In smart power grids, electricity theft causes huge economic losses to electrical utility companies. Machine learning (ML), especially deep neural network (DNN) models hold state-of-the-art performance in detecting electricity theft cyberattacks. However, DNN models are vulnerable to adversarial attacks, i.e., evasion attacks. In this work, we study the vulnerability of the DNN-based electricity theft detectors against evasion attacks and the influence of the model's regularization (generalization) on robustness. We cluster the power consumers and train a detector for each cluster, and compare the performance and robustness of this detector to a global detector that is trained on all the consumers, data. The results indicate that the cluster-based detector is not only more robust against evasion attacks but also enhances normal classification accuracy because its training data has more consumption pattern similarity compared to the training data of the global detector which requires higher level of regularization. Moreover, unlike the existing solutions that sacrifice the normal accuracy of the model to improve the robustness against evasion attacks, the proposed cluster-based detector holds state-of-the-art performance in both robustness and accuracy.

In the ever-evolving landscape of real-time usage, there is a constant pursuit of advancements in infrastructures and technologies to meet the growing demand for network accessibility across a wide range of services. In this context, the advent of 5G technology has brought about transformative changes in the realm of networking. 5G, the fifth generation of wireless communication technology, offers unprecedented speed, low latency, and massive connectivity. It has become a critical enabler for applications ranging from autonomous vehicles to the Internet of Things (IoT). The integration of 5G into the networking infrastructure introduces new dimensions to the challenges and opportunities associated with hypercube routing. One significant area of interest in this regard is the implementation of hypercube routing, which poses notable challenges. Researchers and professionals are actively exploring various methods and techniques to achieve precise computations within optimal time limits. This paper specifically focuses on a fundamental concept: the use of hypercubes in networking and their application as a routing solution. Additionally, the paper aims to investigate existing proposals and techniques that are relevant to addressing concerns like fault-tolerant routing. Furthermore, the paper introduces a novel scheme for routing in hypercube networks, incorporating a multicluster node, thereby presenting an innovative approach to tackle these challenges within the 5G ecosystem. Taking advantage of 5G capabilities, this scheme could potentially improve the efficiency and fault tolerance of hypercube routing in modern network infrastructures.

The current trends toward the design and deployment of smart city services, including water services, improve quality, reliability and reduce operational costs. These advancements have led to the proliferation of ubiquitous connectivity to critical infrastructures. However, although smart sensors and Industrial Internet of Things (IIoTs) expedites rigorous monitoring and control, they exponentially increase vulnerabilities that can be exploited by cyberattacks. Therefore, development of advanced cybersecurity tools and resilience methods for smart city services are critically important because compromising these services can lead to disasters, accidents or even loss of life. To address the cybersecurity challenges facing smart city services, researchers need realistic testbeds to perform experiments, collect real-time data, and evaluate different security algorithms to protect smart critical infrastructure services. This paper presents a Water Treatment Facility Testbed (WTFT), a Cyber-Physical System (CPS) developed to enable experimentation with cybersecurity and resilient algorithms to deliver smart water services that can tolerate cyberattacks. Furthermore, an anomaly-based detection unit for water quality is implemented and our experimental results show a 96.8% F1-score, and a 98.3% accuracy with an attack detection latency under two seconds.

Today’s cellular networks (known as 2G, 3G, and 4G) provide a solid foundation for connecting things. The Internet of Things (IoT) is helping people live and work smarter and take full control of their lives. In addition to providing smart devices for home automation, IoT is also critical for businesses. The security of classical cryptosystems is characterized by their simple arithmetic complexity. This type uses; shifts, arrangements, permutations, and substitutions of letters, words, or phrases to encrypt a given message. Moreover, this kind of cryptosystem is easy to break, because the complexity of their scheme is convergent. On the other hand, the security of modern cryptosystems is characterized by complex arithmetic, using the concept of keys; private keys to encrypt and public keys to decrypt. This type is hard to break because of the complexity of their scheme being divergent. This paper aims to secure the 5G networks with a new variant of the classical Polybius Checkerboard Cipher (HPCC). The system of letter substitution is based on the complexity and the divergence of private key generation. Filling a magic square with primes is an NP-hard task, which shows the complexity and divergence of the strategy adopted in this variant.

Over the last decade, the demand for greater security in 5G networks has grown significantly. Ensuring data security during transmission against external attacks has become a critical priority. However, existing security systems, which focus on attack identification, face limitations in terms of both security and performance. This requires the implementation of more rigorous measures. Meeting the need for improved security in 5G networks calls for advanced machine learning techniques. To tackle this challenge, a proposed hybrid mechanism employs various machine learning approaches to effectively classify threats, such as denial of service, detection denial, and resource misuse. The incorporation of the DET model improves the accuracy of decision making and improves attack classification for 5G networks. Key accuracy parameters, including recall, precision, and F-score, play a crucial role in ensuring the model’s reliability. Simulation results demonstrate the superiority of the proposed model compared to others, particularly in terms of accuracy. Our approach presents a promising solution for identifying and categorizing attacks in 5G networks. By prioritizing accuracy and providing superior performance, this research significantly contributes to ongoing efforts to improve 5G network security.

5G networks are highly distributed, built on an open service-based architecture that requires multi-vendor hardware and software development environments, all of which create a high attack surface in the 5G networks than other proprietary fixed-function networks. Besides that, cloud-native architectures also present new security challenges. Cloud-native separates monolithic virtual machines into microservice pods, resulting in higher volumes of signaling and communication flowing through and between microservices. In addition, secure connections in monolithic applications have been replaced by untrusted communication between microservice pods, requiring additional cybersecurity capabilities. Access control systems were created to provide reliability and limit access to an organization’s assets. However, due to technology's constant evolution and dynamicity, these conventional security systems lack the security to protect an organization’s information because they were created to address access control for known users. For 5G based cloud native technology, these access controls need to be taken further by implementing a Zero Trust model to secure one’s essential assets for all users within the system. Zero Trust is implemented in an access control system under the concept "Never Trust, Always Verify". In this paper, we implement zero trust as a factor within access control systems by combining the principles of access control systems and zero-trust security by factoring in the user’s historical behavior and recommendations into the mix.

The use of Unmanned Aerial Vehicles (UAVs) for collecting data from remotely located sensor systems is emerging. The data can be time-sensitive and require to be transmitted to a data processing center. However, planning the trajectory for a swarm of UAVs depends on multi-fold constraints, such as data collection requirements, UAV maneuvering capacities, and budget limitations. Since a UAV may fail or be compromised, it is important to provide necessary resilience to such contingencies, thus ensuring data security. It is important to provide the UAVs with efficient spatio-temporal trajectories so that they can efficiently cover necessary data sources. In this work, we present Synth4UAV, a formal approach for automated synthesis of efficient trajectories for a UAV swarm by logically modeling the aerial space and data point topology, UAV moves, and associated constraints in terms of the turning and climbing angle, fuel usage, data collection point coverage, data freshness, and resiliency properties. We use efficient, logical formulas to encode and solve the complex model. The solution to the model provides the routing and maneuvering plan for each UAV, including the time to visit the points on the paths and corresponding fuel usage such that the necessary data points are visited while satisfying the resiliency requirements. We evaluate the proposed trajectory synthesizer, and the results show that the relationship among different parameters follows the requirements while the tool scales well with the problem size.

With the development of the smart systems such as smart city, smart buildings, smart industries, the need for a highly reliable, scalable, and secure communications using high-data-rate and low latency networks such as 6G networks is increased. The artificial intelligence and machine learning (AI/ML) will be pervasive and of key relevance across the security technology stack and architecture in the 6G networks. Despite the advantages of the 6G networks, sophisticated cyberattacks can disrupt the operation of 6G critical infrastructures and associated services. In this paper, we present a novel methodology to create a federated cyber testbed as a service (FCTaaS) that can be offered as a ubiquitous cloud service. Due to the widespread usage of Machine Learning (ML) in critical decision processes of 5G/6G resource management and their applications, there is an exponential growth in cyberattacks to maliciously manipulate the ML algorithms and consequently influence their decision process in favor of the attackers. Currently, there are many isolated cyber testbeds; however, little research has focused on methods to automatically build a federated cyber testbed in general and especially in 6G testbeds. In this paper, we show how to use the FCTaaS services can be used to seamlessly compose a federated cyber testbed that allows researchers to experiment with and evaluate different algorithms to implement different algorithms to conduct data analytics, cybersecurity, and resilient algorithms. In particular, we will show how the FCTaaS can be used to develop highly efficient and accurate federated learning algorithms that can tolerate a wide range of attacks against ML algorithms such as data poisoning and ML model attacks.

The 5G technology will play a crucial role in global economic growth through numerous industrial developments. However, it is essential to ensure the security of these developed systems, while 5G brings unique security challenges. This paper contributes explicitly to the need for an effective Vulnerability Assessment Approach (VAA) to identify and assess the vulnerabilities in 5G networks in an accurate, salable, and dynamic way. The proposed approach develops an optimized mechanism based on the Technique for Order Preference by Similarity to an Ideal Solution (TOPSIS) to analyze the vulnerabilities in 5G Edge networks from the attacker perspective while considering the dynamic and scalable Edge properties. Furthermore, we introduce a cloud-based 5G Edge security testbed to test and evaluate the accuracy, scalability, and performance of the proposed VAA.

Modern building control systems adopt demand control heating, ventilation, and cooling (HVAC) for increased energy efficiency. The integration of the Internet of Things (IoT) in the building control system can determine real-time demand, which has made the buildings smarter, reliable, and efficient. As occupants in a building are the main source of continuous heat and CO2 generation, estimating the accurate number of people in real-time using building IoT (BIoT) system facilities is essential for optimal energy consumption and occupants' comfort. However, the incorporation of less secured IoT sensor nodes and open communication network in the building control system eventually increases the number of vulnerable points to be compromised. Exploiting these vulnerabilities, attackers can manipulate the controller with false sensor measurements and disrupt the system's consistency. The attackers with the knowledge of overall system topology and control logics can launch attacks without alarming the system. This paper proposes a building internet of things analyzer (BIoTA) framework1that assesses the smart building HVAC control system's security using formal attack modeling. We evaluate the proposed attack analyzer's effectiveness on the commercial occupancy dataset (COD) and the KTH live-in lab dataset. To the best of our knowledge, this is the first research attempt to formally model a BIoT-based HVAC control system and perform an attack analysis.

Despite the important benefits that cloud computing could offer, security remains one of the major concern that is hindering the development of this paradigm. Masquerades attacks and malicious insiders are often listed among the most dangerous challenges faced by cloud computing. The detection of masquerade attacks in cloud systems has to integrate host and network detection by correlating the user's behaviours in several virtual machines. The author has introduced two approaches that use sequences of events from the operating system and data from the network environment. Then, he integrated these approaches through a neural network that also considers information about the active session. Both approaches use his DDSGA method, a data‐driven semi‐global alignment approach for detecting masquerade attacks based on the alignment technique. He evaluated the efficiency and accuracy of the approaches through the Cloud Intrusion Detection Dataset. He also shows that the integrated approach results in the best accuracy and the proposed approaches outperform a recent masquerade detection framework that works in the cloud computing systems called the Sliding Window‐based Anomaly Detection using Maximum Mean Discrepancy.

The Cypher Physical Power Systems (CPPS) became vital targets for intruders because of the large volume of high speed heterogeneous data provided from the Wide Area Measurement Systems (WAMS). The Nonnested Generalized Exemplars (NNGE) algorithm is one of the most accurate classification techniques that can work with such data of CPPS. However, NNGE algorithm tends to produce rules that test a large number of input features. This poses some problems for the large volume data and hinders the scalability of any detection system. In this paper, we introduce VHDRA, a Vertical and Horizontal Data Reduction Approach, to improve the classification accuracy and speed of the NNGE algorithm and reduce the computational resource consumption. VHDRA provides the following functionalities: (1) it vertically reduces the dataset features by selecting the most significant features and by reducing the NNGE’s hyperrectangles. (2) It horizontally reduces the size of data while preserving original key events and patterns within the datasets using an approach called STEM, State Tracking and Extraction Method. The experiments show that the overall performance of VHDRA using both the vertical and the horizontal reduction reduces the NNGE hyperrectangles by 29.06%, 37.34%, and 26.76% and improves the accuracy of the NNGE by 8.57%, 4.19%, and 3.78% using the Multi-, Binary, and Triple class datasets, respectively.

Property-graphs are becoming popular for Intrusion Detection Systems (IDSs) because they allow to leverage distributed graph processing platforms in order to identify malicious network traffic patterns. However, a benchmark for studying their performance when operating on big data has not yet been reported. In general, benchmarking a system involves the execution of workloads on datasets, where both of them must be representative of the application of interest. However, few datasets containing real network traffic are openly available due to privacy concerns, which in turn could limit the scope and results of the benchmark. In this work, we build two synthetic data generators for benchmarking next generation IDSs by introducing the support for property-graphs in two well-known graph generation algorithms: Barabási-Albert and Kronecker. We run an extensive experimental evaluation using a publicly available dataset as seed for the data generation, and we show that the proposed approach is able to generate synthetic datasets with high veracity, while also exhibiting linear performance scalability.

The prediction of cloud consumer resource needs is a vital step for several cloud deployment applications such as capacity planning, workload management, and dynamic allocation of cloud resources. In this paper, we develop a new prediction model for predicting cloud consumer resource needs. The new model uses a new hybrid prediction approach that combines the Multiple Support Vector Regression (MSVR) model and the Autoregressive Integrated Moving Average (ARIMA) model to predict with higher accuracy the resource needs of a cloud consumer in terms of CPU, memory, and disk storage utilization. The new model is also able to predict the response time and throughput which in turn enable the cloud consumers to make a better scaling decision. The new model elucidated a better prediction accuracy than the current prediction models. In terms of CPU utilization prediction, it outperforms the accuracy of the existing cloud consumer prediction models that uses Linear Regression, Neural Network, and Support Vector Machines approaches by 72.66%, 44.24%, and 56.78% respectively according to MAPE and 56.95%, 80.42%, and 63.86% according to RMSE. The analysis, architecture, and experiment results of the new model are discussed in details in this paper.

Security is an important element in Cloud computing. Intruders may exploit clouds for their advantage. This paper presents a cost-aware model for risk mitigation in cloud computing systems. The proposed model is integrated with our Autonomous Cloud Intrusion detection Framework, ACIDF, which continuously monitors and analyzes system events and computes security and risk parameters to provide risk assessment capabilities with a scalable and elastic architecture. The proposed model helps ACIDF to select the appropriate response to mitigate the detected attacks by considering the costs of deploying a response and the costs of damage caused by a non-responded attack. The proposed model reduces the risk by 18.9%. This paper describes the proposed model functions and advantages.

A masquerade attacker impersonates a legal user to utilize the user services and privileges. The semi-global alignment algorithm (SGA) is one of the most effective and efficient techniques to detect these attacks but it has not reached yet the accuracy and performance required by large scale, multiuser systems. To improve both the effectiveness and the performances of this algorithm, we propose the Data-Driven Semi-Global Alignment, DDSGA approach. From the security effectiveness view point, DDSGA improves the scoring systems by adopting distinct alignment parameters for each user. Furthermore, it tolerates small mutations in user command sequences by allowing small changes in the low-level representation of the commands functionality. It also adapts to changes in the user behaviour by updating the signature of a user according to its current behaviour. To optimize the runtime overhead, DDSGA minimizes the alignment overhead and parallelizes the detection and the update. After describing the DDSGA phases, we present the experimental results that show that DDSGA achieves a high hit ratio of 88.4 percent with a low false positive rate of 1.7 percent. It improves the hit ratio of the enhanced SGA by about 21.9 percent and reduces Maxion-Townsend cost by 22.5 percent. Hence, DDSGA results in improving both the hit ratio and false positive rates with an acceptable computational overhead.

The extensive use of virtualization in implementing cloud infrastructure brings unrivaled security concerns for cloud tenants or customers and introduces an additional layer that itself must be completely configured and secured. Intruders can exploit the large amount of cloud resources for their attacks. Most of the current security technologies do not provide the essential security features for cloud systems such as early warnings about future ongoing attacks, autonomic prevention actions, and risk measure. This paper discusses the integration of these three features to our Autonomic Cloud Intrusion Detection Framework (ACIDF). The early warnings are signaled through a new finite State Hidden Markov prediction model that captures the interaction between the attackers and cloud assets. The risk assessment model measures the potential impact of a threat on assets given its occurrence probability. The estimated risk of each security alert is updated dynamically as the alert is correlated to prior ones. This enables the adaptive risk metric to evaluate the cloud's overall security state. The prediction system raises early warnings about potential attacks to the autonomic component, controller. Thus, the controller can take proactive corrective actions before the attacks pose a serious security risk to the system. According to our experiments, both risk metric and prediction model have successfully signaled early warning alerts 39.6 minutes before the launching of the LLDDoS1.0 attack. This gives the system administrator or an autonomic controller ample time to take preventive measures.

Cloud computing significantly increased the security threats because intruders can exploit the large amount of cloud resources for their attacks. However, most of the current security technologies do not provide early warnings about such attacks. This paper presents a Finite State Hidden Markov prediction model that uses an adaptive risk approach to predict multi-staged cloud attacks. The risk model measures the potential impact of a threat on assets given its occurrence probability. The attacks prediction model was integrated with our autonomous cloud intrusion detection framework (ACIDF) to raise early warnings about attacks to the controller so it can take proactive corrective actions before the attacks pose a serious security risk to the system. According to our experiments on DARPA 2000 dataset, the proposed prediction model has successfully fired the early warning alerts 39.6 minutes before the launching of the LLDDoS1.0 attack. This gives the auto response controller ample time to take preventive measures.

Security problems arise in software systems are very challenging. Using program analysis techniques and some language based security rules can help in enforcing application-level security through control access to program resources and verification of control flow of the information inside the program based on some security properties. This paper presents a new job analyzer component for an intrusion detection system which works inside our developed computational grid system called “HIMAN” to analyze access required by a certain submitted task to the grid resources. This paper consists of three parts. First part is a survey for the previous work for access control, information flow security analyses, and the stack inspection methodology. Second part is a representation for a static analysis study for enhancing the stack inspection methodology in order to optimize the program complexity. Finally, the third part explains how to use the access control flow analysis based on the enhanced stack inspection methodology described in this paper to develop the new job analyzer component.

Word Alignment is an important supporting task for different NLP applications like training of machine translation systems, translation lexicon induction, word sense discovery, word sense disambiguation, information extraction and the cross-lingual projection of linguistic information. In this paper we study the main rules and guidelines required to build an aligner tool for Arabic language which should help in correcting most of alignment errors. These errors are identified by considering the outputs of some already existing aligner annotation tools.

In most applications, security attributes are pretty difficult to meet but security becomes even a bigger challenge when talking about grid computing. Providing secure communication between elements of a computational grid, by encrypting data passes between them using enhanced encryption algorithms that do not affect the performance of the grid middleware completely comparable to the actual execution time. In this paper we will cover two points. First, accelerating RC4 encryption algorithm using our developed grid security scheme "ULTRA GRIDSEC" and our developed "HIMAN" middleware and show that RC4 was accelerated by about 873.52% comparable to that accelerated by "GRIDCRYPT" scheme that applied by "Alchemi" middleware developed by Melbourne University. Second, using the accelerated RC4 scheme to secure communication between elements of "HIMAN", the stream ciphering algorithms like RC4 are the most suitable encryption algorithms for applying inside "HIMAN" as we will show.