Abstract Digital twin technology is emerging as the cornerstone of proactive maintenance and monitoring of ICT/OT infrastructures. This paper discusses a security twin, an evolution of a digital twin that is a graph-based model, which acts as a dynamic inventory enriched with vulnerability intelligence and that can mirror complex ICT infrastructures to predict intrusions by threat agents without disrupting live production environments. This requires a high-fidelity synchronization between the infrastructure and the security twin, which remains a challenge mainly when active scanning cannot be employed. As an answer to the challenge, this paper introduces NotLine, a non-intrusive and fully automated platform that builds and updates a security twin through the continuous passive ingestion of multi-protocol network telemetry. NotLine leverages a distributed monitoring pipeline architecture to filter, normalize, and correlate heterogeneous traffic metadata in real time. NotLine maps these data to the security twin. The core innovation of NotLine lies in its integration of this live model with an AI-driven Monte Carlo simulation engine. The engine uses the security twin to generate the state transitions of a threat actor in an intrusion, as determined by the access rights and information they have acquired. This enables the quantification of risk exposure probabilistically and enables prescriptive analytics and preemptive remediation. We present an evaluation of NotLine in a production environment and show that a hypoexponential mathematical model characterizes the platform discovery pattern. According to this model, the platform maps most assets within 48 h; this confirms that NotLine provides a robust foundation for simulation-powered cybersecurity, bridging the gap between passive observation and proactive risk prediction, even if a long-tail monitoring period is critical to capture all infrastructure components.

Non-Fungible Tokens (NFTs) are promising additions to the blockchain universe. After Ethereum introduced the NFT concept in 2015, it quickly rose in popularity, triggering other public blockchains to support their own versions of these new types of token by extending their smart contract capabilities to enable minting of these new tokens in their ecosystems. Ethereum is the reference for NFT development, establishing the token standards widely used today. The popularity of NFTs in Ethereum created a rich application ecosystem that also revealed limitations in scalability and throughput for this network. An attempt to solve these issues resulted in the creation of Flow, a new NFT-centric blockchain that claims to solve the scalability issues that plagued Ethereum. This paper presents the alternative NFT architecture introduced by Flow and how it compares with Ethereum’s version.

We evaluate the performance of a genetic algorithm to discover the best set of rules to implement an intrusion against an ICT network. The rules determine how the attacker selects and sequentializes its actions to implement an intrusion. The fitness of a set of rules is assigned after exploiting it in an intrusion. The evaluation of the distinct sets of rules in the populations the algorithm considers requires multiple intrusions. To avoid the resulting noise on the ICT network, the intrusions target a digital twin of the network. We present a preliminary experimental results that supports the feasibility of the proposed solution.

We present a rule-based system to dynamically deploy countermeasures against privilege escalations where a rule includes some n-grams and a countermeasure. An n-gram consists of n consecutive attacks. A rule deploys the countermeasure as soon as all the attacks in its n-grams are detected. After discussing the discovery of escalations, we show how to compute the rules starting from the escalations to stop and those we may neglect because they cannot reach a goal. We also evaluate the false positive rate and false negative one of attack detection affect the proposed approach. Lastly, we describe a preliminary evaluation using data from an industrial control system.

Haruspex is a suite of tools to assess and manage the risk posed by an information and communication technology system. The suite is built around the application of a Monte Carlo method to a scenario where intelligent agents implement chains of attacks to reach their goals. Some tools build a description of the agents, the target system, its vulnerabilities and the resulting attacks. Another tool applies a Monte Carlo method to this description, simulates the building of attack chains by the agents and it returns a database with samples it collects in the simulations. Further tools analyze this database to select countermeasures. To validate the suite and verify it truthfully models attackers, it has been adopted in Locked Shield 2014, a network defense exercise with participants from 17 nations. The results of this exercise validate the designs of the tools.

Haruspex is a suite of tools that assesses ICT risk through a scenario approach. Each scenario includes the target system and some threat agents that compose the attacks enabled by the system vulnerabilities to reach some predefined goals. The suite applies a Monte Carlo method with multiple simulations of the agent attacks against the target system. The simulation applies a formal model of the target system that describes the system nodes, the components with their vulnerabilities, and the logical topology. This paper proposes an extension to model in a more accurate way how the relations and the interactions among applications affect the agent attacks. After introducing this extension, we show how it supports the modeling of web applications. Then, we adopt the new model to assess a critical infrastructure that supervises and manages gas distribution.

We describe the tools of the Haruspex suite to manage the risk due to intelligent agents. The suite applies a Monte Carlo method and it return a statistical samples on the attacks these agents implement. Some tools of the suite analyzes these samples to select the countermeasures to deploy. The tools work in an iterative way that alternates the selection of countermeasures and the application of the Monte Carlo method. This takes into account that an intelligent agent may select distinct attacks to replace those affected by the countermeasures. Lastly, we apply the tools to three industrial control systems.

A masquerade attacker impersonates a legal user to utilize the user services and privileges. The semi-global alignment algorithm (SGA) is one of the most effective and efficient techniques to detect these attacks but it has not reached yet the accuracy and performance required by large scale, multiuser systems. To improve both the effectiveness and the performances of this algorithm, we propose the Data-Driven Semi-Global Alignment, DDSGA approach. From the security effectiveness view point, DDSGA improves the scoring systems by adopting distinct alignment parameters for each user. Furthermore, it tolerates small mutations in user command sequences by allowing small changes in the low-level representation of the commands functionality. It also adapts to changes in the user behaviour by updating the signature of a user according to its current behaviour. To optimize the runtime overhead, DDSGA minimizes the alignment overhead and parallelizes the detection and the update. After describing the DDSGA phases, we present the experimental results that show that DDSGA achieves a high hit ratio of 88.4 percent with a low false positive rate of 1.7 percent. It improves the hit ratio of the enhanced SGA by about 21.9 percent and reduces Maxion-Townsend cost by 22.5 percent. Hence, DDSGA results in improving both the hit ratio and false positive rates with an acceptable computational overhead.

We present an assessment of ICT systems that merges a scenario approach and a Monte Carlo method. To automate the assessment, we have developed two tools. The first one builds a formal description of the vulnerabilities in the target system and of the attacks they enable. Starting from this description, the second tool consider each scenario of interest and it simulate several times how intelligent and adaptive threat agents compose these attacks to reach some goals. By collecting samples in these simulations, this tool returns a database to compute statistics of interest for the assessment, such as the success probability of the agents or their average impacts. After outlining the design of the tools, we discuss a test case to show how they are exploited in a real assessment to manage the corresponding risk.

A global vulnerability is a set of vulnerabilities in one or several nodes of an ICT infrastructure. These vulnerabilities enable some attacks that may be sequentialized so that the privileges that each attack requires are acquired through the previous ones. Current vulnerability scanners cannot discover global vulnerabilities because they analyze each node in isolation, without correlating the vulnerabilities in the same or in distinct nodes. To discover global vulnerabilities, an analysis has to correlate node vulnerabilities according to the architecture and the topology of the infrastructure. After defining a formal analysis to discover global vulnerabilities and the corresponding attack sequences, we present GVScan, a tool to automate the analysis based upon a classification of vulnerabilities. A first application of GVScan to a real infrastructure is described together with an evaluation of its accuracy.

We present an obfuscation strategy to protect a program against injection attacks. The strategy represents the program as a set of code fragments in-between two consecutive system calls (the system blocks) and a graph that represents the execution order of the fragment (the system block graph). The system blocks and the system block graph are partitioned between two virtual machines (VMs). The Blocks-VM stores and executes the system blocks but does not store any information on how control flows across the system blocks. This information is represented only by the system block graph stored in the Graph-VM, which correctly sequentializes the system blocks by analyzing the system block graph and accessing the Blocks-VM. At run-time, each time a system block ends, i.e. the program issues a system call, the execution of the Blocks-VM is frozen and control is transferred to the Graph-VM. After deducing the next system block to be executed from the system block graph, the current system block and the current system call, the Graph-VM updates the return address in the Blocks-VM so that the correct system block is executed and then resumes the Blocks-VM. To protect code integrity, the Graph-VM also stores a hash of each block. The overall strategy results in a clean separation between the program and its control-flow and this is important whenever the Graph-VM is in full control of the user whereas the Blocks-VM may be attacked through code injection. The Graph-VM can discover these attacks because either the current system call is not present in the original program or the hash of the current block is invalid. In all these cases, the Graph-VM halts the execution of the program. We present the algorithm that maps the program source code into the system blocks and the system block graph and discuss a first implementation of the run-time architecture along with some performance results.

PsycoTrace is a set of tools to protect a process P from attacks that alter P self as specified by its source code. P self is specified in terms of legal traces of system calls and of assertions on P status paired with each call. In turn, legal traces are specified through a context-free grammar returned by a static analysis of P program that may also compute assertions. At run-time, each time P invokes a system call, PsycoTrace checks that the trace is coherent with the grammar and assertions are satisfied. To increase overall robustness, PsycoTrace's run-time tool relies on two virtual machines that run, respectively, P and the monitoring system. This strongly separates the monitored machine that runs P from the monitoring one. The current implementation is fully transparent to P but not to the OS because a kernel module in the monitored machine intercepts system calls. We describe PsycoTrace overall architecture and focus on the run-time and introspection tools that enable the monitoring machine to check that a trace is legal and to transparently access the memory of the other machine to evaluate assertions. Lastly, a preliminary evaluation of the run-time overhead is discussed.

Semantics-driven monitoring discovers attacks against a process by evaluating invariants on the process state. We propose an approach that increases the robustness and the transparency of the run-time monitoring system by introducing two virtual machines (VMs) running on the same platform. One VM runs the monitored process, i.e. the process P to be protected, while the other one evaluates invariants on P state each time P invokes a system call. To this purpose, an Introspection Library allows the monitoring VM to access the memory and the processor registers of the monitored VM. After describing the overall architecture, we focus on the Introspection Library and the problems posed by the introspection of variables in the memory of a program running in a distinct VM to evaluate invariants. A first prototype implementation is also presented together with preliminary performance results.

Psyco-Virt is a high assurance intrusion detection tool that merges host and network intrusion detection technologies with virtual machine introspection. Psyco-Virt architecture includes a cluster of virtual machines, the monitored VMs, which run the OS and applications of interest, and a further VM, the introspection one. Several agents distributed across the monitored VMs execute network and host IDS tools to discover attempted intrusions/attacks on the monitored VMs. The introspection VM makes the detection tools trustworthy by running an introspector and a director to discover any attempt to maliciously modify the kernel, the agents and the IDSes hosted on a monitored VM. On each monitored VM a collector gathers the alerts generated by the agents and forwards them to the director through a control network dedicated to data exchange among the agents and the introspection VM. The director on the introspection VM filters all the alerts and delegates the execution of a proper action to a notifier whenever an intrusion or an attempt to modify the IDSes is detected. In such cases, a monitored VM can either be stopped or frozen and its current state saved in a file for a later, deeper inspection. After describing Psyco-Virt, we discuss some examples of agents and functions using introspection and present preliminary results and performance figures of a first prototype.

This paper advocates virtualization technology as a methodology to solve the security problems that an organization has to face when contributes with its resources to a grid. In particular, this technology makes it possible to increase the overall security of any system by inserting a set of controls into the code that implements one virtual machine. In this way, a secure cooperation among virtual machine can be implemented. This generalizes the current approach that exploits virtualization only for the confinement of alternative programming environments resulting from the partitioning of a physical machine into a set of non-cooperating virtual machines. The ability to support cooperation among virtual machines may be used to define networks of cooperating virtual machines to execute distributed applications. The paper describes a general purpose approach to security based upon virtual networks of cooperating virtual machines and applies it to one of the most challenging problems: that of securing a grid environment

While technology improvements in VLSI favor the building of massively parallel computers, the key obstacle to the widespread adoption of such computers is the lack of a methodology for developing software that achieves both portability and high performance. This paper presents a virtual machine intended to serve as the cornerstone of such a methodology. The PM virtual machine can be mapped efficiently to different physical machines and enables the development of software tools and applications that can be ported across different parallel machines.

A methodology is presented which is aimed at the development of efficient and portable software for general-purpose highly-parallel computers. The methodology has two major components: a programming language that allows the programmer to express the parallelism of an application at a high level and an abstract model of parallel computers that allows programs written for it to be mapped efficiently to different multiple instruction-multiple data (MIMD) parallel computers.>

A programming tool, called parallelizer, for the static optimization of concurrent programs is considered. The tool partitions the alternative command lists of a nondeterministic iterative command into distinct elements that are concurrently executed. To improve the program's performance, the tool determines a decomposition where the granularity of the resulting processes is close to optimal for the target parallel architecture. This requires that some parameters of the target architecture are taken into account. Search techniques traditionally used in artificial intelligence are exploited to determine an optimal alternative assignment. The implementation of the parallelizer is described and an example of its application is considered.>

The authors discuss issues related to the debugging of concurrent programs. A set of desirable characteristics for a debugger for concurrent languages is deduced from a review of the differences between the debugging of concurrent programs and that of sequential ones. A debugger for concurrent language based upon CSP is then described. The debugger makes it possible to compare a description of the expected program behavior to the actual behaviour. The description of the behavior is given in terms of expressions composed by events and/or assertions on the process state. The developed formalism is able to describe behaviors at various levels of abstraction. Lastly, some guidelines for the implementation of the debugger are given and a detailed example of program debugging is analyzed.