@article {831, title = {Blockchain meets Internet of Things (IoT) forensics: A unified framework for IoT ecosystems}, journal = {Internet of Things}, year = {2023}, month = {oct}, pages = {100968}, abstract = {

With the continuously increasing number of security incidents targeting sensors, embedded devices, and other electronics appliances and systems that comprise the so-called Internet of things (IoT), the field of IoT forensics emerged as a branch of digital forensics focusing on the investigation of attacks in the IoT ecosystem. Digital evidence authenticity, integrity, confidentiality, and privacy are among the factors affecting the investigation process in IoT forensics, which can be addressed by employing the blockchain as the means not only for the preservation of digital evidence, but also for other steps of a digital forensics investigation process. The high-level goal of the paper is three-fold: to establish a holistic IoT forensics process as a reference point against which blockchain integration patterns and best practices will be identified in order to yield a robust, widely accepted and scalable architecture of the blockchain-enabled solution; to integrate the blockchain with the proposed IoT forensics process for addressing the above challenges; and to evaluate the overall solution highlighting improvements and potential performance bottlenecks. The proposed blockchain-enabled platform leverages multi-access edge computing and has been implemented with Hyperledger Fabric on an extensive virtualized testbed providing a realistic smart home environment. A thorough evaluation was conducted with real cyber-attacks generating digital evidence at high rates for testing the platform{\textquoteright}s behavior at high load. The experimental results showed that the proposed platform achieved high throughput, excessively low latency, and zero error rate in the operation of the blockchain network.

}, keywords = {blockchain, cyber-security, Digital forensics, Edge computing, Internet of Things}, doi = {10.1016/j.iot.2023.100968}, url = {https://www.sciencedirect.com/science/article/pii/S2542660523002913}, author = {Sotirios Brotsis and Konstantinos P. Grammatikakis and Dimitrios Kavallieros and Antonio I. Mazilu and Nicholas Kolokotronis and Konstantinos Limniotis and Costas Vassilakis} } @conference {822, title = {Minimizing Software-Rooted Risk through Library Implementation Selection}, booktitle = {Proceedings of the 2023 IEEE CSR Workshop on Data Science for Cyber Security (DS4CS)}, year = {2023}, abstract = {

In contemporary Internet of Things (IoT) systems, complex software artifacts are deployed to realize the required functionalities. The business logic of these software artifacts is uniquely composed through code that is customly developed according to the requirements, while all software artifacts utilize libraries that implement generic functionalities, which are needed in the context of the realized operations. Libraries, however, often entail vulnerabilities, which may be exploited by threat agents to attack the system. In many cases, the functionality required by an application is realized by a number of alternative libraries, with each library having its own list of vulnerabilities, while differentiations in other non-functional properties (e.g. execution efficiency, memory footprint etc.) may also be present. In this paper, we present an approach for automating the task of minimizing the risk level of IoT systems that is owing to the vulnerabilities of libraries required by software artifacts. The proposed approach exploits knowledge on which libraries provide equivalent implementations of the same functionalities, and automatically assesses the risk level of candidate library combinations and finally selects the library configuration exhibiting the minimum risk level to bundle into the executable software artifact. Additionally, the risk level of candidate implementations is constantly monitored for new vulnerability identifications or fixes in the implementations, triggering new risk assessments and producing new executables as appropriate. The proposed approach can be used in IoT platform deployment to minimize the software-rooted risk level.

}, author = {Panagiotis Sotiropoulos and Christos-Minas Mathas and Costas Vassilakis and Nicholas Kolokotronis} } @article {823, title = {A Software Vulnerability Management Framework for the Minimization of System Attack Surface and Risk}, journal = {Electronics}, volume = {12}, year = {2023}, month = {may}, pages = {2278}, abstract = {

Current Internet of Things (IoT) systems comprise multiple software systems that are deployed to provide users with the required functionalities. System architects create system blueprints and draw specifications for the software artefacts that are needed; subsequently, either custom-made software is developed according to these specifications and/or ready-made COTS/open source software may be identified and customized to realize the overall system goals. All deployed software however may entail vulnerabilities, either due to insecure coding practices or owing to misconfigurations and unexpected interactions. Moreover, software artefacts may implement a much broader set of functionalities than may be strictly necessary for the system at hand, in order to serve a wider range of needs, and failure to appropriately configure the deployed software to include only the required modules results in the further increase of the system attack surface and the associated risk. In this paper, we present a software vulnerability management framework which facilitates (a) the configuration of software to include only the necessary features, (b) the execution of security-related tests and the compilation of platform-wide software vulnerability lists, and (c) the prioritization of vulnerability addressing, considering the impact of each vulnerability, the associated technical debt for its remediation, and the available security budget. The proposed framework can be used as an aid in IoT platform implementation by software architects, developers, and security experts.

}, keywords = {IoT systems, risk management, software vulnerabilities, system design, system security, technical debt}, doi = {10.3390/electronics12102278}, url = {https://doi.org/10.3390/electronics12102278}, author = {Panagiotis Sotiropoulos and Christos-Minas Mathas and Costas Vassilakis and Nicholas Kolokotronis} } @article {798, title = {On the Design of IoT Security: Analysis of Software Vulnerabilities for Smart Grids}, journal = {Energies}, volume = {14}, year = {2021}, month = {may}, pages = {2818}, abstract = {

The 5G communication network will underpin a vast number of new and emerging services, paving the way for unprecedented performance and capabilities in mobile networks. In this setting, the Internet of Things (IoT) will proliferate, and IoT devices will be included in many 5G application contexts, including the Smart Grid. Even though 5G technology has been designed by taking security into account, design provisions may be undermined by software-rooted vulnerabilities in IoT devices that allow threat actors to compromise the devices, demote confidentiality, integrity and availability, and even pose risks for the operation of the power grid critical infrastructures. In this paper, we assess the current state of the vulnerabilities in IoT software utilized in smart grid applications from a source code point of view. To that end, we identified and analyzed open-source software that is used in the power grid and the IoT domain that varies in characteristics and functionality, ranging from operating systems to communication protocols, allowing us to obtain a more complete view of the vulnerability landscape. The results of this study can be used in the domain of software development, to enhance the security of produced software, as well as in the domain of automated software testing, targeting improvements to vulnerability detection mechanisms, especially with a focus on the reduction of false positives.

}, keywords = {Internet of Things, robustness, security, software vulnerabilities}, doi = {10.3390/en14102818}, author = {Christos-Minas Mathas and Costas Vassilakis and Nicholas Kolokotronis and Charilaos C. Zarakovitis and Michail-Alexandros Kourtis} } @inbook {780, title = {Reconnaisance}, booktitle = {Cyber-Security Threats, Actors, and Dynamic Mitigation}, year = {2020}, publisher = {CRC Press}, organization = {CRC Press}, abstract = {

Reconnaissance is the phase of gathering information about an organization{\textquoteright}s network and computing devices. This information includes both technical characteristics, such as IP addresses and software, and non-technical aspects, such as people operating the devices and the business value of tangible or intangible assets associated with the computing infrastructure. This information allows attackers to better understand their target and prepare elaborate attack plans. The reconnaissance phase is itself divided in a number of subphases, and each subphase is supported by a multitude of tools. In this chapter, we firstly describe in more detail the reconnaissance phase, while subsequently we present the different subphases and the methods and tools supporting each one, providing specific examples of how reconnaissance actions are performed. The information presented in this chapter can be used by organizations{\textquoteright} cyber-security officers to identify weaknesses in the organizations{\textquoteright} security plan implementations and take appropriate mitigation measures.

}, keywords = {Actors, Cyber-Security Threats, Dynamic Mitigation, Reconnaissance}, author = {Mathas, Christos-Minas and Vassilakis, Costas}, editor = {Nicholas Kolokotronis and Stavros Shiaeles} } @conference {783, title = {Threat landscape for smart grid systems}, booktitle = {Proceedings of the 15th International Conference on Availability, Reliability and Security}, year = {2020}, month = {jul}, publisher = {ACM}, organization = {ACM}, abstract = {

Smart Grids are energy delivery networks, constituting an evolution of power grids, in which a bidirectional flow between power providers and consumers is established. These flows support the transfer of electricity and information, in order to support automation actions in the context of the energy delivery network. Insofar, many smart grid implementations and implementation proposals have emerged, with varying degrees of feature delivery and sophistication. While smart grids offer many advantages, their distributed nature and information flow streams between energy producers and consumers enable the launching of a number of attacks against the smart grid infrastructure, where the related consequences may range from economic loss to complete failure of the smart grid. In this paper, we survey the threat landscape of smart grids, identifying threats that are specific to this infrastructure, providing an assessment of the severity of the consequences of each attack type, discerning features that can be utilized to detect attacks and listing methods that can be used to mitigate them.

}, keywords = {attack detection features, attack mitigation, attacks, security, Smart grids}, doi = {https://doi.org/10.1145/3407023.3409229}, author = {Christos-Minas Mathas and Konstantinos-Panagiotis Grammatikakis and Costas Vassilakis and Nicholas Kolokotronis and Vasiliki-Georgia Bilali and Dimitris Kavallieros} } @conference {789, title = {A Trust Management System for the IoT domain}, booktitle = {Proceedings the 2020 IEEE World Congress on Services (SERVICES)}, year = {2020}, publisher = {IEEE}, organization = {IEEE}, abstract = {

In modern internet-scale computing, interaction between a large number of parties that are not known a-priori is predominant, with each party functioning both as a provider and consumer of services and information. In such an environment, traditional access control mechanisms face considerable limitations, since granting appropriate authorizations to each distinct party is infeasible both due to the high number of grantees and the dynamic nature of interactions. Trust management has emerged as a solution to this issue, offering aids towards the automated verification of actions against security policies. In this paper, we present a trust- and risk-based approach to security, which considers status, behavior and associated risk aspects in the trust computation process, while additionally it captures user-to-user trust relationships which are propagated to the device level, through user-to-device ownership links.

}, keywords = {associated risk, behavior, Internet-of-things, status, trust management}, doi = {10.1109/SERVICES48979.2020.00047}, author = {Christos-Minas Mathas and Costas Vassilakis and Nicholas Kolokotronis} } @conference {Kolokotronis2019IEEESrv, title = {On Blockchain Architectures for Trust-based Collaborative Intrusion Detection}, booktitle = {Proceedings of the 1st IEEE Services Workshop on Cyber Security and Resilience in the Internet Of Things, within IEEE Services 2019}, year = {2019}, publisher = {IEEE}, organization = {IEEE}, abstract = {This paper considers the use of novel technologies for mitigating attacks that aim at compromising intrusion detection systems (IDSs). Solutions based on collaborative intrusion detection networks (CIDNs) could increase the resilience against such attacks as they allow IDS nodes to gain knowledge from each other by sharing information. However, despite the vast research in this area, trust management issues still pose significant challenges and recent works investigate whether these could be addressed by relying on blockchain and related distributed ledger technologies. Towards that direction, the paper proposes the use of a trust-based blockchain in CIDNs, referred to as trust-chain, to protect the integrity of the information shared among the CIDN peers, enhance their accountability, and secure their collaboration by thwarting insider attacks. A consensus protocol is proposed for CIDNs, which is a combination of a proof-of-stake and proof-of-work protocols, to enable collaborative IDS nodes to maintain a reliable and tampered-resistant trust-chain.}, keywords = {blockchain, collaborative intrusion detection, insider threats, security, trust management}, author = {Nicholas Kolokotronis and Sotirios Brotsis and Georgios Germanos and Costas Vassilakis and Stavros Shiaeles} }