As the alarming trend of industrial and critical-infrastructure systems targeting by sophisticated APT actors continues, the need for accurate and effective modeling of adversary behavior in these systems has becomes even more pressing. Namely, models of complex attacks that do not contain all the relevant information, or are visually inordinate and difficult to comprehend or navigate, are more likely to: 1) impede the overall understanding of attack strategies and objectives, for both cybersecurity experts and non-experts; 2) result in poor decision making, such as selection and implementation of inadequate defences against the modeled attacks. In this work, we first explain the main difference between the concepts of ‘attack modeling’ and ‘threat modeling’. Subsequently, we survey the existing most prominent attack modelling techniques (AMTs), while emphasizing their respective pros and cons. Next, we also survey the most recent research works that deal with the (in)effectiveness of the existing AMTs from the visual representation and human perception perspective. As the main contribution of this work, we propose a novel attack visualization approach that merges the traditional attack-trees with the MITRE ATT&CK methodology. We name this technique Color Coded MITRE ATT&CK Inspired Attack Tree (CC-MATT-AT) modeling. CC-MATT-AT is able to produces attack representations that are visually far superior to models produced using attack trees or MITRE ATT&CK alone – which is especially important and evident in the case of complex attacks. Finally, we demonstrate the practical use and potential advantages of our CC-MATT-AT modeling by building a representation of one of the best-known attacks on industrial control systems to date (Sutxnet).

Internal network and system reconnaissance is one of the first crucial stages of most cyber attacks, though it plays an especially critical role in attacks on complex industrial control systems (ICSs) that span both IT and OT environments. Frequently, besides device enumeration and scanning, a malicious ICS reconnaissance campaign will also involve siphoning of important operational in-transit data, which can provide the adversary with invaluable insights and information about the functioning of the target system. In this work, by specifically focusing on industrial systems that deploy OPC UA standard, we first give a brief overview of different data siphoning strategies possibly conducted by an adversary. We then discuss the important role of periodic encryption-key rotation (i.e., limiting of cryptoperiod length/duration) to minimize the ultimate risk and impact of data siphoning. We also point to the lack of clear guideline in industry standards and research literature on how cryptoperiod(s) assigned to an OPC UA security group should be determined/calculated. We then introduce our novel framework and tool for automatic risk-based optimal cryptoperiod calculation (ARC-C). We demonstrate the use and usefulness of this tool by applying it to a hypothetical but highly plausible Water Treatment Plant environment built on real-world models.

Session-replay bots are believed to be the latest and most sophisticated generation of web-bots, that are also very difficult to defend against. Combating session-replay bots is particularly challenging in online domains that get repeatedly visited by the same genuine human user(s), and possibly in the same/similar way - such as news, banking or gaming sites. Namely, in such domains, it is difficult to determine whether two look-alike sessions are produced by the same human user or these sessions are just bot-generated session replays. Unfortunately, to date, only a handful of research studies have looked at the problem of session-replay bots, with many related questions still waiting to be addressed. The main contributions of this paper are two-fold: 1) We introduce and provide to the public a novel real-world mouse dynamics dataset named ReMouse. ReMouse dataset is collected in a guided environment and, unlike other publicly available mouse dynamics dataset, it contains repeat-sessions generated by the same human user(s). As such, ReMouse dataset is first of its kind and is of particular relevance for studies on the development of effective defenses against session-replay bots. 2) Our own analysis of ReMouse dataset using statistical and advanced ML-based methods (including deep and unsupervised neural learning) shows that not only two different human users are highly unlikely to generate same/similar looking sessions when performing the same/similar online task, but even the (repeat) sessions generated by the same human user are likely to be sufficiently distinguishable from one another.

Most traditional techniques for Tor user de-anonymization rely on the use of server-side originating traffic watermarks. In this poster, we outline the key ideas behind our novel client-side originating watermark scheme and describe some possible ways of how this scheme could be implemented in practice. We also demonstrate the superior real-world performance of this approach vs. those previously discussed in the literature.

Session-replay bots are believed to be the latest and most advanced generation of web-bots, that are also difficult challenging to defend against. Combating session-replay bots is particularly problematic in online domains that get repeatedly visited by the same genuine human user(s), and possibly in the same/similar way - such as news, banking or gaming sites. Namely, in such domains, it is difficult to determine whether two look-alike sessions are produced by the same human user or these sessions are just bot-generated session replays. In this paper we introduce and provide to the public a novel real-world mouse dynamics dataset named ReMouse. ReMouse dataset is collected in a guided environment and, unlike other publicly available mouse dynamics dataset, it contains repeat-sessions generated by the same human user(s). As such, ReMouse dataset is first of its kind and is of particular relevance for studies on the development of effective defenses against session-replay bots. Our own statistical analysis of ReMouse dataset shows that not only two different human users are highly unlikely to generate same/similar looking sessions when performing the same/similar online task, but even the (repeat) sessions generated by the same human user are likely to be sufficiently distinguishable from one another.

As Web bot technologies continue to evolve, the task of separating human Web sessions from those generated by malicious bots becomes increasingly more challenging. To date, many research studies have proposed the use of advanced ML-based methods as automated means of differentiating between Web bot and genuine human sessions. Unfortunately, most of these studies overlook the importance of adequate feature selection during the dataset preprocessing stage. Namely, instead of making the process of feature selection automated and optimized to each particular dataset, these studies generally resort to the use of the same fixed set of hand-picked Web-session attributes. It is well known, however, that suboptimal approach to feature selection is likely to result in suboptimal performance of the respective ML algorithm and, consequently, of the entire system. The main contributions of our work are as follows: First, we propose the use of Gradient Boosting Technique to automatically identify the most significant Web-session features (out of an extensive list of 119 possible attributes) for any given dataset. Second, we integrate this automated features selection technique into a system for Web-session classification based on the unsupervised Self-Organizing Map (SOM) algorithm. Third, we validate the performance of the integrated system on a recent real-world dataset which has been collected during a confirmed large-scale attack on our home institution. The obtained experimental results not only verify that our proposed system is highly effective in identifying malicious Web-sessions, but they also help us better understand the nature and scale of the conducted attack itself.

Classifiers are often used to detect malicious activities in adversarial environments. Sophisticated adversaries would attempt to find information about deployed classifiers in order to strategise different evasion techniques. It is a widely held belief that randomization of decision boundaries/rules of detection systems would introduce further complexities in attempts made by the adversaries for finding minimal adversarial cost (MAC) evading instances. We have extended the results obtained by Nelson et al. [14] and further presented a novel algorithm that can find optimal evading instances in randomized convex-inducing classifiers using polynomial-many queries. Our results have demonstrated that the complexity introduced through randomization only increases the complexity of finding an optimal evading instance by a constant factor and thus the risk of optimal evasion is still present.

Online tracking of children by third-parties is strictly regulated by law in many regions of the world (e.g., COPPA in USA and GDPR in EU), and in a large number of situations constitutes criminal activity. Unfortunately, the existence of these laws does not seem to be an effective deterrence. In this paper, we provide a brief summary of our findings pertaining to the effectiveness of four popular browser add-ons in protecting against third-party tracking on a select number of children-oriented Web-sites. The obtain results show that protection from tracking by a browser add-on is generally achieved at the expense of Web-page performance. In other words, add-ons that are effective at blocking third-party trackers will often adversely affect the normal functioning of the visited Web-page(s). In addition, our results also show that when it comes to user/children tracking by well-known 'tech giants', all four add-ons are likely to provide only limited protection.

1 To date, much of the development in Web-related technologies has been driven by the users' quest for ever faster and more intuitive WWW. One of the most recent trends in this development is built around the idea that a user's WWW experience can further be improved by predicting and/or preloading Web resources most likely sought by this user, ahead of time. Resource hints is a set of features introduced in HTML5 and intended to support the idea of predictive preloading in the WWW. Unfortunately, as the very actualization and the present use of the resource hints have been almost exclusively driven by the speed and end-user experience in mind, the opportunities for their misuse in terms of other user-related metrics (user privacy and reputation, as well as business analytics) appear to be considerable.

The development of Web bots capable of exhibiting human-like browsing behavior has long been the goal of practitioners on both side of security spectrum - malicious hackers as well as security defenders. For malicious hackers such bots are an effective vehicle for bypassing various layers of system/network protection or for obstructing the operation of Intrusion Detection Systems (IDSs). For security defenders, the use of human-like behaving bots is shown to be of great importance in the process of system/network provisioning and testing. In the past, there have been many attempts at developing accurate models of human-like browsing behavior. However, most of these attempts/models suffer from one of following drawbacks: they either require that some previous history of actual human browsing on the target web-site be available (which often is not the case), or, they assume that 'think times' and 'page popularities' follow the well-known Poisson and Zipf distribution (an old hypothesis that does not hold well in the modern-day WWW). To our knowledge, our work is the first attempt at developing a model of human-like browsing behavior that requires no prior knowledge or assumption about human behavior on the target site. The model is founded on a more general theory that defines human behavior as an 'interest-driven' process. The preliminary simulation results are very encouraging - web bots built using our model are capable of mimicking real human browsing behavior 1000-fold better compared to bots that deploy random crawling strategy.

The existing state-of-the art in the field of application-layer DDoS protection is generally designed, and thus effective, only for static Web-domains. To the best of our knowledge, this paper is the first one to study the problem of application-layer DDoS defense in Web-sites of dynamic content and/or organization and under non-trivial bot (i.e., Attack) behavior. The main contributions of the paper are threefold: 1) we provide a detailed taxonomy of the existing and next-generation application-layer HTTP-based DDoS attacks, 2) we discuss the relevance of a branch of data mining theory -- known as data streams with concept drift -- to the problem of application-layer DDoS defense in dynamic Web-domains, 3) we present the outline of our next-generation anti-DDoS system that is intended for dynamic Web-domains facing different sophisticated variants of application-layer DDoS attacks. The paper also includes some of our preliminary experimental results concerning the detection of malicious Web-users/sessions using the proposed system.

In the wireless sensor network (WSN) literature, the use of a mobile sink is commonly viewed as one of the most successful means of load balancing and is often recommended as an effective defence against the so-called hot-spot phenomenon.

In this work, we investigate the advantages and challenges of deploying a single mobile sink in IEEE 802.15.4/ZigBee wireless sensor networks (WSNs). The first part of the paper provides an overview of the most recent research on sink mobility in WSNs, placing a special emphasis on different types of sink mobility (random, predictable and controlled) and discussing the application scenarios most suitable for their respective deployment. In the second part of the paper, our OPNET model for simulation of large-scale and ZigBee-based wireless sensor networks is presented. The model enables effective evaluation of random and predictable sink mobility under varying conditions and forms of routing in the underlying ZigBee WSN. The results obtained using this model show that in terms of energy efficiency ZigBeepsilas tree-based routing outperforms ZigBeepsilas mesh routing, both in the case of random and predictable sink mobility. At the same time, under both mobility models, tree-based routing generates longer delays in the delivery of data reporting packets. Furthermore, when compared against each other assuming identical network conditions, random mobility is shown to achieve higher energy efficiency and shorter packet delays than predictable mobility.

Wireless sensor networks (WSNs) for environment monitoring consist of a large number of low-cost battery-powered sensors nodes, densely deployed throughout a remote or inaccessible physical space. "Energy conservation" has been identified as the key challenge in the design and operation of these networks. At the same time, clustering of sensor nodes has been widely recognized as the most promising approach in dealing with the given challenge. In our earlier work, we examine the actual energy-conservation effectiveness of node clustering in WSNs, and we prove that only clustering schemes that position their resultant clusters within the isoclusters1 of the monitored phenomenon are guaranteed to reduce the nodes' energy consumption and extend the network lifetime. A thorough review of the known literature on WSNs shows that the existing WSN clustering algorithms commonly do not satisfy the above requirement, i.e. they do not consider the similarity of sensed data as an important clustering criterion. Therefore, the utilization of these algorithms cannot be considered truly effective in dealing with the WSN energy conservation challenge. In this paper, we propose a novel WSN clustering algorithm - local negotiated clustering algorithm (LNCA). To our knowledge, LNCA is the first clustering algorithm that employs the similarity of nodes' readings as the main criterion in cluster formation. As such, LNCA is highly effective in minimizing in-network data-reporting traffic and, accordingly, in reducing the energy usage of individual sensor nodes. Our simulation results show clear performance supremacy of LNCA over two popular WSN clustering algorithms: low-energy adaptive clustering hierarchy (LEACH) and weight clustering algorithm (WCA).

The key challenge in the design and operation of wireless sensor networks (WSNs) is the maximization of system lifetime. Node clustering is commonly considered as one of the most promising techniques for dealing with the given challenge, and as such has been referred to by many researchers. It is interesting to observe, however, that very few, if any, published research works provide explicit analysis of node clustering in WSNs and/or manage to prove its actual effectiveness. In this paper we take a closer analytical look at WSNs of clustered organization. We prove that these networks do not necessarily outperform non-clustered WSNs. The condition that ensures superior performance of clustered WSNs, with absolute certainty, is that the formed clusters lie within the isoclusters of the monitored phenomenon. We also show that in clustered WSNs which satisfy the given condition, cluster sizes do not need to match the sizes of their respective underlying isoclusters. Instead, simple 5-hop clusters can provide near-optimal network performance under a wide range of cluster-to-sink and cluster-to-isocluster spatial arrangements

The user retrial phenomenon and its significant impact on network performance in unicast wireless systems are known and relatively well studied in the literature. However, there have been no previous studies on the impact of the user retrial phenomenon on other types of wireless networks. The objective of this paper is to extend the analysis of the user retrial phenomenon to wireless systems which, in addition to unicast service, also support a data broadcast service. This objective is realized by defining several performance measures appropriate for the analysis of hybrid unicast-broadcast systems in the presence of users' retrials. Subsequently, we derive the exact mathematical expression for each of the measures. Based on these expressions, we prove the existence of a single broadcast scheduling scheme, which ensures optimal system performance, with respect to the given set of proposed measures, the system's throughput, and the grade and quality of service. We also take a closer look at the class of hybrid unicast-broadcast systems with autonomous estimation of data item popularities, and we elaborate on the major challenges associated with such systems. Finally, we evaluate our theoretical expressions through simulation, and we discuss their robustness with respect to moderate deviations in the underlying model.

In recent years, both wireless data broadcast (WDB) and hierarchical cell structure (HCS) have attracted the attention of the scientific community, yet they have been treated as entirely separate research topics. This paper presents one of the first attempts to bring the two subjects together. In particular, the paper deals with the issue of optimized data broadcast in systems of hierarchical cellular organization. We see the following as the main contributions of the paper: 1) considerably superior performance of HCS-over single-layer- WDB system is proven; 2) an algorithm for fast identification of the optimal broadcast schedule in HCS-WDM systems is proposed. As we are moving in the era of pervasive computing, where millions of devices - many of them of mobile and nomadic nature - will be requesting network support for retrieval of information, development of efficient wireless based transfer systems become immensely important.

A modified adaptive resonance theory (ART2) learning algorithm, which we employ in this paper, belongs to the family of NN algorithms whose main goal is the discovery of input data clusters, without considering their actual size. This feature makes the modified ART2 algorithm very convenient for image compression tasks, particularly when dealing with images with large background areas containing few details. Moreover, due to the ability to produce hierarchical quantization (clustering), the modified ART2 algorithm is proved to significantly reduce the computation time required for coding, and therefore enhance the overall compression process. Examples of the results obtained are presented, suggesting the benefits of using this algorithm for the purpose of VQ, i.e., image compression, over the other NN learning algorithms.

The implementation of an intermediary-proxy is a common approach to the problem of network heterogeneity in the Internet infrastructure. Due to the hypertext nature of the most popular Internet application-the World Wide Web, image compression is considered to be one of the fundamental functions of such a proxy. It has been observed that most images embedded into Web documents are of 'information-delivery' type, so an algorithm intended for their compression has to satisfy some specific requirements. First, in order to support network (bandwidth) constraints for an arbitrary case, the algorithm should be inherently adaptive, i.e. able to provide a wide range of compression rates. Second, as dealing with images that are integral parts of an interactive application (such as a Web browser), the algorithm should be capable of preserving a sufficient level of image semantics according to the quality standards of human perception. The vector quantization (VQ) technique, in its general form, is proven to satisfy the first requirement. On the other hand, a modified adaptive resonance (modified ART2) learning algorithm (which we employ in this paper) more properly belongs to the family of NN algorithms whose main goal is the discovery of input data clusters, without considering their actual size. This feature makes the modified ART2 algorithm satisfy the second requirement. Thus, the discussion and results presented are intended to show that modified ART2 underlying the general VQ procedure is an appropriate techniques for image compression purposes in a bandwidth-constrained environment.

The WWW is an online hypertextual collection, and a more sophisticated algorithm for Web page clustering may have to be based on combined term-similarity and hyperlink-similarity measures. It has been observed that nearly all currently employed techniques for document classification on the Web make use of textual information only. In addition, most of these techniques are incapable of discovering the real nature of the collection to which they are applied due to rather inefficient clustering algorithms employed. This paper describes a novel technique for hypertext clustering, called an adaptive hypertext clustering (AHC) algorithm. This algorithm has been derived from a modified neural network algorithm, and adjusted to the problem of combined term-similarity and hyperlink-similarity measures. The results presented in the paper show that AHC can be easily adapted to enable the most appropriate Web page classification within collections of various thematic and functional profiles, suggesting its main benefits over the traditional techniques.