Efficient cyber risk assessment needs to consider all security alerts provided by cybersecurity solutions deployed in a network. To build a reliable overview of cyber risk, there is a need to adopt continuous monitoring of emerged cyber threats related to that risk. Indeed, the integration of Cyber Threat Intelligence (CTI) into cybersecurity solutions provides valuable information about threats, targets, and potential vulnerabilities. Structured Threat Information eXpression (STIX), as a language for expressing information about cyber threats in a structured and unambiguous manner, is becoming a de facto standard for sharing information about cyber threats. In addition, ontology-based semantic knowledge modeling has become a promising solution that provides a machine-readable language for downstream work in cybersecurity problem-solving. In this paper, we propose an ontology using CTI for risk monitoring. This latter improves an existing ontology, originally proposed to be used within a SIEM (Security Information Event Management), by extending it and aligning it with the STIX concepts.

Finding the right resource at the right time and space is a key enabler for a wide adoption and spread of the Internet of Things (IoT).The Constrained Application Protocol (CoAP) and related standards are among the most prominent efforts working towards such a goal.Indeed, CoAP-related standards provide interesting mechanisms for resource discovery in both centralized and distributed architectures based on the CoAP's GET method.In this paper, we, first, highlight the limitations of GET-based discovery mechanisms.The paper, then proposes a new solution using the recently standardized FETCH method and develops its specifications, rules and semantics.The proposed solution is implemented in the recently released, secure and reliable OpenThread platform and compared with GET-based approaches in different home automation scenarios.Obtained results demonstrate the performance of FETCH-based discovery in achieving fine-grained, time-efficient and reliable discovery while preserving network resources.

During the last decade the support vector data description (SVDD) has been used by researchers to develop anomaly-based intrusion detection systems (IDS), with the ultimate objective to design new efficient IDS that achieve higher detection rates together with lower rates of false alerts. However, most of these systems are generally evaluated during a short period without considering the dynamic aspect of the monitored environment. They are never experimented to test their behavior in long-term, namely after some long period of deployment. In this paper, we propose an adaptive SVDD-based learning approach that aims at continuously enhancing the performances of the SVDD classifier by refining the training dataset. This approach consists of periodically evaluating the classifier by an expert, and feedback in terms of false positives and confirmed attacks is used to update the training dataset. Experimental results using both refined training dataset and compromised dataset (dataset with mislabeling) have shown promising results.

ABSTRACT The majority of key management schemes suffer from the physical compromising of nodes. This vulnerability allows an adversary to reproduce clones and inject them throughout the network to perform other types of attacks. Furthermore, adding new nodes to the network (for maintenance), which is an inevitable step to prolong its life or to repair voids, is the best opportunity to carry out the cloning attack. Our contribution in this paper is to perfectly secure network maintenance against the cloning attack, using a solution based on the digital signature of the base station. Our solution is based on the agreement that the base station should give to a new node to share a pairwise key with its neighbors. The conducted simulations under TinyOS SIMulator (TOSSIM) show that, in addition to perfect resilience, our approach is efficient in terms of time consumption and communication overhead. Copyright © 2014 John Wiley & Sons, Ltd.

In cooperative intrusion detection, several intrusion detection systems (IDS), network analyzers, vulnerability analyzers and other analyzers are deployed in order to get an overview of the system under consideration. In this case, the definition of a shared vocabulary describing the different information is prominent. Since these pieces of information are structured, we first propose to use description logics which ensure the reasoning decidability. Besides, the analyzers used in cooperative intrusion detection are not totally reliable. The second contribution of this paper is to handle these inconsistencies induced by the use of several analyzers using the so-called partial lexicographic inference.

Bayesian networks are very powerful tools for knowledge representation and reasoning under uncertainty. This paper shows the applicability of naive Bayesian classifiers to two major problems in intrusion detection: the detection of elementary attacks and the detection of coordinated ones. We propose two models starting with stating the problems and defining the variables necessary for model building using naive Bayesian networks. In addition to the fact that the construction of such models is simple and efficient, the performance of naive Bayesian networks on a representative data is competing with the most efficient state of the art classification tools. We show how the decision rules used in naive Bayesian classifiers can be improved to detect new attacks and new anomalous activities. We experimentally show the effectiveness of these improvements on a recent Web-based traffic. Finally, we propose a naive Bayesian network-based approach especially designed to detect coordinated attacks and provide experimental results showing the effectiveness of this approach.

Alert correlation is a very useful mechanism to reduce the high volume of reported alerts and to detect complex and coordinated attacks. Existing approaches either require a large amount of expert knowledge or use simple similarity measures that prevent detecting complex attacks. They also suffer from high computational issues due, for instance, to a high number of possible scenarios. In this paper, we propose a Naive Bayes approach to alert correlation. Our modeling only needs a small part of expert knowledge. It takes advantage of available historical data, and provides efficient algorithms for detecting and predicting most plausible scenarios. Our approach is illustrated using the well known DARPA 2000 data set.