Networking Unmanned Areal Vehicles (UAV) is a new paradigm with an interesting endeavor that aims at in-terconnecting UAVs as the traditional computer networks. One such endeavor that pushes UAV networking towards reality is segregating the network into sub-networks (sub-nets) for ease of network management, security and resiliency to disruptions. This paper presents a micro-services based UAV sub-networking using a combination of a Kademlia-based DHT for the overlay topology construction and Geo-Hashing for partitioning the overlay into logical groups/sub-nets. We first discuss the formation of aerial UAV network topology boundaries, then, discuss how the network is partitioned into sub-nets. Finally, we present the design and implementation details of a prototype built on top of ZeroMQ messaging middleware for selective data routing within and across the sub-nets, and show a preliminary evaluations of interconnected micro-services with docker-swarm utility managed under Docker Desktop as of networked UAV swarm.

Studies on resiliency against system attacks have contributed well established defensive techniques, sound protocols and paradigms in distributed systems’ literature. One of this contribution is credited to redundancy and replication techniques which is proven to be a double–edged–sword, by increasing the number of nodes inherently increases the system's attack-vector – the set of ways an attacker can compromise a system. To remedy this issue, system randomization and diversification has been considered as an effective defensive strategy, referred to as a Moving Target Defense (MTD). In this article, we introduce a bio-inspired formal model for space/time system randomization/diversification and a quantification scheme for virtual machines (VMs) in a cloud computing environment. We show the practicality of the model with a MTD framework(Mayflies)integrated into the cloud management software stack(OpenStack)and illustrate with realistic VM attacks and proactive defense use cases.

The smart features of modern cars are enabled by a number of Electronic Control Units (ECUs) components that communicate through an in-vehicle network, known as Controller Area Network (CAN) bus. The fundamental challenge is the security of the communication link where an attacker can inject messages (e.g., increase the speed) that may impact the safety of the driver. Most of existing practical IDS solutions rely on the knowledge of the identity of the ECUs, which is proprietary information. This paper proposes a message injection attack detection solution that is independent of the IDs of the ECUs. First, we represent the sequencing of the messages in a given time-interval as a direct graph and compute the similarities of the successive graphs using the cosine similarity and Pearson correlation. Then, we apply threshold, change point detection, and Long Short-Term Memory (LSTM)-Recurrent Neural Network (RNN) to detect and predict malicious message injections into the CAN bus. The evaluation of the methods using a dataset collected from a moving vehicle under malicious RPM and speed reading message injections show a detection accuracy of 97.32% and detection speed of 2.5 milliseconds when using a threshold method. The performance metrics makes the IDS suitable for real-time control mechanisms for vehicle resiliency to cyber-attacks.

We present Byzantine Fault-Avoidance (BFA), a fault-resilient architecture designed for Byzantine Fault Tolerant (BFT) systems to withstand against attacks and failures. BFA allows replicas to short live on a given computing platform, i.e., hardware, hypervisors and OS, to thwart successful and in-progress attacks while simultaneously preserving the correctness condition of BFT properties; safety and liveness. BFA combines the cloud management software stack of OpenStack (nova) and the Software Defined Network (SDN) implementation (neutron) to control the replicas susceptibility window of attack in order to avoid Byzantine faults. The proposed fault-avoidance scheme illustrates the defensive security solutions enabled by the underlying cloud computing fabric are far superior than the ones implemented at the application/protocol level. Preliminary results of widely studied BFT system (BFT-SMaRT) deployed in a cloud infrastructure (OpenStack-Kilo) indicate that BFA achieves desired BFT reliability properties and throughput over contested environments.

Advances in cloud computing have made it a feasible and cost-effective solution to improve the resiliency of enterprise systems. However, the replication approach taken by cloud computing to provide resiliency leads to an increase in the number of ways an attacker can exploit or penetrate the systems. This calls for designing cloud systems that can accurately detect anomalies and dynamically adapt themselves to keep performing mission-critical functions even under attacks and failures. In this paper, we propose a self-adaptive resiliency approach for cloud enterprise systems that employs a live monitoring and moving target defense based approach to automatically detect deviations from normal behavior and reconfigure critical cloud processes through software-defined networking to mitigate attacks and reduce system downtime. The proposed solution is promising to present a unified framework for resilient cloud systems.

Publish and Subscribe (pub/sub) dissemination paradigm has emerged as a popular means of disseminating selective time-sensitive information. Through the use of event service or broker, published information is filtered to disseminate only to the subscribers interested in that information. Once a broker is compromised, information can be delivered unfiltered, dropped, delayed, perhaps colluding among the brokers in virtualized cloud platforms. Such disruptive behavior is known as Byzantine faults. We present a Disruption–Resilient Publish and Subscribe (DRPaS) system designed to withstand faults through continuously refreshing the virtual instances of the broker. DRPaS combines advances in cloud management software stack (i.e., OpenStack nova and neutron) to control the broker’s susceptibility window of disruption. Preliminary experimental results show that the defensive security solutions enabled by the underlying cloud computing fabric is simpler and more effective than the ones implemented at the application/protocol level to withstand disruptions.