Cross-program taint analysis for IoT systems

To increase and maintain web application security, developers could use some different methods, one of them is static code analysis. This method could find security vulnerabilities inside a source code without the need of running the program. It could also be automated by using tools, which considered more efficient than manual reviews. One specific method which is commonly used in static code analysis is taint analysis. Taint analysis usually utilizes source code modeling to prepare the code for analysis process to detect any untrusted data flows into security sensitives computations. While this kind of analysis could be very helpful, static code analysis tool for Laravel-based web application is still quite rare, despite its popularity. Therefore, in this research, we want to know how static code (taint) analysis could be utilized to detect security vulnerabilities and how the projects (Laravel-based) should be modeled in order to facilitate this analysis. We then developed a static analysis tool, which models the application’s source code using AST and dictionary to be used as the base of the taint analysis. The tool first parsed the route file of Laravel project to get a list of controller files. Each file in that list would be parsed in order to build the source code representation, before actually being analyzed using taint analysis method. The experiments was done using this tool shows that the tools (with taint analysis) could detect 13 security vulnerabilities from 6 Laravel-based projects with one False Negative. An ineffective sanitizer was the suspected cause of this False Negative. This also shows that proposed modeling technique could be helpful in facilitating taint analysis in Laravel-based projects. For future development and studies, this tool should be tested with more Laravel and even other framework based web application with a wider range of security vulnerabilities.

Subject of research: Subject of research: The object of research is the security infrastructure of intelligence-enabled environments such as IoT systems and cyber-physical systems that involve high levels of heterogeneity, mobility, as well as constantly changing boundaries of operations. Investigated problem: The identified problem description relates to the inefficacy of classical perimeter security concepts in a scaled-up intelligence environment where the boundaries of a network are no more precise, making trust a concept difficult to define by location. The main scientific results: The study proposes an analysis framework with which the principles of Zero Trust can be applied to smart systems following the guidelines of NIST SP 800-207. The research highlights the vulnerabilities associated with multi-level intelligent environments and has outlined the essential elements of effective Zero Trust Architecture to be adapted to resource-constrained scenarios. It has concluded that to adequately safeguard IoT and cyber-physical systems, the need arises to integrate the aspects of continuous verification, context-responsive access control, and adaptive trust assessments. The research has shown that the integration of the aspects of artificial intelligence and machine learning with predictive threat analysis, along with the usage of blockchain identity management, highly enhances the resilience level of the system. The area of practical use of the research results: The research results can be applied in the implementation of secure IoT ecosystems, cyber-physical systems, cloud infrastructure, and enterprise networks that require a high level of adaptability to changing threats. Innovative technological product: The innovative technological product that has been described in the research paper is a Zero Trust Architecture framework that has been designed for smart environments which are diverse and resource-scarce. Scope of the innovative technological product: The proposed framework is universal in application, as it spans smart cities, industrial IoT, healthcare IoT, smart areas, smart buildings, smart transportation systems, smart grids, smart energy, smart homes, smart education, smart industries, smart governance, smart IoT, smart security, smart surveillance, smart sensors, smart

At present, Cross Site Scripting (XSS) vulnerability exists in most web sites. The main reason is the lack of effective validation and filtering mechanisms for user input data from web request. This paper explores vulnerability detection method which based on taint dependence analysis and implements a prototype system for Java Web program. We treat all user input as tainted data, and track the flow of Web applications, then we judge whether it will trigger an attack or not. The taint dependent analysis algorithm mentioned in this paper is used to construct the taint dependency graph. Next the value representation method of the string tainted object based on finite state automata is discussed. Finally, we propose the vulnerability detection method for the program. The experiment result shows that the prototype system can detect reflection cross-site scripting vulnerability well in those programs which dont have effective treatment for the user input data.

Federated Learning (FL) has emerged as a suitable option for collaborative, user-centric machine learning while protecting sensitive user data. FL differs significantly from traditional centralized frameworks that collect raw data on a central server. FL focuses on collecting model updates generated locally on edge devices. With traditional FL approaches, data must be downloaded to a central server for model training. In contrast, training occurs on the edge and only model updates are sent. This decentralized framework, unlike traditional FL approaches, is ideal for ubiquitous applications—systems woven seamlessly into everyday surroundings like smart homes, advanced mobile devices, and IoT systems—where sensitive data is constantly and automatically generated. In these systems, user privacy is paramount, and advanced methods must be implemented to ensure privacy and system efficacy. This paper discusses the integration of FL into ubiquitous environments, addressing the relevance, advantages, and disadvantages of this approach. I’d like to focus on privacy-preserving methods, but their preservation against data leakage and adversary attacks adds significant value. There are case studies to show the challenges encountered, lessons learned, and the use of FL within privacy-centric ubiquitous systems. In closing this paper, I summarize the key points and underscore the transformational potential of FL for privacy-sensitive, innovative systems. I also promote further research in this area to support its practical relevance. This paper demonstrates that among the many approaches to privacy within pervasive computing, FL is the only one that is practical and scalable.

Designing and assessing the security of IoT systems is very challenging, mainly due to the fact that new threats and vulnerabilities affecting IoT devices are continually discovered and published. Moreover, new (typically low-cost) devices are continuously plugged-in into IoT systems, thus introducing unpredictable security issues. This paper proposes a methodology aimed at automating the threat modeling and risk analysis processes for an IoT system. Such methodology enables to identify existing threats and related countermeasures and relies upon an open catalogue, built in the context of EU projects, for gathering information about threats and vulnerabilities of the IoT system under analysis. In order to validate the proposed methodology, we applied it to a real case study, based on a commercial smart home application.

With the industrial revolution 4.0, the use of IoT-based systems is increasing, both in the field of health manufacturing, urban planning, housing, and even automotive. Therefore, the security of the IoT system needs to be considered, this is related to data integrity, privacy, service stability. Through intrusion detection, activities on the IoT system will be able to be analyzed whether there are suspicious activities that can interfere with or threaten IoT services. In several previous studies in the literature, the approach used to detect intrusions in the IoT system has a high false alarm rate. This research proposes an approach through machine learning, specifically the ensemble learning approach and the synthetic minority over-sampling technique (SMOTE) method as a method of detecting intrusions in the IoT system which is expected to produce better performance. The results of this study indicate that the proposed approach is able to detect intrusion and classify into five types of intrusion including normal intrusion, probe, dos, r2l, u2r. Based on the evaluation results, the proposed approach can improve the performance of intrusion detection in terms of accuracy to 97.02%, detection rate of 97%, false alarm rate 0.16%, compared to base learning and approaches in previous studies used as intrusion detection methods, but in processing time performance have not shown satisfying results.

Android is currently the most popular smartphone operating system in use, with its success attributed to the large number of applications available from the Google Play Store. However, these contain issues relating to the storage of the user’s sensitive data, including contacts, location, and the phone’s unique identifier (IMEI). Use of these applications therefore risks exfiltration of this data, including unauthorized tracking of users’ behavior and violation of their privacy. Sensitive data leaks are currently detected with taint analysis approaches. This paper addresses these issues by proposing a new static taint analysis framework specifically for Android platforms, termed “B-Droid”. B-Droid is based on static taint analysis using a large set of sources and sinks techniques, side by side with the fuzz testing concept, in order to detect privacy leaks, whether malicious or unintentional by analyses the behavior of Applications Under Test (AUTs). This has the potential to offer improved precision in comparison to earlier approaches. To ensure the quality of our analysis, we undertook an evaluation testing a variety of Android applications installed on a mobile after filtering according to the relevant permissions. We found that B-Droid efficiently detected five of the most prevalent commercial spyware applications on the market, as well as issuing an immediate warning to the user, so that they can decide not to continue with the AUTs. This paper provides a detailed analysis of this method, along with its implementation and results.

Mobile apps are widely used and often process users’ sensitive data. Many taint analysis tools have been applied to analyze sensitive information flows and report data leaks in apps. These tools require a list of sources (where sensitive data is accessed) as input, and researchers have constructed such lists within the Android platform by identifying Android API methods that allow access to sensitive data. However, app developers may also define methods or use third-party library’s methods for accessing data. It is difficult to collect such source methods, because they are unique to the apps, and there are a large number of third-party libraries available on the market that evolve over time. To address this problem, we propose DAISY, a Dynamic-Analysis-Induced Source discoverY approach for identifying methods that return sensitive information from apps and third-party libraries. Trained on an automatically labeled dataset of methods and their calling context, DAISY identifies sensitive methods in unseen apps. We evaluated DAISY on real-world apps, and the results show that DAISY can achieve an overall precision of 77.9% when reporting the most confident results. Most of the identified sources and leaks cannot be detected by existing technologies.

Although there has been much research on the leakage of sensitive data in Android applications, most of the existing research focus on how to detect the malware or adware that are intentionally collecting user privacy. There are not much research on analyzing the vulnerabilities of apps that may cause the leakage of privacy. In this paper, we present a vulnerability analyzing method which combines taint analysis and cryptography misuse detection. The four steps of this method are decompile, taint analysis, API call record, cryptography misuse analysis, all of which steps except taint analysis can be executed by the existing tools. We develop a prototype tool PW Exam to analysis how the passwords are handled and if the app is vulnerable to password leakage. Our experiment shows that a third of apps are vulnerable to leak the users' passwords.

Internet of Things, delineated as a network of connected heterogeneous devices is emerging as a widely adopted technology in almost all walks of life today. The massive increase in the number of IoT devices has introduced several issues related to security and management. Blockchains can be a promising technology to make IoT systems secure and distributed for the time to come. However, current blockchain systems are not capable of scaling in accordance to the huge IoT data without a loss in speed and time efficiency. Therefore, we use the concept of sidechains and offline data storage to alleviate the scalability issue of blockchains. In this work, we propose an architectural framework for the security and maintenance of IoT systems using blockchain technology. Smart contracts are used to enforce data authentication, authorization, and keep track of all the activities. Extensive simulation and analysis results demonstrate that the proposed blockchain architecture is highly scalable (in terms of average latency, throughput and cost) and can be applied efficiently in the IoT system.

In this study, we present the uitHyDroid system, which allows the detection of sensitive data leakage via multi-applications using hybrid analysis. uitHyDroid uses static analysis to collect user interface elements that must interact to illuminate possible sensitive data flows. In addition, dynamic analysis is used to capture inter-application communications to link partial sensitive data flows from static analysis. This approach is faster than using only dynamic analysis. In this study, we use hooking technology to conduct dynamic analysis phase emulator modification. The experimental results show that the proposed system can detect most sensitive data leakages for both our dataset and real-world applications.

Internet of Things (IoT) platforms enable users to deploy home automation applications. Meanwhile, privacy issues arise as large amounts of sensitive device data flow out to IoT platforms. Most of the data flowing out to a platform actually do not trigger automation actions, while homeowners currently have no control once devices are bound to the platform. We present PFirewall, a customizable data-flow control system to enhance the privacy of IoT platform users. PFirewall automatically generates data-minimization policies, which only disclose minimum amount of data to fulfill automation. In addition, PFirewall provides interfaces for homeowners to customize individual privacy preferences by defining user-specified policies. To enforce these policies, PFirewall transparently intervenes and mediates the communication between IoT devices and the platform, without modifying the platform, IoT devices, or hub. Evaluation results on four real-world testbeds show that PFirewall reduces IoT data sent to the platform by 97% without impairing home automation, and effectively mitigates user-activity inference/tracking attacks and other privacy risks.

An efficient perturbation approach for multivariate data in sensitive and reliable data mining

A Lot of documents in many organizations from companies to governments are shared on on-premise storage or clouds. And some of those documents may contain sensitive information such as names, social security numbers, addresses and so on. Especially a large amount of sensitive information written in Korean have been leaked nowadays. It can be severe problems to not only individuals but also many organizations. Therefore, for information protection, data loss prevention (DLP) has been needed. DLP systems based on pattern matching were popular in the past. But they have a difficulty handling new type of sensitive data whenever they come. To handle this problem, sensitive data identification with NER is proposed as a useful method of DLP system. By using NER, we can classify the words in a document into categories which consist of name, location and so on. These categories are considered as sensitive information. This approach shows good performance identifying information in unstructured data(e.g. sentences) which have contextual information whereas it has a weakness identifying sensitive information in structured data (e.g. personal names in cells of the table). Actually, a large amount of sensitive information is organized in structured data and the form of structured data varies depending on the document. Furthermore, it also has difficulties identifying data written in Korean because of its characteristics. We proposed a primary preventive measure of DLP by identifying sensitive data in tables of Korean documents combining text generation and NER models regardless of the form of tables and masking them as to share documents without disclosing sensitive information.

It is easier than ever before to build complex web applications that handle sensitive user data. At same time, regulatory shifts have made data breaches more costly than ever before.While starting Akita, I discovered just how difficult it is for software teams to maintain an up-to-date picture of how sensitive data flows across complex applications. A major challenge is that modern web applications run across many heterogenous components, often communicating via remote procedure calls. Unfortunately, network calls subvert all known software analysis methods for the application layer---and using network tools alone do not yield the full picture. The result is that developers end up piecing the whole story together through reading code, logs, and documentation.At Akita, we observed that network-based application programming interfaces (APIs) are both a root cause of what we call the Software Heterogeneity Problem---and also the key to the solution. The proliferation of APIs for both internal and external use, with the rise of service-oriented architectures and the growth of the API economy, have made it easy to quickly build applications that are amalgams of cross-service network calls. At the same time, there is consolidation around a handful of interface definition languages for web APIs. This makes it possible for us to address the Software Heterogeneity problem by applying programming languages techniques at the API layer.In this talk, I will introduce the Software Heterogeneity Problem and its consequences, demonstrate one way to tackle it at the API layer, and outline API-level security problems I believe we can solve as a community.