The Internet of Things (IoT) in the world is drastically increasing to make environments more efficient, user-friendly, and automated. However, cyberattacks on these IoT devices continue to be a significant t hreat. I n t his a rticle, w e p ropose a novel Artificial Intelligence (AI)-based middleware and model for middleware to detect attacks in versatile Smart Environments. To assess the applicability of the proposed method, we designed four-step process for data-driven multi-agent malware and attack detection. The first s tep c orresponds w ith t he a ggregation of multi-level network traffic d ata f rom s everal I oT d evices s uch as Arduino, Rasberry Pi, NVIDIA Jetson devices, etc. In the second phase, different AI and Deep Learning models are applied for multi-level malware and attack classifications, a nd t he efficiency of the off-chip inferred AI model is evaluated with a motive to reduce the overhead and latency of the IoT components. In the third step, we deploy the different versions of the inferred model on our heterogeneous local smart environments. Finally, as the fourth step, the performance and concurrency testing in terms of electrical power, network bandwidth, and memory usage by the model is measured to check how efficient the Artificial Intelligence method is towards IoT cybersecurity for smart environments. The experimental results on the heterogeneous IoT malware and attack datasets inspected in this study suggest AI can be used as an effective tool to prevent the smart environment from cybersecurity threats.

Smart Environments contribute towards better, user-friendly and automated environments; however, often lacking means of implementation of necessary cybersecurity measures capable of handling adversarial actions. In this paper we will introduce the anticipated cyber threats and corresponding ambition of the ENViSEC project that is aimed at enhancing the Smart Environments cybersecurity by introducing intelligent multi-agent data handling and cyber threats sharing. The potential of the project is to introduce situational awareness and data streams from Internet of Things ecosystem to offer a resilient response to cyber-attacks. This will ensure human-oriented awareness and early detection of cybercrimes in the era of Big Data. The new approach will include multi-level data aggregation and off-chip Machine Learning model training to reduce the overhead and latency of the IoT components yet guarantee the necessary level of hardening cybersecurity in a cross-sector context.

Connectivity as a whole and the Internet of Things (IoT) has influenced a great many things in the past decade. Among those, the most prominent is our daily life routines, which have increasingly started to depend on technology. A Smart Home, being a central part, has gained more importance from a forensic perspective since it affects many lives and can be an easy target for cybercrimes. In this work in progress paper, we explore the feasibility of conducting forensic analysis on different Smart Plugs and what sort of challenges are encountered in such a forensic investigation. We also review current related work for forensic analysis of Smart Plugs.

Last decade can be characterized by the rapid integration of smart applications and digitization of all aspects of our life. Cheap, portable and easy to deploy hardware and software components lead to the integration of tiniest Internet of Things (IoT) components in almost every digital household product that is currently on the market. Bringing data processing to the Edge and moving operations into the Cloud, companies try to operationalize novel utilization of IoT. Given altruistic goals to improve quality of life, reduce the amount of manual labour and provide more sustainable technologies, such smart solutions became an increasingly attractive target for adversarial actors. Attack scenarios that were considered as highly unlikely 10 years ago have been implemented and demonstrated on several occasions, including Mirai botnet. Distributed computations, variety of legal standards, cross-border data sharing brings novel obstacles in cybercrime investigation. However, it does not mean that the data and pieces of digital evidence from the IoT ecosystem cannot improve the pro-active response of law enforcement agencies. This paper addresses issues and discusses opportunities of IoT technology to enhance public safety and security in the long run.

Android malware has become the topmost threat for ubiquitous and useful Android eco-system. Multiple solutions leveraging big data and machine learning capabilities to detect android malware are being constantly developed. Too often, many of these solutions are either limited to the research output or remain isolated and unable to reach to end-users or malware researchers. In this paper, we propose, PACE, a unified solution to offer open and easy implementation access to several machine learning-based Android malware detection techniques that make most of the research in this domain reproducible. The benefits of PACE are offered using three interfaces i.e. through REST API, Web Interface and ADB interface. Multiple interfaces enable users with different expertise such as IT administrator, security practitioners, malware researcher, etc. to avail its offered services. A community-accepted dataset is used for testing of all the techniques to provide a better comparison of performance. A prototype of the proposed platform is introduced and our vision is that it will help malware analysts to tackle challenges and reduce the amount of manual work.

The omnipresence of smart devices in many aspects of modern everyday life has helped to achieve an enormous level of automation, has ensured sustainable development, and improved quality of life. Over the last decade, such small and portable devices became cheap and easy to deploy in any kind of application. With the full range of versatile connectivity, such technological development also brings multiple challenges related to the security of infrastructure and data. Many individuals, companies, and states worldwide experience the previously unseen scale and scope of the attacks using novel approaches. All these smart applications have also increased the overall attack surface leading to multiple attack vectors available through vulnerabilities. Lack of standards, insufficient security awareness, and new technological landscape does not help either. Considering this, one needs to enhance forensics investigation methodologies, employ novel tools, combine threat intelligence, and integrate forensic readiness. Such measures will help to reduce the total cyber risk through a high level of preparedness for anticipated data-driven crimes in smart applications. We believe that this paper will help in bringing novel focus to existing digital forensics methodologies with a focus on smart applications.

Power systems domain has generally been very conservative in terms of conducting digital forensic investigations, especially so since the advent of smart grids. This lack of research due to a multitude of challenges has resulted in absence of knowledge base and resources to facilitate such an investigation. Digitalization in the form of smart grids is upon us but in case of cyber-attacks, attribution to such attacks is challenging and difficult if not impossible. In this research, we have identified digital forensic artifacts resulting from a cyber-attack on Wide Area Monitoring, Protection and Control (WAMPAC) systems, which will help an investigator attribute an attack using the identified evidences. The research also shows the usage of sandboxing for digital forensics along with hardware-in-the-loop (HIL) setup. This is first of its kind effort to identify and acquire all the digital forensic evidences for WAMPAC systems which will ultimately help in building a body of knowledge and taxonomy for power system forensics.

Smart grid improves and revolutionizes the way how energy is generated, distributed and consumed. Despite utilization of such technologies for better life of end-users and communities, there might be outlier events happening that will introduce disturbance to the smart grids. To mitigate impact from such events in power grid, particularly in Wide Area Monitoring Protection and Control (WAMPAC) has been introduced for mitigation and prevention of large disruption and extreme events. Large network of interconnected devices is being monitored through WAMPAC sub-system to avoid major events with negative impact through analysis of system-wide contextual information. The assessment of the state is being made based on the data from Phasor Measurement Unit (PMUs) collected and processed in the Phasor Data Concentrator (PDC). There is an enormous amount of Machine-to-Machine (M2M) communication that the system has to analyze. However, blackout prediction and mitigation is done using measurements data and does not necessarily focus on more high level adversarial events. This paper proposes an ongoing research into timely detection of adversarial attack on the power grid. During the experimental phase, authentication attack scenario was successfully executed on power substation setup. Further, framework for intelligent identification of digital evidences related to attack was suggested unveiling possibility for crime investigations preparedness.

The amount of data seized in Crime Investigations has increased enormously. Investigators are more than ever confronted with vast amount of heterogeneous data, highly-diverse data formats, increased complexity in distributed stored information. With constantly increasing network bandwidth it makes extremely challenging to process or even store part of the network traffic. Nevertheless, criminal investigations need to solve crimes in a timely manners. New computational methods, infrastructure and algorithmic approaches are required. Although Big Data is a challenge for criminal investigators, it can also help them make to source an detect patterns to prevent and solve crimes. This paper aims to raise attention to current challenges in Cyber Crime Investigations - related to Big Data - and possible ways to approach combating cybercrimes.

Neuro-Fuzzy has been successfully applied in the malware detection from before. It gives flexibility in building an effective and human understandable rule-based detection model. Fuzzy variables consist of linguistic terms that are constructed based on the characteristics of the corresponding numerical features. This gives a level of abstraction that allows controlling the distribution drift and maintaining the appropriate performance when the number of terms is fixed. At this point the challenge can be seen when it comes to inclusion of a new term in a fuzzy set. Originally, this leads to a need of Neuro-Fuzzy model retraining. However, in case of Big Data retraining of the whole model may require enormous resources. In this paper we concentrate on mitigation of the retraining by means dynamic fusion of terms in fuzzy sets and corresponding rules selection. The algorithm Dynamically-Expanded Neuro-Fuzzy (DENF) was proposed to facilitate the different area of Information security such that pro-active malware detection or Intrusion Detection, where the properties of investigated data may change unpredictably.