The advancement of the Internet of Things (IoT) has allowed for unprecedented data collection, automation, and remote sensing and actuation, transforming autonomous systems and bringing smart command and control into numerous cyber physical systems (CPS) that our daily lives depend on. Simultaneously, dramatic improvements in machine learning and deep neural network architectures have enabled unprecedented analytical capabilities, which we see in increasingly common applications and production technologies, such as self-driving vehicles and intelligent mobile applications. Predictably, these technologies have seen rapid adoption, which has left many implementations vulnerable to threats unforeseen or undefended against. Moreover, such technologies can be used by malicious actors, and the potential for cyber threats, attacks, intrusions, and obfuscation that are only just being considered, applied, and countered. In this paper, we consider the good, the bad, and the ugly use of machine learning for cybersecurity and CPS/IoT. In detail, we consider the numerous benefits (good use) that machine learning has brought, both in general, and specifically for security and CPS/IoT, such as the improvement of intrusion detection mechanisms and decision accuracy in CPS/IoT. More pressing, we consider the vulnerabilities of machine learning (bad use) from the perspectives of security and CPS/IoT, including the ways in which machine learning systems can be compromised, misled, and subverted at all stages of the machine learning life-cycle (data collection, pre-processing, training, validation, implementation, etc.). Finally, the most concerning, a growing trend has been the utilization of machine learning in the execution of cyberattacks and intrusions (ugly use). Thus, we consider existing mechanisms with the potential to improve target acquisition and existing threat patterns, as well as those that can enable novel attacks yet to be seen.

/pdf/machine-learning-for-security-and-the-internet-of-things-the-29e8cxpjhl.pdf

Machine Learning for Security and the Internet of Things: The Good, the Bad, and the Ugly

In some examples, a method includes accessing an orthogonal network policy set that represents a first intent-based network policy and a second intentbased network policy. The method may also include determining multiple reduced orthogonal network policy sets from the orthogonal network policy set. The multiple reduced orthogonal network policy sets may differ from one another, and each represent the first and second intent-based network policies. The method may further include selecting a particular reduced orthogonal network policy set among the multiple reduced orthogonal network policy sets to implement on a target switching device.

Reduced orthogonal network policy set selection

With exponential growth in virtualized traffic within physical data centers, many end users (e.g., individuals and enterprises) have begun moving work processes and data to cloud computing platforms. However, accessing virtualized traffic traversing the cloud computing platforms for application, network, and security analysis is a challenge. Introduced here, therefore, are visibility platforms for monitoring virtualized traffic traversing a cloud computing platform, such as Amazon Web Services, VMware, and OpenStack. A visibility platform can be integrated into a cloud computing platform to provide a coherent view of virtualized traffic in motion across the cloud computing platform for a given end user. Said another way, a visibility platform can intelligently select, filter, and forward virtualized traffic belonging to an end user to a monitoring infrastructure, thereby eliminating traffic blind sports.

Network visibility appliances for cloud computing architectures

A system comprising nodes coupled to a network including virtual links in an overlay network provisioned over an underlay network. The system includes a virtual machine (VM) provisioned at a node and coupled to the network. The VM is configured to receive feedback data of link conditions, and use the feedback data to dynamically determine and adapt an optimal route through the network. The VM is configured to control routing of traffic flows using the optimal route. The routing includes split routing of a traffic flow from the node via two or more of the virtual links.

High performance software-defined core network

In one aspect, a computerized system useful for implementing a virtual private network (VPN) including an edge device that automatically establishes an Internet Protocol Security (IPsec) tunnel alongside an unsecure Multipath Protocol (MP) tunnel with a gateway device in preparation for a transmission of a secure traffic communication. The edge device has a list of local subnets. The edge device sends the list of local subnets to the gateway during an initial MP tunnel establishment handshake message exchange between the edge device and the gateway device. Each subnet includes an indication of whether the subnet is reachable over the VPN. A gateway device that automatically establishes the IPsec tunnel alongside the unsecure MP tunnel with the edge device. An enterprise datacenter server that comprises an orchestrator module that receives a toggle the VPN command and enables the VPN on the orchestrator. The orchestrator informs the edge device the list of subnets is accessible over the VPN causing the edge device to update the gateway device with a new list of subnets of the edge device that accessible over the VPN.

Method and system of establishing a virtual private network in a cloud service for branch networking

“Multi-tenant awareness” is added to a set of one or more packet processing devices in a Software Defined Network (SDN) having a controller. For each of one or more tenants, information in a table associates network protocol address attributes with an Internet Protocol (IP) address unique to the tenant. The table is associated with a multiple-layer translation layer being managed by the SDN controller. As a data packet traverses the translation layer, network protocol address attributes are translated according to values in the table to enable logical routing of the packet (to a given PPD. This translation occurs dynamically (or “on-the-fly”) as packets are “on route” to their destination. By implementing a multi-layer network address translation (NAT), one layer may be used to translate network protocol address source attributes, while a second layer may be used to translate network protocol address destination attributes.

Adding multi-tenant awareness to a network packet processing device on a Software Defined Network (SDN)

Cloud storage is one of the most important applications in our daily lives. User can store their own data into cloud storage and remotely access the saved data. Owing to the social media develops, users can share the digital files to other users, leading to the amount of data growing rapidly and searching abilities necessarily. In the some cases, servers cannot avoid data leakage even if the server provides complete access control. The encrypted data is a best way to resolve this problem but it may eliminate original structure and searching may become impossible. Applying searchable encryption for each receiver may produce messy duplication and occupy the quota of cloud storage from each receiver. User requires keeping their shared documents belonging up to date which are compared with the latest version. To this aim, we thus propose a sharable ID-based encryption with keyword search in cloud computing environment, which enables users to search in data owners’ shared storage while preserving privacy of data. For the performance analysis, we demonstrate the compared resultant with others ID-based or ID-relative encryption. In addition to that, we show the formal proof to verify the security of our proposed.

A shareable keyword search over encrypted data in cloud computing

Cyber-defense and cyber-resilience techniques sometimes fail in defeating cyber-attacks. One of the primary causes is the ineffectiveness of business process impact assessment in the enterprise network. In this paper, we propose a new business process impact assessment method, which measures the impact of an attack towards a business-process-support enterprise network and produces a numerical score for this impact. The key idea is that all attacks are performed by exploiting vulnerabilities in the enterprise network. So the impact scores for business processes are the function result of the severity of the vulnerabilities and the relations between vulnerabilities and business processes. This paper conducts a case study systematically and the result shows the effectiveness of our method.

/pdf/assessing-attack-impact-on-business-processes-by-3rfati3fsy.pdf

Assessing Attack Impact on Business Processes by Interconnecting Attack Graphs and Entity Dependency Graphs

Android malware writers often utilize online malware scanners to check how well their malware can evade detection, and indeed we can find malware scan reports that were generated before the major outbreaks of such malware. If we could identify in-development malware before malware deployment, we would have developed effective defense mechanisms to prevent malware from causing devastating consequences. To this end, we propose Lshand to discover undiscovered malware before day zero, which we refer to as negative-day malware. The challenge includes scalability and the fact that malware writers would apply detection evasion techniques and submission anonymization techniques. Our approach is based on the observation that malware development is a continuous process and thus malware variants inevitably will share certain characteristics throughout its development process. Accordingly, Lshand clusters scan reports based on selective features and then performs further analysis on those seemingly benign apps that share similarity with malware variants. We implemented and evaluated Lshand with submissions to VirusTotal. Our results show that Lshand is capable of hunting down undiscovered malware in a large scale, and our manual analysis and a third-party scanner have confirmed our negative-day malware findings to be malware or grayware.

/pdf/towards-large-scale-hunting-for-android-negative-day-malware-3m25kw6jkb.pdf

Towards large-scale hunting for Android negative-day malware

One of the most challenging problems in the field of intrusion detection is anomaly detection for discrete event logs. While most earlier work focused on applying unsupervised learning upon engineered features, most recent work has started to resolve this challenge by applying deep learning methodology to abstraction of discrete event entries. Inspired by natural language processing, LSTM-based anomaly detection models were proposed. They try to predict upcoming events, and raise an anomaly alert when a prediction fails to meet a certain criterion. However, such a predict-next-event methodology has a fundamental limitation: event predictions may not be able to fully exploit the distinctive characteristics of sequences. This limitation leads to high false positives (FPs). It is also critical to examine the structure of sequences and the bi-directional causality among individual events. To this end, we propose a new methodology: Recomposing event sequences as anomaly detection. We propose DabLog, a LSTM-based Deep Autoencoder-Based anomaly detection method for discrete event Logs. The fundamental difference is that, rather than predicting upcoming events, our approach determines whether a sequence is normal or abnormal by analyzing (encoding) and reconstructing (decoding) the given sequence. Our evaluation results show that our new methodology can significantly reduce the numbers of FPs, hence achieving a higher F1 score.

Lun-Pin Yuan

Papers

Adding multi-tenant awareness to a network packet processing device on a Software Defined Network (SDN)

A shareable keyword search over encrypted data in cloud computing

Assessing Attack Impact on Business Processes by Interconnecting Attack Graphs and Entity Dependency Graphs

Towards large-scale hunting for Android negative-day malware

Recompose Event Sequences vs. Predict Next Events: A Novel Anomaly Detection Approach for Discrete Event Logs