Neural Networks (NNs) are not secure enough to be deployed on security-critical tasks such as Network Intrusion Detection Systems (NIDS). NNs are vulnerable to Adversarial Attacks (AAs), which affect their accuracy in identifying malicious activity, by introducing perturbations on network traffic. This work proposes "Adversarial Resistant Intrusion Detection Systems using GANs" (ARGAN-IDS) a method to address these vulnerabilities. ARGAN-IDS is implemented as a Generative Adversarial Network (GAN) trained on network traffic to protect NIDS. ARGAN-IDS, greatly mitigates the impact of AAs, achieving comparable results to a non-perturbed execution. We show GANs have limitations in differentiating between malicious traffic and traffic altered by AAs. And we address this in ARGAN-IDS by training the GAN on network traffic containing malicious packets. This enhancement significantly improved the GAN’s performance, enabling it to identify even highly perturbed adversarial attacks effectively. ARGAN-IDS acts as a neutralizer of perturbations introduced by AAs and mitigates the NIDS vulnerabilities. We have integrated ARGAN-IDS with a state-of-the-art anomaly-based detector, Kitsune. We achieve a reduction of 99.27% of false positives and an improvement of 99.29% of the true negatives, leading to an improvement of roughly 36.75% in overall system accuracy while under AAs.

Personalized electronic services, e.g. from the e-government domain, need to reliably identify and authenticate users. During user-authentication processes, the electronic identity of the respective user is determined and required additional attributes, e.g. name and date of birth, linked to this identity are collected. This attribute-collection process can become complex, especially if required attributes are distributed over various attribute providers that are organized in a federated identity-management system. In many cases, these identity management systems rely on different ontologies and make use of different languages. Hence, identity federations, such as the one currently established across the European Union, require effective solutions to collect user attributes from different heterogeneous sources and aggregate them to a holistic user facet. At the same time, these solutions need to comply with minimum disclosure rules to preserve users’ privacy. In this article, we propose and introduce a solution for privacy-preserving attribute aggregation. Our solution combines attributes from different domains using ontology alignment and makes use of locality sensitive hashing functions to preserve users’ privacy. Evaluation results obtained from conducted experiments demonstrate our solution’s advantages for both, service providers and users. While service providers can be provided with a larger set of attributes, users remain in full control of their data and can decide on which of their attributes shall be revealed.

This demonstration showcases the potential of OFDM-based Visible Light Communication (VLC) systems for indoor high-speed communications using off-the-shelf LEDs, suitable for illumination. The physical layer was implemented in a Xilinx Virtex-6 FPGA using System Generator. It was designed with a modular architecture, enabling collaboration with other groups with interest in this field. This demonstration explores the optical front-end out-of-band bandwidth to transmit, showing the usefulness of OFDM-based schemes. Using 64QAM and 25MHz modulation bandwidth, it is possible to transmit over 50cm at 150Mbit/s with a BER smaller than the usual 3.8×10-3 limit.

Mobile devices with wireless communication capabilities are a constant in our daily lives. This offers the possibility for such devices to exchange information for their users to assist in their daily lives. Consider for instance the exchange of information about points of interest in the locations that the user usually frequents. One should expect those devices to support such an application in a decentralized fashion, through pair wise interactions, without the interaction of the user, and avoiding to disclose information that might be sensitive to a central entity. Current solutions are not suitable for supporting such applications since most rely on some kind of centralized architecture (either brokers or rendezvous nodes), other solutions that don't rely on centralized solutions present a high overhead. To address this challenge, in this paper we propose MobUser, a novel topic-based publish-subscribe service specially tailored for supporting location-aware operation for mobile devices in a decentralized fashion. Extensive experimental work shows that MobUser offers not only better performance but also superior delivery rates when compared with a state-of-the-art mobile publish subscribe solution. We also show through a prototype implementation deployed on Android 4.0 devices, that the overhead and energy consumption of MobUser is acceptably low.

The Sybil Attack is a serious threat to the secure and dependable operation of wireless ad hoc networks. This paper proposes an algorithm to provide each correct node in an one-hop wireless network with a quorum of non-Sybil identities from the neighbourhood. The quorums provided to different correct nodes may differ, but their intersection is composed by a majority of correct identities, with an arbitrarily close to 1 probability. Therefore, the quorums may be used for different purposes, such as voting. The algorithm is based on the combination of different resource tests, to efficiently detect (and exclude) Sybil identities.

Topological worms, such as those that propagate by following links in an overlay network, have the potential to spread faster than traditional random scanning worms because they have knowledge of a subset of the overlay nodes, and choose these nodes to propagate themselves; and also because they can avoid traditional detection mechanisms. Furthermore, this worm propagation strategy is likely to become prevalent as the deployment of networks with a sparse address space, such as IPv6, makes the traditional random scanning strategy futile. We present a novel approach for containing topological worms based on the fact that some overlay nodes may not have common vulnerabilities, due to their platform diversity. By reorganizing the overlay graph, it is possible to contain topological worms in small islands of nodes with common vulnerabilities that only have knowledge of themselves or nodes running on distinct platforms. We also present the design of Verme, a peer-to-peer overlay based on Chord that follows this approach, and VerDi, a DHT layer built on top of the Verme routing overlay. Simulations show that Verme and VerDi have a low overhead when compared to Chord's corresponding layers, and that our new overlay design helps containing, or at least slowing down the propagation of topological worms.

The arising of grid platforms introduced inexpensive and highly available computing, storage and networking resources. Therefore, in a worldwide trend, institutions aggregate on virtual organizations, registering their resources to the grid and in return accessing a virtually limitless warehouse. This overabundance allowed the emergence of innovative application and business models, delivering the solution to several large-scale problems, as is the case of data processing, storage and sharing in CERN's Large Hadron Collider Project. In order to allow system administrators to assure resources are employed in a coordinated and secure way, policy mechanisms need to cope with such new models and the increased complexity in resource usage management. However, current grid platforms only provide simple primitives in their authorization modules. By restricting access control mechanisms to ACLs and role-based models, they disregard powerful usage semantics, such as those which are history-based (e.g. the Chinese-wall security policy). This absence obliges the development of ad hoc security managers for each deployed resource, introducing vulnerabilities in the security architecture. The use of advanced policies, and more specifically history-based policies, provides a natural method for expressing and enforcing several grid usage patterns, such as fair resource consumption. Additionally, some policy concepts not usually found in policy engines, such as periodic reevaluation, assure an effective policy enforcement. We present the Heimdhal system, a history-enabled policy engine which allows the definition, enforcement and accounting of history-based policies in grid platforms, and more specifically in Globus Toolkit 4.0. A practical evaluation using selected usage patterns corroborates the effectiveness of this kind of policies in grid computing environments, denoting encouraging performance results.

Programming distributed applications supporting data sharing is very hard. In most middleware platforms, programmers must deal with system-level issues for which they do not have the adequate knowledge, e.g., object replication, abusive resource consumption by mobile agents, and distributed garbage collection. As a result, programmers are diverted from their main task: the application logic. In addition, given that such system-level issues are extremely error-prone, programmers spend inumerous hours debugging. We designed, implemented, and evaluated a middleware platform called OBIWAN that releases the programmer from the above mentioned system-level issues. OBIWAN has the following distinctive characteristics: 1) allows the programmer to develop applications using either remote object invocation, object replication, or mobile agents, according to the specific needs of applications, 2) supports automatic object replication (e.g., incremental on-demand replication, transparent object faulting and serving, etc.), 3) supports distributed garbage collection of useless replicas, and 4) supports the specification and enforcement of history-based security policies well adapted to mobile agents needs (e.g., preventing abusive resource consumption).