The growing awareness of environmental sustain-ability has led to new investments in the field of electric vehicles. One of the most expensive and important components of electric vehicles are their batteries, with battery management systems (BMS) being responsible for their control. New regulations, such as those of the European Union, aim to introduce battery passports as a way to track battery lifecycle from manufacturing, over second-life use, to recycling. Given the vast amount of data generated during the lifecycle of a battery, the current research is focused on combining BMS with cloud connectivity. However, not much research has yet been done in the area of BMS cloud security and secure data logging. To address this gap, we propose a novel solution for secure BMS data acquisition for on-premise and cloud environments. In this paper, we make two main contributions: a secure data structure for BMS logging and a secure architecture for transferring BMS data from its source to cloud and end systems. We demonstrate the feasibility of the design by developing a prototype with real components and evaluate it in terms of security and performance.

In recent years, enterprises have been targeted by advanced adversaries who leverage creative ways to infiltrate their systems and move laterally to gain access to critical data. One increasingly common evasive method is to hide the malicious activity behind a benign program by using tools that are already installed on user computers. These programs are usually part of the operating system distribution or another user-installed binary, therefore this type of attack is called “Living-Off-The-Land”. Detecting these attacks is challenging, as adversaries may not create malicious files on the victim computers and anti-virus scans fail to detect them.

An increasing amount of sensory data, often of confidential nature, is exchanged day by day: from the sensor and actuator layers over smart gateways to the business logic and analytics level. Robust yet efficient security measures play an essential role in this interaction. However, the complexity of securely connecting different building blocks of a distributed, multi-layered systems is considerable. Security methodologies are often applied at a late stage of system development, posing problems such as inappropriate security levels, performance issues, and longer time-to-market cycles. Addressing possible security properties already in the design phase of a security-critical system helps to mitigate these problems. In this paper, we discuss a distributed, multi-layered IoT data collection system that enables data aggregation and exchange from the embedded level up to different cloud instances while supporting end-to-end secured communication. The system was designed in the course of a case study where we used a design-space-exploration tool for identifying secure processes in regard to key management and distribution. Based on our analysis results, a distributed proof of concept was developed. Subsequently, the most critical processes of the individual layers were evaluated regarding security and execution speed.

Detecting cyber attacks in large computer networks is crucial for many organizations. To that purpose, different types of detectors capture the important signals resembling a security attack from individual computers and bring that to the attention of a security analyst. Unfortunately, the analyst sometimes has no indications about why the particular computer was identified as being "under attack". In addition, the analyst may have no method to provide feedback to the detector if the computer was actually identified for some benign reason. In this paper, we use a state-of-the-art anomaly detector called an Isolation Forest [1] for attack detection and generate explanations about why the detector identified certain computers as anomalous. These explanations allow the analyst to direct their investigation in order to save time. We then take the feedback from the analyst in the form of true and false positives and update the anomaly detector to capture signals that align better with the given feedback. Our experiments on actual network data show that the explanations give more insight into the detections, and the analyst's feedback increases the attack detection rate.

The Catabolite Activator Protein (CAP) is a showcase example for entropic allostery. For full activation and DNA binding, the homodimeric protein requires the binding of two cyclic AMP (cAMP) molecules in an anti-cooperative manner, the source of which appears to be largely of entropic nature according to previous experimental studies. We here study at atomic detail the allosteric regulation of CAP with Molecular dynamics (MD) simulations. We recover the experimentally observed entropic penalty for the second cAMP binding event with our recently developed force covariance entropy estimator and reveal allosteric communication pathways with Force Distribution Analyses (FDA). Our observations show that CAP binding results in characteristic changes in the interaction pathways connecting the two cAMP allosteric binding sites with each other, as well as with the DNA binding domains. We identified crucial relays in the mostly symmetric allosteric activation network, and suggest point mutants to test this mechanism. Our study suggests inter-residue forces, as opposed to coordinates, as a highly sensitive measure for structural adaptations that, even though minute, can very effectively propagate allosteric signals.

3-Phosphogycerate kinase (PGK) is a two domain enzyme, which transfers a phosphate group between its two substrates, 1,3-bisphosphoglycerate bound to the N-domain and ADP bound to the C-domain. Indispensable for the phosphoryl transfer reaction is a large conformational change from an inactive open to an active closed conformation via a hinge motion that should bring substrates into close proximity. The allosteric pathway resulting in the active closed conformation has only been partially uncovered. Using Molecular Dynamics simulations combined with Force Distribution Analysis (FDA), we describe an allosteric pathway, which connects the substrate binding sites to the interdomain hinge region. Glu192 of alpha-helix 7 and Gly394 of loop L14 act as hinge points, at which these two secondary structure elements straighten, thereby moving the substrate-binding domains towards each other. The long-range allosteric pathway regulating hPGK catalytic activity, which is partially validated and can be further tested by mutagenesis, highlights the virtue of monitoring internal forces to reveal signal propagation, even if only minor conformational distortions, such as helix bending, initiate the large functional rearrangement of the macromolecule.

In this paper, we propose an image-based detection method to identify web-based scareware attacks that is robust to evasion techniques. We evaluate the method on a large-scale data set that resulted in an equal error rate of 0.018%. Conceptually, false positives may occur when a visual element, such as a red shield, is embedded in a benign page. We suggest including additional orthogonal features or employing graders to mitigate this risk. A novel visualization technique is presented demonstrating the acquired classifier knowledge on a classified screenshot.

JavaScript-based malware attacks have increased in recent years and currently represent a signicant threat to the use of desktop computers, smartphones, and tablets. While static and runtime methods for malware detection have been proposed in the literature, both on the client side, for just-in-time in-browser detection, as well as offline, crawler-based malware discovery, these approaches encounter the same fundamental limitation. Web-based malware tends to be environment-specific, targeting a particular browser, often attacking specic versions of installed plugins. This targeting occurs because the malware exploits vulnerabilities in specific plugins and fails otherwise. As a result, a fundamental limitation for detecting a piece of malware is that malware is triggered infrequently, only showing itself when the right environment is present. We observe that, using fingerprinting techniques that capture and exploit unique properties of browser configurations, almost all existing malware can be made virtually impssible for malware scanners to detect. This paper proposes Rozzle, a JavaScript multi-execution virtual machine, as a way to explore multiple execution paths within a single execution so that environment-specific malware will reveal itself. Using large-scale experiments, we show that Rozzle increases the detection rate for offline runtime detection by almost seven times. In addition, Rozzle triples the effectiveness of online runtime detection. We show that Rozzle incurs virtually no runtime overhead and allows us to replace multiple VMs running different browser configurations with a single Rozzle-enabled browser, reducing the hardware requirements, network bandwidth, and power consumption.

A drive-by download attack occurs when a user visits a webpage which attempts to automatically download malware without the user's consent. Attackers sometimes use a malware distribution network (MDN) to manage a large number of malicious webpages, exploits, and malware executables. In this paper, we provide a new method to determine these MDNs from the secondary URLs and redirect chains recorded by a high-interaction client honeypot. In addition, we propose a novel drive-by download detection method. Instead of depending on the malicious content used by previous methods, our algorithm first identifies and then leverages the URLs of the MDN's central servers, where a central server is a common server shared by a large percentage of the drive-by download attacks in the same MDN. A set of regular expression-based signatures are then generated based on the URLs of each central server. This method allows additional malicious webpages to be identified which launched but failed to execute a successful drive-by download attack. The new drive-by detection system named ARROW has been implemented, and we provide a large-scale evaluation on the output of a production drive-by detection system. The experimental results demonstrate the effectiveness of our method, where the detection coverage has been boosted by 96% with an extremely low false positive rate.

BACKGROUND: The way mechanical stress is distributed inside and propagated by proteins and other biopolymers largely defines their function. Yet, determining the network of interactions propagating internal strain remains a challenge for both, experiment and theory. Based on molecular dynamics simulations, we developed force distribution analysis (FDA), a method that allows visualizing strain propagation in macromolecules. RESULTS: To be immediately applicable to a wide range of systems, FDA was implemented as an extension to Gromacs, a commonly used package for molecular simulations. The FDA code comes with an easy-to-use command line interface and can directly be applied to every system built using Gromacs. We provide an additional R-package providing functions for advanced statistical analysis and presentation of the FDA data. CONCLUSIONS: Using FDA, we were able to explain the origin of mechanical robustness in immunoglobulin domains and silk fibers. By elucidating propagation of internal strain upon ligand binding, we previously also successfully revealed the functionality of a stiff allosteric protein. FDA thus has the potential to be a valuable tool in the investigation and rational design of mechanical properties in proteins and nano-materials.

Identifying websites hosting malicious code is a priority for helping protect consumers using the web and for the collection of malicious code for analysis by malware researchers. We have been running an InternetNZ sponsored study where homepages of almost all New Zealand Web servers are scanned on a regular basis by a set of client honeypots. This paper reflects upon our experience of running moderate scale scans over a period of several months manually and identifies some requirements for automation of such a system using workflow and related middleware.

Malicious Web pages that launch drive-by-download attacks on Web browsers have increasingly become a problem in recent years. High-interaction client honeypots are security devices that can detect these malicious Web pages on a network. However, high-interaction client honeypots are both resource-intensive and unable to handle the increasing array of vulnerable clients. This paper presents a novel classification method for detecting malicious Web pages that involves inspecting the underlying server relationships. Because of the unique structure of malicious front-end Web pages and centralized exploit servers, merely counting the number of domain name extensions and Domain Name System (DNS) servers used to resolve the host names of all Web servers involved in rendering a page is sufficient to determine whether a Web page is malicious or benign, independent of the vulnerable Web browser targeted by these pages. Combining high-interaction client honeypots and this new classification method into a hybrid system leads to performance improvements.

This paper introduces the Grid Enabled Internet Instrument concept and discusses instruments that are being developed at Victoria University to measure Internet quality. The first instrument is a Grid version of the network telescope for studying Internet Background Radiation (IBR) and the second is a hybrid client honeypot system using high and low interaction devices for scanning the web for malicious content and servers. A third instrument on VOIP quality has been approached through simulation. The GEII framework is a work in progress and the initial design is introduced in this paper as the basis of a new Grid of Internet sensors that could be deployed to improve Internet measurement and gain a global insight to Internet quality.