Search results for "Tietoturva"
showing 10 items of 184 documents
Exploring Azure Active Directory Attack Surface: Enumerating Authentication Methods with Open-Source Intelligence Tools
2022
Azure Active Directory (Azure AD) is Microsoft’s identity and access management service used globally by 90 per cent of Fortune 500 companies and many other organisations. Recent attacks by nation-state adversaries have targeted these organisations by exploiting known attack vectors. In this paper, open-source intelligence (OSINT) is gathered from organisations using Azure AD to explore the current attack surface. OSINT is collected from Fortune 500 companies and top 2000 universities globally. The collected OSINT includes authentication methods used by the organisation and the full name and phone number of the primary technical contact. The findings reveal that most organisations are using…
A Comprehensive Survey on Cooperative Relaying and Jamming Strategies for Physical Layer Security
2019
Physical layer security (PLS) has been extensively explored as an alternative to conventional cryptographic schemes for securing wireless links. Many studies have shown that the cooperation between the legitimate nodes of a network can significantly enhance their secret communications performance, relative to the noncooperative case. Motivated by the importance of this class of PLS systems, this paper provides a comprehensive survey of the recent works on cooperative relaying and jamming techniques for securing wireless transmissions against eavesdropping nodes, which attempt to intercept the transmissions. First, it provides a in-depth overview of various secure relaying strategies and sch…
Hypervisor-based Protection of Code
2019
The code of a compiled program is susceptible to reverse-engineering attacks on the algorithms and the business logic that are contained within the code. The main existing countermeasure to reverse-engineering is obfuscation. Generally, obfuscation methods suffer from two main deficiencies: 1) the obfuscated code is less efficient than the original and 2) with sufficient effort, the original code may be reconstructed. We propose a method that is based on cryptography and virtualization. The most valuable functions are encrypted and remain inaccessible even during their execution, thus preventing their reconstruction. A specially crafted hypervisor is responsible for decryption, execution, a…
Hypervisor-assisted dynamic malware analysis
2021
AbstractMalware analysis is a task of utmost importance in cyber-security. Two approaches exist for malware analysis: static and dynamic. Modern malware uses an abundance of techniques to evade both dynamic and static analysis tools. Current dynamic analysis solutions either make modifications to the running malware or use a higher privilege component that does the actual analysis. The former can be easily detected by sophisticated malware while the latter often induces a significant performance overhead. We propose a method that performs malware analysis within the context of the OS itself. Furthermore, the analysis component is camouflaged by a hypervisor, which makes it completely transp…
Artificial Intelligence in Protecting Smart Building’s Cloud Service Infrastructure from Cyberattacks
2020
Gathering and utilizing stored data is gaining popularity and has become a crucial component of smart building infrastructure. The data collected can be stored, for example, into private, public, or hybrid cloud service infrastructure or distributed service by utilizing data platforms. The stored data can be used when implementing services, such as building automation (BAS). Cloud services, IoT sensors, and data platforms can face several kinds of cybersecurity attack vectors such as adversarial, AI-based, DoS/DDoS, insider attacks. If a perpetrator can penetrate the defenses of a data platform, she can cause significant harm to the system. For example, the perpetrator can disrupt a buildin…
Evaluation of Ensemble Machine Learning Methods in Mobile Threat Detection
2017
The rapid growing trend of mobile devices continues to soar causing massive increase in cyber security threats. Most pervasive threats include ransom-ware, banking malware, premium SMS fraud. The solitary hackers use tailored techniques to avoid detection by the traditional antivirus. The emerging need is to detect these threats by any flow-based network solution. Therefore, we propose and evaluate a network based model which uses ensemble Machine Learning (ML) methods in order to identify the mobile threats, by analyzing the network flows of the malware communication. The ensemble ML methods not only protect over-fitting of the model but also cope with the issues related to the changing be…
Too many passwords? : How understanding our memory can increase password memorability
2018
Passwords are the most common authentication mechanism, that are only increasing with time. Previous research suggests that users cannot remember multiple passwords. Therefore, users adopt insecure password practices, such as password reuse in response to their perceived memory limitations. The critical question not currently examined is whether users’ memory capabilities for password recall are actually related to having a poor memory. This issue is imperative: if insecure password practices result from having a poor memory, then future password research and practice should focus on increasing the memorability of passwords. If, on the other hand, the problem is not solely related to memory…
Understanding the inward emotion-focused coping strategies of individual users in response to mobile malware threats
2021
According to coping theory, individuals cope with information system threats by adopting either problem-focused coping (PFC) or emotion-focused coping (EFC). However, little is known about EFC in the information security (ISec) literature. Moreover, there is potential confusion regarding the meaning of some EFC strategies. Hence, ISec scholars and practitioners may (i) have a narrow view of EFC or (ii) confuse it with other concepts. In this study, we offer one response to this issue. We first address the ambiguity regarding EFC before differentiating five inward EFC strategies and assessing them empirically in the mobile malware context. To the best of our knowledge, this study is the firs…
DGA detection using machine learning methods
2016
Yksi yleisimmistä kyberhyökkäysistä on käyttää ryhmä yksityisiä tietokoneita (private computers), joita käytetään esimerkiksi salaisien tietojen levittämiseen. Näitä koneryhmiä kutsutaan botnet. Botnetit pysyvät havaitsemattomana käyttämällä Domain Name Generation (DGA) menetelmää, joka luo ajoittain ja ratkaisee suurina lukumäärinä erillaisia pseudosatunnaisia verkkotunnuksia, kunnes jokin näistä pseudosatunnaisista verkkotunnuksista DNS palvelin hyväksyy. Tämän tutkielman tarkoitus on kehitellä ei- ohjattuja koneoppimismenetelmiä ja vertailla näiden tarkkuutta ohjattuihin koneoppimismenetelmiin DGA hyökkäyksien havaitsemiseen. Lisäksi, tutkielmassa esitellään Random One Class Support Vect…
DNS Tunneling Detection Techniques – Classification, and Theoretical Comparison in Case of a Real APT Campaign
2017
Domain Name System (DNS) plays an important role as a translation protocol in everyday use of the Internet. The purpose of DNS is to translate domain names into IP addresses and vice versa. However, its simple architecture can easily be misused for malicious activities. One huge security threat concerning DNS is tunneling, which helps attackers bypass the security systems unnoticed. A DNS tunnel can be used for three purposes: as a command and control channel, for data exfiltration or even for tunneling another protocol through it. In this paper, we surveyed different techniques for DNS tunneling detection. We classified those first based on the type of data and then within the categories b…