Digital twin (DT) is an emerging concept that is gaining attention in various industries It refers to the ability to clone a physical object (PO) into a software counterpart The softwarized object, termed logical object, reflects all the important properties and characteristics of the original object within a specific application context To fully determine the expected properties of the DT, this article surveys the state-of-the-art starting from the original definition within the manufacturing industry It takes into account related proposals emerging in other fields, namely augmented and virtual reality (eg, avatars), multiagent systems, and virtualization This survey thereby allows for the identification of an extensive set of DT features that point to the “softwarization” of POs To properly consolidate a shared DT definition, a set of foundational properties is identified and proposed as a common ground outlining the essential characteristics (must-haves) of a DT Once the DT definition has been consolidated, its technical and business value is discussed in terms of applicability and opportunities Four application scenarios illustrate how the DT concept can be used and how some industries are applying it The scenarios also lead to a generic DT architectural model This analysis is then complemented by the identification of software architecture models and guidelines in order to present a general functional framework for the DT This article, eventually, analyses a set of possible evolution paths for the DT considering its possible usage as a major enabler for the softwarization process

/pdf/digital-twin-in-the-iot-context-a-survey-on-technical-4dp6h32olt.pdf

Digital Twin in the IoT Context: A Survey on Technical Features, Scenarios, and Architectural Models

In the area of congestion management "security" is an established term that describes electric stability in the high voltage network. Actually it is so well established that it is reasonable to remind electric engineers that other disciplines use the same term in other meanings. For a symposium that covers several disciplines it may even be quite necessary. This paper discusses cyber security in the electric power industry in general as well as some perspectives in VATTENFALL, one of Europe's largest electric utilities

http://ieeexplore.ieee.org/iel5/10267/32701/01532753.pdf

Cyber security

Intelligent Dynamic Malware Detection using Machine Learning in IP Reputation for Forensics Data Analytics

: Memory analysis is critical in detecting malicious processes as it can capture various characteristics and behav-iors. However, while there is much research in the ﬁeld, there are also some signiﬁcant obstacles in malware detection, such as detection rate and advanced malware obfuscation. As advanced malware uses obfuscation and other techniques to stay hidden from the detection methods, there is a strong need for an efﬁcient framework that focuses on detecting obfuscation and hidden malware. In this research, the advancement of the VolMemLyzer , as one of the most updated memory feature extractors for learning systems, has been extended to focus on hidden and obfuscated malware used with a stacked ensemble machine learning model to create a framework for efﬁciently detecting malware. Also, a speciﬁc malware memory dataset (MalMemAnalysis-2022) was created to test and evaluate this framework, focusing on simulating real-world obfuscated malware as close as possible. The results show that the proposed solution can detect obfuscated and hidden malware using memory feature engineering extremely fast with an Accuracy and F1-Score of 99.00% and 99.02%, respectively.

Detecting Obfuscated Malware using Memory Feature Engineering

GarliChain: A privacy preserving system for smart grid consumers using blockchain

The invention belongs to the field of quick virtual machine deployment systems, discloses an Xen-based virtual machine deployment system and an Xen-based virtual machine deployment method and solves the problem that an existing quick Xen virtual machine deployment system cannot meet large-scale cloud environment requirements and fails to dynamically change IP (internet protocol) addresses and software environments of virtual machines. According to demands of users, a JSP webpage server, a Tomcat webpage server and an MySQL database are combined to serve as a front end of a front-end system and a management system, a front-end server is in interaction with the users and sends different instructions to load servers by means of adoption of a Livbirt control library for communication according to configuration parameter information of user demands acquired from interaction, and the front-end system selects increment mirror images in a mirror image template library and carries out one-key deployment of different operating systems and one-key deployment of virtual machines for different applications by means of virtual machine increment for deployment; the IP addresses of the virtual machines are automatically configured according to the information of user demands. On the basis of the different deployed operating systems and the deployed virtual machines for different applications, life cycles of the virtual machines can be controlled by the users; in addition, the software environments of the virtual machines can be changed dynamically.

Xen-based virtual machine deployment system and Xen-based virtual machine deployment method

With the development of Internet applications, anonymous communication technology plays a very significant role in protecting personal privacy. As one of the most popular anonymous communication systems, I2P provides strong anonymity through its encryption and communication schemes. However, I2P does not consider the users’ preferences, which is difficult to meet the individual demands of specific users and then allows them to decide their anonymity. Thus, this paper proposes two novel user-oriented node selection algorithms that can effectively enhance the anonymity or reduce the communication delay over the I2P network. In order to choose proper nodes, we also investigate key factors to evaluate the nodes. Then, the basic node selection algorithm (BNSA) is proposed to group routing nodes and provide high-performance node candidates. Based on BNSA, the geographic-diversity-oriented node selection algorithm (GDNSA) and the communication-delay-oriented node selection algorithm (CDNSA) are proposed. These can improve the anonymity or communication performance of the I2P network. The GDNSA increases the attack difficulty by establishing tunnels that span multiple regions. In the meantime, the CDNSA reduces the communication delay of the tunnel by selecting the next hop node with the lowest communication delay. Finally, the mathematical analysis and experimental results show that the GDNSA has good resistance to collusion attacks, and the CDNSA reduces the communication delay in spite of weakening a little anonymity.

Deciding Your Own Anonymity: User-Oriented Node Selection in I2P

Protecting critical files in file systems is very important to computer systems. To protect critical files, the VMI-based Real-time File-system Monitor tools are promising options. However, these tools are always operation-based and introduce high overhead. The operation-based approaches intercept some kind of file operation to monitor critical files. The selected file operation is intercepted by the monitor whenever it is being executed. As file operation are high-frequency, the operationbased methods always result in the high performance degradation. In this paper, we present a VMI-based low overhead real-time critical file monitor method, CFWatcher, to meet the performance requirements of real-time monitor tools. CFWatcher is a target-based monitor tool which means it only intercepts the file operations accessing the user-defined critical files, and then obtains enough information to check the rules. The overhead of CFWatcher is related to the frequency of the target being accessed. Besides monitoring critical files, CFWatcher can take actions to prevent the illegal access if there is any rule violation. We implemented the prototype of CFWatcher and then evaluated the performance. Experimental results show that the overhead of our approach is low.

CFWatcher: A novel target-based real-time approach to monitor critical files using VMI

Kernel control-flow integrity (CFI) of virtual machines is very important to cloud security. VMI-based dynamic tracing and analyzing methods are promising options for checking kernel CFI in cloud. However, the CFI monitors based on tracing always work at instruction or branch level and result in serious virtual machine performance degradation. To meet the performance requirements in the cloud, we present a page-level dynamic VMI-based kernel CFI checking solution. We trace VM kernel execution at page level, which means that the in-page instruction execution cannot trigger our monitor. As a result, the tracing overhead can be greatly reduced. Based on page-level execution information, we propose two policies to describe the kernel control-flow so as to build the secure kernel control-flow database in the learning stage. In the monitoring stage, we compare runtime execution information with the secure database to check kernel CFI. To further reduce the monitoring overhead, we propose two performance optimization strategies. We implement the prototype on Xen and leverage hardware events to trace VM memory page execution. Then, we evaluate the effectiveness and performance of the prototype. The experimental results prove that our system has enough detection capability and the overhead is acceptable.

Dongyang Zhan

Papers

Xen-based virtual machine deployment system and Xen-based virtual machine deployment method

Deciding Your Own Anonymity: User-Oriented Node Selection in I2P

CFWatcher: A novel target-based real-time approach to monitor critical files using VMI

Checking virtual machine kernel control-flow integrity using a page-level dynamic tracing approach

A high-performance virtual machine filesystem monitor in cloud-assisted cognitive IoT