The automatic extraction of information from Cyber Threat Intelligence (CTI) reports is crucial in risk management. The increased frequency of the publications of these reports has led researchers to develop new systems for automatically recovering different types of entities and relations from textual data. Most state-of-the-art models leverage Natural Language Processing (NLP) techniques, which perform greatly in extracting a few types of entities at a time but cannot detect heterogeneous data or their relations. Furthermore, several paradigms, such as STIX, have become de facto standards in the CTI community and dictate a formal categorization of different entities and relations to enable organizations to share data consistently.

Cyber Threat Intelligence (CTI) reporting is pivotal in contemporary risk management strategies. As the volume of CTI reports continues to surge, the demand for automated tools to streamline report generation becomes increasingly apparent. While Natural Language Processing techniques have shown potential in handling text data, they often struggle to address the complexity of diverse data sources and their intricate interrelationships. Moreover, established paradigms like STIX have emerged as de facto standards within the CTI community, emphasizing the formal categorization of entities and relations to facilitate consistent data sharing. In this paper, we introduce AGIR (Automatic Generation of Intelligence Reports), a transformative Natural Language Generation tool specifically designed to address the pressing challenges in the realm of CTI reporting. AGIR’s primary objective is to empower security analysts by automating the labor-intensive task of generating comprehensive intelligence reports from formal representations of entity graphs. AGIR utilizes a two-stage pipeline by combining the advantages of template-based approaches and the capabilities of Large Language Models such as ChatGPT. We evaluate AGIR’s report generation capabilities both quantitatively and qualitatively. The generated reports accurately convey information expressed through formal language, achieving a high recall value (0.99) without introducing hallucination. Furthermore, we compare the fluency and utility of the reports with state-of-the-art approaches, showing how AGIR achieves higher scores in terms of Syntactic Log-Odds Ratio (SLOR) and through questionnaires. By using our tool, we estimate that the report writing time is reduced by more than 40%, therefore streamlining the CTI production of any organization and contributing to the automation of several CTI tasks.

Mobile devices can be maliciously exploited to violate the privacy of people. In most attack scenarios, the adversary takes the local or remote control of the mobile device, by leveraging a vulnerability of the system, hence sending back the collected information to some remote web service. In this paper, we consider a different adversary, who does not interact actively with the mobile device, but he is able to eavesdrop the network traffic of the device from the network side (e.g., controlling a Wi-Fi access point). The fact that the network traffic is often encrypted makes the attack even more challenging. In this paper, we investigate to what extent such an external attacker can identify the specific actions that a user is performing on her mobile apps. We design a system that achieves this goal using advanced machine learning techniques. We built a complete implementation of this system, and we also run a thorough set of experiments, which show that our attack can achieve accuracy and precision higher than 95%, for most of the considered actions. We compared our solution with the three state-of-the-art algorithms, and confirming that our system outperforms all these direct competitors.

While smartphone usage become more and more pervasive, people start also asking to which extent such devices can be maliciously exploited as "tracking devices". The concern is not only related to an adversary taking physical or remote control of the device, but also to what a passive adversary without the above capabilities can observe from the device communications. Work in this latter direction aimed, for example, at inferring the apps a user has installed on his device, or identifying the presence of a specific user within a network.

It is generally recognized that the network traffic generated by an individual acts as his biometric signature. Several tools exploit this fact to fingerprint and monitor users. Often, though, these tools access the entire traffic, including IP addresses and payloads. In general, this is not feasible on the grounds that both performance and privacy would be negatively affected. In reality, most ISPs convert user traffic into Net Flow records for a concise representation that does not include the payload. More importantly, a single IP address belonging to a large and distributed network is usually masked using Network Address Translation techniques, thus a few IP addresses may be associated to thousands of individuals (NAT'd IPs). We devised a new fingerprinting framework that overcomes these hurdles. Our system is able to analyze a huge amount of network traffic represented as Net Flows, with the intent to track people. It does so by accurately inferring when users are connected to the network and which IP addresses they are using, even though thousands of users are hidden behind NAT. Our prototype implementation was deployed and tested within an existing large metropolitan WiFi network serving about 200,000 users, with an average load of more than 1,000 users simultaneously connected behind 2 NAT'd IP addresses only. Our solution turned out to be very effective, with an accuracy greater than 90%. We also devised new tools and refined existing ones that may be applied to other contexts related to Net Flow analysis.

Message authentication for resource constrained devices is a challenging topic. Indeed, given the scarceness of on-board resources, solutions that do not rely on asymmetric key cryptography are in demand. A few solutions to address this issue have been proposed, and some have gained the status of state of the art thanks to their effectiveness and efficiency. However, even if state of the art solutions do provide sender-receiver on-the-fly message authentication, they are not able to tackle a few relevant attacks on received messages when the time dimension is taken into account. In particular, we first introduce two types of attacks: the switch command attack (where an adversary pretends to “switch” two messages over time-that is, altering the relative time ordering), and the drop command attack (where an adversary could pretend not having received a message previously sent from the legitimate sender). We then propose a new solution for broadcast authentication that copes with the above introduced attacks: MASS. Our analysis shows that MASS is effective in detecting both switch command and drop command attacks.

Although Location-based Services (LBSs) offer evident advantages to their users, many privacy concerns are sought when user tracking data are shared with the service provider. Existing privacy enhancing solutions (e.g. k-anonymity) usually degrade service precision, and also require the collaboration of the service provider-this latter one not always willing to lose control over the user's location data. In this paper, we propose a solution that is able to obfuscate the user's path to the service provider, while preserving (for the LBS) the capability to compute a few functions-useful for the user-over the obfuscated path. In particular, we provide several contributions: first, we formalize the concept of obfuscation function, and we propose a solution that provides user privacy while allowing users to continue leveraging the services offered by the service provider. Moreover, we formally prove the privacy preserving properties of our approach. Finally, an extensive experimental campaign supports the feasibility of our approach, showing that the proposed solution can be efficiently implemented over mobile device.

Role Based Access Control (RBAC) is the de facto standard in access control models, and is widely used in many applications and organizations of all sizes. However, the task of finding an appropriate set of roles, called role engineering, remains the most challenging roadblock to effective deployment. In recent years, this problem has attracted a lot of attention, with several bottom-up approaches being proposed, under the field of role mining. However, most of these theoretical approaches cannot be directly applied to large scale datasets, which is where they are most necessary. Therefore, in this paper, we look at how to make role mining practical and usable for actual deployment. We propose a six steps methodology that makes role mining scalable without sacrificing on utility and is agnostic to the actual role mining technique used. The experimental evaluation validates the viability of our approach.

Broadcast authentication is an important security mechanism for resource constrained devices, like Wireless Sensor Networks (WSNs). In this paper we revise how broadcast authentication has been enforced in this context, and we show that most of the current implementations (generally based on lightweight hash chain implementing time limited validity of the authentication property) leave open the possibility of a dreadful attack. We detail such an attack, and propose three different protocols to cope with it: PASS, TASS, and PTASS. We further analyze the overhead introduced by these protocols in terms of set-up, transmission overhead, and on device verification.

This paper offers a new role engineering approach to Role-Based Access Control (RBAC), referred to as visual role mining. The key idea is to graphically represent user-permission assignments to enable quick analysis and elicitation of meaningful roles. First, we formally define the problem by introducing a metric for the quality of the visualization. Then, we prove that finding the best representation according to the defined metric is a NP-hard problem. In turn, we propose two algorithms: ADVISER and EXTRACT. The former is a heuristic used to best represent the user-permission assignments of a given set of roles. The latter is a fast probabilistic algorithm that, when used in conjunction with ADVISER, allows for a visual elicitation of roles even in absence of predefined roles. Besides being rooted in sound theory, our proposal is supported by extensive simulations run over real data. Results confirm the quality of the proposal and demonstrate its viability in supporting role engineering decisions.

A recent research thread focused on Unattended Wireless Sensor Networks (UWSNs), that are characterized by the intermittent presence of the sink. An adversary can take advantage of this behavior trying to erase a piece of information sensed by the network before the sink collects it. Therefore, without a mechanism in place to assure data availability, the sink will not ever know that a datum has been compromised. In this paper, we adopt data replication to assure data survivability in UWSNs. In particular, we revisit an epidemic model and show that, even if the data replication process can be modelled as the spreading of a disease in a finite population, new problems that have not been discovered before arise: optimal parameters choice for the model do not assure the intended data survivability. The problem is complicated by the fact that it is driven by two conflicting parameters: On the one hand the flooding of the datum has to be avoided---due to the sensor resource constraints---, while on the other hand data survivability depends on the data replication rate. Using advanced probabilistic tools we achieve a theoretically sound result that assures at the same time: Data survivability, an optimal usage of sensors resources, and a fast and predictable collecting time. These results have been achieved in both the full visibility and the geometrical model. Finally, extensive simulation results support our findings.

One of the most relevant issues pertaining UWSN is to guarantee a certain level of information survivability, even in presence of a powerful attacker. In this paper, we provide a preliminary assessment of epidemic-domain inspired approaches to model the information survivability in UWSN. In particular, we show that epidemic models can be used to set up the parameters that allow the information to survive, once estimated the maximal compromising power of the attacker. Further, we point out that the mere application of these models is not always the right choice. Indeed, it comes out that these deterministic models are not enough accurate, and “unlikely” events can cause the loss of the datum. Finally, we provide some final comments, as well as promising research directions.

The role-based access control (RBAC) model has proven to be cost effective to reduce the complexity and costs of ac-cess permission management. To maximize the advantages offered by RBAC, the role engineering discipline has been introduced. A viable approach is to explore current applica-tions and systems to find de facto roles embedded in existing user permissions, leading to what is usually referred to as role mining. However, a key problem that has not yet been adequately addressed by existing role mining approaches is how to propose roles that have business meaning. In order to do this, we provide a new formal framework that also enjoys practical relevance. In particular, the proposed framework leverages business information—such as business processes and organization structure—to implement role mining algo-rithms. Our key observation is that a role is likely to be meaningful from a business perspective when it involves ac-tivities within the same business process or organizational units within the same branch. To measure the “spreading” of a role among business processes or organization structure, we resort to centrality indices. Such indices are used in our cost-driven approach during the role mining process. Fi-nally, we illustrate the application of the framework through a few examples.