Designing educational scenarios to teach network security

There is a general assumption that one must purchase costly antivirus software products to defend one’s computer system. However, if one is using the Windows Operating System, the question that arises is whether one needs to purchase antivirus software or not. The Windows operating system has a market share of 31.15% behind Android with a market share of 41.56% worldwide amongst all the operating systems. This makes Windows a prime target for hacking due to its large user base. Windows 11 a recent upgrade to the Windows operating system has claimed to have taken its security to the next level. There is a need to evaluate the capability of the Windows 11 default security against antivirus evasion tools. This research investigated the capability of Windows 11 default security by evaluating it against 6 free and open-source antivirus evasion tools: TheFatRat, Venom, Paygen, Defeat Defender, Inflate and Defender Disabler. The criteria for the selection of the antivirus evasion tools were free and open source and recently updated. A research lab was set up using Oracle VirtualBox where two guest machines were installed: a Windows 11 victim machine and the Kali Linux attacking machine. The antivirus evasion tools were installed on the Kali Linux machine one at a time to generate a malware and pass it to the victim machine. Apache web server was used in holding the malicious sample for the Windows 11 victim machine to download. A score of 2 was awarded to an antivirus evasion tool that successfully evaded the Windows 11 security and created a reverse connection with the attacking machine. From the research results: TheFatRat had a 25% evasion score, Venom had 20% while the rest had a 0% evasion score. None of the payloads generated with the antivirus evasion tools was able to create a connection with the Kali Linux attacking machine. The research results imply that the default Windows 11 security is good enough to stand on its own. A third-party antivirus solution will only supplement the already good protection capability of Windows 11.

Research ProblemCyber attacks are targeting the cloud computing systems, where enterprises, governments, and individuals are outsourcing their storage and computational resources for improved scalability and dynamic management of their data. However, the different types of cyber attacks, as well as the different attack goals, create difficulties providing the right security solution needed. This is because different cyber attacks are associated with different threats in the cloud computing systems, where the importance of threats varies based on the cloud user requirements. For example, a hospital patient record system may prioritize the security of cyber attacks tampering patient records, while a media storage system may prioritize the security of cyber attacks carrying out a denial of service attack for ensuring a high availability. As a result, it is of paramount importance to analyze the risk associated with the cloud computing systems taking into account the importance of threats based on different cloud user requirements.However, the current risk evaluation approaches focus on evaluating the risk associated with the asset, rather than the risk associated with different types of threats. Such a holistic approach to risk evaluation does not show explicitly how different types of threats contribute to the overall risk of the cloud computing systems. Consequently, This makes it difficult for security administrators to make fine-grained decisions in order to select security solutions based on different importance of threats given the cloud user requirements. Therefore, it is necessary to analyze the risk of the cloud computing systems taking into account the different importance of threats, which enables the allocation of resources to reduce particular threats, identify the risk associated with different threats imposed, and identify different threats associated with cloud components.Proposed SolutionThe STRIDE threat modeling framework (short for STRIDE) is proposed by Microsoft, which can be used for threat categorization. Using the STRIDE, we propose a threat-guided risk evaluation approach for the cloud computing systems, which can evaluate the risk associated with each threat category from the STRIDE explicitly. Further, we utilize seven different types of security metrics to evaluate the risk namely: \textit{component, component-threat, threat-category, snapshot, path-components, path-threat}, and \textit{overall asset}. Component, component-threat, threat-cateory, and snapshot risks measure the total risk on a component, component risk for a particular threat category, total snapshot risk for a single threat, and the total risk of the snapshot considering all threat categories, respectively. Path-components, path-threat, and overall asset measure the total risk of components in an attack path, the risk of a single threat category in the attack path, and the overal risk to an asset considering all attack paths, respectively. These metrics makes it possible to measure the contribution of each threat category to the overall risk more precisely.When a vulnerability is discovered in a component (e.g. a Virtual Machine) of the Cloud deployment, the administrator first determines which types of threats could be posed should the vulnerability be successfully exploited, and what would be the impacts of each of those threats on the asset. The impact assignment of each threat type is weighted depending on the importance of the component. For example, a Virtual Machine (VM) that acts a Web Server in a medical records management application could be assigned a higher weighting for \textit{denial-of-service} threats because if such attacks are successfully launched then the rest of the VMs that are reached through the Web Server will be unavailable. On the other hand, a vulnerability discovered in a VM that hosts a database of medical records would be rated highest impact for \textit{information disclosure} because if it is compromised confidentiality of the medical history of patients will be violated.By multiplying the probability of successfully exploiting the vulnerability with the threat impact, we compute the risk of each threat type. The variation in the assignment of impact for different threat types enables our approach to compute risks associated with the threats - thus empowering the security administrator with the ability to make fine-grained decisions on how much resources to allocate for mitigating which type of threat and which threats to prioritize. We evaluated the usefulness of our approach through its application to attack scenarios in an example Cloud deployment. Our results show that it is more effective and informative to administrators compared to asset-based approaches to risk evaluation.

Information System for Administrating and Distributing Color Images Through Internet

“Securing the Digital Frontier: Navigating Cyber Threats in Cloud, Network, and Information Security” offers a comprehensive exploration of the intricate landscape of Cyber security, meticulously designed to equip readers with a robust understanding of contemporary challenges and proactive strategies. With an elaborate Table of Contents spanning thirteen chapters, the book embarks on a journey that starts with laying the groundwork in Chapter 1, providing a holistic Introduction to Cyber security. Here, readers delve into the nuances of the digital realm, tracing the Evolution of Cyber Threats, and comprehending the Historical Milestones that have shaped the field. It underscores the paramount Importance of Cyber security in Modern Society and elucidates the Current State of Cyber security Challenges while speculating on Future Projections and Trends, emphasizing the Interdisciplinary Nature of Cyber security. Moving forward, Chapter 2 delves into the Fundamentals of Information Security, elucidating the CIA Triad – Confidentiality, Integrity, and Availability. It navigates through Risk Management, Compliance, and Regulatory Frameworks, shedding light on Security Policies and Procedures alongside the significance of Security Awareness Training and Incident Response Planning. Subsequent chapters systematically dissect various domains of Cyber security, from Network Security (Chapter 3) to Cloud Security (Chapter 4), Endpoint Security (Chapter 5), and Identity and Access Management (Chapter 6). Each chapter meticulously examines core concepts, methodologies, and best practices essential for fortifying digital infrastructures against evolving threats. The discourse extends to Data Protection (Chapter 7), Threat Intelligence and Detection (Chapter 8), and Incident Response and Management (Chapter 9), offering invaluable insights into encryption techniques, threat hunting strategies, and incident triage frameworks. Furthermore, Security Operations and Monitoring (Chapter 10) elucidates the pivotal role of Security Operations Centers (SOCs), Vulnerability Management, and Red Team vs. Blue Team Exercises in bolstering cyber defenses. Chapter 11 ventures into Emerging Technologies and Threats, contemplating the security ramifications of IoT, AI, Quantum Computing, Block chain, AR, VR, and Biometric Authentication. Meanwhile, Chapter 12 explores the realm of Ethical Hacking and Penetration Testing, unraveling methodologies for ethical hacking, vulnerability assessment, and social engineering mitigation. Finally, Chapter 13 prognosticates on Future Trends and Challenges, accentuating the imperative of addressing the Skills Gap, fostering Global Collaboration, and navigating Regulatory Challenges amidst burgeoning technological advancements. It underscores the ethical considerations paramount in Cyber security endeavors while advocating for resilience-building strategies against escalating cyber threats. In essence, “Securing the Digital Frontier” transcends the realms of a conventional Cyber security manual, emerging as an indispensable compendium for Cyber security professionals, aspiring enthusiasts, and stakeholders navigating the ever-evolving digital ecosystem. It amalgamates theoretical insights with practical wisdom, empowering readers to navigate the complex terrain of cyber threats with confidence and acumen.

At present, APT attack detection has become the focus of the network security protection field. APT attacks are one of the most difficult attacks in cyber attacks. The complexity and variability of APT attack behavior greatly increases the difficulty of attack detection. In order to cope with APT attack, some well-known network security companies at home and abroad have developed a commercial APT intrusion detection system. This highly targeted attack can not be identified by the traditional intrusion detection system. Therefore, in order to deal with this new type of cyber attack. The paper proposes a new method to detect APT attack from different organizations. Data mining algorithm is used to analyze every organization’s APT network attack behavior and obtain association rules, so as to customize the design of the Snort rules and apply them to intrusion detection system. Experiments have shown that the evaluation index of the intrusion detection system using the extended Snort rule is significantly better than the traditional Snort intrusion detection system when detecting the same test data. The precision of the extended Snort intrusion detection system is as high as 98.3%, and the false alarm rate is almost 0, which ultimately achieves the purpose of APT detection.

Top-down cognitive control seems to be sensitive to the detrimental effects of fatigue induced by time-on-task (ToT). The planning and preparation of the motor responses may be especially vulnerable to ToT. Yet, effects of ToT specific to the different phases of movements have received little attention. Therefore, in three experiments, we assessed the effect of ToT on a mouse-pointing task. In Experiment 1, there were 16 possible target positions with variable movement directions. In Experiment 2, the layout of the targets was simplified. In Experiment 3, using cuing conditions, we examined whether the effects of ToT on movement preparation and execution were caused by an increased orientation deficit or decreased phasic alertness. In each experiment, initiation of movement (preparatory phase) became slower, movement execution became faster and overall response time remained constant with increasing ToT. There was, however, no significant within-person association between the preparatory and execution phases. In Experiments 1 and 2, we found a decreasing movement time/movement error ratio, suggesting a more impulsive execution of the pointing movement. In addition, ToT was also accompanied with imprecise movement execution as indicated by the increased errors, mainly in Experiment 2. The results of Experiment 3 indicated that ToT did not induce orientation and phasic alerting deficits but rather was accompanied by decreased tonic alertness.

A flexible SDN-based framework for slow-rate DDoS attack mitigation by using deep reinforcement learning

The paper presents an innovative and simple way of creating computer clustering and obtaining HPC clusters using computers in the classroom, Ethernet facilities and open source software. Automatic enlarge of a computer cluster is a cost-effective way to increase available computing power. This is achieved by forming a computer cluster from the computers in the classroom. The main aim of this paper is to present a solution that will use existing resources in the computer classroom, for applying complex computer services/jobs under the Linux operating system. The execution of these services/jobs programs is performed at the time when the computing resources are not in used in learning under the Windows operating system. A real-life example of applying computers in dual-boot Windows/Linux work mode along with the developed software application support is presented in a teaching environment. The implementation also includes logistics and support for automatic computer clustering and for service/ job programs execution. The primary goal is to use existing resources for useful applications in education in the image programming, simulations and volume rendering.

As cloud services become mature and provide capabilities for elastic computation and data management, hosting services become increasingly prevalent such as Amazon Web Services, Microsoft Azure, or RedHat OpenStack. Workloads are hosted in these platforms using hypervisors running on physical machines which host virtual machines (VMs) presented to the customer. Software-defined network (SDN) technologies move many of the network functions into the hosts. Accordingly SDN-based VM placements have received significant attention as a way to minimize network traffic between VMs and hosts. Careful placement of VMs can generate a significantly lower amount of network traffic to the hosting provider. Further, it may impact the level of security risk exposed by the VM placement as each VM may have a different level of security risk. In this work, we consider these two conflicting goals by presenting a Software-Defined Network based VM Placement, called SDNVMP, to minimize both network traffic between VMs (and hosts) and security risk by grouping VMs with similar security scrutiny needs. Our results show that the proposed placement algorithm outperforms the baseline counterparts in terms of network traffic overhead and security risk in each VM introduced by such algorithms.

Modern multi-core, multi-socket hardware powering the "cloud" is designed with memory and cache resources that have local associativity to a group of cores. Operating systems have characterized these associativities as part of Non-Uniform Memory Architecture (NUMA) optimizations within their virtual memory manager (VMM) and scheduler which improves application performance. Mature NUMA optimizations are prevalent for an OS running on bare-hardware. However, their benefits are reduced within virtual machines(VM) in the cloud. Even though cloud applications are executed by standard multi-core multi-socket hardware, the abstraction brought in by the virtualization layer makes it challenging to optimize resource management within a VM. This paper describes new paradigms in hypervisor technology-- scheduling VMs on cores and managing their memory resources which streamlines their execution on underlying multicore hardware. Being Linux kernel developers, we base our work on Linux operating system and Kernel Virtual Machine (KVM) --a subsystem which turns the Linux kernel into a scalable hypervisor. We evaluate few approaches for optimal resource allocation with KVM. We summarize our findings with a comparative study of how different scheduling algorithms can be employed with KVM for various systems to support efficient resource placement while running cloud workloads.

Since the virtual network traffic is invisible outside the hypervisor, it is impossible for traditional network-base security devices to harness the attacks happened in virtual computing environment. Industry and academies adopt the network security enabled hypervisor (NSE-H) to protect virtual machines (VM) residing in the virtual network. In this paper, we identified the insufficiency of the existing live migration implementation, which prevents itself from providing transparent VM relocation between NSE-Hs. This occurs because the contemporary migration implementation only takes VM encapsulated states into account, but ignores VM related security context(SC) needed by NSE-H embedded security engines (SE). We presented a comprehensive live migration framework for the NSE-H, considering both the execution context encapsulated in VM instance and the VM related security context within the SEs. We built a prototype system of the framework based on stateful firewall enabled Xen hypervisor. Our experiment was performed with realistic applications and the results demonstrate that the solution complements the insufficiency without introducing significant performance downgrade. Even in the worst case, the downtime that occurs during migration increases no more than 15%, comparing to existing implementation.

2 - Where Open Source Is Successful

Visualization and modeling of forest fire propagation in Patagonia

Teknolojik gelişmeler ve bu zamana kadar biriken bilgilerin ışığında otonom sistemlerde muazzam bir ilerleme kaydedilmiştir. Bu sayede otonom sistemler çarpışmadan kaçınma, trafik işareti tespiti, haritalama vb. sayısız akıllı işlevleri gerçekleştirebilmektedir. Gerçek zamanlı otonom araçların en zorlu problemi aracın kendi kendine haritalandırma ve lokasyon işlemlerini yapabilmesidir. Genetik Algoritma (GA) kullanarak optimize edilmiş lokasyon uygulaması ile otonom araçlar için sürüş güvenliğinin artması beklenmektedir. Bu çalışmada lazer tabanlı bir lokalizasyon ve haritalama tekniğinin üzerine odaklanılmıştır. Gerçekleştirilen sistemde sanal bir test ortamı kurulmuş ve bir otonom araç üzerinde denemeler yapılmıştır. Çalışma kapsamında sanal makineler oluşturularak üzerlerine Linux işletim sistemi kurulmuştur. Sonra bu sanal makinelere ROS ortamında TurtleBot3 kurulmuş ve iç mekân lokalizasyonu yapılarak bir harita elde edilmiştir. Bu harita genetik algoritma ile en kısa mesafelerin bulunmasını sağlamak için kullanılmaktadır. Gözlemler neticesinde simülasyon ortamındaki robot yüksek başarımla istenilen konuma gidebildiği sonucuna ulaşılmıştır.

Summary form only given. Most virtualization environments demand users to download complete disk images to create virtual machines. Due to this requirement a user has to spend a great deal of time downloading disk images from remote repositories. However, if we consider the system software and application software each user access in virtual machines, they are similar amongst most users, especially system data. Thus, there is a possibility for certain blocks at the disk level to be equal amongst the disk image and the hosting environment. For example if the disk image contains a Linux operating system and the hosting environment is also running Linux, at the disk level certain blocks can be similar. Latencies related to virtual machine access are partly due the unawareness of these common components. Our research is built upon this observation. We evaluate how existing problems in virtualization environments can be rectified by exploiting common data blocks.