Quantum Key Distribution (QKD) protocols, such as BB84, require secure authentication of their classical communication channel to ensure message integrity and authenticity, which is fundamental to successfully distribute unconditionally secure keys and prevent critical vulnerabilities. Traditionally, QKD relies on pre-shared secret keys for this authentication, posing significant scalability challenges. Employing asymmetric encryption methods is also not a viable alternative, as these methods are either vulnerable to quantum computing attacks or lack rigorous security proofs. To address these issues, we propose using the well-established Kerberos authentication protocol, which relies on symmetric cryptography inherently resistant to known quantum attacks, to securely distribute symmetric session keys that authenticate classical communication in QKD systems. We demonstrate the feasibility and practical security advantages of employing Kerberos-generated session keys, inherently resistant to quantum computing attacks, without modifying existing Kerberos workflows, providing a practical quantum-secure solution that leverages existing IT infrastructure.

The aviation domain is undergoing rapid digital transformation, exposing air navigation systems, surveillance, communication, and data sharing architectures to evolving cyber threats. While the MITRE ATT&CK framework is widely adopted in defense and detection contexts, its potential for guiding offensive security testing in aviation remains underexplored. In this paper, we present a structured methodology to map adversary emulation and penetration testing activities onto ATT&CK tactics and techniques, and apply it in a case study targeting System Wide Information Management (SWIM) and related Air Traffic Control (ATC) systems. We demonstrate how each phase of an offensive workflow, from reconnaissance to impact can be contextualized to aviation-specific assets, identify gaps in defenses, and derive mitigation strategies aligned with ATT&CK’s mitigations. Our results show that this approach can systematically uncover vulnerabilities in aviation systems and provide a common framework b ridging offense and defense. We discuss challenges, limitations, and directions for further research.

Abstract As NLP models are used by a growing number of end-users, an area of increasing importance is NLP Security (NLPSec): assessing the vulnerability of models to malicious attacks and developing comprehensive countermeasures against them. While work at the intersection of NLP and cybersecurity has the potential to create safer NLP for all, accidental oversights can result in tangible harm (e.g., breaches of privacy or proliferation of malicious models). In this emerging field, however, the research ethics of NLP have not yet faced many of the long-standing conundrums pertinent to cybersecurity, until now. We thus examine contemporary works across NLPSec, and explore their engagement with cybersecurity’s ethical norms. We identify trends across the literature, ultimately finding alarming gaps on topics like harm minimization and responsible disclosure. To alleviate these concerns, we provide concrete recommendations to help NLP researchers navigate this space more ethically, bridging the gap between traditional cybersecurity and NLP ethics, which we frame as “white hat NLP”. The goal of this work is to help cultivate an intentional culture of ethical research for those working in NLP Security.

Cryptocurrencies have gained immense significance and popularity in recent times. With thousands of digital currencies available, selecting the right one can be challenging for users. In the financial sector, accurately predicting future prices is crucial for profitable investments in digital currencies. However, price prediction in this realm poses unique challenges, as it lacks physical goods or services as the basis, unlike stock prices. Machine learning emerges as a pivotal tool for addressing this challenge and plays a vital role in price prediction. This research analyzes five prominent currencies - Monero, Bitcoin, Ethereum, IOTA, and Zcash - employing five models: SVR, LRG, Huber, RANSAC, MLP, and AdaBoost. The experimental results demonstrate promising outcomes, showcasing the ability to predict digital currency prices with an impressive R2 score of 1.0 for specific machine learning algorithms. This advancement opens new avenues for informed decision-making and profitable ventures in the dynamic world of digital currencies

Recruiting and educating cybersecurity professionals continues to be a challenge. It is not hard for people with a preexisting interest to learn more, but in order to fill the gap of missing professionals within the field it is necessary to reach a broader audience and make more people interested in cybersecurity. One element in achieving this, is to show that cybersecurity is not only a technical discipline. Privacy Universe is a platform built within the Haaukins training platform, which a focus on privacy, data protection, ethics and social media usage, targeting less technical students. It enables students to learn about cybersecurity and privacy with hands-on training in a closed and secure environment. This paper presents the platform as well as a survey of 50 students of which 80% who have replied that their learning outcome is 4 or 5 on a scale from 1–5, 5 being the highest. In addition to this, a majority also found that their interest within cybersecurity increased based on their experience with Privacy Universe. This indicates that Privacy Universe is a beneficial addition to the already existing platforms to make cybersecurity interesting for a broader audience, in a field where those competences are much needed.

The Internet of things (IoT) and critical infrastructure utilizing operational technology (OT) protocols are nowadays a common attack target and/or attack surface used to further propagate malicious actions. Deception techniques such as honeypots have been proposed for both IoT and OT but they either lack an extensive evaluation or are subject to fingerprinting attacks. In this paper, we extend and evaluate RIoTPot, a hybrid-interaction honeypot, by exposing it to attacks on the Internet and perform a longitudinal study with multiple evaluation parameters for three months. Furthermore, we publish the aforementioned study in the form of a dataset that is available to researchers upon request. We leverage RIoTPot’s hybrid-interaction model to deploy it in three interaction variants with six protocols deployed on both cloud and self-hosted infrastructure to study and compare the attacks gathered. At a glance, we receive 10.87 million attack events originating from 22,518 unique IP addresses that involve brute-force, poisoning, multistage and other attacks. Moreover, we fingerprint the attacker IP addresses to identify the type of devices who participate in the attacks. Lastly, our results indicate that the honeypot interaction levels have an important role in attracting specific attacks and scanning probes.

Network traffic that is not preceded by any Domain Name System (DNS) resolutions is referred to as unnamed traffic. Any DNS-based security system is ineffective against malicious content distributed through this traffic. In this paper, we introduce a novel method for identifying unnamed traffic based on the correlation of flows and DNS responses extracted from raw network traces. We describe two challenges that affect the validity of our method, and how to handle them. By applying our method to a one-week trace of network traffic, we illustrate that unnamed traffic is ubiquitous in a university network across nearly all client systems, destination IP addresses, and destination services. We conclude by presenting several open problems that prevent us from blocking unnamed traffic for security reasons.

The current supply of a highly specialized cyber security professionals cannot meet the demands for societies seeking digitization. To close the skill gap, there is a need for introducing students in higher education to cyber security, and to combine theoretical knowledge with practical skills. This paper presents how the cyber security training platform Haaukins, initially developed to increase interest and knowledge of cyber security among high school students, was further developed to support the need for training in higher education. Based on the differences between the existing and new target audiences, a set of design principles were derived which shaped the technical adjustments required to provide a suitable platform - mainly related to dynamic tooling, centralized access to exercises, and scalability of the platform to support courses running over longer periods of time. The implementation of these adjustments has led to a series of teaching sessions in various institutions of higher education, demonstrating the viability for Haaukins for the new target audience.

Mirai and its variants have demonstrated the ease and devastating effects of exploiting vulnerable Internet of Things (IoT) devices. In many cases, the exploitation vector is not sophisticated; rather, adversaries exploit misconfigured devices (e.g. unauthenticated protocol settings or weak/default passwords). Our work aims at unveiling the state of IoT devices along with an exploration of the current attack landscape. In this paper, we perform an Internet-level IPv4 scan to unveil 1.8 million misconfigured IoT devices that may be exploited to perform large-scale attacks. These results are filtered to exclude a total of 8,192 devices that we identify as honeypots during our scan. To study current attack trends, we deploy six state-of-art IoT honeypots for a period of 1 month. We gather a total of 200, 209 attacks and investigate how adversaries leverage misconfigured IoT devices. In particular, we study different attack types, including denial of service, multistage attacks and attacks from infected online hosts. Furthermore, we analyze data from a /8 network telescope covering a total of 81 billion requests towards IoT protocols (e.g. CoAP, UPnP). Combining knowledge from the aforementioned experiments, we identify 11, 118 IP addresses (that are part of the detected misconfigured IoT devices) that attacked our honeypot setup and the network telescope.

This paper investigates the potential of using digital certificates for the detection of phishing domains. This i motivated by phishing domains that have started to abuse the (erroneous) trust of the public in browser padloc symbols, and by the large-scale adoption of the Certificate Transparency (CT) framework. This publicl accessible evidence trail of Transport Layer Security (TLS) certificates has made the TLS landscape mor transparent than ever. By comparing samples of phishing, popular benign, and non-popular benign domains we provide insight into the TLS certificates issuance behavior for phishing domains, focusing on the selectio of the certificate authority, the validation level of the certificates, and the phenomenon of certificate sharin among phishing domains. Our results show that phishing domains gravitate to a relatively small selection o certificate authorities, and disproportionally to cPanel, and tend to rely on certificates with a low, and cheap validation level. Additionally, we demonstrate that the vast majority of certificates issued for phishing domain cover more than only phishing domains. These results suggest that a more pro-active role of CAs and puttin more emphasis on certificate revocation can have a crucial impact in the defense against phishing attacks.

With the continuous rise in the numbers and sophistication of cyber-attacks, defenders are moving towards more proactive lines of defense. Deception methods such as honeypots and moving target defense paradigms, are nowadays utilized in a multitude of ways. A honeytoken is an umbrella term that describes honeypot-like entities/resources that can be inserted into a network or system. The moment an adversary interacts with a honeytoken, an alert is raised. Similar to honeypots, the value of honeytokens lies in their indistinguishability; if an attacker can detect them, e.g. via a fingerprinting tool, they can easily evade them. In this paper, we propose and discuss honeytoken fingerprinting methods. To the best of our knowledge, this is the first paper to examine honeytoken-specific fingerprinting. Furthermore, we showcase a proof of concept that is able to successfully detect a number of honeytoken types.

Education of IT security can include a tedious and frustrating experience for novice students and organizers. We have sought out to create an education platform that improves upon this experience, through automation, and individualized learning labs. These learning labs hosts are isolated clusters of virtual computer instances, representing real and insecure computer networks. The platform, named Haaukins, improves upon typical accessibility issues of students and cumbersome configuration management for organizers. In order make the platform accessible for other organizations, it has been open sourced.

Private and public institutions are using open and public data to provide better services, which increases the impact of open data on daily life. With the advancement of technology, it becomes also important to equip our younger generation with the essential skills for future challenges. In order to bring up a generation equipped with 21st century skills, open data could facilitate educational processes at school level as an educational resource. Open data could acts as a key resource to enhance the understanding of data through critical thinking and ethical vision among the youth and school pupils. To bring open data into schools, it is important to know the teacher's perspective on open data literacy and its possible impact on pupils. As a research contribution, we answered these questions through a Danish public school teacher's survey where we interviewed 10 Danish public school teachers of grade 5-7th and analyzed their views about the impact of open data on pupils' learning development. After analyzing Copenhagen city's open data, we identified four open data educational themes that could facilitate different subjects, e.g. geography, mathematics, basic science and social science. The survey includes interviews, open discussions, questionnaires and an experiment with the grade 7th pupils, where we test the pupils' understanding with open data. The survey concluded that open data cannot only empower pupils to understand real facts about their local areas, improve civics awareness and develop digital and data skills, but also enable them to come up with the ideas to improve their communities.

Multiplayer online games are on the rise with millions of registered player and hundreds of thousands concurrent players. Current state of the art servers achieve scalability by splitting the game world into linked mini worlds that can be hosted on separate servers. One of the problems is that, players are flocking to one area, resulting in an overloaded server with decreasing Quality of Service(QoS) for the players. A number of approaches were developed to address these issues, by balancing loads between the over-loaded and under-loaded servers. This paper investigates a new dimension that is created due to the load balancing of servers. Load balancing among servers is sensitive to correct status information. The Markov based load prediction was introduced in this paper to predict load of under-loaded servers, based on arrival (μ) and departure (λ) rates of players. The prediction based algorithm is proposed to minimize the effect of out dated status information. This approach was compared with normal load status information exchange algorithm. The model presented in this paper does not deal directly with optimizing the load balancing of the server but rather tries to present a new insight that need to be considered when developing load balancing algorithm, that is the reliability of the information that is shared. Simulation results show that Markov based prediction of load information performed better from the normal load status information sharing.

The increasing amount of smart devices and handheld devices have widened the amount of information presence all over. The application running on one device can be distributed to a surrounding device for better functionality. A capability that might be enjoyable or frustrating for end user. This paper has identified the factors that contribute to the loss of user experience for seamless application migration in a context aware environment. These are the context information updates, transfer time and resumption time. To quantify the loss of user experience, a Quality of experience (QoE) Loss score value (representing the time that is lost in user experience during migrating process)is introduced. A high QoE loss score value indicates a higher loss of user experience and a lower QoE loss score value indicate a lower loss of user experience. A test-bed setup was implemented and different policies of migration processes in a context aware environment were evaluated.

ABSTRACT Many globally distributed cloud computing (CC) applications and services running over the Internet, between globally dispersed clients and servers, will require certain levels of QoS in order to deliver and give a sufficiently smooth user experience. This would be essential for real‐time streaming multimedia applications such as online gaming and watching movies on a pay as you use basis hosted in a CC environment. However, guaranteeing or even predicting QoS in global and diverse networks that are supporting complex hosting of application services is a very challenging issue that needs a stepwise refinement approach to be solved as the technology of CC matures. In this paper, we investigate if latency in terms of simple ping measurements can be used as an indicator for other QoS parameters such as jitter and throughput. The experiments were carried out on a global scale, between servers placed in universities in Denmark, Poland, Brazil, and Malaysia. The results show the correlation between latency and throughput, and between latency and jitter, even though the results are not completely consistent. As a side result, we were able to monitor the changes in QoS parameters during a number of 24‐hour periods. This is also a first step toward defining QoS parameters to be included in service level agreements for CC at the global scale in the foreseeable future. Concurrency and Computation: Practice and Experience, 2013.© 2013 Wiley Periodicals, Inc.

Context-awareness is a key requirement in many of today's networks, services and applications. Context Management systems are in this respect used to provide access to distributed, dynamic context information. The reliability of remotely accessed dynamic context information is challenged by network delay, packet drop probability, information dynamics and the access strategies taken. QoS classification and system configuration of context management traffic is in this aspect important in order to efficiently balance generated access traffic between network delay, packet loss probability, information dynamics and reliability requirements to the information from the applications. In this paper we develop a QoS Control network concept for context management systems. The concept includes a soft realtime algorithm for model based context access configuration and QoS class assignment, and allows to put probabilistic bounds on.

Our previous work demonstrated the possibility of distinguishing several kinds of applications with accuracy of over 99%. Today, most of the traffic is generated by web browsers, which provide different kinds of services based on the HTTP protocol: web browsing, file downloads, audio and voice streaming through third-party plugins, etc. This paper suggests and evaluates two approaches to distinguish various HTTP content: distributed among volunteers' machines and centralized running in the core of the network. We also assess accuracy of the global classifier for both HTTP and non-HTTP traffic. We achieved accuracy of 94%, which supposed to be even higher in real-life usage. Finally, we provided graphical characteristics of different kinds of HTTP traffic.

Many global distributed cloud computing applications and services running over the Internet, between globally dispersed clients and servers, will require certain levels of Quality of Service (QoS) in order to deliver and give a sufficiently smooth user experience. This would be essential for real-time streaming multimedia applications like online gaming and watching movies on a pay as you use basis hosted in a cloud computing environment. However, guaranteeing or even predicting QoS in global and diverse networks supporting complex hosting of application services is a very challenging issue that needs a stepwise refinement approach to be solved as the technology of cloud computing matures. In this paper, we investigate if latency in terms of simple Ping measurements can be used as an indicator for other QoS parameters such as jitter and throughput. The experiments were carried out on a global scale, between servers placed in universities in Denmark, Poland, Brazil and Malaysia. The results show some correlation between latency and throughput, and between latency and jitter, even though the results are not completely consistent. As a side result, we were able to monitor the changes in QoS parameters during a number of 24-hour periods. This is also a first step towards defining QoS parameters to be included in Service Level Agreements for cloud computing in the foreseeable future.

Context aware network services are a new and interesting way to enhance network users experience. A context aware application/service enhances network performance in relation to dynamic context information, e.g. mobility, location and device information as it senses and reacts to environment changes. The reliability of the information accessed is a key factor in achieving reliable context aware application. This paper will review the service degradation in Context Management Frameworks (CMF) and the effect of high network utilization, with particular focus on the reliability of the accessed information. The paper considers a developed framework from the ICT project, OPEN, and investigates the impact of applying Differentiated Services (DiffServ) Quality of Services (QoS). The paper finally provides insight in how the insight gained can be utilized to ensure reliable remote accessed context information.

We show how integrated planning of wired and wireless infrastructures can be used to build a QoS-aware broadband infrastructure. The outset is a case study of the municipality of Hals, a rural community in Denmark, where the objective is to establish a broadband infrastructure reaching all households and businesses. Two factors are considered particularly important when designing an infrastructure: the chosen technology must allow for sufficient bandwidth, and the physical network structures must allow for independent paths between any pair of nodes. A final solution is obtained by using fiber to the home for primary connections and fixed wireless access for backup. This is implemented over 15 years, during which temporary solutions ensure sufficient QoS and reliability for all users. These temporary solutions form parts of the final solutions.