Cybersecurity in the space domain is becoming increasingly critical because of rising satellite attacks. In this paper, leveraging digital twin technology as a novel security measure that is tailored for the space domain is proposed. The architecture aims to address key challenges such as remote management, long-term operation, and resource limitations that are inherent to space environments. By using local security digital twins for multiple devices, the proposed framework facilitates remote attack detection, security management, and simulation, all while significantly reducing communication costs. The ultimate goal is to enable early attack detection and response, thereby ensuring long-term resilience and security in space operations.

This paper proposes an architecture that supports security measures by evaluating the impact of cyber attacks on physical spaces, utilizing information gathered from the neighborhoods of devices. The architecture includes digital twin (DT) models that represent the conditions of physical spaces in cyberspace and utilizes various types of information in both cyber and physical spaces, such as device location, speed, and vulnerability, for cyber-physical security measures. We summarize the challenges in translating security information into DT models and in implementing the overall architecture for security measurements.

The widespread use of the Internet of Things (IoT) devices introduces a novel security threat due to the many vulnerable devices connected to the Internet. One effective countermeasure against such threats involves detecting vulnerable IoT devices by identifying the models of connected IoT devices. Several studies have concentrated on model identification methods that utilize flow and communication data to identify IoT device models. With the advances in machine learning and deep learning, high identification accuracy has been reported under certain conditions. However, when implementing these research findings, selecting the most suitable model for the application is crucial. This selection process presents challenges in terms of reproducibility and applicability. The issue of reproducibility lies in the difficulty of implementing a model that accurately reproduces the methods outlined in the paper. The applicability issue arises when attempting to select the best method based solely on the experimental results described in the papers, as difference studies have conducted these experiments on different datasets across various papers. This study focused on IoT device model identification using flow data. We surveyed existing studies and selected a method with high reproducibility. Additionally, we conducted experiments to evaluate the accuracy of the selected methods using multiple datasets under uniform conditions for feature values and dataset usage. Consequently, we identified the optimal method in terms of both reproducibility and applicability within the scope of our study.

With the spread of Internet of Things (IoT) devices, countermeasures against cyber-attacks have become an issue. In this study, we focused on anomaly detection using flow data, which can reduce the data volume, and proposed a new anomaly detection method that combines a new graph composition method that represents a sequence of flow data as a graph and a graph neural network (GNN). Various detection methods, including deep learning, have been proposed for identifying malware such as denial-of-service (DoS) attacks, in which the characteristics of traffic deviate significantly from those of benign communications. We conducted an evaluation experiment with the proposed method using the KDDI-IoT-2019 dataset and discussed its effectiveness and limitations.

Millions of vulnerable consumer IoT devices in home networks are the enabler for cyber crimes putting user privacy and Internet security at risk. Internet service providers (ISPs) are best poised to mitigate risks by automatically inferring active IoT devices per household and notifying users of vulnerable ones. Developing a scalable inference method that can perform robustly across thousands of home networks is a nontrivial task. This article focuses on the challenges of developing and applying data-driven inference models when labeled data of device behaviors is limited and the distribution of data changes across time and space domains (concept drifts). Our contributions are fourfold: 1) we collect and analyze more than six million network traffic flows of 24 types of consumer IoT devices from 12 real homes over six weeks to highlight the challenge of temporal and spatial concept drifts in network behaviors of IoT devices—we publicly release our training and testing instances data; 2) we analyze the performance of two inference strategies, namely global inference (a model trained on a combined set of all labeled data from training homes) and contextualized inference (several models each trained on the labeled data from a training home) in the presence of concept drifts; 3) to manage concept drifts, we develop a method that dynamically applies the “best” model (from a set) to network traffic of unseen homes during the testing phase, yielding better performance in a fifth of scenarios when the labels are available for the testing data (ideal but unrealistic settings); and 4) we develop a method to automatically select the best model without needing labels of unseen data (a realistic inference) and show that it can achieve 94% of the ideal model’s accuracy.

With the widespread adoption of the Internet of Things (loT), a large number of diverse devices are now con-nected to the internet, and the number and variety of these devices are expected to increase in the future. Various manu-facturers have entered the consumer loT (home loT) market, and users can purchase a wide variety of devices such as smart speakers, network cameras, and home appliances. Some loT devices with security vulnerabilities have been reported, and the number of cyberattacks targeting loT devices is increasing, so the use of loT devices may involve security risks. One way to protect users and networks from such security risks to loT devices is to identify and manage loT devices connected to the network. This allows us to detect devices that pose a security risk. This research discusses development and evaluation of a method to estimate the models of loT devices connected to a home gateway using communication data sent from the devices. With regard to traffic data, IPFIX, a standard for flow information, is used for communication packets captured on the home gateway. By using IPFIX, the number of data records was reduced to approximately 11% compared to the number of traffic packets. Since IPFIX does not have information on the application layer in the TCP/IP model, the information available from IPFIX records is limited compared to traffic packets. Our method was evaluated using the traffic data of 25 different loT devices released by 19 vendors and obtained 98.48% precision.

To mitigate cyberattacks, detecting anomalies in network traffic is of key importance. In this paper, we propose a model training method for detection of Internet of Things (IoT) anomalous traffic that is robust against the contamination of anomalous samples in the training set. The key idea is to focus on the nature of IoT malware infections (i.e., only a limited number of IoT networks contain infected devices) and employ federated learning (FL) to mitigate the impact of anomalous samples on model training. The simulation evaluation using IoT traffic data obtained from residences and malware traffic data collected from sandbox experiments demonstrates that the proposed method does not cause accuracy degradation even when the anomalous samples are contaminated, in contrast with the detection accuracy of baseline methods, which does degrade.

As one of the scales which assess the end-user’s security behavior, the security behavior stage model (SeBeST) [1] is a practical approach to characterize similar groups of users (precontemplation, contemplation, preparation, action and maintenance stages) and provide customized remedies to improve their security behavior. For example, in OS update message customization, a group that does not update OS continuously may require a message indicating the ease of OS update; on the other hand, updating users need a message indicating the importance of OS update. In this paper, we propose a personalized OS update message interface based on SeBeST. We conduct two online surveys to evaluate effective appearance and message as the personalized user interface (UI). First, we assess the interface’s appearance individually for the three behavior stages (preparation, action, and maintenance) and then combine the customized messages and the selected impressions for these stages. We confirmed that appropriate appearances are different for each stage. For example, a highlighted red button is efficient for users in the preparation stage. On the other hand, the red background is suitable for users of the action and maintenance stages. We discovered that the combination of the message indicating the disadvantage of the OS update and the UI which is the highlighted red button is suitable for the preparation and action stages. In addition, we confirmed the best combination for users of the maintenance stage is a message indicating the ease of OS update and the UI which is mouse over pop-up representation. Therefore, it is necessary for each user to show the appropriate message and UI.

Secret sharing scheme has been applied commonly in distributed storage for Big Data. It is a method for protecting outsourced data against data leakage and for securing key management systems. The secret is distributed among a group of participants where each participant holds a share of the secret. The secret can be only reconstructed when a sufficient number of shares are reconstituted. Although many secret sharing schemes have been proposed, they are still inefficient in terms of share size, communication cost and storage cost; and also lack robustness in terms of exact-share repair. In this paper, for the first time, we propose a new secret sharing scheme based on Slepian-Wolf coding. Our scheme can achieve an optimal share size utilizing the simple binning idea of the coding. It also enhances the exact-share repair feature whereby the shares remain consistent even if they are corrupted. We show, through experiments, how our scheme can significantly reduce the communication and storage costs while still being able to support direct share repair leveraging lightweight exclusive-OR (XOR) operation for fast computation.

Many computer-security defenses are reactive---they operate only when security incidents take place, or immediately thereafter. Recent efforts have attempted to predict security incidents before they occur, to enable defenders to proactively protect their devices and networks. These efforts have primarily focused on long-term predictions. We propose a system that enables proactive defenses at the level of a single browsing session. By observing user behavior, it can predict whether they will be exposed to malicious content on the web seconds before the moment of exposure, thus opening a window of opportunity for proactive defenses. We evaluate our system using three months' worth of HTTP traffic generated by 20,645 users of a large cellular provider in 2017 and show that it can be helpful, even when only very low false positive rates are acceptable, and despite the difficulty of making "on-the-fly'' predictions. We also engage directly with the users through surveys asking them demographic and security-related questions, to evaluate the utility of self-reported data for predicting exposure to malicious content. We find that self-reported data can help forecast exposure risk over long periods of time. However, even on the long-term, self-reported data is not as crucial as behavioral measurements to accurately predict exposure.

Computer security tools usually provide universal solutions without taking user characteristics (origin, income level, ...) into account. In this paper, we test the validity of using such universal security defenses, with a particular focus on culture. We apply the previously proposed Security Behavior Intentions Scale (SeBIS) to 3,500 participants from seven countries. We first translate the scale into seven languages while preserving its reliability and structure validity. We then build a regression model to study which factors affect participants' security behavior. We find that participants from different countries exhibit different behavior. For instance, participants from Asian countries, and especially Japan, tend to exhibit less secure behavior. Surprisingly to us, we also find that actual knowledge influences user behavior much less than user self-confidence in their computer security knowledge. Stated differently, what people think they know affects their security behavior more than what they do know.

Despite the enactment of several privacy laws by the governments of several nations, achieving user privacy on the Internet has remained elusive, primarily due to the conflicting objectives of the stakeholders, i.e., users, web-based service providers, represented primarily by Internet Service Providers (ISPs) and governments. Internet usage data is still collected by ISPs and in certain jurisdictions is mandated by law, even with the inherent risk of possible data breaches that this brings. Data breaches have become very common nowadays and have affected several large renowned organizations and are likely to occur again in the future. To this end, it is not uncommon to find certain users resorting to the user of peer-to-peer anonymity services like Tor. According to Tor metrics, at least 2 million people use Tor on a daily basis. This number would probably be higher if more users were aware of online privacy risks and were tech-savvy enough to install it on their systems. Using services like Tor, however has its downside, primarily because its legitimate users are likely to be viewed suspiciously by law enforcement due to the abuse of the service by criminal elements. In this paper, we propose a web access protocol that guarantees basic user anonymity while trying to achieve a compromise on the conflicting objectives of the stakeholders. The protocol simultaneously provides anonymity to the user, allows the web usage data to be analyzed by interested parties (e.g., the ISP), and reduces the risk of abuse by criminal elements thereby allowing for flexibility in the enactment of laws that mandate collection of web usage information in support of law enforcement. The main techniques used in our protocol are: (i) the Onion Protocol, which is used to conceal web users' identities, (ii) the Secure Computation, which allows the parties (user and ISP) to jointly compute a common function while keeping those inputs private, (iii) and the Licensing and Digital Certificates, which ensure that only authorized web-content providers can provide content to users who want to be anonymous and that no one can impersonate the service providers licensed to provide services anonymously.

Oblivious RAM (ORAM) is a primitive for hiding storage access patterns in the context of software protection. With the trend of cloud computing, ORAM also has important applications in privacy-preserving cloud storage applications. Many ORAMs for cloud storage have been proposed to improve efficiency and security. However, data availability, data confidentiality, and data integrity have not been simultaneously addressed. In this paper, we formalize a new concept of ORAM called RORAM (Robust ORAM by enhancing availability, confidentiality and integrity), which can deal with these three challenges. Furthermore, RORAM not only can achieve a higher security level but also is more efficient compared with previous ORAMs by using linear network coding to reduce the client's computational cost of block encryption/decryption in every read/write operation in previous ORAMs. The security and complexity analyses show that RORAM is provably secure and highly lightweight.

Future Internet proposals have employed edge-directed routing to realize the benefits of path choice by the sources (e.g., end users). However, economic issues hamper the adoption by ISPs: 1) ISPs' costs increase when sources choose paths that are not economically optimal for ISPs, and 2) ISPs have to overprovision their links aggressively since traffic engineering is shifted to the users and congestion is more likely to occur. We implement a path-based dynamic pricing scheme that addresses these challenges. ISPs can dynamically adjust the prices of paths in order to compensate for potential losses incurred by users' choices and to incentivize users to switch paths in case of congestion. We describe our implementation in the context of future Internet architectures and demonstrate a mutually beneficial situation for ISPs and users.

We present XSWAT (Xen SoftWare ATtestation), a system that makes use of timing based software attestation to verify the integrity of cloud computing platforms. We believe that ours is the first instance of a system that uses this attestation technique in a cloud environment and results obtained indicate the feasibility of its deployment. An overview of the XSWAT system and the associated threat model, along with a study of cloud environment impacts on performance, is presented. Environmental parameters include types of interconnects between the XSWAT verifier and measurement agent as well as the number of concurrently executing virtual machines on the platform being verified. Conversely, we also study the impact of XSWAT execution using well known system benchmarks and find this to be insignificant, thereby strengthening the case for XSWAT. We also discuss novel XSWAT mechanisms for addressing TOCTOU attacks.

In this paper, we propose a new passive OS fingerprinting method which only requires DNS traffic analysis. The method utilizes characteristics on DNS queries specific to each OS, e.g. unique domain names, query patterns, time interval etc. The method can estimate the number of devices with each OS from the number of queries by utilizing the characteristics of the time interval patterns. The method considers the likelihood of irregular events that some queries are sent at less than regular time intervals, and some other queries are sent at more than regular time intervals. We analyze DNS traffic sent by each OS and extract the characteristics for OS fingerprinting. Then, we examine our estimation method by using DNS traffic in our intra-network. According to our examination, some results of our estimation method are close to the results of DHCP fingerprinting.

Seventy percent of smartphone applications employ third party libraries for advertisement and usage analysis. Because the host application and those third party libraries have to be packed into one application package, they share the same set of privileges. This worries users because of the concern that third party libraries might abuse the host application's privileges. This is not a desirable situation for application developers, either, because they are forced to add privileges for advertising libraries that are not necessary for their application, and users tend to avoid applications with sensitive privileges. Although advertising libraries are generally not welcomed by users, mobile advertisements play a key role in a mobile application eco-system that promotes the popularity of free applications. Therefore, we need a solution that will not hamper a mobile advertising agency service while addressing the concerns of users and developers. In this paper, we designed SanAdBox, a privilege separation framework for Android applications and a third party library that will not interfere with the behavior of third party libraries. In SanAdBox, each third party library is installed as an independent application so that it runs in a separate sandbox. In this way, the privileges of applications and libraries are strictly separated, solving the above-mentioned problems. Furthermore, because SanAdBox does not require modification of the Android operating system, we can install it on smartphones with the normal Android operating system.

Secure private networking over the Internet is difficult especially when trying to form a new network with private servers and hosts that belong to different administrative domains. Although such form of private network is useful as a closed group communication environment, simply applying existing VPN technologies is not sufficient. Not to mention common problems such as NAT and firewall traversal, potential collision of private IP addresses among networks makes their interconnection extremely difficult. In addition, access control inside the private network is required in order to prevent inappropriate access to other users' network resources. In this paper, we propose a public key-based rendezvous infrastructure and user-side VPN agents that can instantly interconnect multiple private networks while automatically mediating address collision and enforcing appropriate access control on cross domain communication by utilizing Zeroconf technologies. We built the rendezvous infrastructure using DHT technologies in order to achieve good scalability and implemented the VPN agent for Linux-based embedded devices so that users can run it on their residential gateway or wireless router.

Although there are variety of VPN products and software available today, it is still difficult for normal users to setup their own VPN server and configure their firewall and NAT so that they can allow remote access to their home network. In this paper, we propose a DHT-based L2VPN hosting infrastructure that allows millions of consumer users to easily create their own L2VPN server processes outside their home network, which can then bridge their home network and remote VPN clients. Because each L2VPN server acts like a virtual Ethernet switch, a user can use auto-configuration technologies like Zeroconf, which relies on layer-2 broadcast capability, among his or her networks and hosts bridged by the L2VPN server. This extends applicability of Zeroconf-like technologies from local are to wide area and greatly broaden their usefulness. A user can dynamically form a L2VPN with widely distributed hosts and use it as a secure plug & play networking platform for Zeroconf-enabled applications. We show that the proposed infrastructure can be easily implemented using an existing DHT technology while achieving great scalability and minimizing the operational cost of the infrastructure nodes.