Antonios Gouglidis

Technology-related disasters: A survey towards disaster-resilient Software Defined Networks.

Resilience against disaster scenarios is essential to network operators, not only because of the potential economic impact of a disaster but also because communication networks form the basis of crisis management. COST RECODIS aims at studying measures, rules, techniques and prediction mechanisms for different disaster scenarios. This paper gives an overview of different solutions in the context of technology-related disasters. After a general overview, the paper focuses on resilient Software Defined Networks.

Anomaly Detection in the Cloud Using Data Density

Cloud computing is now extremely popular because of its use of elastic resources to provide optimized, cost-effective and on-demand services. However, clouds may be subject to challenges arising from cyber attacks including DoS and malware, as well as from sheer complexity problems that manifest themselves as anomalies. Anomaly detection techniques are used increasingly to improve the resilience of cloud environments and indirectly reduce the cost of recovery from outages. Most anomaly detection techniques are computationally expensive in a cloud context, and often require problem-specific parameters to be predefined in advance, impairing their use in real-time detection. Aiming to overcome these problems, we propose a technique for anomaly detection based on data density. The density is computed recursively, so the technique is memory-less and unsupervised, and therefore suitable for real-time cloud environments. We demonstrate the efficacy of the proposed technique on a dataset created in our cloud testbed. The dataset consists of feature vectors obtained from a physical cloud testbed network experiencing migration under controlled traffic conditions modelling scenarios combining normal network use with network-based attacks. The obtained results, which include precision, recall, accuracy, F-score and G-score, show that network level attacks are detectable with high accuracy.

The Extended Cloud: Review and Analysis of Mobile Edge Computing and Fog From a Security and Resilience Perspective

Mobile edge computing (MEC) and fog are emerging computing models that extend the cloud and its services to the edge of the network. The emergence of both MEC and fog introduce new requirements, which mean their supported deployment models must be investigated. In this paper, we point out the influence and strong impact of the extended cloud (i.e., the MEC and fog) on existing communication and networking service models of the cloud. Although the relation between them is fairly evident, there are important properties, notably those of security and resilience, that we study in relation to the newly posed requirements from the MEC and fog. Although security and resilience have been already investigated in the context of the cloud-to a certain extent-existing solutions may not be applicable in the context of the extended cloud. Our approach includes the examination of models and architectures that underpin the extended cloud, and we provide a contemporary discussion on the most evident characteristics associated with them. We examine the technologies that implement these models and architectures, and analyze them with respect to security and resilience requirements. Furthermore, approaches to security and resilience-related mechanisms are examined in the cloud (specifically, anomaly detection and policy-based resilience management), and we argue that these can also be applied in order to improve security and achieve resilience in the extended cloud environment.

Threat awareness for critical infrastructures resilience

Utility networks are part of every nations critical infrastructure, and their protection is now seen as a high priority objective. In this paper, we propose a threat awareness architecture for critical infrastructures, which we believe will raise security awareness and increase resilience in utility networks. We first describe an investigation of trends and threats that may impose security risks in utility networks. This was performed on the basis of a viewpoint approach that is capable of identifying technical and non-technical issues (e.g., behaviour of humans). The result of our analysis indicated that utility networks are affected strongly by technological trends, but that humans comprise an important threat to them. This provided evidence and confirmed that the protection of utility networks is a multi-variable problem, and thus, requires the examination of information stemming from various viewpoints of a network. In order to accomplish our objective, we propose a systematic threat awareness architecture in the context of a resilience strategy, which ultimately aims at providing and maintaining an acceptable level of security and safety in critical infrastructures. As a proof of concept, we demonstrate partially via a case study the application of the proposed threat awareness architecture, where we examine the potential impact of attacks in the context of social engineering in a European utility company.

Protecting Water Utility Networks from Advanced Persistent Threats: A Case Study

The sovereignty and wellbeing of nations is highly dependent on the continuous and uninterrupted operation of critical infrastructures. Thus, the protection of utilities that provision critical services (e.g., water, electricity, telecommunications) is of vital importance given the severity imposed by any failure of these services. Recent security incidents in the context of critical infrastructures indicate that threats in such environments appear to be increasing both in frequency and intensity. The complexity of typical critical infrastructures is among the factors that make these environments vulnerable to threats. One of the most problematic types of threat is an advanced persistent threat (an APT). This usually refers to a sophisticated, targeted, and costly attack that employs multiple attack vectors to gain access to the target system, then to operate in stealth mode when penetration is achieved, and to exfiltrate data or cause failures inside the system. In this chapter, we demonstrate how a set of processes developed in the context of HyRiMs risk management framework can assist in minimizing the damage caused to a utility organization that is subjected to an APT style of attack. Specifically, the framework is demonstrated using data from a real-world water utility network and an industrial control system (ICS) testbed, and in which optimal defensive strategies are investigated.

All That Glitters Is Not Gold: On the Effectiveness of Cybersecurity Qualifications

Do today’s certification qualifications effectively assess cybersecurity professionals’ core competencies? Five distinct techniques for identifying qualifications form the basis of a large-scale survey of industry stakeholders.

Random Damage in Interconnected Networks

When looking at security incidents in Industrial Control System (ICS) networks, it appears that the interplay between an attacker and a defender can be modeled using a game-theoretic approach. Preparing a game require several steps, including the definition of attack and defense strategies, estimation of payoffs, etc. Specifically, during the preparation of a game, the estimation of payoffs (i.e. damage) for each possible scenario is one of its core tasks. However, damage estimation is not always a trivial task since it cannot be easily predicted, primarily due to incomplete information about the attack or due to external influences (e.g. weather conditions, etc.). Therefore, it is evident that describing the payoffs by means of a probability distribution may be an appropriate approach to deal with this uncertainty. In this chapter, we show that if the network structure of an organization is known, it is possible to estimate the payoff distribution by means of a stochastic spreading model. To this extend, the underlying network is modeled as a graph whose edges are classified depending on their properties. Each of these classes has a different probability of failure (e.g. probability of transmitting a malware). Finally, we demonstrate how these probabilities can be estimated, even if only subjective information is available.

Assessing the Impact of Malware Attacks in Utility Networks

Utility networks are becoming more and more interconnected. Besides the natural physical interdependencies (e.g., water networks heavily depend on power grids, etc.), utility networks are nowadays often monitored and operated by industrial control systems (ICS). While these systems enhance the level of control over utility networks, they also enable new forms of attacks, such as cyberattacks. During the last years, cyberattacks have occurred more frequently with sometimes a significant impact on the company as well as the society. The first step toward preventing such incidents is to understand how an infection of one component influences the rest of the network. This malware spreading can be modeled as a stochastic process on a graph where edges transmit an infection with a specific probability. In practice, this probability depends on the type of the malware (e.g., ransomware, spyware, virus, etc.) as well as on the type of the connection between the nodes (e.g., physical or logical connections). In this chapter, we illustrate how the abstract model can be put into practice for a concrete use case.

G-DPS: A Game-Theoretical Decision-Making Framework for Physical Surveillance Games

Critical infrastructure protection becomes increasingly a major concern in governments and industries. Besides the increasing rates of cyber-crime, recent terrorist attacks bring critical infrastructure into a severer environment. Many critical infrastructures, in particular those operating large industry complexes, incorporate some kind of physical surveillance technologies to secure their premises. Surveillance systems, such as access control and malicious behavior detection, have been long used for perimeter security as a first line of defense. Traditional perimeter security solutions typically monitor the outer boundary structures and lines, thus ignoring threats from the inside. Moreover, the deterrent effect of surveillance systems like Closed Circuit Television (CCTV) becomes considerably less important due to the inflexibility induced by their fixed installations. Hence, an infrastructure’s surveillance policy is more predictable and a potential adversary has a better opportunity to observe and bypass it subsequently. Therefore, it is important to maintain situational awareness within such environments so that potential intruders can still be detected. Regardless of whether personnel (e.g., security guards, etc.) or technical solutions (e.g., cameras, etc.) are applied, such surveillance systems have an imperfect detection rate, leaving an intruder with the potential to cause some damage to the infrastructure. Hence, the core problem is to find an optimal application of the surveillance technology at hand to minimize such a potential damage. This problem already has a natural reflection in game theory known as cops-and-robbers game but current models always assume a deterministic outcome of the gameplay. In this work, we present a decision-making framework, which assesses possible choices and alternatives towards finding an optimal surveillance configurations and hence minimizing addressed risks. The decision is made by means of a game-theoretic model for optimizing physical surveillance systems and minimizing the potential damage caused by an intruder with respect to the imperfect detection rates of surveillance technology. With our approach, we have the advantage of using categorical (or continuous) distributions instead of a single numerical value to capture the uncertainty in describing the potential damage of an intruder. This gives us the opportunity to model the imperfection of surveillance systems and to optimize over large collections of empirical or simulated data without losing valuable information during the process.

A Multi-commodity Network Flow Model for Cloud Service Environments

Next-generation systems, such as the big data cloud, have to cope with several challenges, e.g., move of excessive amount of data at a dictated speed, and thus, require the investigation of concepts additional to security in order to ensure their orderly function. Resilience is such a concept, which when ensured by systems or networks they are able to provide and maintain an acceptable level of service in the face of various faults and challenges. In this paper, we investigate the multi-commodity flows problem, as a task within our \(D^2R^2+DR\) resilience strategy, and in the context of big data cloud systems. Specifically, proximal gradient optimization is proposed for determining optimal computation flows since such algorithms are highly attractive for solving big data problems. Many such problems can be formulated as the global consensus optimization ones, and can be solved in a distributed manner by the alternating direction method of multipliers (ADMM) algorithm. Numerical evaluation of the proposed model is carried out in the context of specific deployments of a situation-aware information infrastructure.