Search results for "verkkohyökkäykset"
showing 10 items of 41 documents
Detection of distributed denial-of-service attacks in encrypted network traffic
2016
Tausta: Hajautetut palvelunestohyökkäykset ovat jo kaksi vuosikymmentä vanhoja. Useita strategioita on kehitetty taistelemaan niiden kasvavaa määrää vastaan vuosien varrella. Sovelluskerroksen protokollien hyökkäykset yleistyvät, ja niitä on hankalampi havaita. Nykyiset havainnointimenetelmät analysoivat tietoliikenteen piirteitä. Paketin sisältö on salattua SSL/TLS liikenteessä, josta syystä sitä ei voida analysoida. Tavoitteet: Tutkielma tarkastelee salatun liikenteen palvelunestohyökkäysten havaintometodien nykyistä tilaa. Tutkielma esittelee myös klusterointiin perustuvan menetelmän ja aikaisemman tutkimuksen kanssa vertailtavissa olevia simulaatiotuloksia. Metodit: Kirjoittaja laati ke…
Attacking TrustZone on devices lacking memory protection
2021
AbstractARM TrustZone offers a Trusted Execution Environment (TEE) embedded into the processor cores. Some vendors offer ARM modules that do not fully comply with TrustZone specifications, which may lead to vulnerabilities in the system. In this paper, we present a DMA attack tutorial from the insecure world onto the secure world, and the design and implementation of this attack in a real insecure hardware.
Creating modern blue pills and red pills
2019
The blue pill is a malicious stealthy hypervisor-based rootkit. The red pill is a software package that is designed to detect such blue pills. Since the blue pill was originally proposed there has been an ongoing arms race between developers that try to develop stealthy hypervisors and developers that try to detect such stealthy hypervisors. Furthermore, hardware advances have made several stealth attempts impossible while other advances enable even more stealthy operation. In this paper we describe the current status of detecting stealth hypervisors and methods to counter them. peerReviewed
Reducing the Time to Detect Cyber Attacks : Combining Attack Simulation With Detection Logic
2021
Cyber attacks have become harder to detect, causing the average detection time of a successful data breach to be over six months and typically costing the target organization nearly four million dollars. The attacks are becoming more sophisticated and targeted, leaving unprepared environments easy prey for the attackers. Organizations with working antivirus systems and firewalls may be surprised when they discover their network has been encrypted by a ransomware operator. This raises a serious question, how did the attacks go undetected? The conducted research focuses on the most common pitfalls regarding late or even non-existent detection by defining the root cause behind the failed detec…
Tietoturvaloukkausten analysointi hunajapurkkijärjestelmän avulla
2016
Tutkielmassa vertailtiin tietoturvaloukkausten ja niiden yritysten tunnistamiseen kehitettyjä ohjelmistoja, joita käytetään parantamaan organisaatioiden tietoturvallisuutta. Tutkittiin, miten tietojärjestelmiin pyritään murtautumaan ja mitä murtautujat pyrkivät murretussa tietojärjestelmässä tekemään. Hunajapurkki on tähän tarkoitukseen suunniteltu, mielenkiintoinen, toisaalta myös hieman ristiriitainen työkalu, mikä voidaan toteuttaa suojaamaan tuotantojärjestelmiä tai toimimaan erillisenä tutkimuksen apuvälineenä. Hunajapurkki ottaa vastaan verkkohyökkäyksiä ja mahdollistaa murtautujan toiminnan tietojärjestelmässä siinä laajuudessa, kuin se halutaan mahdollistaa. Hunajapurkkeja käytettäe…
Transport layer DDoS attack types and mitigation methods in networks
2015
Hajautetut palvelunestohyökkäykset ovat olleet kasvava uhka yrityksille jotka käyttävät tietoverkkoihin perustuvia elementtejä tietojärjestelmissään. Viime aikoina eivät pelkästään liikeyritykset, vaan myös poliittiset organisaatiot ovat olleet hajautettujen palvelunestohyökkäysten kohteina. Tämän takia on erittäin tärkeää hahmoittaa nykyinen tilanne tässä tietoturvan jatkuvasti muuttuvalla alalla. Hyökkäysmenetelmien ja vastatoimenpiteiden uusiutuessa jatkuvasti, tarve ajankohtaiselle tutkimukselle on selkeä. Viiden erilaisen hyökkäystyypin on havaittu koostavan suuremman osan hajautetuista palvelunestohyökkäyksistä vuonna 2014. Nämä olivat SYN, DNS vahvistus, NTP vahvistus, DNS hyökkäykse…
APT Cyber-attack Modelling: Building a General Model
2022
The global community continues to experience an increase in the scale, sophistication, and successful perpetration of cyber-attacks. As the quantity and value of electronic information have increased, so too have the efforts of criminals and other malicious actors who have embraced the Internet as a more anonymous, convenient, and profitable way of carrying out their activities. The systems are attacked more and more by single or multiple hacktivists, state sponsored hackers, cyber criminals, cyber terrorists, cyber spies, or cyber warfare warfighters. The cyber security approach requires a balance of cyber threat intelligence, real time cyber-attack detection and especially the cyber early…
Unsupervised network intrusion detection systems for zero-day fast-spreading network attacks and botnets
2015
Today, the occurrence of zero-day and complex attacks in high-speed networks is increasingly common due to the high number vulnerabilities in the cyber world. As a result, intrusions become more sophisticated and fast to detrimental the networks and hosts. Due to these reasons real-time monitoring, processing and intrusion detection are now among the key features of NIDS. Traditional types of intrusion detection systems such as signature base IDS are not able detect intrusions with new and complex strategies. Now days, automatic traffic analysis and anomaly intrusion detection became more efficient in field of network security however they suffer from high number of false alarms. Among all …
Emergency Response Model as a part of the Smart Society
2021
Centralized hybrid emergency model with predictive emergency response functions is necessary when the purpose is to protect the critical infrastructure (CI). A shared common operational picture among Public Protection and Disaster Relief (PPDR) authorities means that a real-time communication link from the local level to the state-level exists. If a cyberattack would interrupt electricity transmission, telecommunication networks will discontinue operating. Cyberattack becomes physical in the urban and maritime area if an intrusion has not been detected. Hybrid threats require hybrid responses. The purpose of this qualitative research was to find out technological-related fundamental risks …
Cybersecurity Attacks on Software Logic and Error Handling Within ADS-B Implementations: Systematic Testing of Resilience and Countermeasures
2022
Automatic Dependent Surveillance-Broadcast (ADS-B) is a cornerstone of the next-generation digital sky and is now mandated in several countries. However, there have been many reports of serious security vulnerabilities in the ADS-B architecture. In this paper, we demonstrate and evaluate the impact of multiple cyberattacks on ADS-B via remote radio frequency links that affected various network, processing, and display subsystems used within the ADS-B ecosystem. Overall we implemented and tested 12 cyberattacks on ADS-B in a controlled environment, out of which 5 attacks were presented or implemented for the first time. For all these attacks, we developed a unique testbed that consisted of 1…