Personal Bluetooth Low Energy (BLE) trackers such as AirTag help locate lost items but can be misused for stalking. Research indicates that BLE trackers can be identified through their transmitted packets, thus offering potential for machine learning (ML) solutions. However, current packet datasets lack the scale and diversity needed for real-world applicability. This paper presents an open-source $\mathbf{2 0 0}$-hour BLE advertisement packet dataset focused on personal tags, enabling future ML-based device detection approaches. Additionally, introduces the first large-scale BLE data preprocessing framework for efficient and modular BLE packet preprocessing. The Framework is showcased on the dataset, demonstrating feature extraction, labelling, and dynamic plotting. This paper lays the groundwork for IoT device detection in high-density, heterogeneous environments, enabling future advances in BLE device classification.

Modern Intrusion Detection Systems (IDS) that rely on signature-based detection struggle to detect novel threats like AI-based Command-and-Control (C2) frameworks, highlighting a gap in the ability of current systems to detect and mitigate emerging botnet threats. This work addresses this gap by investigating NimPlant's detection and evasion capabilities. This paper (1) shows strategies to detect NimPlant bots using network traffic analysis, (2) enhances their evasion capabilities using Reinforcement Learning (RL), and (3) evaluates AI-driven evasion against IDS. Using a controlled testing environment, an infected device is simulated by implementing evasion strategies and integrating them into an RL-based AI system. Herewith, AI significantly improves evasion, with the RL-enhanced NimPlant achieving higher detection bypass rates. However, the IDS configuration heavily impacts AI effectiveness, underscoring the need for robust security setups. Thus, recommendations are provided for detecting bot infections and countering AI-enhanced botnets.

Bluetooth Low Energy (BLE)-based trackers have become increasingly widespread due to their affordability, energy efficiency, and integration into Crowd-Sourced Finding Networks (CFNs). CFNs, such as Apple’s Find My system, leverage vast user bases to enable device location even without direct Internet connectivity. However, the expansion of such technologies has raised concerns about security and potential misuse, particularly for unauthorized tracking.This paper investigates whether Received Signal Strength Indication (RSSI) data, when combined with Machine Learning (ML) techniques, can enhance the detection and protection mechanisms for individuals targeted by such misuse. A dataset comprising 13,353 labeled entries was collected using Apple AirTags to simulate various tracking scenarios and used to train and evaluate multiple classification models. Among these, a Decision Tree classifier demonstrated a strong balance between accuracy, F1-score, and overfitting resilience, achieving an accuracy of 85.35%. The model was subsequently integrated into HomeScout, marking a promising step toward proactive misuse mitigation in BLE-tracking ecosystems.

The rise of the Internet-of-Things (IoT) and smart homes has resulted in the increased use of ZigBee as the communication protocol of choice in home networks, giving ample opportunity for network monitoring and user profiling, as a consequence, raising a major privacy concern. Yet, there has been little exploration of the extractable information solely from network packets, particularly Philips Hue packets.Especially as, to the authors’ knowledge, there have been no studies examining whether a single network key provides enough generalization to extract data from other unknown ZigBee networks. To address this gap, this paper proposes StealthProfiler, a passive and real-time Proof-of-Concept (PoC) tool designed to identify, classify, and extract devices and events within a Philips Hue network.As a result, the tool was successfully used to extract network events from encrypted Zigbee networks, achieving an accuracy of approximately 94% in identifying devices and events within the network without decrypting network traffic.

Security management of Internet-of-Things (IoT) infrastructures encompassing the entire lifecycle of products and their continuous certification are fundamental functions to guarantee a high level of security. This paper demonstrates a DLT-based platform enabling secure inventorying and management of IoT devices and sensors distributed across multiple stakeholders. This work makes use of the Hyperledger framework, Decentralized Identifiers (DID), and Manufacturer Usage Description (MUD) files for IoT device inventorying and the identification of critical software updates.

With the growing popularity of Internet-of-Things (IoT) and the smart home market, third party data stores and remote cloud environments, security and privacy of personal data is the central problem. Since the existing Privacy Enhancing Technologies (PET) have yet to provide a lightweight solution to safeguard privacy within smart homes, this paper presents the Security and Home Integration Framework for IoT (SHIFT). SHIFT leverages an open-source architecture to integrate existing tools, including home assistants and network monitors, into a unified framework designed to monitor and control smart home devices through security policies. The proof-ofconcept prototype for monitoring and controlling smart home device communications using user-defined policies successfully monitors device activity, processes data, and enforces user policies in a live smart home environment. SHIFT gives users control over their devices and data while balancing convenience with privacy and security.

With a rising frequency and scale, Distributed Denial-of-Service (DDoS) attacks persist as a critical cybersecurity issue. While shared attack fingerprints aid many intrusion detection systems in identifying threats, their application for DDoS attacks remains limited due to their distinct nature. However, fingerprints observed from multiple locations can provide valuable insights. This paper presents Reassembler, a novel platform for achieving a global DDoS attack analysis using attack fingerprints recorded from various locations. Reassembler consolidates these fingerprints into a unified view allowing to obtain a global overview of DDoS attacks. The evaluation, conducted on four simulated scenarios, demonstrates Reassembler's ability to extract novel properties, such as the count of intermediate nodes and the estimated percentage of spoofed IPs.

Bluetooth Low Energy (BLE) personal trackers are affordable devices misused to track nonconsensual individuals. Due to the increased misuse, Apple implemented two detection applications. However, the Android application is limited to user-initiated scans with a fixed detection algorithm. This paper focuses on reducing the misuse of malicious trackers by examining current solutions, potential generic detection approaches, and improving tracker detection times.HomeScout expands detection to the Tile and Samsung Galaxy SmartTag+, and examines the misuse potential of all BLE-enabled devices. HomeScout can reliably detect devices tracking the user as quickly as 1 minute once in motion by optimizing the parameters. The optimal parameter setting for distance is 200 m due to its high recall rate, for occurrence is 2, and for time is 1 minute. Furthermore, HomeScout applies the tracking algorithm to all BLE-enabled devices.

The recent pandemic posed a challenge to several healthcare systems, exposing limited resources and inefficiency in managing PMDs (Portable Medical Devices). This paper reports the experience of an approach enabling hospitals to efficiently find their resources and maximize the usage of PMDs in emergency situations, such as pandemics or natural disasters, when a sudden increase in demand may be anticipated. The key novelty relies on the use of smartphones provided to hospital employees replacing typical stationary gateways spread across a hospital, functioning as mobile gateways with a front-end that assists staff in locating PMDs. As employees approach tagged PMDs, they update their locations in a real-time inventory tracker, delivering accurate data. Experiments were evaluated by contrasting two techniques (fingerprinting and multilateration) based on two different locations (an office and an apartment complex) in Zürich.

Recent years saw an increase in voting systems using public permissionless blockchains. Although public blockchains offer transparency and immutability, permissioned consensus is better suited for voting systems’ requirements, because an initial level of trust in authorities is always required. Hence, a permissioned Distributed Ledger (DL) immutably storing the voting system’s audit trail satisfies demands measurably.ProvotuMN 3.0 is a decentralized and receipt-Free (RF) voting system based on an end-to-end verifiable Re-Encryption Mixnet (RMN). RMNs allow for flexible votes and elections and decouple the ballot structure from the cryptographic voting protocol. Thus, ProvotuMN decentralizes trust (i) through the use of cryptographic shuffles and Non-Interactive Zero-Knowledge Proofs (NIZKP) in an RMN executed among DL nodes, (ii) by employing a distributed key generation for election keys, and (iii) by offering a decentralized re-encryption service assuring RF. Performance evaluations performed indicate that the voting scheme is scalable for large-scale voting.

Blockchains (BC) and Distributed Ledgers (DL) offer favorable properties, especially immutability and decentralization, which are suitable for voting systems’ Bulletin Boards (BB). In recent years, an influx of BC-based voting systems have been observed. Distributing trust among multiple trustees is a crucial reason to adopt BCs and DLs in voting systems. The practical deployment must be decentralized, too, and not just done through virtualizing interconnected systems. As discussed widely, adopting a BC or DL can incur threats to a system that assumed a trusted and centralized Public Bulletin Board (PBB). Therefore, the exploitation of BCs or DLs requires careful consideration of cryptographic mechanisms and the overall system design, as well as the adversary model. Besides these operational necessities, the long-term privacy of ballots is essential. Thus, the key question investigated in this article is: Can BC, and DL-based voting systems be considered harmful? Hence, first (i) requirements of BC-based voting systems are provided, followed by (ii) terminology definitions, and (iii) complemented by the design and implementation of a fully decentralized voting system: Æternum, which achieves Unconditional Privacy (UP) and neither relies on computational hardness assumptions nor on a trusted Trusted Third Party (TTP). Achieving UP is crucial because future adversaries may be able to break hardness assumptions. Æternum does not present a Single-Point-of-Failure (SPoF) either, since (i) the PBB in use is based on a permissioned DL, and (ii) the final tally and proofs can be verified by anyone, without requiring trust in any authority.

Light Detection and Ranging (LiDAR) is used in various applications, from mapping the environment’s topography to self-driving vehicles. Among such applications, the use of LiDAR for indoor tracking and quantifying visitors’ interest (and ensuring safe distancing) is still not widely explored. Technologies based on wireless signals and video captures are typically used for indoor tracking, but they deficits concerning the lack of accuracy of captured signals or the lack of user privacy in the case of traditional surveillance cameras. Despite introducing tracking challenges inherent in the detection based on light reflection, LiDAR-based approaches represent a relatively low-cost solution for accurate indoor tracking. Thus, this paper presents LaFlector, a LiDAR-based indoor tracking system introducing tracking heuristics capable of detecting, classifying, and tracking several objects simultaneously, which are recorded and dynamically displayed in a 2D coordinate system. LaFlector was evaluated based on a low-cost 2D LiDAR hardware (Slamtec Mapper M1M1) and capable of detecting moving objects with high precision, showing in practice that a LiDAR-based can be used to track visitors’ interest and count the number of moving objects.

Due to the increasing number of cyberattacks and respective predictions for the upcoming years with even larger numbers of occurrences, companies are becoming aware not only that the digitization of their businesses is essential, but also that the adoption of efficient cybersecurity strategies is crucial. Therefore, approaches for a better understanding and analysis of cybersecurity are essential.Thus, SecGrid, a Machine Learning (ML) empowered platform for analyzing, classification, and visualization of cyberattacks is introduced. SecGrid implements an extensible set of miners to analyze information from network traces to provide insightful visualizations of malicious traffic given and to classify automatically different types of cyberattacks by using supervised ML. Experiments conducted show high overall usability, scalability in terms of the capacity of the platform to extract information from large files, and high performance and accuracy during the classification of cyberattacks.

Distributed Denial-of-Service (DDoS) attacks remain one of the top reasons for business disruption and financial losses. Although mitigation solutions are available on the market, there is still a need for approaches that help network operators understand attack characteristics and behaviors, resulting in better planning of companies' cybersecurity strategies. This paper introduces DDoSGrid, a platform for the analysis and visualization of DDoS attacks. DDoSGrid implements an extensible set of miners to extract, process, and analyze information from network traces (i.e., PCAP files) to provide insightful visualizations for a better understanding and in-depth analysis of DDoS attacks in different scenarios. A case study was performed using an HTTP flood attack scenario to evaluate the feasibility of the approach. DDoSGrid enables real-world DDoS scenarios' analysis, providing an intuitive interface integrated with extensible insightful visualizations and data miners.

Mobile devices expose information about their hardware and manufacturer while searching for available WiFi networks via a Media Access Control (MAC) protocol. Thus, to protect the users' privacy and prevent MAC address tracking, manufacturers typically provide anonymity through MAC randomization techniques by randomly and periodically modifying the MAC address. This paper presents the ASIMOV tracking approach, which shows through the correlation of randomized information concerning the displacement of devices in space-time dimensions that it is possible to gain insights into identifiable device information. The proposed system is entirely passive and uses a combined Received Signal Strength Indicator (RSSI) value-based localization and the Information Elements (IE) transmitted in every IEEE 802.11 probe request frame.

Businesses were moving during the past decades to-ward full digital models, which made companies face new threats and cyberattacks affecting their services and, consequently, their profits. To avoid negative impacts, companies' investments in cybersecurity are increasing considerably. However, Small and Medium-sized Enterprises (SMEs) operate on small budgets, minimal technical expertise, and few personnel to address cybersecurity threats. In order to address such challenges, it is essential to promote novel approaches that can intuitively present cybersecurity-related technical information.This paper introduces SecBot, a cybersecurity-driven conversational agent (i.e., chatbot) for the support of cybersecurity planning and management. SecBot applies concepts of neural networks and Natural Language Processing (NLP), to interact and extract information from a conversation. SecBot can (a) identify cyberattacks based on related symptoms, (b) indicate solutions and configurations according to business demands, and (c) provide insightful information for the decision on cybersecurity investments and risks. A formal description had been developed to describe states, transitions, a language, and a Proof-of-Concept (PoC) implementation. A case study and a performance evaluation were conducted to provide evidence of the proposed solution's feasibility and accuracy.

While the existence of Public Bulletin Boards (PBB) is often formulated as an assumption in related work on Remote Electronic Voting (REV) systems, this work here on Provotum focuses on the practical design and architecture of such a PBB, including its distributed execution. Further, Provotum leverages a public permissioned Blockchain (BC) as a PBB, where only authorized entities can sign blocks, while the general public can verify all BC data. Therefore, Provotum defines a new and fully decentralized BC-based REV system, which deploys a permissioned BC as a PBB and allows for the explicit distribution of trust across different permissioned BC nodes. Provotum is operated in a fully distributed fashion by using Smart Contracts (SC), Distributed Key Generation (DKG), Homomorphic Encryption (HE), and Cooperative Decryption (CD), as well as employing client-side encryption, which enables ballot secrecy, while the BC forms an audit trail, enabling public and End-to-end Verifiability (E2E-V).

Due to the growing interest in the blockchain (BC), several applications are being developed, taking advantage of the benefits that such technology promises to deliver, such as removal of Trust Third Parties (TTP) to verify transactions and data immutability. However, these applications require certain aspects, such as high transaction throughput or data privacy, that early BC implementations (e.g., Bitcoin) did not provide. Thus, a myriad of novel BC implementations was developed, which introduced the issue of choosing the right implementation for a specific use-case. This paper presents a framework, called PleBeuS, to address this selection issue by allowing users to specify policies that rule the automatic selection of the BC that data will be stored. The selection process relies on a cost-aware approach and considers both public and private implementations and their technical characteristics. Moreover, PleBeuS communicates with a BC-agnostic interoperability API to enforce transactions. The evaluation of the PleBeuS prototype showed that it is possible to automatically select a BC-based on user policies, considering cost thresholds and technical details (e.g., BC throughput, deployment), and reduce manual interaction.

Cyberattacks are the cause of several damages on governments and companies in the last years. Such damage includes not only leaks of sensitive information, but also economic loss due to downtime of services. The security market size worth billions of dollars, which represents investments to acquire protection services and training response teams to operate such services, determines a considerable part of the investment in technologies around the world. Although a vast number of protection services are available, it is neither trivial for network operators nor endusers to choose one of them in order to prevent or mitigate an imminent attack. As the next-generation cybersecurity solutions are on the horizon, systems that simplify their adoption are still required in support of security management tasks. Thus, this paper introduces MENTOR, a support tool for cybersecurity, focusing on the recommendation of protection services. MENTOR is able to (a) to deal with different demands from the user and (b) to recommend the adequate protection service in order to provide a proper level of cybersecurity in different scenarios. Four similarity measurements are implemented in order to prove the feasibility of the MENTOR's enngine. Aug evaluation determines the performance and accuracy of each measurement used during the recommendation process.

The blockchain (BC) world is rapidly becoming a universe of several ledgers designed for a specific purpose, holding data previously stored (i.e., siloed) in centralized databases. The use of different BCs for the same purpose could hamper the frictionless exchange of data or value. On one hand, it is natural that there are competing implementations exploring the benefits of BC. On the other hand, the problem of siloed data re-emerges, with respect to isolated chains. In this regard, BC interoperability is necessary to connect different BCs, exchanging information and assets. Moreover, to foster BC employment, developers must be able to interact with such different BCs without knowing the details of each implementation. This paper presents a novel solution, called Bifröst, to store and retrieve data on different BCs. Bifröst employs a notary scheme, which allows for connectivity to different BCs. The presented prototype is highly modular and currently implements seven adapters to popular BC implementations, including Bitcoin, Ethereum, and Stellar. The developed prototype was evaluated concerning performance, security, and data size to verify the feasibility of such an implementation and assess design decisions taken during its development.

Blockchains are on the top of the Gartner Hype Cycle 2016 and many start-ups are integrating blockchains into their technology portfolio. While blockchains have emerged in the context of financial applications, non-financial application areas are of interest as well. In this paper, modum.io is presented, a start-up that uses IoT (Internet of Things) sensor devices leveraging blockchain technology to assert data immutability and public accessibility of temperature records, while reducing operational costs in the pharmaceutical supply-chain. The medical industry has many complex and strict environmental control process (e.g., temperature and humidity) to ensure quality control and regulatory compliance over the transport of medical products. The sensor devices monitor the temperature of each parcel during the shipment to fully ensure GDP regulations. All data is transferred to the blockchain where a smart contract assesses against the product attributes. As modum.io is not the only non-financial start-up working with blockchains, a list of areas and other start-ups is provided that aim to reduce bureaucracy, distribute the infrastructure, and saving costs using blockchains.

Video-on-demand and live streaming services are about to take over video discs. Video streaming services typically cannot compete with the content available in Peer-to-Peer (P2P) file sharing networks. Thus, content providers can use P2P systems to identify content to include in their offer. This work defines a novel method to apply Social Network Analysis (SNA) on video streaming or download traces. Those traces are abstracted int a two-mode graph, which is projected to a content-centric one mode graph (ConNet). SNA measures are used on a ConNet to classify a content-centric graph and provide a general interpretation and insights into the system the traces were collected from. To evaluate the proposed method, real world traces acquired from BitTorrent (BT) swarms sharing movies and television (TV) shows are used to construct 48 hourly graphs to show the evolution of the graph. The results show that the video network can be classified as scale-free, that SNA measures can be used as an alternative popularity indicator, and that the network evolves over time and exhibits diurnal patterns. Finally, this work shows that the proposed method can be applied to real world traces and provides a novel perspective on video consumption.

Various energy efficiency network capabilities have been proposed in recent years in response to the demand of reducing the amount of energy consumed by the network infrastructure. In this regard, we demonstrate SOS, a method able to orchestrate different energy efficiency capabilities considering the possible combinations and conflicts among them, as well as the best option for a given bandwidth utilization and network characteristics, such as topology and power profiles of devices. The method was tested on GreenSDN, a testbed based on the Mininet environment and the POX controller, which emulates the effects of different energy efficiency capabilities. During the demonstration, we will show the energy efficiency achieved by the orchestration method, highlighting the additional savings due to capabilities orchestration, and, at the same time, considering performance constraints and different policies.

A significant number of green, energy-saving network protocols have been invented in recent years in response to demand for reducing the amount of energy consumed by network infrastructure. In this paper, we report on the difficulties we encountered when building an SDN environment that could emulate energy saving protocols operating at different layers of the network. We propose solutions, based on the Mininet environment and the POX Openflow controller, that emulate the effects of three different energy saving protocols. Our approach is validated by comparing energy savings obtained by activating these protocols in an emulated network topology inspired by the Brazilian Research Network.

The energy demand for operating Information and Communication Technologies is growing, implying in high operational costs and consequent carbon emissions. Both in datacenters and in telecom infrastructures, the networks represent a significant amount of energy spending. This implies in an increased demand for energy efficiency, and several functionalities to save energy are being proposed. However, there is no proposal on how to coordinate or combine such energy efficiency functionalities in the same network, or choosing the best one for a given scenario. There is neither a way to do this using business directives, telling, for instance, the period of the day to apply such functionalities or the operational conditions (e.g. If the network usage is low). In this regard, we propose a method able to orchestrate different energy efficiency functionalities considering the possible combinations and conflicts among them, as well as the best option for a given workload and network characteristics, such as topology and power profiles of devices. The business policies are refined down to the network level in order to bring high-level directives into the operation. Our method operation is validated with an example which achieves near 50% of savings for the given scenario by combining two different energy efficiency functionalities.