As smart cities evolve, they integrate various applications such as intelligent transportation systems, energy management, healthcare, and public safety, all of which depend on interconnected networks. These applications rely on massive data exchanges between sensors, devices, and cloud services, making the system more efficient but also exposing it to cybersecurity challenges. Cyber threats, including data breaches, denial of service (DoS) attacks, and malware, can disrupt essential services, compromise privacy, and endanger lives. The complexity of smart city infrastructure amplifies vulnerabilities, making real-time detection and localization of attacks a critical necessity. In this paper, we propose a novel framework for attack detection and localization specifically designed for smart city environments. The framework integrates machine learning-based intrusion detection systems (IDS) with packet analysis techniques. Upon detection of an anomaly, detailed packet analysis is performed to extract crucial information, such as IP addresses, GPS coordinates, and other metadata. This enables precise localization of the attack's source, facilitating rapid response and mitigation. The combination of machine learning for anomaly detection with packet-level analysis ensures a comprehensive approach, significantly improving detection accuracy and localization precision. Extensive evaluations on real-world datasets demonstrate the efficacy of the proposed method in enhancing the security of smart city networks, while reducing false positives and improving real-time response capabilities. This framework represents a critical advancement in protecting smart cities from evolving cyber threats.

In order to improve the quality of human existence, comfort and efficiency are key objectives in smart environments. It is now possible to construct smart cities due to the latest advancements in Internet of Things (IoT) technology. Privacy and security are major concerns in IoT-based smart objects. Smart environments are at risk for safety from IoT-based technologies. Intrusion detection systems (IDSs) created for IoT environments are essential for preventing IoT-related security threats. Many cyber security systems use IDSs to find intrusions. Anomaly-based IDS learns the typical pattern of system activity and alerts on anomalous events as they happen as opposed to analyzing monitored events against a database of known intrusion events, as is the case with signature-based IDS. The installation of IDS on the IoT network is the main topic of this paper. Key design approach presented in this paper must be taken into consideration when developing an intrusion detection system for the Internet of Things. In this study, we use the Convolutional Neural Network (CNN) to identify attacks on nine commercial IoT devices. Using an actual N-BaIoT dataset that was taken from a real system and included both benign and harmful patterns, extensive empirical research was conducted. The testing results demonstrated a good accuracy of the CNN model in identifying botnet assaults from security cameras with accuracies of 90.25% and 91.76%. Overall, the CNN model was effective in accurately identifying botnet attacks from a variety of IoT devices.

Internet of Medical Things (IoMT) is gaining interest as an emerging paradigm for healthcare improvement. Cyber-security is one of the major issues breaking down its expansion. Indeed, IoMT ecosystem complexities and cyber-attacks development require thinking about smart and efficient security solutions. Machine Learning (ML) techniques are widely used to help detecting abnormalities and intrusions in such environments in order to improve trustworthiness in Connected Medical Devices (CMD). Towards this direction, risk assessment is also proposed to proactively evaluate the security of such platforms. Regarding the complexity and heterogeneity of IoMT, dealing with the inherent security risks is a challenging task. In this context, we aim to evaluate the cumulative risk of CMD based on anomaly detection in IoMT traffic via ML algorithms. Our model relies on anomalies detection coupled with intrinsic risk assessment of medical devices trying to have a holistic risk evaluation for the platform.

Emerging networks envisage to establish a modern digital society that tends to be more valuable on both social and economic levels. The objective is to resolve current network challenges and offer adequate security measures. As a consequence, adaptive architecture is necessary for upcoming networks. An emerging paradigm that can overcome the limitations of conventional networks is software-defined network (SDN), especially when coupled with Network Function Virtualization (NFV). It offers the capacity to dynamically manage and control the entire network by decoupling the control plane from the data plane. Nevertheless, various new network security issues must be handled. More opportunities to deliver intelligence inside of networks are given by SDN. This is why, thanks to SDN’s characteristics, the use of machine learning methods is easily implemented. In this study, we introduce different existing network intrusion detection data sets, with a strong attention to SDN specific new dataset. Furthermore, we suggest an intelligent way to identify intrusions within SDN/NVF networks using a publicly available new SDN datasets (SDN Intrusion) and several Machine Learning techniques. Finally, we present and discuss our obtained results.

The Internet of Things (IoT), which requires architectures with scalable, trustworthy, and well-configured solutions, is evolving toward a multi-tenant and multi-application state. Low-power wireless technologies are a key component of IoT. However, using a software-based centralized architecture in the context of a low-power wireless IoT network poses significant difficulties, including the inability to control traffic, unreliable links, network contention, and high associated overheads that may materially interfere with network performance.To overcome security issues in Software Defined Wireless Networks (SDWN), enterprises and scientists have to develop new techniques and methods for recognizing corrupted entities and threats. In this article, we present a method for identifying and fixing security issues in SDWN that relies on machine learning algorithms using WSN-DS (Wireless Sensor Networks dataset). The main finding of this research is the suggestion of a comprehensive and smart approach to rapidly detect and resolve various wireless network security problems.

When building a performing one-class classifier, the low variance direction of the training data set might provide important information. The low variance direction of the training data set improves the Covariance-guided One-Class Support Vector Machine (COSVM), resulting in better accuracy. However, this classifier does not use data dispersion in the one class. It explicitly does not make use of target class subclass information. As a solution, we propose Scatter Covariance-guided One-Class Support Vector Machine, a novel variation of the COSVM classifier (SC-OSVM). In the kernel space, our approach makes use of subclass information to jointly decrease dispersion. Our algorithm technique is even based on a convex optimization problem that can be efficiently solved using standard numerical methods. A comparison of artificial and real-world data sets shows that SC-OSVM provides more efficient and robust solutions than normal COSVM and other contemporary one-class classifiers.

Software Defined Networks (SDN) heavily rely on diverse management rules (ACL, traffic control, etc. ) to satisfy security and business requirements of their associated services. As these networks are increasing in size and complexity, their management rules configured in devices are becoming more complex. These rules are constantly growing in size and it is challenging to distribute them across network devices with limited capacities. The most challenging task is to deploy rules updates in a fast and efficient way to avoid a security breach or to meet a service needs. In this paper, we extend our previous work on network management rules distribution by introducing an efficient update strategy. Through extensive experiments on several rule sets with single and multiple path topologies, we evaluate and analyze the performance of our strategy. Our obtained results show a reduction of up to 90% in update time.

Smart cities are made up of various components that are interconnected. These components exchange data on an ongoing basis and they facilitate the lives of citizens. Its use of Information and Communication Technology (ICT) was a key factor in its sustainable development. Nonetheless, this development contributed to a rise of safety threats, criminal use of information and several other security and privacy challenges. As a result, security and privacy concerns have emerged as a significant problem for smart cities. Safety factors for smart cities have become a concern for all those involved in this field. In this study, we deeply examine and review and the concept of smart cities and the challenges it faces at first. In a second phase, we mainly address the research gap of security in smart cities and present an analysis of associated security challenges. In the last section, we introduce our approach that aims to: (i) capture the processes of penetration attempts, alterations and cyber attacks; (ii) truck malicious behaviors and locate their sources; and (iii) finally setup controls to repel and prevent them. To illustrate the applicability and efficiency of our solution, We refer to a case of study to demonstrate the efficacy of our detection method, using different machine learning algorithms and the dataset CICIDS2017.

One of the most challenging issues facing Internet of Medical Things (IoMT) cyber defense is the complexity of their ecosystem coupled with the development of cyber-attacks. Medical equipments lack built-in security and are increasingly becoming connected. Moving beyond traditional security solutions becomes a necessity to protect patients and organizations. In order to effectively deal with the security risks of networked medical devices in such a complex and heterogeneous system, we need to measure security risks and prioritize mitigation actions. In this context, we propose a Fuzzy AHP-based method to assess security attributes of connected medical devices and compare different device models against a selected profile with regards to the user requirements. The proposal aims to empower user security awareness to make well-educated decisions.

The dynamic state of networks presents a challenge for the deployment of distributed applications and protocols. Ad-hoc schedules in the updating phase might lead to a lot of ambiguity and issues. By separating the control and data planes and centralizing control, Software Defined Networking (SDN) offers novel opportunities and remedies for these issues. However, software-based centralized architecture for distributed environments introduces significant challenges. Security is a main and crucial issue in SDN. This paper presents a deep study of the state-of-the-art of security challenges and solutions for the SDN paradigm. The conducted study helped us to propose a dynamic approach to efficiently detect different security violations and incidents caused by network updates including forwarding loop, forwarding black hole, link congestion, network policy violation, etc. Our solution relies on an intelligent approach based on the use of Machine Learning and Artificial Intelligence Algorithms.

The Internet of Medical Things (IoMT) is creating all sorts of new applications and capabilities for healthcare services and transforming medical care in lasting and impactful ways. Jointly, new security and cyber-security risks are arisen. Nevertheless, traditional risk management frameworks cannot be directly applied to the IoMT context. In fact, IoMT devices naturally favor usability instead of security and are contained in a distributed and mistrustful environment. The main goal of this paper is to introduce and technically detail an adaptive risk management model for IoT-based medical systems. The proposal performs risk quantification in different layers. To do so, a deep analysis of IoMT security risks is conducted and an agent-based risk management model is then explained.

Software Defined Networks administrators can specify and smoothly deploy abstract network-wide policies. The rule sets of these policies are deployed in the forwarding tables of the available switches. In this paper, we propose a technique, named R2-D2, for decomposing and distributing a rule set on network switches of limited flow tables size, while preserving the network policy semantics. Through experiments on several rule sets with single dimension, we evaluate and analyse the performance of our rule decomposition techniques. Our results show that our technique is efficient in practice compared to existing techniques.

Software-defined networking (SDN) is a network architecture that enables the network to be centrally controlled using software. The network administrators can reprogram the network using SDN without changing hardware devices to provide new solutions for controlling network traffic. However, SDN has its drawbacks in security, scalability, and elasticity. The security validation of SDN configurations is an important issue that should be addressed. Therefore, there is a need for automated methods to analyze, investigate and fix switch configurations faults. The objective of our work is to propose: (1) a new formal approach to discover security challenges using Flow entries Decision Diagram (FeDD) analysis, to identify loop freedom, access violation, black-holes, and controller misconfiguration; (2) an optimal and fine-grained resolution mechanisms to correct these misconfigurations in different topologies: (3) a tool that implements the proposed techniques and effectively helps administrators in detecting and resolving switch misconfigurations.

Software Defined Networking (SDN), as an emerging paradigm, offers a centralized control platform by disassociating the forwarding process of network packets (data plane) from the routing process (control plane). However, the distributed state of the Openflow rules across various flow tables and the involvement of multiple independent rules writers may lead to problems of inconsistencies and conflicts within configurations at the infrastructure level. To tackle these issues, we propose, in this paper, an offline approach to fix violations at data plane side and a fine-grained control of SDN switches flow tables. Our solution considers Flow entries Decision Diagram (FeDD) as data structure and relies on formal techniques for analyzing the policy defects and resolving misconfigurations. It allows ensuring that the operator's policies are correctly applied in an optimal way. The implemented prototype, on top of OpendayLight, of our solution and experimentations, based on a real network configurations topology, demonstrate the scalability and applicability of our approach.

Access control is a main security measure for the prevention of loss, disclosure or degradation of sensitive information in business. As such, it has become a source of inspiration for many researchers who have undertaken to conduct studies related to that subject. More specifically, risk management in access control is a topic that captivates information and communication technology scientists. Several approaches are defined in literature that can be classified into two main trends: some researchers discuss risk management based on user access, while some other consider policies expression when assessing the risk. In this paper, we study the thematic of enforcing risk awareness/management in access control systems. We review, classify and present a comprehensive synthesis of scientific articles that deal specifically with risk management in access control. We mainly discuss risk management approaches that deal with access control policy expressions and conformity.

Policy anomalies are frequent in nowadays's computer networks due to their increasing configuration complexity. Resolving policy anomalies usually requires network administrator intervention, which is a time-intensive and error-prone process. In this paper, we present Net Auto-Solver, a formal approach for automatic resolution of OpenFlow anomalies. The approach resorts to the concept of high-level policies to not only detect policy violations but also correct them on-the-fly. Our approach is fully automated and does not require interaction with the network administrator. Although there is a multitude of research works on detecting anomalies in SDN, research to correct those anomalies in an automatic manner is extremely scarce. At the heart of our approach, we propose two inference systems to perform corrective actions to the policy. We provide some experimental results involving real-life network configurations to show the performance of our approach. The first results are very promising.

Software Defined Networks administrators can specify and smoothly deploy abstract network-wide policies, and then the controller acting as a central authority implements them in the flow tables of the network switches. The rule sets of these policies are specified in the forwarding tables, which are usually accessed using very expensive and power-hungry ternary content-addressable memory (TCAM). Consequently, a given table can only contain a limited number of rules. However, various applications need large rule sets to perform filtering on diverse flows. In this paper, we propose several algorithms for decomposing and distributing a rule set on network switches of limited flow tables size, while preserving the network policy semantics. Through experiments on several rule sets with single and multiple dimensions, we evaluate and analyse the performance of our rule placement techniques. Our results show that our proposals are efficient in practice.

Nowadays, the domain of Information System (IS) security is closely related to that of Risk Management (RM). As an immediate consequence, talking about and tackling the security of IS imply the implementation of a set of mechanisms that aim to reduce or eliminate the risk of IS degradations. Also, the high cadence of IS evolution requires careful consideration of corresponding measures to prevent or mitigate security risks that may cause the degradation of these systems. From this perspective, an access control service is subjected to a number of rules established to ensure the integrity and confidentiality of the handled data. During their lifecycle, the use or manipulation of Access Control Policies (ACP) is accompanied with several defects that are made intentionally or not. For many years, these defects have been the subject of numerous studies either for their detection or for the analysis of the risks incurred by IS to their recurrence and complexity. In our research works, we focus on the analysis and risk assessment of noncompliance anomalies in concrete instances of access control policies. We complete our analysis by studying and assessing the risks associated with the correlation that may exist between different anomalies. Indeed, taking into account possible correlations can make a significant contribution to the reliability of IS. Identifying correlation links between anomalies in concrete instances of ACP contributes in discovering or detecting new scenarios of alterations and attacks. Therefore, once done, this study mainly contributes in the improvement of our risk assessment model.

Packet filtering is widely used in multiple networking applications, including firewalls, intrusion detection systems, routers and load balances, to decide whether to accept or deny an incoming packet. This mechanism relies on packet's header fields to filter such traffic by using range rules of IP addresses or ports. However, the set of packet filters has to handle a growing number of connected nodes and many of them are compromised and used as sources of attacks. For instance, IP filter sets available in blacklists may reach several millions of entries, and may require large memory space for their storage in filtering appliances. In this paper, we propose a new method based on a double mask IP prefix representation associated to a linear transformation algorithm to build a reduced set of range rules. Our experiments show that the proposed method achieves a reduction ratio of up to 74% on synthetic range rule sets.

Substantial advances in Information and Communication Technologies (ICT) bring out novel concepts, solutions, trends, and challenges to integrate intelligent and autonomous systems in critical infrastructures. A new generation of ICT environments (such as smart cities, Internet of Things,edge-fog-social-cloudcomputing, and big data analytics) is emerging; it has different applications to critical domains (such as transportation, communication, finance, commerce, and healthcare) and different interconnections via multiple layers of public and private networks, forming a grid of critical cyberphysical infrastructures. Protecting sensitive and private data and services in critical infrastructures is, at the same time, a main objective and a great challenge for deploying secure systems. It essentially requires setting up trusted security policies. Unfortunately, security solutions should remain compliant and regularly updated to follow and track the evolution of security threats. To address this issue, we propose an advanced methodology for deploying and monitoring the compliance of trusted access control policies. Our proposal extends the traditional life cycle of access control policies with pertinent activities. It integrates formal and semiformal techniques allowing the specification, the verification, the implementation, the reverse-engineering, the validation, the risk assessment, and the optimization of access control policies. To automate and facilitate the practice of our methodology, we introduce our systemSVIRVROthat allows managing the extended life cycle of access control policies. We refer to an illustrative example to highlight the relevance of our contributions.

With the growing complexity of networks and communications protocols that become increasingly enormous and extensive, we are confronted with the problem of covert channel that affects the confidentiality and integrity of data sent in the network. Covert channels also known as hidden channels can elude basic security systems such as Intrusion Detection Systems (IDS) and firewalls. We propose in this work a method to monitor and detect the presence of hidden channels that are based on an essential monitoring protocol "Internet Control Message Protocol" (ICMP). We undergo the network traffic with a set of verifications ranging from simple fields verification to more complex pattern matching operations. To validate our idea, we have installed Ptunnel, a tool that allows to tunnel TCP connections to a remote host using ICMP echo request and reply packets. Our experimental results show the possibility to discover such malicious traffic with high performance.

With the dramatic growth of network attacks, a new set of challenges has raised in the field of electronic security. Undoubtedly, firewalls are core elements in the network security architecture. However, firewalls may include policy anomalies resulting in critical network vulnerabilities. A substantial step towards ensuring network security is resolving packet filter conflicts. Numerous studies have investigated the discovery and analysis of filtering rules anomalies. However, no such emphasis was given to the resolution of these anomalies. Legacy work for correcting anomalies operate with the premise of creating totally disjunctive rules. Unfortunately, such solutions are impractical from implementation point of view as they lead to an explosion of the number of firewall rules. In this paper, we present a new approach for performing assisted corrective actions, which in contrast to the-state-of-the-art family of radically disjunctive approaches, does not lead to a prohibitive increase of the firewall size. In this sense, we allow relaxation in the correction process by clearly distinguishing between constructive anomalies that can be tolerated and destructive anomalies that should be systematically fixed. This distinction between constructive and destructive anomalies is assisted by the network administrator which supports the fact that he has a major role in the heart of the corrective process. To the best of our knowledge, such assisted approach for relaxed resolution of packet filter conflicts was not investigated before. We provide theoretical analysis that demonstrate that our scheme results is sound and indeed result into a conflict-free policy. In addition, we have implemented our solution in a user friendly tool.

The firewall is a critical component of network security and is one of the most commonly used techniques to protect a network. Being based on a set of filtering rules, the accuracy and reliability of firewall protection heavily depend on the quality of the employed rule set. In this context, any mis configurations that arise between rules create ambiguity in classification of new traffic, not only affecting the performance of the firewall, but also putting the system in a vulnerable position. Manual management of this problem can be overwhelming and potentially inaccurate. Therefore, there is a need of automated methods to analyze, detect and fix mis configurations. Given these issues, algorithms and techniques have been proposed. Though these methods are useful for discovering and classifying anomalies, they still have limitations in term of the absence of the distinction between real mis configurations and intentional anomalies and in term of automatic correction of discovered mis configurations. In this paper, we present (1) a new classification of anomalies bringing out real mis configurations using a data structure (FDD) which facilitates mis configurations identification and resolution, (2) Optimal and totally automatic method to fix discovered mis configurations and (3) formal specification of proposed techniques using inference systems. The first results we obtained are very promising.

Firewalls are essential components in network security solutions. They implement a network security policy which represents the highest level requirements for controlling the resource accesses. The effectiveness of security protection provided by a firewall mainly depends on the quality of the configuration implemented in it. Unfortunately, different conflicts between filtering rules may occur which make the network vulnerable to attacks. Manual management of this problem can be overwhelming and potentially inaccurate. Therefore, there is a need of automated methods to analyze, detect and correct misconfigurations. Prior solutions have been proposed but we note their drawbacks are threefold: First, common approaches deal only with pairwise filtering rules. In such a way, some other classes of configuration anomalies could be uncharted. Second, syntactic anomalies could be intentional (i.e., not perforce misconfigurations). This substantial distinction is not often highlighted. Third, although anomalies resolution is a tedious and error prone task, it is generally given to the network administrator. We present, in this paper, a formal approach whose contributions are the following: Detecting new classes of anomalies, bringing out real misconfigurations and finally, proposing automatic resolution method by considering the security policy. We prove the soundness of our method and demonstrate its applicability and scalability by the use of a Satisfiabilty Solver. The first results we obtained are very promising.

ABSTRACT Honeypots play an important role in collecting relevant information about malicious activities that happen on the Internet. In this paper, we are particularly interested in attacks targeting Web services. We therefore propose a honeypot implementation for Web services, called WS Honeypot. However, the data collected by honeypots can become very large, which greatly complicates the analysis task performed by the human analyst. As a solution for this problem, we propose in this paper an automatic technique to analyze the data collected from our WS Honeypot. The proposed approach is based on four machine learning methods: support vector machines, support vector regression, spectral clustering, and k‐means clustering. Our main objectives are to analyze the collected data, automatically characterizing the captured attacks and detecting the denial‐of‐service and novel attacks. Copyright © 2013 John Wiley & Sons, Ltd.

Network security requirements are generally regarded once network topology is implemented. In particular, once firewalls are emplaced to filter network traffic between different Local Area Networks (LANs). This commun approach may lead to critical situations: First, machines that should not communicate could belong to a same LAN where the network traffics do not pass through the firewall for being filtered. Often overwhelmed by the complexity of security requirements and the growth of networks, network administrators are struggling to resolve such design faults while ensuring not to cause further vulnerabilities. Second, according to network security policy, the required number of LANs, and therefore the number, range and thus, the cost required for both network and security equipments, can be much more reduced than that originally proposed by the network administrator. In this paper, we present an automatic approach that consists on proposing a network topology which is both safe and optimal by taking into account the network security policy, given in a high-level language. The safety property ensures that every prohibited traffic has to cross the firewall to be filtered. The optimal property allows to deduce the necessary and sufficient resources (Sub networks, network switches, firewalls range) to be used. To our best knowledge, such problematic has not been explored in previous works, despite the importance of these challenges. Our method has been implemented using Graph Coloring Theory. The first results are very promising. Experiment conducted on large-scale networks demonstrate the efficiency and the scalability of our approach.

The coexistence of range based and prefix based fields within the filtering rules is one of the most important cause that makes the packet classification problem difficult to resolve and the proposed hybrid solutions hard to implement. How to effectively support such complex filtering rules is really a challenge. Most of the cases range-based fields need to be converted into a set of standard prefixes. Actually, there is a manifested need to have new expressive conversion techniques to process efficiently multiple type of conditions. In this context, the problem of limited scalability is encountered and must be resolved to avoid the range to prefix blowout. In this paper, we propose the NAF conversion technique (Non-adjacent form) which is able to expand an arbitrary range or multiple ranges into an optimal set of signed prefixes. The proposed technique is flexible enough and let us the possibility to reach a better compression ratio than the previous proposed solutions.

The process of packet filtering becomes time consuming as filtering policies become larger and more complex. New firewall designs are needed to meet the challenges associated with the high-speed networks. For this reason, access control lists in firewalls need to be flexible enough to give us the possibility to implement efficiently new high-performance filtering strategies. The precedence relationships within the access control rules are considered as being one of the most important handicap remaining unsolved in the context of optimization. In this paper, we introduce a Karnaugh map (k-map) based technique able to remove totally the dependencies between rules without changing the filtering behavior (i.e. input and output lists of rules remain semantically equivalent). On one hand, statistical rule ordering models become easy to implement, provide a differentiated quality of service and enable to reach a good processing time. On the other hand, dependency removal is very useful in the context parallelization especially when the access policy has to be equitably distributed among multiple firewalls. We have implemented this new technique and the first computer experiments were very promising.

The growth of the Internet coupled with the complexity of the security needs increases the demands on filtering performance, so much so that it is crucial to maintain high classification throughput in a high speed environment. As a result, today's security devices require innovative designs and algorithms to optimize the efficiency of packet filtering systems. In this paper, we propose a safe and an optimal reordering method aimed at reducing the operational cost of network packet filters. In addition, an evaluation performance study is also given using a set of special matrices: Dependency Matrix, Reordering Matrix and Grouping Matrix. Besides, each matrix has an associated factor in [0,1] and the new defined factors are introduced to measure the efficiency of the proposed technique and to show its high potential to make optimization easy, optimal and safe.

Abstract During this time when Internet provides essential communication between an infinite number of people and is being increasingly used as a tool for commerce, security becomes a tremendously important issue to deal with. However, traditional widely used security methods such as firewalls, cryptography and intrusion detection systems (IDSs) have been unable to provide an effective security mechanism for defending high‐speed networks. In fact, nowadays high‐speed networks are very popular; they play an increasingly important role in the domain of information technology, they provide us with a lot of advantages, but they present a big problem for security tools; as networks are becoming faster there is an emerging need for security analysis techniques that keep up with the increased network throughput. In this paper, we are interested in the network intrusion detection systems (NIDSs). In fact, existing NIDSs can barely keep up with bandwidths of some hundred Mbps, whereas nowadays, the network speed presses forward 10 Gbps. So, in order to protect such installations, we propose a new approach presenting trusted intrusion detection architecture for high‐speed networks. The approach aims at accelerating the intrusion detection operation and it is based on three main steps: traffic classification, load balancing and high availability mechanism. This paper describes the above‐mentioned approaches and presents an experimental evaluation of their effectiveness. Copyright © 2010 John Wiley & Sons, Ltd.

Honeypot is an effective security tool, which is intended to be attacked and compromised to gain more information about the attacker and his attack techniques. To study these attacks, the honeypot must capture and log large amounts of data which are very difficult to process manually. So, the analysis of these logs has become a very difficult and time consuming task. To resolve this problem, several researchers have proposed the use of data mining techniques in order to classify logged traffic and extract useful information. In this paper, we present a data analysis tool for our Honeypot Router. This tool is based on data mining clustering. The main idea is to extract useful features from data captured by the Honeypot Router. These data will be then clustered by using the DBSCAN clustering algorithm in order to classify the captured packets and extract those that are suspicious. Suspicious packets will be then verified by a human expert. This solution is very useful to detect novel routing attacks.

Web services are increasingly becoming an integral part of next-generation web applications. A Web service is defined as a software system designed to support interoperable machine-to-machine interaction over a network based on a set of XML standards. This new architecture and set of protocols brings new security challenges such as confidentiality, integrity, anonymity, authentication, authorization and availability of requested services. Vulnerabilities in Web services are very dangerous since they can be used by attackers to damage the company's information system and steal confidential data.

Nowadays, it is a well-known fact that only formal methods can provide a proof that a given system meets its requirements. Their use become mandatory for critical systems such as electronic voting which must satisfy several and complex properties (receipt-freeness, verifiability). Among these properties, anonymity is probably the most desirable one. Formally, this property was mainly specified using the concept of indistinguishability which implies complex definitions (in terms of equivalence relations). In this paper, we give an alternative and simpler specification of anonymity property in the ADM logic. We specify anonymity as a secrecy property which represents the oldest and most understood property of security protocols. Our specification is specific to homomorphic-based voting schemes since in this case, voter's anonymity rely on the secrecy of his vote.

Intrusion detection systems (IDS) and intrusion prevention systems (IPS) are now considered a mainstream security technology. IDS and IPS are designed to identify security breaches. However, one of the most important problems with current IDS and IPS is the lack of the ldquoenvironmental awarenessrdquo (i.e. security policy, network topology and software). This ignorance triggers many false positives (false alerts) and false negatives (undetected attacks). In this paper, we propose a novel intrusion detection and prevention architecture where we integrate the characteristics and the properties of the protected system in the traffic analysis process. The experimental evaluation shows the effectiveness of our solution. In fact, we measure a reduction of 89.59% of false positives and 79.18% of false negatives.

Routing protocols are essential for interconnecting networks; however they may enclose several vulnerabilities that can be exploited by malicious attackers. For example, an attacker may send forged packets to a router with the intention of changing or corrupting the routing table, which in turn can reduce the network connectivity and degrade the router functionalities. To prevent and detect such attacks, several security techniques are available like firewall, authentication mechanisms and intrusion detection system (IDS). Nevertheless these security methods encounter some problems, especially when dealing with new attacks. Relying on additional security principles seems to be important to well protect network connectivity offered by routers. In this paper, we propose using honeypot to protect routing protocols. Honeypot is particularly useful to attract attackers, driving them away real routers and allowing the administrators to be aware about intrusion attempts on their networks and the employed techniques that can be recent. Our solution (honeypot router) is to deploy a honeypot playing the role of a router. The honeypot is based on routing software called Quagga and other tools for traffic capture and analysis. The entire solution supervises all routing traffic, so it detects and studies new attacks against routing protocols (RIP, OSPF and BGP).

The configuration of firewalls is highly error prone and automated solution are needed in order to analyze its correctness. We propose a formal and automatic method for checking whether a firewall reacts correctly with respect to a security policy given in an high level declarative language. When errors are detected, some feedback is returned to the user in order to correct the firewall configuration. Furthermore, the procedure verifies that no conflicts exist within the security policy. We show that our method is both correct and complete. Finally, it has been implemented in a prototype of verifier based on a satisfiability solver modulo theories (SMT). Experiment conducted on relevant case studies demonstrate the efficiency and scalability of the approach.

Algebraic specifications provide a powerful method for the specification of abstract data types in programming languages and software systems. Completeness and ground confluence are fundamental notions for building algebraic specifications in a correct and modular way. Related works for checking ground confluence are based on the completion techniques or on the test that all critical pairs between axioms are valid with respect to a sufficient criterion for ground confluence. It is generally accepted that such techniques may be very inefficient, even for very small specifications. Indeed, the completion procedure often diverges and there often exist many critical pairs of the axioms. In this article, we present a procedure for simultaneously checking completeness and ground confluence for specifications with free/nonfree constructors and parameterized specifications. If the specification is not complete or not ground confluent, then our procedure will output the set of patterns on whose ground instances a function is not defined and it can easily identify the rules that break ground confluence. In contrast to previous work, our method does not rely on completion techniques and does not require the computation of critical pairs of the axioms. The method is entirely implemented and allowed us to prove the completeness and the ground confluence of many specifications in a completely automatic way, where related techniques diverge or generate very complex proofs. Our system offers two main components: (i) a completeness and ground confluence analyzer that computes pattern trees of defined functions and may generate some proof obligations; and (ii) a procedure to prove (joinable) inductive conjectures which is used to discharge these proof obligations.

Many schemes of high-performance IP address lookup have been proposed recently. But most of them do not process dynamically the packets and give no specific interest in the skewness of the traffic. Hence, the lack of dynamic packet routing algorithms has been the motivation for this research. In this paper, we have conceived a self-adjusting tree filter, by combining the scheme of binary search on prefix length with the splay tree model. Consequently, we have at most 2 hash accesses for all consecutive values. We give also a special interest in the amount of packets treated then routed through the default route entry. Those packets present an important part of the traffic treated by the routers and they might cause more harm than others as they traverse a long decision path before they are finally sent to the default route.

The Solutions of security are disturbed by aftermaths of the fast evolution of the infrastructure. Indeed, the new networks use more and more fast links in Gigabits and 10 Gigabits whereas the methods of security most often applied as IDSs, firewalls and cryptography are incapable to follow this fast transfer of data. In this paper, we are interested in the NIDSs. In fact the constant increase in network speed and throughput pose new challenges to these systems. Current NIDSs are designed to 10/100 Mbps [6], nevertheless large network installations are Gigabit Ethernet (1000 Mbps), so the task of detection becomes increasingly difficult with only one NIDS. The purpose of this paper is to discuss a new approach with the aim of accelerating the intrusion detection. The approach is based on three main steps: traffic classification, load balancing and a high availability mechanism. The paper describes all the above mentioned approaches and presents an experimental evaluation of their effectiveness.

Firewalls implement packet filtering and thereby provide security functions that are used to manage data flow to, from and through routers based on a set of predefined filtering rules. Hence, filtering rules have to be well defined and coherent in order to guarantee the desired responses of the firewall. In this paper, we propose a new approach for detecting anomalies in the firewall filtering rules. An anomaly occurs when the domains of two given filtering rules are not disjoint. Filtering rules relationships have a structure of an algebraic semi group (R, Lambda), and via a morphism, we transform the problem from the formal writing and resolution to an analytic treatment. Our approach is more general than related works, since it treats any protocol header, any number of fields and different IP address writing, and, as a result, we define new anomalies such as Contradiction Anomaly and other types of the Redundancy Anomaly. We have implemented our technique and the first experimental tests show its efficiency and simplicity.

Algebraic specifications provide a powerful method for the specification of abstract data types in programming languages and software systems. Completeness and ground confluence are fundamental notions for building algebraic specifications in a correct and modular way. In this paper, we present a procedure for simultaneously checking completeness and ground confluence for specifications with free/non-free constructors and parameterized specifications. If the specification is not complete or not ground-confluent, then our procedure outputs the set of patterns on whose ground instances a function is not defined and it can easily identify the rules that break ground confluence. Our procedure is complete and always terminates under the assumption of an oracle for deciding (joinable) inductive properties. In contrast to previous work, our method does not rely on completion techniques and does not require the computation of critical pairs of axioms. The method has been implemented in the prover SPIKE. This system has allowed us to prove the completeness and the ground confluence of many specifications in a completely automatic way, where related techniques diverge or generate very complex proofs.

This work investigates inductive theorem proving techniques for first-order functions whose meaning and domains can be specified by Horn Clauses built up from the equality and finitely many unary membership predicates. In contrast with other works in the area, constructors are not assumed to be free. Techniques originating from tree automata are used to describe ground constructor terms in normal form, on which the induction proofs are built up. Validity of (free) constructor clauses is checked by on original technique relying on the recent discovery of a complete axiomatisation of finite trees and their rational subsets. Validity of clauses with defined symbols or non-free constructor terms is reduced to the latter case by appropriate inference rules using a notion of ground reducibility for these symbols. We show how to check this property by generating proof obligations which can be passed over to the inductive prover.

Proofs by induction arc important in many computer science and artificial intelligence applications, in particular, in program verification and specification systems. We present a new method to prove (and disprove) automatically inductive properties. Given a set of axioms, a well-suited induction scheme is constructed automatically. We call such an induction scheme a test set. Then, for proving a property, we just instantiate it with terms from the test set and apply pure algebraic simplification to the result. This method needs no completion and explicit induction. However it retains their positive features, namely, the completeness of the former and the robustness of the latter. It has been implemented in the theorem-prover SPIKE.