Risks and Security of Internet and Systems: 15th International Conference, CRiSIS 2020, Paris, France, November 4–6, 2020, Revised Selected Papers (Lecture Notes in Computer Science)

This book constitutes the proceedings of the 15 th International Conference on Risks and Security of Internet and Systems, CRiTIS 2020, which took place during November 4-6, 2020. The conference was originally planned to take place in Paris, France, but had to change to an online format due to the COVID-19 pandemic. The 16 full and 7 short papers included in this volume were carefully reviewed and selected from 44 submissions. In addition, the book contains one invited talk in full paper length. The papers were organized in topical sections named: vulnerabilities, attacks and intrusion detection; TLS, openness and security control; access control, risk assessment and security knowledge; risk analysis, neural networks and Web protection; infrastructure security and malware detection. Preface Organization Contents Keynote Talk New Dimensions of Information Warfare: The Economic Pillar—Fintech and Cryptocurrencies 1 Introduction 1.1 Motivations 1.2 Contribution 2 Cryptocurrencies 2.1 Vulnerabilities of the Technological Pillars 2.2 Vulnerabilities of the IT Infrastructure 3 Stock Market 3.1 Market Manipulation Threat 3.2 Double-Edged Technologies 3.3 Threatening Availability 4 Conclusion References Vulnerabilities, Attacks and Intrusion Detection Measuring and Modeling Software Vulnerability Security Advisory Platforms 1 Introduction 2 Risk Aware Patch Management and Related Work 3 Measurement Setup and Measurement Insights 4 Analytical Model 4.1 Model Description 4.2 Security Advisory Platforms Metrics of Interest 5 Evaluation 6 Conclusion References Frequency Hopping Spread Spectrum to Counter Relay Attacks in PKESs 1 Introduction 2 Cars Keyless Entry Systems Hacking 3 Mitigating Relay Attacks 3.1 Frequency-Hopping Spread Spectrum 3.2 Frequency-Hopping Spread Spectrum in RFID 3.3 Applying FHSS on PKESs 3.4 PKES Design 4 Related Work 5 Conclusion References A Deeper Analysis of Adversarial Examples in Intrusion Detection 1 Introduction 2 Background 2.1 Artificial Neural Networks 2.2 Adversarial Machine Learning 2.3 Adversarial Examples 2.4 Adversarial Examples Generation Methods 3 Literature Review 4 Experimentation Approach and Settings 4.1 Dataset and Pre-processing 4.2 Target Model Design and Training 4.3 Adversarial Attacks Models 5 Evaluation of the Perturbation Potential 5.1 Fast Gradient Sign Method 5.2 Basic Iterative Method (BIM) 5.3 DeepFool 5.4 Carlini and Wagner 5.5 Jacobian-Based Saliency Map Attack 6 Criteria for Valid End-To-End Adversarial Attacks 7 Conclusion and Future Work References TLS, Openness and Security Control Implementation Flaws in TLS Stacks: Lessons Learned and Study of TLS 1.3 Benefits 1 Common Programming Errors 1.1 CVE-2014-1266: Apple's goto fail 1.2 CVE-2014-0092: GnuTLS' goto fail 1.3 CVE-2002-0862 and CVE-2011-0228: BasicConstraints Checks 1.4 CVE-2014-0160: Heartbleed 1.5 CVE-2014-6321: WinShock 1.6 Lessons Learned 2 Parsing Bugs 2.1 CVE-2009-2408: Null Characters in Distinguished Names 2.2 CVE-2014-3511: OpenSSL Downgrade Attack 2.3 CVE-2014-1568: NSS/CyaSSL/PolarSSL Signature Forgery 2.4 Lessons Learned 3 The Real Impact of Obsolete Cryptography on Security 3.1 CVE-2013-0169: The Dangers of MAC-then-Encrypt 3.2 CVE-2016-0270: Issues with GCM Nonce Generation 3.3 CVE-2014-0411 and Others: PKCS#1 v1.5 and Bleichenbacher 3.4 Lessons Learned 4 The Consequences of Complex State Machines 4.1 CVE-2014-0224: EarlyCCS 4.2 SMACK: State Machine AttaCKs 4.3 Black-Box Fuzzing to Evaluate TLS State Machines 4.4 Lessons Learned 5 Related Work 6 Conclusion A Apple's goto fail Vulnerable Code B GnuTLS' goto fail Vulnerable Code C Examples of Automata Inferred from TLS Implementations References Security Through Transparency and Openness in Computer Design 1 Instruction Set Architectures and Their Role for Security 1.1 Instruction Set Architecture in Computer Design 1.2 Role of the Instruction Set Architecture for Security 1.3 Open ISAs in Practice: The Case of RISC-V 2 Security Promises of Open ISAs 3 Legal and Policy Perils of Open ISAs 3.1 Manageability, Collaboration and Competition 3.2 Intellectual Property Rights 3.3 Liability 4 Conclusion and Further Work References An ML Behavior-Based Security Control for Smart Home Systems 1 Introduction 2 Related Work 3 Proposed Framework 3.1 Overview 3.2 Initial Stage 3.3 Analysis Stage 4 Experimental Evaluation 4.1 Evaluation Dataset 4.2 Evaluation Methodology 4.3 Results and Discussion 5 Conclusion References Access Control, Risk Assessment and Security Knowledge A Posteriori Analysis of Policy Temporal Compliance 1 Introduction 2 Fundamentals 2.1 Event Calculus 2.2 OWL and SWRL 2.3 Modeling Event Calculus in SWRL 3 A Posteriori Access Control Framework 4 Multi-Agent System Architecture and Functioning 4.1 The Policy Agent 4.2 The Mediator Agent 4.3 Data Source Agents 4.4 Event Calculus Agent 5 Illustrating the Example 6 Capabilities Evaluation 7 Related Work 8 Conclusion and Future Perspectives References Asset-Driven Approach for Security Risk Assessment in IoT Systems 1 Introduction 2 State of the Art 2.1 Aurum 2.2 CORAS 2.3 CRAMM 2.4 EBIOS 2.5 MEHARI 3 BRAIN-IoT Risk Assessment Methodology 3.1 Identification of Assets 3.2 Threats and Vulnerabilities 3.3 Security Objectives 3.4 Security Requirements and Countermeasures 4 Case Study 5 Conclusion References Heterogeneous Security Events Prioritization Using Auto-encoders 1 Introduction 2 State of the Art in AI Applied to Security Monitoring 3 Computing Anomaly Score on Heterogeneous Events 3.1 Basics on Neural Networks Auto-encoders for Anomaly Detection 3.2 Input Transformation 3.3 Neural Network Structure 3.4 Event Clustering 3.5 Anomaly Score Computation 4 Implementation 4.1 Heterogeneous Events 4.2 The Monitored System Architecture 4.3 Considered Event Types 5 Approach Assessment 5.1 Collecting Data 5.2 Assessing Clustering Capabilities 5.3 Anomaly Detection Results 6 Conclusion References Community Knowledge About Security: 1 Introduction 2 Related Work 3 Background 3.1 Data, Information and Knowledge 3.2 Security Related Information 4 Approach 5 Classification 6 Evaluation 6.1 RQ1: Can We Semi-automatically Extract Security Knowledge from Code Communities? 6.2 RQ2: Could Artificial Intelligence Approaches Be Leveraged in Order to Classify the Code Fragments into Vulnerabilities, Patches, and Exploits Semi-automatically? 7 Conclusion References Risk Analysis, Neural Networks and Web Protection Modelling Security Risk Scenarios Using Subjective Attack Trees 1 Introduction 2 Attack Trees and Related Work 3 Subjective Logic 4 Subjective Attack Trees 5 Security Events Evaluation Using Subjective Logic 5.1 The Two Criteria Evaluation 5.2 Evaluation Rules for Security Events 5.3 Computing Final Opinions About Security Events 6 Propagation of Subjective Opinions in SATs 7 Experimental Evaluation 8 Conclusions and Future Work References Premium Access to Convolutional Neural Networks 1 Introduction 1.1 Related Works 2 Background 2.1 Convolutional Neural Networks 2.2 ResNet18 2.3 Selecting Optimal Parameters 2.4 Per User Training 2.5 Finite Fields 3 Protecting Optimal Parameters 4 Example of Application: Facial Recognition 4.1 Optimal Parameters for ResNet18 4.2 Batch Normalization 4.3 Convolutional Layer 4.4 Exhaustive Search FAR and FRR 5 Conclusion References An OWASP Top Ten Driven Survey on Web Application Protection Methods 1 Introduction 2 Security Attacks Against Web Applications 2.1 Injection 2.2 Broken Authentication and Session Management 2.3 Cross-site Scripting (XSS) 2.4 Insecure Direct Object References 2.5 Security Misconfiguration 2.6 Sensitive Data Exposure 2.7 Missing Function Level Access Control 2.8 Cross-site Request Forgery (CSRF) 2.9 Using Components with Known Vulnerabilities 2.10 Unvalidated Redirects and Forwards 3 Countermeasures Against Attacks 3.1 Countermeasures Against Injection Attacks 3.2 Countermeasures Against Broken Authentication and Session Management 3.3 Countermeasures Against XSS Attacks 3.4 Countermeasures Against Insecure Direct Object References and Missing Function Level Access Control 3.5 Countermeasures Against Sensitive Data Exposure 3.6 Countermeasures Against CSRF 3.7 Countermeasures Against Unvalidated Redirects and Forwards 3.8 Discussion 4 Protection Methods for WA Firewalls 4.1 Open Source WAF 4.2 Commercial WAF 5 Model-Based Testing and Formal Methods for Web Service Security 6 Conclusions and Future Work References Infrastructure Security and Malware Detection Autonomous Vehicle Security: Literature Review of Real Attack Experiments 1 Introduction 2 Overview of AV Technology 3 Potential Threats and Practical Attacks 3.1 Attack Surfaces and Security Issues 3.2 Survey of Real-World Experiments 4 Threat Modeling of AVs 5 Security Requirements and Threat Mitigation 6 Conclusion References New Dataset for Industry 4.0 to Address the Change in Threat Landscape 1 Introduction 2 Related Works 3 New Dataset Proposal 3.1 Dataset Novelty and Added Value 3.2 Design Criteria 3.3 Dataset Generation Process 3.4 Dataset Model 3.5 Data Acquisition: Extractor 3.6 Dataset Approach Extension to Other Protocols 4 Experimentation Environment 4.1 Description 4.2 Attacks Scenarios 5 DATASET 5.1 Preprocessing and Labelling 5.2 Extracted Features 6 Conclusion and Perspectives References Toward Semantic-Based Android Malware Detection Using Model Checking and Machine Learning 1 Introduction 2 Related Work 2.1 Model Checking Based Malware Detection 2.2 Machine Learning Based Malware Detection 3 Preliminaries 3.1 LNT Language 3.2 Modal mu sans avertissement-Calculus 4 Modeling Android Applications 4.1 Removal of Silent Chains 4.2 Synchronization Mechanisms 5 Security Related Android Behaviors 5.1 Evasion Technique 5.2 Block Incoming SMS 5.3 Ransomware 5.4 Spyware 5.5 Native Code 5.6 Use of Obfuscation 5.7 Check Ip Address 5.8 Domain Name Server (DNS) Lookup 6 Machine Learning 7 Discussion and Futur Work 8 Conclusion References Short Papers Augmented Voting Reality 1 Introduction 2 Physical Embodiment of the Setup 2.1 Voting Box 2.2 Ballots 3 Self-cancellation Property 4 Our Proposal 4.1 Referendum Preparation 4.2 Referendum and Tally Procedures 5 Conclusion References Malicious Http Request Detection Using Code-Level Convolutional Neural Network 1 Introduction 2 Related Works 3 CNN Based Code Level 3.1 Http Request Pre-processing 3.2 The Designed CNN 4 Experiments and Results 4.1 Large Scale Dataset 4.2 Evaluation Metrics and Results 4.3 Results and Comparison Study 5 Conclusion References Enhancement of a Business Model with a Business Contextual Risk Model 1 Introduction 2 Background 3 Related Works 4 Risk-Driven Business Contextual Model 4.1 Business Contextual Risk Metamodel 4.2 Security Management Process for Business Contextual Risk Model 5 Business Contextual Risk Model Integration into MDA Approach 6 Conclusion and Future Works References Secure Data Processing for Industrial Remote Diagnosis and Maintenance 1 Introduction 2 Secure Maintenance of Critical Infrastructures 3 Homomorphic Encryption 4 Privacy Preserving for Remote Maintenance Infrastructure 4.1 Threat Model 4.2 Privacy-Preserving Protocol for Remote Maintenance 4.3 Protocol Optimization with Transciphering 5 Implementation 5.1 Homomorphic Calculus of an Average 5.2 Homomorphic Calculus of a Standard Deviation 5.3 Performance 6 Conclusion and Future Work References Towards Attacker Attribution for Risk Analysis 1 Introduction 2 Attacker Attribution 2.1 Attacker Model and Classification of Attributes 2.2 Source Data for Attacker Attribution and Experiments 3 Conclusion References Modelling and Verification of Safety of Access Control in SCADA Systems 1 Introduction 2 Safety-Aware RBAC 3 Overview of Event-B 4 Case Study – Monitoring and Control of a Power Switch 5 Related Work and Conclusions References Security Assessment and Hardening of Autonomous Vehicles 1 Introduction 2 Related Work 3 AV Security Assessment 4 AV Code Generation 5 Experimental Results 6 Conclusion References Author Index