This is a considerable problem that implies a crucial challenge for the evolution of DRM, given the impact of a software architecture on the functional and non-functional qualities of the implemen-tation. This paper (1) presents a generic DRM architecture, (2) evaluates it in the context of interoperability, extendability, and modifiability, and (3) compares it to related work in the Digital Media Project (DMP). To the best of our knowledge, the proposed architecture is more detailed than related work published so far. I.

Security principles, like least privilege, are among the few resources in the body of knowledge for security that survived the test of time. Over the last few years, several secure software development processes have emerged that mention security principles and acknowledge their importance. Nevertheless, support for principles in security processes does not appear to be satisfactory. This paper analyzes a forefront security process (CLASP) and elicits both explicit and hidden relationships between process activities and security principles.

Policies can be used for the configuration and management of existing services, possibly at runtime, without having to change their implementation. They declaratively specify the behavior of these services in certain circumstances and can be used in areas like security or quality of service. In order to make the policy specification as effective as possible, specific policy languages have been defined for many different areas. We present a policy ontology where specific policy languages are created as simple extensions of a generic policy model. In addition, by explicitly representing (and mapping) the domain the policies are applied to, domain concepts can be used directly inside policies. As a result, policies can be more targeted towards different areas and domains.

In this paper we present an efficient countermeasure against stack smashing attacks. Our countermeasure does not rely on secret values (such as canaries) and protects against attacks that are not addressed by state-of-the-art countermeasures. Our technique splits the standard stack into multiple stacks. The allocation of data types to one of the stacks is based on the chances that a specific data element is either a target of attacks and/or an attack vector. We have implemented our solution in a C-compiler for Linux. The evaluation shows that the overhead of using our countermeasure is negligible

Fine-grained and expressive access control policies on application resources need to be enforced in application-level code. Uniformly enforcing a single policy (referred to as the organizationwide policy) in diverse applications is challenging with current technologies. This is due to a poor delimitation of the responsibilities of application deployer and security officer, which hampers a centralized management of a policy and therefore compromises the uniformity of its enforcement. To address this problem, the concept of an access interface is introduced as a contract between an organization-wide authorization engine and the various applications that need its services. The access interface provides support for the central management of the policy by the security officer. By means of a view connector, the application deployer ensures that each application complies with this contract, so that the policy can be enforced

The domain of digital rights management (DRM) is currently lacking a generic architecture that supports interoperability and reuse of specific DRM technologies. This lack of architectural support is a serious drawback in light of the rapid evolution of a complex domain like DRM. It is highly unlikely that a single DRM technology or standard will be able to support the diversity of devices, users, platforms, and media, or the wide variety of system requirements concerning security, flexibility, and efficiency. This paper analyses state-of-the-art DRM technologies and extracts from them high level usage scenarios according to content consumers, producers, and publishers. In addition, the key services are identified both from a functional and security perspective. Identifying key DRM services and locating them in an overall structure brings us one step closer to a software architecture for DRM. Having available a software architecture should help the DRM community in reasoning about DRM systems, and in achieving reuse and interoperability of multiple domain-specific DRM technologies and standards.

Research domains such as active networks, ad-hoc networks, ubiquitous computing, pervasive computing, grid computing, and sensor networks, clearly show that computer networks will become more complex and heterogeneous. In many cases, central management and control of the network are far from trivial since both the topology and the connected devices change rapidly in such highly dynamic environments, while load circumstances may vary arbitrarily. The software architecture in a node needs to support flexibility. We have developed an architecture tailored to protocol stack software that allows customizing internal resource management in order to handle overload conditions gracefully. We show that the investment in explicit support for modularity and architectural constraints pays off: the paper elaborates on a case study in which dynamic adaptation of access control behavior leads to significant performance improvements.

This paper discusses client-specific customization of systems that implement an on-line Internet service in the presence of simultaneous client-specific views. The problem is that each client must be able to customize the running system for use in its own context, without impacting the service behavior that is delivered to other clients. To solve this, we propose to customize the system on a per client request basis, where the system itself consists of a stable core and several extensions that are injected into the core as needed. However, this approach brings on its own several consistency management problems that must be dealt with in order to make the approach viable. We give an overview of these problems and present a management architecture that deals with these problems.

Support for dynamic and client-specific customization is required in many application areas. We present a (distributed) application as consisting of a minimal functional core, implemented as a component based system, and an unbound set of potential extensions that can be selectively integrated within this core functionality. An extension to this core may be a new service due to new requirements of end users. Another important category of extensions we consider are non-functional services such as authentication, which typically introduce interaction refinements at the application level. In accordance with the separation of concerns principle, each extension is implemented as a layer of mixin-like wrappers. Each wrapper incrementally adds behavior and state to a core component instance from the outside, without modifying the component's implementation. The novelty of this work is that the composition logic, responsible for integrating extensions into the core system, is externalized from the code of clients, core system and extensions. Clients (end users, system integrators) can customize this composition logic on a per collaboration basis by 'attaching' high-level interpretable extension identifiers to their interactions with the core system.