Security has become the primary concern in many telecommunications industries today as risks can have high consequences. Especially, as the core and enable technologies will be associated with 5G network, the confidential information will move at all layers in future wireless systems. Several incidents revealed that the hazard encountered by an infected wireless network, not only affects the security and privacy concerns, but also impedes the complex dynamics of the communications ecosystem. Consequently, the complexity and strength of security attacks have increased in the recent past making the detection or prevention of sabotage a global challenge. From the security and privacy perspectives, this paper presents a comprehensive detail on the core and enabling technologies, which are used to build the 5G security model; network softwarization security, PHY (Physical) layer security and 5G privacy concerns, among others. Additionally, the paper includes discussion on security monitoring and management of 5G networks. This paper also evaluates the related security measures and standards of core 5G technologies by resorting to different standardization bodies and provide a brief overview of 5G standardization security forces. Furthermore, the key projects of international significance, in line with the security concerns of 5G and beyond are also presented. Finally, a future directions and open challenges section has included to encourage future research.

/pdf/a-survey-on-security-and-privacy-of-5g-technologies-1hq5wqw2pb.pdf

A Survey on Security and Privacy of 5G Technologies: Potential Solutions, Recent Advancements, and Future Directions

Internet of Things (IoT) is one of the most rapidly used technologies in the last decade in various applications. The smart things are connected in wireless or wired for communication, processing, computing, and monitoring different real-time scenarios. The things are heterogeneous and have low memory, less processing power. The implementation of the IoT system comes with security and privacy challenges because traditional based existing security protocols do not suitable for IoT devices. In this survey, the authors initially described an overview of the IoT technology and the area of its application. The primary security issue CIA (confidentially, Integrity, Availability) and layer-wise issues are identified. Then the authors systematically study the three primary technology Machine learning(ML), Artificial intelligence (AI), and Blockchain for addressing the security issue in IoT. In the end, an analysis of this survey, security issues solved by the ML, AI, and Blockchain with research challenges are mention.

Survey on IoT security: Challenges and solution using machine learning, artificial intelligence and blockchain technology

Service-oriented architecture (SOA) is gaining momentum as an emerging distributed system architecture for business-to-business collaborations. This momentum can be observed in both industry and academic research. SOA presents new challenges and opportunities for testing and verification, leading to an upsurge in research. This paper surveys the previous work undertaken on testing and verification of service-centric systems, which in total are 177 papers, showing the strengths and weaknesses of current strategies and testing tools and identifying issues for future work. Copyright © 2012 John Wiley & Sons, Ltd.

Testing and verification in service-oriented architecture: a survey

A scalable distributed machine learning approach for attack detection in edge computing environments

Security attacks typically result from unintended behaviors or invalid inputs. Security testing is labor intensive because a real-world program usually has too many invalid inputs. It is highly desirable to automate or partially automate security-testing process. This paper presents an approach to automated generation of security tests by using formal threat models represented as Predicate/Transition nets. It generates all attack paths, i.e., security tests, from a threat model and converts them into executable test code according to the given Model-Implementation Mapping (MIM) specification. We have applied this approach to two real-world systems, Magento (a web-based shopping system being used by many online stores) and FileZilla Server (a popular FTP server implementation in C++). Threat models are built systematically by examining all potential STRIDE (spoofing identity, tampering with data, repudiation, information disclosure, denial of service, and elevation of privilege) threats to system functions. The security tests generated from these models have found multiple security risks in each system. The test code for most of the security tests can be generated and executed automatically. To further evaluate the vulnerability detection capability of the testing approach, the security tests have been applied to a number of security mutants where vulnerabilities are injected deliberately. The mutants are created according to the common vulnerabilities in C++ and web applications. Our experiments show that the security tests have killed the majority of the mutants.

Automated Security Test Generation with Formal Threat Models

Mobile ad hoc networks (MANETs) are self-configuring networks of mobile devices connected via wireless links. Every device in MANETs is also a router because it is required to forward traffic unrelated to its own use. These kinds of networks are exposed more than traditional networks to security threats due to their mobility and open architecture aspects. In addition, any attack can severely affect the network as all nodes participate in the routing task. For these mentioned reasons, it is important to check the validity of ad hoc protocols, and verify whether their running implementation is in accordance with their security goals in order to detect potential security flaws in the network. In this chapter, we propose a formal methodology based on passive testing techniques to collect and analyze ad hoc network traffic trace and detect potential attacks (distributed or not). Observers running on a set of nodes collect local traces and send them later to a global observer. An adapted time synchronization mechanism allows the global observer to correlate the received traces obtaining thus a global trace. The latter is then analyzed to study the security aspects of the running routing protocol. This analysis is performed using dedicated algorithms that allow checking the collected trace against a set of functional and security properties specified in a well adapted formal language called Nomad.

Security Engineering Techniques and Solutions for Information Systems: Management and Implementation

Dynamic code analysis attempts to find errors or vulnerabilities while a program is executing on a real or virtual processor. The objective of dynamic analysis is to reduce debugging time by automatically pinpointing and informing on errors as they occur. The use of dynamic analysis tools can reduce the need for the developer to recreate the precise conditions under which an error, a vulnerability or a security flow occurs. This paper presents a formal approach to detect software vulnerabilities in C programs relying on formal models of vulnerabilities causes called “Vulnerability Detection Conditions” (VDCs). These models provide a formal interpretation of a vulnerability to facilitate its automatic detection using dynamic code analysis tool. To illustrate our approach, a prototype tool TestInv-Code has been developed. It allows to detect the presence of vulnerabilities by checking the VDCs on the execution trace of the studied C program. By traces we mean here the disassembled instructions that are being executed. The tool has been applied on an open source application XINE that contains a known vulnerability to demonstrate its effectiveness.

/pdf/vdc-based-dynamic-code-analysis-application-to-c-programs-11nyogf599.pdf

VDC-Based Dynamic Code Analysis: Application to C Programs.

Requests to improve the quality of software are increasing due to the competition in software industry and the complexity of software development integrating multiple technology domains (e.g., IoT, Big Data, Cloud, Artificial Intelligence, Security Technologies). Measurements collection and analysis is key activity to assess software quality during its development live-cycle. To optimize this activity, our main idea is to periodically select relevant measures to be executed (among a set of possible measures) and automatize their analysis by using a dedicated tool. The proposed solution is integrated in a whole PaaS platform called MEASURE. The tools supporting this activity are Software Metric Suggester tool that recommends metrics of interest according several software development constraints and based on artificial intelligence and MINT tool that correlates collected measurements and provides near real-time recommendations to software development stakeholders (i.e. DevOps team, project manager, human resources manager etc.) to improve the quality of the development process. To illustrate the efficiency of both tools, we created different scenarios on which both approaches are applied. Results show that both tools are complementary and can be used to improve the software development process and thus the final software quality.

Smart Measurements and Analysis for Software Quality Enhancement.

This paper presents the main results of the experiments conducted using the MMT-IoT security analysis solution run on a IoT Fed4Fire+ platform (Virtual Wall - w.iLab proposed by IMEC, Belgium). MMT is a monitoring framework developed by Montimage, and MMT-IoT is the tool that allows monitoring and analysing the security and performance of IoT networks. The results obtained concern two principal advancements. First, the adaptations made to deploy MMT-IoT on the IoT platform in order to run the tool on the platform’s IoT devices. Second, the deployment of the software allowed us to run preliminary tests on the selected platform for performing initial validation and scalability tests on this real environment. To this end, Montimage defined and implemented three test scenarios related to security and scalability with 1 or more clients. These results will be used to prepare a new experimentation phase involving also another Fed4Fire+ platform (LOG-a-TEC proposed by IJS, Slovenia).

Industrial IoT security monitoring and test on Fed4Fire+ platforms

In modern networks, the heterogeneity and the increasing distribution of applications, such as telecommunication protocols,Web-based systems and real-time systems, make security management complex. These applications are more and more open and rely on networking parts of computer systems that generally make use of different solutions. In the context of the deployment of such applications and services, the security officials are led to empirically bring security solutions together. The consistency of these assemblies is difficult to achieve. Nowadays, many security features are available. We can cite for instance cryptographic protocols, management infrastructures of public keys (PKI), firewalls, control access mechanisms within operating systems and applications, intrusion detection systems or anti-viral mechanisms etc.

Wissam Mallouli

Papers

Security Engineering Techniques and Solutions for Information Systems: Management and Implementation

VDC-Based Dynamic Code Analysis: Application to C Programs.

Smart Measurements and Analysis for Software Quality Enhancement.

Industrial IoT security monitoring and test on Fed4Fire+ platforms

Modeling and testing secure web applications