Publications

@conference{acar2024fifty,

title = {50 Shades of Support: A Device-Centric Analysis of Android Security Updates},

author = {Abbas Acar and Güliz Seray Tuncay and Esteban Luques and Harun Oz and Ahmet Aris and Selcuk Uluagac},

url = {https://research.google/pubs/50-shades-of-support-a-device-centric-analysis-of-android-security-updates/},

year  = {2024},

date = {2024-01-01},

urldate = {2024-01-01},

booktitle = {In the Proceedings of the 31st Network and Distributed System Security Symposium (NDSS)},

abstract = {Android is by far the most popular OS with over three billion active mobile devices. As in any software, uncovering vulnerabilities on Android devices and applying timely patches are both critical. Android Open Source Project (AOSP) has initiated efforts to improve the traceability of security updates through Security Patch Levels (SPLs) assigned to devices. While this initiative provided better traceability for the vulnerabilities, it has not entirely resolved the issues related to the timeliness and availability of security updates for end users. Recent studies on Android security updates have focused on the issue of delay during the security update roll-out, largely attributing this to factors related to fragmentation. However, these studies fail to capture the entire Android ecosystem as they primarily examine flagship devices or do not paint a comprehensive picture of the Android devices’ lifecycle due to the datasets spanning over a short timeframe. To address this gap in the literature, we utilize a device-centric approach to analyze the security update behavior of Android devices. Our approach aims to understand the security update distribution behavior of OEMs (e.g., Samsung) by using a representative set of devices from each OEM and characterize the complete lifecycle of an average Android device. We obtained 367K official security update records from public sources, span- ning from 2014 to 2023. Our dataset contains 599 unique devices from four major OEMs that are used in 97 countries and are associated with 109 carriers. We identify significant differences in the roll-out of security updates across different OEMs, device models/types, and geographical regions across the world. Our findings show that the reasons for the delay in the roll-out of security updates are not limited to fragmentation but also involve OEM-specific factors. Our analysis also uncovers certain key issues that can be readily addressed as well as exemplary practices that can be immediately adopted by OEMs in practice.},

keywords = {Android Security, Mobile Security },

pubstate = {published},

tppubtype = {conference}

}

@conference{10325770,

title = {Q-SECURE: A Quantum Resistant Security for Resource Constrained IoT Device Encryption},

author = {Ngouen, Maurice and Rahman, Mohammad Ashiqur and Prabakar, Nagarajan and Uluagac, Selcuk and Njilla, Laurent},

url = {https://ieeexplore.ieee.org/document/10325770},

doi = {10.1109/IOTSMS59855.2023.10325770},

issn = {2832-3033},

year  = {2023},

date = {2023-11-23},

urldate = {2023-11-23},

booktitle = {2023 10th International Conference on Internet of Things: Systems, Management and Security (IOTSMS)},

pages = {141-148},

publisher = {IEEE},

abstract = {The Internet of Things (IoT) plays a significant role in shaping different aspects of our lives. IoT devices have become increasingly important due to their ability to connect, collect, and analyze data, automate processes, improve safety and efficiency, and deliver personalized experiences. However, the advancement in quantum computer development poses a significant threat to resource-constrained IoT devices. This new generation of computers can break the classic public-key cryptographic schemes and digital signatures implemented in these IoT devices. While protecting IoT devices from quantum computer attacks poses many challenges, researchers are continuously making significant progress in developing lightweight post-quantum cryptographic algorithms for efficient key exchange mechanisms and digital signature algorithms tailored to IoT devices to overcome this issue. This paper proposes Q-SECURE, a post-Quantum resistant Security Enhancing Cryptography for Unified Resource-constrained device Encryption. A novel scheme that enables any IoT system to leverage the assistance of other devices in the network to gain the capability to generate any proposed post-quantum cryptographic key of a given size using distributed and parallel computing.},

keywords = {},

pubstate = {published},

tppubtype = {conference}

}

@conference{OZRans2023,

title = {RøB: Ransomware over Modern Web Browsers},

author = {Harun Oz and Ahmet Aris and Abbas Acar and Güliz Seray Tuncay and Leonardo Babun and Selcuk Uluagac},

url = {https://www.usenix.org/conference/usenixsecurity23/presentation/oz

https://www.youtube.com/watch?v=MUVNz6p3_jk

https://research.google/pubs/r%C3%B8b-ransomware-over-modern-web-browsers/},

year  = {2023},

date = {2023-08-01},

urldate = {2023-08-01},

booktitle = {In the Proceedings of the 32nd USENIX Security Symposium},

abstract = {File System Access (FSA) API enables web applications to interact with files on the users' local devices. Even though it can be used to develop rich web applications, it greatly extends the attack surface, which can be abused by adversaries to cause significant harm. In this paper, for the first time in the literature, we extensively study this new attack vector that can be used to develop a powerful new ransomware strain over a browser. Using the FSA API and WebAssembly technology, we demonstrate this novel browser-based ransomware called RøB as a malicious web application that encrypts the user's files from the browser. We use RøB to perform impact analysis with different OSs, local directories, and antivirus solutions as well as to develop mitigation techniques against it. Our evaluations show that RøB can encrypt the victim's local files including cloud-integrated directories, external storage devices, and network-shared folders regardless of the access limitations imposed by the API. Moreover, we evaluate and show how the existing defense solutions fall short against RøB in terms of their feasibility. We propose three potential defense solutions to mitigate this new attack vector. These solutions operate at different levels (i.e., browser-level, file-system-level, and user-level) and are orthogonal to each other. Our work strives to raise awareness of the dangers of RøB-like browser-based ransomware strains and shows that the emerging API documentation (i.e., the popular FSA) can be equivocal in terms of reflecting the extent of the threat.},

keywords = {Malware, Ransomware, Web Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{Haque2023,

title = {SHATTER: Control and Defense-Aware Attack Analytics for Activity-Driven Smart Home Systems},

author = {N. Haque and M. Ngouen and M. Rahman and S. Uluagac and L. Njilla},

url = {https://doi.ieeecomputersociety.org/10.1109/DSN58367.2023.00015},

year  = {2023},

date = {2023-06-01},

urldate = {2023-06-01},

booktitle = {In the Proceedings of the 53rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)},

abstract = {Modern smart home control systems utilize realtime occupancy and activity monitoring to ensure control efficiency, occupants' comfort, and optimal energy consumption. Moreover, adopting machine learning-based anomaly detection models (ADMs) enhances security and reliability. However, sufficient system knowledge allows adversaries/attackers to alter sensor measurements through stealthy false data injection (FDI) attacks. Although ADMs limit attack scopes, the availability of information like occupants' location, conducted activities, and alteration capability of smart appliances increase the attack surface. Therefore, performing an attack space analysis of modern home control systems is crucial to design robust defense solutions. However, state-of-the-art analyzers do not consider contemporary control and defense solutions and generate trivial attack vectors. To address this, we propose a control and defense-aware novel attack analysis framework for a modern smart home control system, efficiently extracting ADM rules. We verify and validate our framework using a state-of-the-art dataset and a prototype testbed.},

keywords = {Cryptojacking, Smart Home Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{franco2022s-pot,

title = {S-Pot: A Smart Honeypot Framework with Dynamic Rule Configuration for SDN},

author = {Javier R Franco and Ahmet Aris and Leonardo Babun and Selcuk Uluagac},

url = {https://ieeexplore.ieee.org/abstract/document/10000682/},

year  = {2022},

date = {2022-12-01},

urldate = {2022-12-01},

booktitle = {In the Proceedings of the 37th IEEE Global Communications Conference (GLOBECOM)},

address = {Rio de Janeiro, Brazil},

abstract = {Enterprise networks are becoming increasingly heterogeneous where enterprise devices and IoT devices coexist, requiring tools for effective management and security. Software Defined Networking (SDN) has emerged in response to such needs of modern networks. SDN lacks adequate security features and Intrusion Detection and Protection Systems (IDPS) have been used to protect SDN from attacks. However, they have limited knowledge of zero day attacks. Machine Learning (ML) has become a valuable tool against these limitations and improve (SDN) network security. However, the solutions that solely rely on ML can struggle to discriminate benign traffic from malicious, and suffer from false negatives. To solve these problems and improve security of SDN-based enterprise networks, we propose S-Pot, an open-source smart honeypot framework. S-Pot uses enterprise and IoT honeypots to attract attackers},

keywords = {Honeypot/Honeynet, SDN Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{babun2022truth,

title = {The Truth Shall Set Thee Free: Enabling Practical Forensic Capabilities in Smart Environments},

author = {Leonardo Babun and Amit Kumar Sikder and Abbas Acar and A. Selcuk Uluagac},

url = {https://www.ndss-symposium.org/wp-content/uploads/2022-133-paper.pdf},

year  = {2022},

date = {2022-04-01},

urldate = {2022-04-01},

booktitle = {In the Proceedings of the 30th Network and Distributed System Security Symposium (NDSS)},

abstract = {In smart environments such as smart homes and offices, the interaction between devices, users, and apps generate abundant data. Such data contain valuable forensic information about events and activities occurring in the smart environment. Nonetheless, current smart platforms do not provide any digital forensic capability to identify, trace, store, and analyze the data produced in these environments. To fill this gap, in this paper, we introduce VERITAS, a novel and practical digital forensic capability for the smart environment. VERITAS has two main components: Collector and Analyzer. The Collector implements mechanisms to automatically collect forensically-relevant data from the smart environment. Then, in the event of a forensic investigation, the Analyzer uses a First Order Markov Chain model to extract valuable and usable forensic information from the collected data. VERITAS then uses the forensic information to infer activities and behaviors from users, devices, and apps that violate the security policies defined for the environment. We implemented and tested VERITAS in a realistic smart office environment with 22 smart devices and sensors that generated 84209 forensically-valuable incidents. The evaluation shows that VERITAS achieves over 95 percent of accuracy in inferring different anomalous activities and forensic behaviors within the smart environment. Finally, VERITAS is extremely lightweight, yielding no overhead on the devices and minimal overhead in the backend resources (ie, the cloud servers).},

keywords = {Forensics, IoT Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{Tekiner2022ALI,

title = {A Lightweight IoT Cryptojacking Detection Mechanism in Heterogeneous Smart Home Networks},

author = {Ege Tekiner and Abbas Acar and Arif Selcuk Uluagac},

url = {https://api.semanticscholar.org/CorpusID:248223996},

year  = {2022},

date = {2022-01-01},

booktitle = {In the Proceedings of the 30th Network and Distributed System Security Symposium (NDSS)},

journal = {Proceedings 2022 Network and Distributed System Security Symposium},

keywords = {},

pubstate = {published},

tppubtype = {conference}

}

@conference{iqtidarThreatAnalysis,

title = {Systematic Threat Analysis of Modern Unified Healthcare Communication Systems},

author = {Akm Iqtidar Newaz and Ahmet Aris and Amit Kumar Sikder and A Selcuk Uluagac},

url = {https://ieeexplore.ieee.org/abstract/document/10001605/},

year  = {2022},

date = {2022-01-01},

urldate = {2022-01-01},

booktitle = {In the Proceedings of the 37th IEEE Global Communications Conference (GLOBECOM)},

abstract = {Recently, smart medical devices have become preva-lent in remote monitoring of patients and the delivery of medication. The ongoing Covid-19 pandemic situation has boosted the upward trend of the popularity of smart medical devices in the healthcare system. Simultaneously, different device manufacturers and technologies compete for a share in a smart medical device's market, which forces the integration of diverse smart medical de-vices into a common healthcare ecosystem. Hence, modern unified healthcare communication systems (UHCSs) combine ISO/IEEE 11073 and Health Level Seven (HL7) communication standards to support smart medical devices' interoperability and their communication with healthcare providers. Despite their advantages in supporting various smart medical devices and communication technologies, these standards do not provide any security and suffer from vulnerabilities},

keywords = {Healthcare Security, Network Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{10017584,

title = {LoFin: LoRa-based UAV Fingerprinting Framework},

author = {Maryna Veksler and David Langus Rodríguez and Ahmet Aris and Kemal Akkaya and A. Selcuk Uluagac},

url = {https://ieeexplore.ieee.org/abstract/document/10017584/},

year  = {2022},

date = {2022-01-01},

urldate = {2022-01-01},

booktitle = {In the Proceedings of the 41st IEEE Military Communications Conference (MILCOM)

},

abstract = {The emerging proliferation of unmanned aerial vehicles (UAV) combined with their autonomous capabilities established the solid incorporation of UAVs for military applications. However, seamless deployment of drones into the adversarial environment and on the battlefield requires a robust and secure network stack, protected from adversarial intrusion. As LoRa became a low-cost solution for the long-distance control channel, it solved the challenge of long-range connectivity and prolonged lifespan present in UAV applications. However, the existing implementations lack protection mechanisms against unauthorized access. In this paper, we present LoFin, the first fingerprinting framework used to identify telemetry transceivers that communicate over the LoRa channel. LoFin exploits information leaked due to the differences in hardware structure, which results in processing time variations. Passively collecting},

keywords = {Fingerprinting, Network Security, UAV Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{ShrenikCodeObfus,

title = {A First Look at Code Obfuscation for WebAssembly},

author = {Shrenik Bhansali and Ahmet Aris and Abbas Acar and Harun Oz and Selcuk Uluagac},

url = {https://doi.org/10.1145/3507657.3528560},

year  = {2022},

date = {2022-01-01},

urldate = {2022-01-01},

booktitle = {In the Proceedings of the 15th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec) },

abstract = {WebAssembly (Wasm) has seen a lot of attention lately as it spreads through the mobile computing domain and becomes the new standard for performance-oriented web development. It has diversified its uses far beyond just web applications by acting as an execution environment for mobile agents, containers for IoT devices, and enabling new serverless approaches for edge computing. Within the numerous uses of Wasm, not all of them are benign. With the rise of Wasm-based cryptojacking malware, analyzing Wasm applications has been a hot topic in the literature, resulting in numerous Wasm-based cryptojacking detection systems. Many of these methods rely on static analysis, which traditionally can be circumvented through obfuscation. However, the feasibility of the obfuscation techniques for Wasm programs has never been investigated thoroughly. In this paper, we address this gap and perform the first look at code obfuscation for Wasm. We apply numerous obfuscation techniques to Wasm programs, and test their effectiveness in producing a fully obfuscated Wasm program. Particularly, we obfuscate both benign Wasm-based web applications and cryptojacking malware instances and feed them into a state-of-the-art Wasm cryptojacking detector to see if current Wasm analysis methods can be subverted with obfuscation. Our analysis shows that obfuscation can be highly effective and can cause even a state-of-the-art detector to misclassify the obfuscated Wasm samples.



},

keywords = {Malware, WebAssembly},

pubstate = {published},

tppubtype = {conference}

}

@conference{9842711,

title = {A Literature Review on Blockchain-enabled Security and Operation of Cyber-Physical Systems},

author = {Alvi Ataur Khalil and Javier Franco and Imtiaz Parvez and Selcuk Uluagac and Hossain Shahriar and Mohammad Ashiqur Rahman},

url = {https://ui.adsabs.harvard.edu/abs/2021arXiv210707916A/abstract},

year  = {2022},

date = {2022-01-01},

urldate = {2022-01-01},

booktitle = {In the Proceedings of  46th Annual Computers, Software and Applications Conference (COMPSAC)},

abstract = {Blockchain has become a key technology in a plethora of application domains owing to its decentralized public nature. The cyber-physical systems (CPS) is one of the prominent application domains that leverage blockchain for myriad operations, where the Internet of Things (IoT) is utilized for data collection. Although some of the CPS problems can be solved by simply adopting blockchain for its secure and distributed nature, others require complex considerations for overcoming blockchain-imposed limitations while maintaining the core aspect of CPS. Even though a number of studies focus on either the utilization of blockchains for different CPS applications or the blockchain-enabled security of CPS, there is no comprehensive survey including both perspectives together. To fill this gap, we present a comprehensive overview of contemporary advancement in using blockchain for enhancing different CPS.},

keywords = {Blockchain Security, CPS Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{rondon2021lightningstrike,

title = {LightningStrike: (in) secure practices of E-IoT systems in the wild},

author = {Luis Puche Rondon and Leonardo Babun and Ahmet Aris and Kemal Akkaya and A Selcuk Uluagac},

year  = {2021},

date = {2021-01-01},

urldate = {2021-01-01},

booktitle = {In the Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec)},

abstract = {The widespread adoption of specialty smart ecosystems has changed the everyday lives of users. As a part of smart ecosystems, Enterprise Internet of Things (E-IoT) allows users to integrate and control more complex installations in comparison to off-the-shelf IoT systems. With E-IoT, users have a complete control of audio, video, scheduled events, lightning fixtures, shades, door access, and relays via available user interfaces. As such, these systems see widespread use in government or smart private offices, schools, smart buildings, professional conference rooms, hotels, smart homes, yachts, and similar professional settings. },

keywords = {IoT Security, Smart Home Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{untoldStory,

title = {In-Browser Cryptomining for Good: An Untold Story},

author = {Ege Tekiner and Abbas Acar and A Selcuk Uluagac and Engin Kirda and Ali Aydin Selcuk},

url = {https://ieeexplore.ieee.org/abstract/document/9566204/},

year  = {2021},

date = {2021-01-01},

urldate = {2021-01-01},

booktitle = {In the Proceedings of the IEEE International Conference on Decentralized Applications and Infrastructures (DAPPS)},

abstract = {In-browser cryptomining uses the computational power of a website's visitors to mine cryptocurrency, i.e., to create new coins. With the rise of ready-to-use mining scripts distributed by service providers (e.g., Coinhive), it has become trivial to turn a website into a cryptominer by copying and pasting the mining script. Both legitimate webpage owners who want to raise an extra revenue under users' explicit consent and malicious actors who wish to exploit the computational power of the users' computers without their consent have started to utilize this emerging paradigm of cryptocurrency operations. In-browser cryptomining, though mostly abused by malicious actors in practice, is indeed a promising funding model that can be utilized by website owners, publishers, or non-profit organizations for legitimate business purposes, such as to collect revenue or donations for humanitarian projects, inter alia. However, our analysis in this paper shows that in practice, regardless of their being legitimate or not, all in-browser mining scripts are treated the same as malicious cryptomining samples (aka cryptojacking) and blacklisted by browser extensions or antivirus programs. Indeed, there is a need for a better understanding of the in-browser cryptomining ecosystem. Hence, in this paper, we present an in-depth empirical analysis of in-browser cryptomining processes, focusing on the samples explicitly asking for user consent, which we call permissioned cryptomining. To the best of our knowledge, this is the first study focusing on the permissioned cryptomining samples. For this, we created a dataset of 6269 unique web sites containing cryptomining scripts in their source codes to characterize the in-browser cryptomining ecosystem by differentiating permissioned and permissionless cryptomining samples. We believe that (1) this paper is the first attempt showing that permissioned in-browser cryptomining could be a legitimate and viable monetization tool if implemented responsibly and without interrupting the user, and (2) this paper will catalyze the widespread adoption of legitimate crvptominina with user consent and awareness.},

keywords = {Cryptojacking, Malware},

pubstate = {published},

tppubtype = {conference}

}

@conference{FarazMinos,

title = {MINOS: A Lightweight Real-Time Cryptojacking Detection System},

author = {Ahmet Arış and Faraz Naseem and Leonardo Babun and Ege Tekiner and Selcuk Uluagac},

url = {https://www.researchgate.net/profile/Ahmet-Aris/publication/349109071_MINOS_A_Lightweight_Real-Time_Cryptojacking_Detection_System/links/61488e123c6cb310697fba33/MINOS-A-Lightweight-Real-Time-Cryptojacking-Detection-System.pdf},

year  = {2021},

date = {2021-01-01},

urldate = {2021-01-01},

booktitle = {In the Processings of 28th the Network and Distributed System Security Symposium (NDSS)},

abstract = {Emerging WebAssembly (Wasm)-based cryptojacking malware covertly uses the computational resources of users without their consent or knowledge. Indeed, most victims of this malware are unaware of such unauthorized use of their computing power due to techniques employed by cryptojacking malware authors such as CPU throttling and obfuscation. A number of dynamic analysis-based detection mechanisms exist that aim to circumvent such techniques. However, since these mechanisms use dynamic features, the collection of such features, as well as the actual detection of the malware, require that the cryptojacking malware run for a certain amount of time, effectively mining for that period, and therefore causing significant overhead. To solve these limitations, in this paper, we propose MINOS, a novel, extremely lightweight cryptojacking detection system that uses deep learning techniques to accurately detect the presence of unwarranted Wasm-based mining activity in real-time. MINOS uses an image-based classification technique to distinguish between benign webpages and those using Wasm to implement unauthorized mining. Specifically, the classifier implements a convolutional neural network (CNN) model trained with a comprehensive dataset of current malicious and benign Wasm binaries. MINOS achieves exceptional accuracy with a low TNR and FPR. Moreover, our extensive performance analysis of MINOS shows that the proposed detection technique can detect mining activity instantaneously from the most current in-the-wild cryptojacking malware with an accuracy of 98.97 percent, in an average of 25.9 milliseconds while using a},

keywords = {Cryptojacking, Machine Learning Security, Malware},

pubstate = {published},

tppubtype = {conference}

}

@conference{tekiner2021,

title = {SoK: Cryptojacking Malware},

author = {Ege Tekiner and Abbas Acar and A. Selcuk Uluagac and Engin Kirda and Ali Aydin Selcuk},

url = {https://ieeexplore.ieee.org/abstract/document/9581251/},

year  = {2021},

date = {2021-01-01},

urldate = {2021-01-01},

booktitle = {In the Processings of 6th IEEE European Symposium on Security and Privacy (EuroS&P)},

address = {Virtual},

abstract = {Emerging blockchain and cryptocurrency-based technologies are redefining the way we conduct business in cyberspace. Today, a myriad of blockchain and cryp-tocurrency systems, applications, and technologies are widely available to companies, end-users, and even malicious actors who want to exploit the computational resources of regular users through cryptojacking malware. Especially with ready-to-use mining scripts easily provided by service providers (e.g., Coinhive) and untraceable cryptocurrencies (e.g., Monero), cryptojacking malware has become an indispensable tool for attackers. Indeed, the banking industry, major commercial websites, government and military servers (e.g., US Dept. of Defense), online video sharing platforms (e.g., Youtube), gaming platforms (e.g., Nintendo), critical infrastructure resources (e.g., routers), and even recently widely popular remote video conferencing/meeting},

keywords = {Blockchain Security, Cryptojacking, Malware},

pubstate = {published},

tppubtype = {conference}

}

@conference{Denney2019USB-Watchb,

title = {USB-Watch: A Dynamic Hardware-Assisted USB Threat Detection Framework},

author = {Kyle Denney and Enes Erdin and Leonardo Babun and Michael Vai and Selcuk Uluagac},

url = {https://link.springer.com/chapter/10.1007/978-3-030-37228-6_7},

year  = {2020},

date = {2020-02-15},

urldate = {2020-02-15},

booktitle = {In the Proceedings of the Security and Privacy in Communication Networks},

abstract = {The USB protocol is among the most widely adopted protocols today thanks to its plug-and-play capabilities and the vast number of devices which support the protocol. However, this same adaptability leaves unwitting computing devices prone to attacks. Malicious USB devices can disguise themselves as benign devices (e.g., keyboard, mouse, etc.) to insert malicious commands on end devices. These malicious USB devices can mimic an actual device or a human typing pattern and appear as a real device to the operating system. Typically, advanced software-based detection schemes are used to identify the malicious nature of such devices. However, a powerful adversary (e.g., as rootkits or advanced persistent threats) can still subvert those software-based detection schemes. To address these concerns, in this work, we introduce a novel hardware-assisted, dynamic USB-threat detection framework called USB-Watch. Specifically, USB-Watch utilizes hardware placed between a USB device and the host machine to hook into the USB communication, collect USB data, and provides the capability to view unaltered USB protocol communications. This unfettered data is then fed into a machine learning-based classifier which dynamically determines the true nature of the USB device. Using real malicious USB devices (i.e., Rubber-Ducky) mimicking as a keyboard, we perform a thorough analysis of typing dynamic features (e.g., typing time differentials, key press durations, etc.) to effectively classify malicious USB devices from normal human typing behaviors. In this work, we show that USB-Watch provides a lightweight, OS-independent framework which effectively distinguishes differences between normal and malicious USB behaviors with a ROC curve of 0.89. To the best of our knowledge, this is the first hardware-based detection mechanism to dynamically detect threats coming from USB devices.},

howpublished = {In the proceedings of the Security and Privacy in Communication Networks (SecureComm)},

keywords = {Hardware Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{acar2020peek,

title = {Peek-a-boo: I see your smart home activities, even encrypted!},

author = {Abbas Acar and Hossein Fereidooni and Tigist Abera and Amit Kumar Sikder and Markus Miettinen and Hidayet Aksu and Mauro Conti and Ahmad-Reza Sadeghi and Selcuk Uluagac},

year  = {2020},

date = {2020-01-01},

urldate = {2020-01-01},

booktitle = {In the Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks},

abstract = {A myriad of IoT devices such as bulbs, switches, speakers in a smart home environment allow users to easily control the physical world around them and facilitate their living styles through the sensors already embedded in these devices. Sensor data contains a lot of sensitive information about the user and devices. However, an attacker inside or near a smart home environment can potentially exploit the innate wireless medium used by these devices to exfiltrate sensitive information from the encrypted payload (i.e., sensor data) about the users and their activities, invading user privacy. With this in mind, in this work, we introduce a novel multi-stage privacy attack against user privacy in a smart environment. },

keywords = {IoT Security, Smart Home Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{sikder2020kratos,

title = {Kratos: Multi-user multi-device-aware access control system for the smart home},

author = {Amit Kumar Sikder and Leonardo Babun and Z Berkay Celik and Abbas Acar and Hidayet Aksu and Patrick McDaniel and Engin Kirda and A Selcuk Uluagac},

url = {https://dl.acm.org/doi/10.1145/3395351.3399358},

year  = {2020},

date = {2020-01-01},

urldate = {2020-01-01},

booktitle = {In the Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec)},

abstract = {In a smart home system, multiple users have access to multiple devices, typically through a dedicated app installed on a mobile device. Traditional access control mechanisms consider one unique trusted user that controls the access to the devices. However, multi-user multi-device smart home settings pose fundamentally different challenges to traditional single-user systems. For instance, in a multi-user environment, users have conflicting, complex, and dynamically changing demands on multiple devices, which cannot be handled by traditional access control techniques. To address these challenges, in this paper, we introduce Kratos, a novel multi-user and multi-device-aware access control mechanism that allows smart home users to flexibly specify their access control demands. Kratos has three main components: user interaction module, back-end server, and policy manager. },

keywords = {IoT Security, Smart Home Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{babun2020z,

title = {Z-iot: Passive device-class fingerprinting of zigbee and z-wave iot devices},

author = {Leonardo Babun and Hidayet Aksu and Lucas Ryan and Kemal Akkaya and Elizabeth S Bentley and A Selcuk Uluagac},

url = {https://ieeexplore.ieee.org/document/9149285},

year  = {2020},

date = {2020-01-01},

urldate = {2020-01-01},

booktitle = {In the proceedings of the IEEE International Conference on Communications (ICC) Conference},

organization = {IEEE},

abstract = {In addition to traditional networking devices (e.g., gateways, firewalls), current corporate and industrial networks integrate resource-limited Internet of Things (IoT) devices like smart outlets and smart sensors. In these settings, cyber attackers can bypass traditional security solutions and spoof legitimate IoT devices to gain illegal access to the systems. Thus, IoT device-class identification is crucial to protect critical networks from unauthorized access. In this paper, we propose Z-IoT, the first fingerprinting framework used to identify IoT device classes that utilize ZigBee and Z-Wave protocols. Z-IoT monitors idle network traffic among IoT devices to implement signature-based device-class fingerprinting mechanisms. Utilizing passive packet capturing techniques and optimal selection of filtering criteria and machine learning algorithms, Z-IoT identifies different types of IoT devices while guaranteeing the anonymity.},

keywords = {IoT Security, Smart Home Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{mercan2020cost,

title = {A cost-efficient iot forensics framework with blockchain},

author = {Suat Mercan and Mumin Cebe and Ege Tekiner and Kemal Akkaya and Melissa Chang and Selcuk Uluagac},

url = {https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=9169397},

year  = {2020},

date = {2020-01-01},

urldate = {2020-01-01},

booktitle = {In the Proceedings of the IEEE International Conference on Blockchain and Cryptocurrency (ICBC)},

organization = {IEEE},

abstract = {IoT devices have been adopted widely in the last decade which enabled collection of various data from different environments. Data storage poses challenges since the data may be compromised during the storage and the integrity might be violated without being noticed. In such cases, integrity and data provenance are required in order to be able to detect the source of any incident and prove it in legal cases. To address these issues, blockchain provides excellent opportunities since it can protect the integrity of the data thanks to its distributed structure. However, it comes with certain costs as storing huge amount of data in a public blockchain will come with significant transaction fees. In this paper, we propose a highly cost effective and reliable digital forensics framework by exploiting multiple inexpensive blockchain networks as a temporary storage before the data is committed to Ethereum. },

keywords = {Blockchain Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{newaz2020heka,

title = {Heka: A novel intrusion detection system for attacks to personal medical devices},

author = {AKM Iqtidar Newaz and Amit Kumar Sikder and Leonardo Babun and A Selcuk Uluagac},

url = {https://csl.fiu.edu/wp-content/uploads/2023/05/heka.pdf},

year  = {2020},

date = {2020-01-01},

urldate = {2020-01-01},

booktitle = {In the proceedings of the IEEE Conference on Communications and Network Security (CNS)},

organization = {IEEE},

abstract = {Modern Smart Health Systems (SHS) involve the concept of connected personal medical devices. These devices significantly improve the patient's lifestyle as they permit remote monitoring and transmission of health data (i.e., telemedicine), lowering the treatment costs for both the patient and the healthcare providers. Although specific SHS communication standards (i.e., ISO/IEEE 11073) enable real-time plug-and-play interoperability and communication between different personal medical devices, they do not specify any features for secure communications. In this paper, we demonstrate how personal medical device communication is indeed vulnerable to different cyber attacks. Specifically, we show how an external attacker can hook into the personal medical device's communication and eavesdrop the sensitive health data traffic, and implement manin-the-middle, replay, false data injection, and denial-of service.},

keywords = {Healthcare Security, IoT Security, Smart Home Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{newaz2020adversarial,

title = {Adversarial attacks to machine learning-based smart healthcare systems},

author = {AKM Iqtidar Newaz and Nur Imtiazul Haque and Amit Kumar Sikder and Mohammad Ashiqur Rahman and A Selcuk Uluagac},

url = {https://ieeexplore.ieee.org/document/9322472},

year  = {2020},

date = {2020-01-01},

urldate = {2020-01-01},

booktitle = {In the proceedings of the IEEE Global Communications Conference (GLOBECOM)},

organization = {IEEE},

abstract = {The increasing availability of healthcare data requires accurate analysis of disease diagnosis, progression, and real-time monitoring to provide improved treatments to the patients. In this context, Machine Learning (ML) models are used to extract valuable features and insights from high-dimensional and heterogeneous healthcare data to detect different diseases and patient activities in a Smart Healthcare System (SHS). However, recent researches show that ML models used in different application domains are vulnerable to adversarial attacks. In this paper, we introduce a new type of adversarial attacks to exploit the ML classifiers used in a SHS. We consider an adversary who has partial knowledge of data distribution, SHS model, and ML algorithm to perform both targeted and untargeted attacks. Employing these adversarial capabilities, we manipulate medical device readings to alter patient status,},

keywords = {Adverserial Machine Learning, Smart Home Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{rondon2020poisonivy,

title = {PoisonIvy: (In) secure Practices of Enterprise IoT Systems in Smart Buildings},

author = {Luis Puche Rondon and Leonardo Babun and Ahmet Aris and Kemal Akkaya and A Selcuk Uluagac},

url = {https://dl.acm.org/doi/abs/10.1145/3408308.3427606},

year  = {2020},

date = {2020-01-01},

urldate = {2020-01-01},

booktitle = {In the Proceedings of the 7th ACM International Conference on Systems for Energy-Efficient Buildings, Cities, and Transportation},

pages = {130–139},

abstract = {The rise of IoT devices has led to the proliferation of smart buildings, offices, and homes worldwide. Although commodity IoT devices are employed by ordinary end-users, complex environments such as smart buildings, government, or private smart offices, conference rooms, or hospitality require customized and highly reliable solutions. Those systems called Enterprise Internet of Things (EIoT) connect such environments to the Internet and are professionally managed solutions usually offered by dedicated vendors (e.g., Control4, Crestron, Lutron, etc.). As EIoT systems require specialized training, software, and equipment to deploy, many of these systems are closed-source and proprietary in nature. This has led to very little research investigating the security of EIoT systems and their components. },

keywords = {CPS Security, IoT Security, Smart Home Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{10.1007/978-3-030-59013-0_36,

title = {LNBot: A Covert Hybrid Botnet on Bitcoin Lightning Network for Fun and Profit},

author = {Ahmet Kurt and Enes Erdin and Mumin Cebe and Kemal Akkaya and A. Selcuk Uluagac},

editor = {Liqun Chen and Ninghui Li and Kaitai Liang and Steve Schneider},

url = {https://link.springer.com/chapter/10.1007/978-3-030-59013-0_36},

year  = {2020},

date = {2020-01-01},

urldate = {2020-01-01},

series = {In the Proceedings of the 25th European Symposium on Research in Computer Security (ESORICS)},

abstract = {While various covert botnets were proposed in the past, they still lack complete anonymization for their servers/botmasters or suffer from slow communication between the botmaster and the bots. In this paper, we propose a new generation hybrid botnet that covertly and efficiently communicates over Bitcoin Lightning Network (LN), called LNBot. LN is a payment channel network operating on top of Bitcoin network for faster Bitcoin transactions with negligible fees. Exploiting various anonymity features of LN, we designed a scalable two-layer botnet which completely anonymize the identity of the botmaster. In the first layer, the botmaster sends commands anonymously to the C&C servers through LN transactions. Specifically, LNBot allows botmaster's commands to be sent in the form of surreptitious multihop LN payments, where the commands are encoded with ASCII or Huffman encoding to provide covert communications. In the second layer, C&C servers further relay those commands to the bots they control in their mini-botnets to launch any type of attacks to victim machines. We implemented a proof-of-concept on the actual LN and extensively analyzed the delay and cost performance of LNBot. Our analysis show that LNBot achieves better scalibility compared to the other similar blockchain botnets with negligible costs. Finally, we also provide and discuss a list of potential countermeasures to detect LNBot activities and minimize its impacts.},

keywords = {Bitcoin, Blockchain Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{10.1145/3360774.3368197,

title = {A novel routing metric for IEEE 802.11s-based swarm-of-drones applications},

author = {Oscar G. Bautista and Nico Saputro and Kemal Akkaya and Selcuk Uluagac},

url = {https://doi.org/10.1145/3360774.3368197},

year  = {2020},

date = {2020-01-01},

urldate = {2020-01-01},

booktitle = {In the Proceedings of the 16th EAI International Conference on Mobile and Ubiquitous Systems},

abstract = {With the proliferation of drones in our daily lives, there is an increasing need for handling their numerous challenges. One of such challenge arises when a swarm-of-drones are deployed to accomplish a specific task which requires coordination and communication among the drones. While this swarm-of-drones is essentially a special form of mobile ad hoc networks (MANETs) which has been studied for many years, there are still some unique requirements of drone applications that necessitates re-visiting MANET approaches. These challenges stem from 3–D environments the drones are deployed in, and their specific way of mobility which adds to the wireless link management challenges among the drones. In this paper, we consider an existing routing standard that is used to enable meshing capability among Wi-Fi enabled nodes, namely IEEE 802.11s and adopt its routing capabilities for swarm-of-drones. Specifically, we propose a link quality metric called SrFTime as an improvement to existing Airtime metric which is the 802.11s default routing metric to enable better network throughput for drone applications. This new metric is designed to fit the link characteristics of drones and enable more efficient routes from drones to their gateway. The evaluations in the actual 802.11s standard indicates that our proposed metric outperforms the existing one consistently under various conditions.},

keywords = {Network Security, UAV Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{celik2019curie,

title = {Curie: Policy-based secure data exchange},

author = {Z Berkay Celik and Abbas Acar and Hidayet Aksu and Ryan Sheatsley and Patrick McDaniel and A Selcuk Uluagac},

url = {https://dl.acm.org/doi/10.1145/3292006.3300042},

year  = {2019},

date = {2019-01-01},

urldate = {2019-01-01},

booktitle = {In the Proceedings of the 9th ACM Conference on Data and Application Security and Privacy (CODASPY)},

abstract = {Data sharing among partners—users, companies, organizations—is crucial for the advancement of collaborative machine learning in many domains such as healthcare, finance, and security. Sharing through secure computation and other means allow these partners to perform privacy-preserving computations on their private data in controlled ways. However, in reality, there exist complex relationships among members (partners). Politics, regulations, interest, trust, data demands and needs prevent members from sharing their complete data. Thus, there is a need for a mechanism to meet these conflicting relationships on data sharing. This paper presents, an approach to exchange data among members who have complex relationships. },

keywords = {Authentication, IoT Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{Naseem2019CSPoweR,

title = {CSPoweR-Watch: A Cyber-Resilient Residential Power Management System},

author = {Faraz Naseem and Leonardo Babun and Cengiz Kaygusuz and S. J. Moquin and Chris Farnell and Alan Mantooth and A. Selcuk Uluagac},

url = {https://ieeexplore.ieee.org/abstract/document/8875295/},

year  = {2019},

date = {2019-01-01},

urldate = {2019-01-01},

publisher = {In the proceedings of the International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)},

abstract = {Modern Energy Management Systems (EMS) are becoming increasingly complex in order to address the urgent issue of global energy consumption. These systems retrieve vital information from various Internet-connected resources in a smart grid to function effectively. However, relying on such resources results in them being susceptible to cyber attacks. Malicious actors can exploit the interconnections between the resources to perform nefarious tasks such as modifying critical firmware, sending bogus sensor data, or stealing sensitive information. To address this issue, we propose a novel framework that integrates PowerWatch, a solution that detects compromised devices in the smart grid with Cyber-secure Power Router (CSPR), a smart energy management system. The goal is to ascertain whether or not such a device has operated maliciously. To achieve this, PowerWatch utilizes a machine learning model that analyzes information from system and library call lists extracted from CSPR in order to detect malicious activity in the EMS. To test the efficacy of our framework, a number of unique attack scenarios were performed on a realistic testbed that comprises functional versions of CSPR and PowerWatch to monitor the electrical environment for suspicious activity. Our performance evaluation investigates the effectiveness of this first-of-its-kind merger and provides insight into the feasibility of developing future cybersecure EMS. The results of our experimental procedures yielded 100% accuracy for each of the attack scenarios. Finally, our implementation demonstrates that the integration of PowerWatch and CSPR is effective and yields minimal overhead to the EMS.},

keywords = {CPS Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{Sikder2019Aegis,

title = {Aegis: A Context-Aware Security Framework for Smart Home Systems},

author = {Amit Kumar Sikder and Leonardo Babun and Hidayet Aksu and A. Selcuk Uluagac},

url = {https://doi.org/10.1145/3359789.3359840},

doi = {10.1145/3359789.3359840},

year  = {2019},

date = {2019-01-01},

urldate = {2019-01-01},

publisher = {In the Proceedings of the 35th Annual Computer Security Applications Conference (ACSA)},

abstract = {Our everyday lives are expanding fast with the introduction of new Smart Home Systems (SHSs). Today, a myriad of SHS devices and applications are widely available to users and have already started to re-define our modern lives. Smart home users utilize the apps to control and automate such devices. Users can develop their own apps or easily download and install them from vendor-specific app markets. App-based SHSs offer many tangible benefits to our lives, but also unfold diverse security risks. Several attacks have already been reported for SHSs. However, current security solutions consider smart home devices and apps individually to detect malicious actions rather than the context of the SHS as a whole. The existing mechanisms cannot capture user activities and sensor-device-user interactions in a holistic fashion. To address these issues, in this paper, we introduce Aegis, a novel context-aware security framework to detect malicious behavior in a SHS. Specifically, Aegis observes the states of the connected smart home entities (sensors and devices) for different user activities and usage patterns in a SHS and builds a contextual model to differentiate between malicious and benign behavior. We evaluated the efficacy and performance of Aegis in multiple smart home settings (i.e., single bedroom, double bedroom, duplex) with real-life users performing day-to-day activities and real SHS devices. We also measured the performance of Aegis against five different malicious behaviors. Our detailed evaluation shows that Aegis can detect malicious behavior in SHS with high accuracy (over 95%) and secure the SHS regardless of the smart home layout, device configuration, installed apps, and enforced user policies. Finally, Aegis achieves minimum overhead in detecting malicious behavior in SHS, ensuring easy deployability in real-life smart environments.},

keywords = {IoT Security, Smart Home Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{Akkaya2019UAVSec,

title = {Privacy-Preserving Control of Video Transmissions for Drone-based Intelligent Transportation Systems},

author = {Kemal Akkaya and Vashish Baboolal and Nico Saputro and Selcuk Uluagac and Hamid Menouar},

url = {https://ieeexplore.ieee.org/abstract/document/8802665/},

year  = {2019},

date = {2019-01-01},

urldate = {2019-01-01},

booktitle = {In the proceedings of the IEEE Conference on Communications and Network Security (CNS)},

abstract = {The drones are now frequently used for many smart city applications including intelligent transportation to provide situational awareness for drivers as well as other stakeholders that manage the traffic. In such situations one of the widely collected data is video that is recorded by a drone and streamed in real-time to a remote control center. The data can then be accessed through cloud services to do further analysis and take actions. However, this captured video may contain private information from the passing by citizens and allow recognition and tracking if it is intercepted by malicious users. While the video data can be stored as encrypted in the cloud, this still does not address the privacy problem as the third party providers still need to decrypt the data to perform any further processing. To address this issue, we propose using fully homomorphic encryption (FHE)which will not only provide confidentiality of the data but also enable processing on the encrypted video data by cloud providers and other third parties without exposing any privacy. However, since fully homomorphic systems have a lot of overhead, in this paper, we propose to conduct background extraction on video images and transmit only the changing foreground to minimize data transmission. As we use FHE, this allows reconstruction of the video at the server without decrypting the data. We tested the feasibility of the proposed approach extensively under various conditions including the type of FHE used, the underlying communication protocols and video size. The results indicate that our approach can even outperform AES-based method in terms of total time to complete the video transmission while additionally enabling privacy features},

keywords = {UAV Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{Rondon2019HDMI-walk,

title = {HDMI-Walk: Attacking HDMI Distribution Networks via Consumer Electronic Control Protocol},

author = {Luis Puche Rondon and Leonardo Babun and Kemal Akkaya and A. Selcuk Uluagac},

url = {https://doi.org/10.1145/3359789.3359841},

year  = {2019},

date = {2019-01-01},

urldate = {2019-01-01},

booktitle = {In the Proceedings of the 35th Annual Computer Security Applications Conference},

abstract = {The High Definition Multimedia Interface (HDMI) is the backbone and the de-facto standard for Audio/Video interfacing between video-enabled devices. Today, almost tens of billions of HDMI devices exist in the world and are widely used to distribute A/V signals in smart homes, offices, concert halls, and sporting events making HDMI one of the most highly deployed systems in the world. An important component in HDMI is the Consumer Electronics Control (CEC) protocol, which allows for the interaction between devices within an HDMI distribution network. Nonetheless, existing network security mechanisms only protect traditional networking components, leaving CEC outside of their scope. In this work, we identify and tap into CEC protocol vulnerabilities, using them to implement realistic proof-of-work attacks on HDMI distribution networks. We study, how current insecure CEC protocol practices and carelessly implemented HDMI distributions may grant an adversary a novel attack surface for HDMI devices otherwise thought to be unreachable through traditional means. To introduce this novel attack surface, in this paper, we present HDMI-Walk, which opens a realm of remote and local CEC attacks to HDMI devices. Specifically, with HDMI-Walk, an attacker can perform malicious analysis of devices, eavesdropping, Denial of Service attacks, targeted device attacks, and even facilitate other well-known existing attacks through HDMI. With HDMI-Walk, we prove that it is feasible for an attacker to gain arbitrary control of HDMI devices. We demonstrate the implementations of both local and remote attacks with commodity HDMI devices including Smart TVs and Media Players. Our work aims to uncover vulnerabilities in a very well deployed system like HDMI distributions. The consequences of which can largely impact HDMI users as well as other systems which depend on these distributions. Finally, we discuss security mechanisms to provide impactful and comprehensive security evaluation to these real-world systems while guaranteeing deployability and providing minimal overhead, while considering the current limitations of the CEC protocol. To the best of our knowledge, this is the first work solely investigating the security of HDMI device distribution networks.},

keywords = {Enterprise Security, Network Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{Newaz2019Hcguard,

title = {HealthGuard: A Machine Learning-Based Security Framework for Smart Healthcare Systems},

author = {AKM Iqtidar Newaz and Amit Kumar Sikder and Mohammad Ashiqur Rahman and A. Selcuk Uluagac},

url = {https://ieeexplore.ieee.org/abstract/document/8931716},

year  = {2019},

date = {2019-01-01},

urldate = {2019-01-01},

booktitle = {In the Proceedings of the 6th International Conference on Social Networks Analysis, Management and Security (SNAMS)},

abstract = {The integration of Internet-of-Things and pervasive computing in medical devices have made the modern healthcare system “smart.” Today, the function of the healthcare system is not limited to treat the patients only. With the help of implantable medical devices and wearables, Smart Healthcare System (SHS) can continuously monitor different vital signs of a patient and automatically detect and prevent critical medical conditions. However, these increasing functionalities of SHS raise several security concerns and attackers can exploit the SHS in numerous ways: they can impede normal function of the SHS, inject false data to change vital signs, and tamper a medical device to change the outcome of a medical emergency. In this paper, we propose HealthGuard, a novel machine learning-based security framework to detect malicious activities in a SHS. HealthGuard observes the vital signs of different connected devices of a SHS and correlates the vitals to understand the changes in body functions of the patient to distinguish benign and malicious activities. HealthGuard utilizes four different machine learning-based detection techniques (Artificial Neural Network, Decision Tree, Random Forest, k-Nearest Neighbor) to detect malicious activities in a SHS. We trained HealthGuard with data collected for eight different smart medical devices for twelve benign events including seven normal user activities and five disease-affected events. Furthermore, we evaluated the performance of HealthGuard against three different malicious threats. Our extensive evaluation shows that HealthGuard is an effective security framework for SHS with an accuracy of 91 % and an F1 score of 90 %.},

keywords = {Machine Learning Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{babun2019real,

title = {Real-time analysis of privacy-(un) aware IoT applications},

author = {Leonardo Babun and Z Berkay Celik and Patrick McDaniel and A Selcuk Uluagac},

url = {https://petsymposium.org/popets/2021/popets-2021-0009.php},

year  = {2019},

date = {2019-01-01},

urldate = {2019-01-01},

journal = {arXiv preprint arXiv:1911.10461},

publisher = {In the Proceedings of the Privacy Enhancing Technologies Symposium (PoPETs)},

abstract = {Users trust IoT apps to control and automate their smart devices. These apps necessarily have access to sensitive data to implement their functionality. However, users lack visibility into how their sensitive data is used (or leaked), and they often blindly trust the app developers. In this paper, we present IoTWatcH, a novel dynamic analysis tool that uncovers the privacy risks of IoT apps in real-time. We designed and built IoTWatcH based on an IoT privacy survey that considers the privacy needs of IoT users. IoTWatcH provides users with a simple interface to specify their privacy preferences with an IoT app. Then, in runtime, it analyzes both the data that is sent out of the IoT app and its recipients using Natural Language Processing (NLP) techniques. Moreover, IoTWatcH informs the users with its findings to make them aware of the privacy risks with the IoT app. We implemented IoTWatcH on real IoT applications. Specifically, we analyzed 540 IoT apps to train the NLP model and evaluate its effectiveness. IoTWatcH successfully classifies IoT app data sent to external parties to correct privacy labels with an average accuracy of 94.25%, and flags IoT apps that leak privacy data to unauthorized parties. Finally, IoTWatcH yields minimal overhead to an IoT app's execution, on average 105 ms additional latency.},

howpublished = {In the proceedings of the Privacy Enhancing Technologies (PETs)},

keywords = {IoT Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{1Babun2019DFFramework,

title = {A Digital Forensics Framework for Smart Settings: Poster},

author = {Leonardo Babun and Amit K. Sikder and Abbas Acar and A. Selcuk Uluagac},

url = {https://doi.org/10.1145/3317549.3326317},

year  = {2019},

date = {2019-01-01},

urldate = {2019-01-01},

publisher = {In the Proceedings of the 12th Conference on Security and Privacy in Wireless and Mobile Networks (WiSec)},

abstract = {Users utilize IoT devices and sensors in a co-operative manner to enable the concept of a smart environment. This integration generate data with high forensic value. Nonetheless, current smart app programming platforms do not provide any digital forensics capability to identify, trace, store, and analyze the data produced in these settings. To overcome these limitations, in this poster, we present our ongoing work to introduce a novel digital forensic framework for a smart environment.},

keywords = {Forensics, IoT Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{Acar2019MalwareTrendsb,

title = { An Analysis of Malware Trends in Enterprise Networks},

author = {Abbas Acar and Long Lu and A. Selcuk Uluagac and Engin Kirda},

url = {https://link.springer.com/chapter/10.1007/978-3-030-30215-3_18},

year  = {2019},

date = {2019-01-01},

urldate = {2019-01-01},

booktitle = {In the Proceedings of the Information Security Conference (ISC)},

abstract = {We present an empirical and large-scale analysis of malware samples captured from two different enterprises from 2017 to early 2018. Particularly, we perform threat vector, social-engineering, vulnerability and time-series analysis on our dataset. Unlike existing malware studies, our analysis is specifically focused on the recent enterprise malware samples. First of all, based on our analysis on the combined datasets of two enterprises, our results confirm the general consensus that AV-only solutions are not enough for real-time defenses in enterprise settings because on average 40% of the malware samples, when first appeared, are not detected by most AVs on VirusTotal or not uploaded to VT at all (i.e., never seen in the wild yet). Moreover, our analysis also shows that enterprise users transfer documents more than executables and other types of files. Therefore, attackers embed malicious codes into documents to download and install the actual malicious payload instead of sending malicious payload directly or using vulnerability exploits. Moreover, we also found that financial matters (e.g., purchase orders and invoices) are still the most common subject seen in Business Email Compromise (BEC) scams that aim to trick employees. Finally, based on our analysis on the timestamps of captured malware samples, we found that 93% of the malware samples were delivered on weekdays. Our further analysis also showed that while the malware samples that require user interaction such as macro-based malware samples have been captured during the working hours of the employees, the massive malware attacks are triggered during the off-times of the employees to be able to silently spread over the networks.},

howpublished = {In the proceedings of the Information Security Conference (ISC)},

keywords = {Enterprise Security, Malware},

pubstate = {published},

tppubtype = {conference}

}

@conference{Erdin2019Blockchainb,

title = {A Heuristic-Based Private Bitcoin Payment Network Formation Using Off-Chain Links},

author = {Enes Erdin and Mumin Cebe and Kemal Akkaya and Eyuphan Bulut and A. Selcuk Uluagac},

url = {https://ieeexplore.ieee.org/abstract/document/8946276},

year  = {2019},

date = {2019-01-01},

urldate = {2019-01-01},

booktitle = {In the Proceedings of the  IEEE International Conference on Blockchain (Blockchain)},

abstract = {While Bitcoin dominates the market for cryptocurrencies, its use in micropayments is still a challenge due to its long transaction validation times and high fees. Recently, the concept of off-chain payments is introduced that led to the idea of establishing a payment network called Lightning Network (LN). Off-chain links provide the ability to do transactions without writing to Blockchain. However, LN's design still favors fees and is creating hub nodes that defeat the purpose of Blockchain. In addition, it is still not reliable as not all the transactions are guaranteed to be transmitted to their destinations. If current retailers would like to use it, these problems might hinder its adoption. To address this issue, in this paper, we advocate creating a private payment network among a given set of retailers that will serve their business needs, just like the idea of private Blockchains. The goal is to build a pure peer-to-peer topology that will eliminate the need for relays and increase the robustness of payments. Using off-chain links as edges and retailers as nodes, the problem is formulated as a multi-flow commodity problem where transactions represent the commodities from various sources to destinations. As the multi-flow commodity problem is NP-Complete, we propose a heuristic approach that utilizes Dijkstra's shortest path algorithm in a dynamic way by updating the edge weights when new payment paths are to be found. The order of transactions is randomized to provide fairness among the retailers. The evaluations indicate that the proposed heuristic comes close to an optimal solution while providing scalability and user privacy.},

howpublished = {In the proceedings of the International Conference on Blockchain},

keywords = {Bitcoin, Blockchain Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{Berkay2018InfoTrackingb,

title = {Sensitive Information Tracking in Commodity IoT},

author = {Z. Berkay Celik and Leonardo Babun and Amit Kumar Sikder and Hidayet Aksu and Gang Tan and Patrick McDaniel and A. Selcuk Uluagac},

url = {https://www.usenix.org/conference/usenixsecurity18/presentation/celik},

year  = {2018},

date = {2018-08-01},

urldate = {2018-08-01},

booktitle = {In the Proceedings of the 27th USENIX Security Symposium},

abstract = {Broadly defined as the Internet of Things (IoT), the growth of commodity devices that integrate physical processes with digital connectivity has had profound effects on society--smart homes, personal monitoring devices, enhanced manufacturing and other IoT applications have changed the way we live, play, and work. Yet extant IoT platforms provide few means of evaluating the use (and potential avenues for misuse) of sensitive information. Thus, consumers and organizations have little information to assess the security and privacy risks these devices present. In this paper, we present SainT, a static taint analysis tool for IoT applications. SainT operates in three phases; (a) translation of platform-specific IoT source code into an intermediate representation (IR), (b) identifying sensitive sources and sinks, and (c) performing static analysis to identify sensitive data flows. We evaluate SainT on 230 SmartThings market apps and find 138 (60%) include sensitive data flows. In addition, we demonstrate SainT on IoTBench, a novel open-source test suite containing 19 apps with 27 unique data leaks. Through this effort, we introduce a rigorously grounded framework for evaluating the use of sensitive information in IoT apps---and therein provide developers, markets, and consumers a means of identifying potential threats to security and privacy.},

howpublished = {In the proceedings of the 27th USENIX Security Symposium},

keywords = {IoT Security, Mobile Security },

pubstate = {published},

tppubtype = {conference}

}

@conference{Saputro2018DroneTranspSystemb,

title = {Drone-Assisted Multi-Purpose Roadside Units for Intelligent Transportation Systems},

author = {Nico Saputro and Kemal Akkaya and Ramazan Algin and Selcuk Uluagac},

url = {https://ieeexplore.ieee.org/abstract/document/8690977/},

year  = {2018},

date = {2018-01-01},

urldate = {2018-01-01},

booktitle = {In the proceedings of the 88th Vehicular Technology Conference (VTC-Fall)},

abstract = {As drones are becoming prevalent to be deployed in various civic applications, there is a need to integrate them into efficient and secure communications with the existing infrastructure. In this paper, considering emergency scenarios for intelligent transportation applications, we design a secure hybrid communication infrastructure for mobile road-side units (RSUs) that are based on drones. The architecture tackles interoperability issues when Dedicated Short Range Communications (DSRC), wireless mesh, and LTE need to coexist for coordination. Specifically, we propose a novel tunneling protocol to integrate LTE with IEEE 802.11s mesh network. In addition, we ensure that only legitimate users can connect and control the mobile RSUs by integrating an authentication framework built on top of the recent OAuth 2.0 standard. A detailed communication protocol is proposed within the elements of the architecture from vehicles to control center for emergency operations. The proposed secure architecture is implemented in ns-3 and tested for its performance under heavy multimedia traffic. The results indicate that the proposed hybrid architecture can enable smooth multimedia traffic delivery via the mobile RSU.},

keywords = {Network Security, UAV Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{Saputro2018DronSeamlessConnb,

title = {Supporting Seamless Connectivity in Drone-assisted Intelligent Transportation Systems},

author = {Nico Saputro and Kemal Akkaya and Selcuk Uluagac},

url = {https://ieeexplore.ieee.org/abstract/document/8628496},

year  = {2018},

date = {2018-01-01},

urldate = {2018-01-01},

booktitle = {In the Proceedings of the 43rd IEEE Conference on Local Computer Networks Workshops (LCN Workshops)},

abstract = {Considering emergency scenarios for intelligent transportation applications, we propose a swarm of drones communication architecture that can sustain connectivity to assist the authorities for damage assessments. The connectivity sustenance needs stem from the fact that drones may move to various locations in response to service requests from the authorities but they still need to cooperate for data collection and transmissions. To address this need, we propose a centralized connectivity maintenance heuristic which will enable the swarm to dynamically adapt its formation in response to the service requests while ensuring uninterrupted live assessment reports. To select the moving drone(s), the minimum connected dominating set concept is utilized to come up with three strategies of mixed stretching or moving heuristic for the connectivity restoration. The proposed architecture and heuristics are implemented in ns-3 network simulator and the effectiveness is tested in terms of providing undisturbed services under heavy multimedia traffic. The results indicate that the proposed approaches enable uninterrupted multimedia traffic delivery.},

howpublished = {In the Proceedings of the 43rd IEEE Conference on Local Computer Networks Workshops (LCN Workshops)},

keywords = {Network Security, UAV Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{8599719b,

title = {OS Independent and Hardware-Assisted Insider Threat Detection and Prevention Framework},

author = {Enes Erdin and Hidayet Aksu and Selcuk Uluagac and Micheal Vai and Kemal Akkaya},

url = {https://ieeexplore.ieee.org/abstract/document/8599719},

year  = {2018},

date = {2018-01-01},

urldate = {2018-01-01},

publisher = {In the Proceedings of the IEEE Military Communications Conference (MILCOM)},

abstract = {Governmental and military institutions harbor critical infrastructure and highly confidential information. Although institutions are investing a lot for protecting their data and assets from possible outsider attacks, insiders are still a distrustful source for information leakage. As malicious software injection is one among many attacks, turning innocent employees into malicious attackers through social attacks is the most impactful one. Malicious insiders or uneducated employees are dangerous for organizations that they are already behind the perimeter protections that guard the digital assets; actually, they are trojans on their own. For an insider, the easiest possible way for creating a hole in security is using the popular and ubiquitous Universal Serial Bus (USB) devices due to its versatile and easy to use plug-and-play nature. USB type storage devices are the biggest threats for contaminating mission critical infrastructure with viruses, malware, and trojans. USB human interface devices are also dangerous as they may connect to a host with destructive hidden functionalities. In this paper, we propose a novel hardware-assisted insider threat detection and prevention framework for the USB case. Our novel framework is also OS independent. We implemented a proof-of-concept design on an FPGA board which is widely used in military settings supporting critical missions, and demonstrated the results considering different experiments. Based on the results of these experiments, we show that our framework can identify rapid-keyboard key-stroke attacks and can easily detect the functionality of the USB device plugged in. We present the resource consumption of our framework on the FPGA for its utilization on a host controller device. We show that the our hard-to-tamper framework introduces no overhead in USB communication in terms of user experience.},

keywords = {Hardware Security, Malware},

pubstate = {published},

tppubtype = {conference}

}

@conference{Erdin2018PrivBCNetc,

title = {Building a Private Bitcoin-Based Payment Network Among Electric Vehicles and Charging Stations},

author = {Enes Erdin and Mumin Cebe and Kemal Akkaya and Senay Solak and Eyuphan Bulut and Selcuk Uluagac},

url = {https://ieeexplore.ieee.org/abstract/document/8726825},

year  = {2018},

date = {2018-01-01},

urldate = {2018-01-01},

publisher = {In the Proceedings of the IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)},

abstract = {Mass penetration and market dominance of Electric Vehicles (EVs) are expected in the upcoming years. Due to their frequent charging needs, not only public and private charging stations are being built, but also V2V charging options are considered. This forms a charging network with various suppliers and EV customers which can communicate to schedule charging operations. While an app can be designed to develop matching algorithms for charging schedules, the system also needs a convenient payment method that will enable privacy-preserving transactions among the suppliers and EVs. In this paper, we adopt a Bitcoin-based payment system for the EV charging network payments. However, Bitcoin has a transaction fee which would be comparable to the price of the charging service most of the time and thus may not be attractive to users. High transaction fees can be eliminated by building a payment network in parallel to main ledger, with permission and signatures. In this paper, we design and implement such a network among charging stations and mobile EVs with flow, connectivity and fairness constraints, and demonstrate results for the feasibility of the scheme under different circumstances. More specifically, we propose a payment network optimization model for determining payment channels among charging stations. We present numerical results on the characteristics of the network model by using realistic use cases.},

keywords = {Blockchain Security, Vehicle security},

pubstate = {published},

tppubtype = {conference}

}

@conference{Acar2018WACAb,

title = {WACA: Wearable-Assisted Continuous Authentication},

author = {Abbas Acar and Hidayet Aksu and A. Selcuk Uluagac and Kemal Akkaya},

url = {https://ieeexplore.ieee.org/abstract/document/8424658},

year  = {2018},

date = {2018-01-01},

urldate = {2018-01-01},

publisher = {In the Proceedings of the IEEE Security and Privacy Workshops (SPW) },

abstract = {One-time login process in conventional authentication systems does not guarantee that the identified user is the actual user throughout the session. However, it is necessary to re-verify the user identity periodically throughout a login session, which is lacking in existing one-time login systems. In this paper, we introduce a usable and reliable Wearable-Assisted Continuous Authentication (WACA), which relies on the sensor-based keystroke dynamics and the authentication data is acquired through the built-in sensors of a wearable (e.g., smartwatch) while the user is typing. The acquired data is periodically and transparently compared with the registered profile of the initially logged-in user with one-way classifiers. With this, WACA continuously ensures that the current user is the user who logged in initially. We implemented the WACA framework and evaluated its performance on real devices with real users. The empirical evaluation of WACA reveals that WACA is feasible and its error rate is as low as 1% with 30 seconds of processing time and 2 - 3% for 20 seconds. The computational overhead is minimal. Furthermore, WACA is capable of identifying insider threats with very high accuracy (99.2%).},

keywords = {Authentication, Vehicle security},

pubstate = {published},

tppubtype = {conference}

}

@conference{Sikder2018Smartlightingb,

title = {IoT-enabled smart lighting systems for smart cities},

author = {Amit Kumar Sikder and Abbas Acar and Hidayet Aksu and A. Selcuk Uluagac and Kemal Akkaya and Mauro Conti},

url = {https://ieeexplore.ieee.org/abstract/document/8301744},

year  = {2018},

date = {2018-01-01},

urldate = {2018-01-01},

booktitle = {In the Proceedings of the IEEE 8th Annual Computing and Communication Workshop and Conference (CCWC)},

abstract = {Over the past few decades, the rate of urbanization has increased enormously. More enhanced services and applications are needed in urban areas to provide a better lifestyle. Smart city, which is a concept of interconnecting modern digital technologies in the context of a city, is a potential solution to enhance the quality and performance of urban services. With the introduction of Internet-of-Things (IoT) in the smart city, new opportunities have emerged to develop new services and integrate different application domains with each other using Information and Communication Technologies. However, to ensure seamless services in an IoT-enabled smart city environment, all the applications have to be maintained with limited energy resources. One of the core sectors that can be improved significantly by implementing IoT is the lighting system of a city since it consumes more energy than other parts of a city. In a smart city, the lighting system is integrated with advanced sensors and communication channels to obtain a Smart Lighting System (SLS). The goal of an SLS is to obtain an autonomous and more efficient lighting management system. In this paper, we provide an overview of the SLS and review different IoT-enabled communication protocols, which can be used to realize the SLS in the context of a smart city. Moreover, we analyzed different usage scenarios for IoT-enabled indoor and outdoor SLS and provide an analysis of the power consumption. Our results reveal that IoT-enabled smart lighting systems can reduce power consumption up to 33.33% in both indoor and outdoor settings. Finally, we discussed the future research directions in SLS in the smart city.},

keywords = {IoT Security, Network Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{Aydeger2018AuthOverheadb,

title = {Assessing the overhead of authentication during SDN-enabled restoration of smart grid inter-substation communications},

author = {Abdullah Aydeger and Nico Saputro and Kemal Akkaya and Selcuk Uluagac},

url = {https://ieeexplore.ieee.org/abstract/document/8319206},

year  = {2018},

date = {2018-01-01},

urldate = {2018-01-01},

publisher = {In the Proceedings of the 15th IEEE Annual Consumer Communications & Networking Conference (CCNC)},

abstract = {Since real-time and resilient recovery of link failures is crucial for power grid infrastructure to continue its services, emerging technologies such as Software Defined Networking (SDN) has started to be employed for such purposes. SDN switches can be remotely controlled to change their configurations by exploiting the wireless communication options. However, when wireless is to be used in Smart Grid communications, security and reliability become important issues due to the specific characteristics of wireless communications. This paper investigates the overhead of providing such services on wireless links when SDN is utilized. Specifically, we consider the establishment of authentication services when wireless back-up links (i.e., WiFi or LTE) are employed as a result of a reactive link failure detection mechanism. To the best of our knowledge, this work is the first to consider authentication of such an SDN-enabled Smart Grid inter-substation communication with WiFi and LTE. To be able to effectively evaluate the performance of this proposed SDN-enabled framework, we developed it in Mininet emulator. Since Mininet does not support the authentication services for WiFi or LTE, we proposed several novel extensions to Mininet by integrating it with ns-3 simulator that supports the LTE/WiFi protocol stacks. We conducted extensive experiments by considering a general application using Smart Grid Manufacturing Message Specification (MMS) standard to assess the recovery performance of the proposed secure SDN-enabled recovery system. The results show that when authentication and reliable protocols such as TCP are to be employed, the proposed framework can still meet the deadlines of 100 ms with WiFi while LTE misses only a few packets.},

keywords = {Authentication, SDN Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{Yesilyurt2018SOTAb,

title = {SOTA: Secure Over-the-Air Programming of IoT Devices},

author = {Halim Burak Yesilyurt and Hidayet Aksu and Selcuk Uluagac and Raheem Beyah},

url = {https://ieeexplore.ieee.org/abstract/document/8599705},

year  = {2018},

date = {2018-01-01},

urldate = {2018-01-01},

booktitle = {In the Proceedings of the IEEE Military Communications Conference (MILCOM)},

abstract = {The emerging Internet of Things (IoT) devices introduced many useful applications that are utilized in our daily lives, scientific research, and military operations. In these applications, secure over the air programming of IoT devices is vital as the devices can be re-programmed by hackers and the firmware can be stolen by eavesdropping a live firmware distribution operation. Nonetheless, as most of the IoT devices have limited computational resources (e.g., memory, CPU, storage), over-the-air programming of IoT devices necessitates efficient utilization of the resources. In this work, to address these concerns and provide a more efficient and secure code-dissemination process, a novel secure over-the-air programming framework called SOTA is introduced, which is also designed as an open-source framework and available for the research and developer communities. SOTA provides confidentiality, integrity, and authentication to resource-limited IoT devices in order to protect the firmware from adversaries. Furthermore, we perform extensive performance evaluations on real resource-limited IoT devices with Atmel-based microcontrollers. Evaluations revealed that SOTA has minimal performance and memory overhead on the IoT devices. SOTA is a promising solution to provide an over-the-air code dissemination protocol with security to resource-limited IoT devices in both military and civilian settings.},

keywords = {IoT Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{Kaygusuz2018SmartGridMLb,

title = {Detection of Compromised Smart Grid Devices with Machine Learning and Convolution Techniques},

author = {Cengiz Kaygusuz and Leonardo Babun and Hidayet Aksu and A. Selcuk Uluagac},

url = {https://ieeexplore.ieee.org/abstract/document/8423022},

year  = {2018},

date = {2018-01-01},

urldate = {2018-01-01},

booktitle = {In the Proceedings of the IEEE International Conference on Communications (ICC)},

abstract = {The smart grid concept has transformed the traditional power grid into a massive cyber- physical system that depends on advanced two-way communication infrastructure to integrate a myriad of different smart devices. While the introduction of the cyber component has made the grid much more flexible and efficient with so many smart devices, it also broadened the attack surface of the power grid. Particularly, compromised devices pose great danger to the healthy operations of the smart-grid. For instance, the attackers can control the devices to change the behaviour of the grid and can impact the measurements. In this paper, to detect such misbehaving malicious smart grid devices, we propose a machine learning and convolution-based classification framework. Our framework specifically utilizes system and library call lists at the kernel level of the operating system on both resource-limited and resource-rich smart grid devices such as RTUs, PLCs, PMUs, and IEDs. Focusing on the types and other valuable features extracted from the system calls, the framework can successfully identify malicious smart-grid devices. In order to test the efficacy of the proposed framework, we built a representative testbed conforming to the IEC-61850 protocol suite and evaluated its performance with different system calls. The proposed framework in different evaluation scenarios yields very high accuracy (avg. 91%) which reveals that the framework is effective to overcome compromised smart grid devices problem.},

keywords = {Smart-grid Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{hakim2018u,

title = {U-pot: A honeypot framework for upnp-based iot devices},

author = {Muhammad A Hakim and Hidayet Aksu and A Selcuk Uluagac and Kemal Akkaya},

url = {https://ieeexplore.ieee.org/document/8711321},

year  = {2018},

date = {2018-01-01},

urldate = {2018-01-01},

booktitle = {In the Proceedings of the IEEE 37th International Performance Computing and Communications Conference (IPCCC)},

abstract = {The ubiquitous nature of the IoT devices has brought serious security implications to its users. A lot of consumer IoT devices have little to no security implementation at all, thus risking user's privacy and making them target of mass cyber-attacks. Indeed, recent outbreak of Mirai botnet and its variants have already proved the lack of security on the IoT world. Hence, it is important to understand the security issues and attack vectors in the IoT domain. Though significant research has been done to secure traditional computing systems, little focus was given to the IoT realm. In this work, we reduce this gap by developing a honeypot framework for IoT devices. Specifically, we introduce U-PoT: a novel honeypot framework for capturing attacks on IoT devices that use Universal Plug and Play (UPnP) protocol. A myriad of smart home devices including smart switches, smart bulbs, surveillance cameras, smart hubs, etc. uses the UPnP protocol. Indeed, a simple search on Shodan IoT search engine lists 1,676,591 UPnP devices that are exposed to public network. The popularity and ubiquitous nature of UPnP-based IoT device necessitates a full-fledged IoT honeypot system for UPnP devices. Our novel framework automatically creates a honeypot from UPnP device description documents and is extendable to any device types or vendors that use UPnP for communication. To the best of our knowledge, this is the first work towards a flexible and configurable honeypot framework for UPnP-based IoT devices. We released U-PoT under an open source license for further research on IoT security and created a database of UPnP device descriptions. We also evaluated our framework on two emulated deices. Our experiments show that the emulated devices are able to mimic the behavior of a real IoT device and trick vendor-provided device management applications or popular IoT search engines while having minimal performance ovherhead.},

keywords = {Honeypot/Honeynet, IoT Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{AnuragCybergrenadeIEEE,

title = {Cybergrenade: Automated Exploitation of Local Network Machines via Single Board Computers},

author = {Anurag Akkiraju and David Gabay and Halim Burak Yesilyurt and Hidayet Aksu and Selcuk Uluagac},

url = {https://ieeexplore.ieee.org/document/8108803},

year  = {2017},

date = {2017-01-01},

urldate = {2017-01-01},

booktitle = {In the Proceedings of the IEEE 14th International Conference on Mobile Ad Hoc and Sensor Systems (MASS)},

abstract = {In this paper, we introduce a defensive cybersecurity framework called Cybergrenade automating various penetration testing tools to sequentially exploit machines connected to a single local network, all underneath a single application running on a Single-Board Computer (SBC). This takes advantage of the SBC's unique capabilities in a way that manual exploitation simply cannot match. Currently, while many SBCs are being used in research as exploitation tool-kits, the current state of automation of the processes associated with exploitation leaves much to be desired. While this paper describes the Cybergrenade Framework, it can be used as a guideline for future research automating the exploitation process. Cybergrenade allows tools such as Nmap, OpenVAS, and Metasploit tools to be automatically utilized under one framework. Our experimental evolution revealed that Cybergrenade can perform the automation of various pentesting tools under a single application with ease.},

keywords = {Network Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{Sikder6thSenseUSENIX,

title = {{6thSense}: A context-aware sensor-based attack detector for smart devices},

author = {Amit Kumar Sikder and Hidayet Aksu and A Selcuk Uluagac},

url = {https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/sikder},

year  = {2017},

date = {2017-01-01},

urldate = {2017-01-01},

booktitle = {In the Proceedings of the 26th USENIX Security Symposium (USENIX Security 17)},

abstract = {Sensors (e.g., light, gyroscope, accelerometer) and sensing enabled applications on a smart device make the applications more user-friendly and efficient. However, the current permission-based sensor management systems of smart devices only focus on certain sensors and any App can get access to other sensors by just accessing the generic sensor API. In this way, attackers can exploit these sensors in numerous ways: they can extract or leak users’ sensitive information, transfer malware, or record or steal sensitive information from other nearby devices. In this paper, we propose 6thSense, a context-aware intrusion detection system which enhances the security of smart devices by observing changes in sensor data for different tasks of users and creating a contextual model to distinguish benign and malicious behavior of sensors. 6thSense utilizes three different Machine Learning-based detection mechanisms (i.e., Markov Chain, Naive Bayes, and LMT) to detect malicious behavior associated with sensors. We implemented 6thSense on a sensor-rich Android smart device (i.e., smartphone) and collected data from typical daily activities of 50 real users. Furthermore, we evaluated the performance of 6thSense against three sensor-based threats: (1) a malicious App that can be triggered via a sensor (e.g., light), (2) a malicious App that can leak information via a sensor, and (3) a malicious App that can steal data using sensors. Our extensive evaluations show that the 6thSense framework is an effective and practical approach to defeat growing sensor-based threats with an accuracy above 96% without compromising the normal functionality of the device. Moreover, our framework costs minimal overhead.},

keywords = {IoT Security, Smart Home Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{AcarSecureIEEEPAC,

title = {Achieving Secure and Differentially Private Computations in Multiparty Settings},

author = {Abbas Acar and Z. Berkay Celik and Hidayet Aksu and A. Selcuk Uluagac and Patrick McDaniel},

url = {https://patrickmcdaniel.org/pubs/aca17.pdf},

year  = {2017},

date = {2017-01-01},

urldate = {2017-01-01},

booktitle = {In the Proceedings of the IEEE Symposium on Privacy-Aware Computing (PAC)},

abstract = {Sharing and working on sensitive data in distributed settings from healthcare to finance is a major challenge due to security and privacy concerns. Secure multiparty computation (SMC) is a viable panacea for this, allowing distributed parties to make computations while the parties learn nothing about their data, but the final result. Although SMC is instrumental in such distributed settings, it does not provide any guarantees not to leak any information about individuals to adversaries. Differential privacy (DP) can be utilized to address this; however, achieving SMC with DP is not a trivial task, either. In this paper, we propose a novel Secure Multiparty Distributed Differentially Private (SM-DDP) protocol to achieve secure and private computations in a multiparty environment. Specifically, with our protocol, we simultaneously achieve SMC and DP in distributed settings focusing on linear regression on horizontally distributed data. That is, parties do not see each others' data and further, can not infer information about individuals from the final constructed statistical model. Any statistical model function that allows independent calculation of local statistics can be computed through our protocol. The protocol implements homomorphic encryption for SMC and functional mechanism for DP to achieve the desired security and privacy guarantees. In this work, we first introduce the theoretical foundation for the SM-DDP protocol and then evaluate its efficacy and performance on two different datasets. Our results show that one can achieve individual-level privacy through the proposed protocol with distributed DP, which is independently applied by each party in a distributed fashion. Moreover, our results also show that the SM-DDP protocol incurs minimal computational overhead, is scalable, and provides security and privacy guarantees.},

keywords = {Cryptojacking, Secure Multipart Computation},

pubstate = {published},

tppubtype = {conference}

}

@conference{BabunIdentifyingIEEEICC,

title = {Identifying counterfeit smart grid devices: A lightweight system level framework},

author = {Leonardo Babun and Hidayet Aksu and A. Selcuk Uluagac},

url = {https://ieeexplore.ieee.org/document/7996877},

year  = {2017},

date = {2017-01-01},

urldate = {2017-01-01},

booktitle = {In the Proceedings of the IEEE International Conference on Communications (ICC)},

abstract = {The use of counterfeit smart grid devices throughout the smart grid communication infrastructure represents a real problem. Hence, monitoring and early detection of counterfeit smart grid devices is critical for protecting smart grid's components and data. To address these concerns, in this paper, we introduce a novel system level approach to identify counterfeit smart grid devices. Specifically, our approach is a configurable framework that combines system and function call tracing techniques and statistical analysis to detect counterfeit smart grid devices based on their behavioural characteristics. Moreover, we measure the efficacy of our framework with a realistic testbed that includes both resource-limited and resource-rich counterfeit devices. In total, we analyze six different counterfeit devices in our testbed. The devices communicate via an open source version of the IEC61850 protocol suite (i.e., libiec61850). Experimental results reveal an excellent rate on the detection of smart grid counterfeit devices. Finally, the performance analysis demonstrates that the use of the proposed framework has minimal overhead on the smart grid devices' computing resources.},

keywords = {Fingerprinting, Smart Home Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{AydegerSoftwareIEEEICC,

title = {Software defined networking for resilient communications in Smart Grid active distribution networks},

author = {Abdullah Aydeger and Kemal Akkaya and Mehmet H. Cintuglu and A. Selcuk Uluagac and Osama Mohammed},

url = {https://ieeexplore.ieee.org/document/7511049},

year  = {2016},

date = {2016-01-01},

urldate = {2016-01-01},

booktitle = {In the Proceedings of the IEEE International Conference on Communications (ICC)},

abstract = {Emerging Software Defined Networking (SDN) technology provides excellent flexibility to large-scale networks in terms of control, management, security, and maintenance. In this paper, we propose an SDN-based communication infrastructure for Smart Grid distribution networks among substations. A Smart Grid communication infrastructure consists of a large number of heterogenous devices that exchange real-time information for monitoring the status of the grid. We then investigate how SDN-enabled Smart Grid infrastructure can provide resilience to active distribution substations with self-recovery. Specifically, by introducing redundant and wireless communication links that can be used during the emergencies, we show that SDN controllers can be effective for restoring the communication while providing a lot of flexibility. Furthermore, to be able to effectively evaluate the performance of the proposed work in terms of various fine-grained network metrics, we developed a Mininet-based testing framework and integrated it with ns-3 network simulator. Finally, we conducted experiments by using actual Smart Grid communication data to assess the recovery performance of the proposed SDN-based system. The results show that SDN is a viable technology for the Smart Grid communications with almost negligible delays in switching to backup wireless links during the times of link failures in reliable fashion.},

keywords = {Network Security, SDN Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{VattapparambanDronesIWCMC,

title = {Drones for smart cities: Issues in cybersecurity, privacy, and public safety},

author = {Edwin Vattapparamban and Ismail Güvenç and Ali I Yurekli and Kemal Akkaya and Selçuk Uluağaç},

url = {https://ieeexplore.ieee.org/document/7577060},

year  = {2016},

date = {2016-01-01},

urldate = {2016-01-01},

booktitle = {In the Proceedings of the International Wireless Communications and Mobile Computing Conference (IWCMC)},

abstract = {It is expected that drones will take a major role in the connected smart cities of the future. They will be delivering goods and merchandise, serving as mobile hot spots for broadband wireless access, and maintaining surveillance and security of smart cities. However, pervasive use of drones for future smart cities also brings together several technical and societal concerns and challenges that needs to be addressed, including in the areas of cybersecurity, privacy, and public safety. Drones, while can be used for the betterment of the society, can also be used by malicious entities to conduct physical and cyber attacks, and threaten the society. The goal of this survey paper is to review various aspects of drones in future smart cities, relating to cybersecurity, privacy, and public safety. We will also provide representative results on cyber attacks using drones.},

keywords = {CPS Security, UAV Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{TonyaliHomomorphiCCNC,

title = {A reliable data aggregation mechanism with Homomorphic Encryption in Smart Grid AMI networks},

author = {Samet Tonyali and Kemal Akkaya and Nico Saputro and A. Selcuk Uluagac},

url = {https://csl.fiu.edu/wp-content/uploads/2023/05/reliable_data_tonyali.pdf},

year  = {2016},

date = {2016-01-01},

urldate = {2016-01-01},

booktitle = {In the Proceedings of the 13th IEEE Annual Consumer Communications & Networking Conference (CCNC)},

abstract = {One of the most common methods to preserve consumers' private data is using secure in-network data aggregation. The security can be provided through the emerging fully (FHE) or partial (PHE) homomorphic encryption techniques. However, an FHE aggregation scheme generates significantly big-size data when compared to traditional encryption methods. The overhead is compounded in hierarchical networks such as Smart Grid Advanced Metering Infrastructure (AMI) as data packets are routed towards the core of the AMI networking infrastructure from the smart meters. In this paper, we first investigate the feasibility and performance of FHE aggregation in AMI networks utilizing the reliable data transport protocol, TCP. Then, we introduce the packet reassembly problem. To address this challenge, we propose a novel packet reassembly mechanism for TCP. We evaluated the effectiveness of our proposed mechanism using both PHE and FHE-based aggregation approaches in AMI in terms throughput and end-to-end delay on an 802.11s-based wireless mesh network by using the ns-3 network simulator. The results indicate significant gains in terms of delay and bandwidth usage with the proposed mechanism.},

keywords = {CPS Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{BabunSmartGridIEEECNS,

title = {A framework for counterfeit smart grid device detection},

author = {Leonardo Babun and Hidayet Aksu and A. Selcuk Uluagac},

url = {https://ieeexplore.ieee.org/document/7860522},

year  = {2016},

date = {2016-01-01},

urldate = {2016-01-01},

booktitle = {In the Proceedings of the IEEE Conference on Communications and Network Security (CNS)},

abstract = {The core vision of the smart grid concept is the realization of reliable two-way communications between smart devices (e.g., IEDs, PLCs, PMUs). The benefits of the smart grid also come with tremendous security risks and new challenges in protecting the smart grid systems from cyber threats. Particularly, the use of untrusted counterfeit smart grid devices represents a real problem. Consequences of propagating false or malicious data, as well as stealing valuable user or smart grid state information from counterfeit devices are costly. Hence, early detection of counterfeit devices is critical for protecting smart grid's components and users. To address these concerns, in this poster, we introduce our initial design of a configurable framework that utilize system call tracing, library interposition, and statistical techniques for monitoring and detection of counterfeit smart grid devices. In our framework, we consider realistic counterfeit device scenarios with different smart grid devices and adversarial settings. Our initial results on a realistic testbed utilizing actual smart-grid GOOSE messages with IEC-61850 communication protocol are very promising. Our framework is showing excellent rates on detection of smart grid counterfeit devices from impostors.},

keywords = {CPS Security, Fingerprinting},

pubstate = {published},

tppubtype = {conference}

}

@conference{MichaelsZigbeeIEEECNS,

title = {Inducing data loss in Zigbee networks via join/association handshake spoofing},

author = {Spencer Michaels and Kemal Akkaya and A. Selcuk Uluagac},

url = {https://ieeexplore.ieee.org/document/7860527},

year  = {2016},

date = {2016-01-01},

urldate = {2016-01-01},

booktitle = {In the Proceedings of the IEEE Conference on Communications and Network Security (CNS)},

abstract = {Zigbee is an IEEE 802.15.4-based specification for low-power wireless mesh networks. Being a protocol with several known vulnerabilities, it continues to attract extensive research interest due to its potential applications in the Internet-of-Things (IoT). One of Zigbee's weak points lies in the network coordinator's initial handshake with a joining device, which is unencrypted. Our paper proposes a denial-of-service attack which exploits this fact to convince an end device to send its data to a rogue device on a different channel rather than the actual coordinator. Because the resource limitations of Zigbee devices generally preclude permanent storage, this is likely to result in loss of the transmitted data. We successfully demonstrate our attack and propose a solution that uses challenge-response based authentication to mitigate the attack.},

keywords = {IoT Security, Network Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{AkkayaSofrwareIEEELCN,

title = {Software defined networking for wireless local networks in Smart Grid},

author = {Kemal Akkaya and A. Selcuk Uluagac and Abdullah Aydeger},

url = {https://ieeexplore.ieee.org/document/7365934},

year  = {2015},

date = {2015-01-01},

urldate = {2015-01-01},

booktitle = {In the Proceedings of the 40th IEEE Local Computer Networks Conference Workshops (LCN Workshops)},

abstract = {Emerging Software Defined Networking (SDN) technology has provided excellent flexibility to large-scale networks in terms of control, management, security, and maintenance. With SDN, network architectures can be deployed and maintained with ease. New trends in computing (e.g., cloud computing, data centers, and virtualization) can seamlessly be integrated with the SDN architecture. On the other hand, recent years witnessed a tremendous growth in the upgrade and modernization of the critical infrastructure networks, namely the Smart-Grid, in terms of its underlying communication infrastructure. From Supervisory Control and Data Acquisition (SCADA) systems to Advanced Metering Infrastructure (AMI), an increasing number of networking devices are being deployed to connect all the local network components of the Smart Grid together. Such large local networks requires significant effort in terms of network management and security, which is costly in terms of labor and hardware upgrades. SDN would be a perfect candidate technology to alleviate the costs while providing fine-grained control of this critical network infrastructure. Hence, in this paper, we explore the potential utilization of the SDN technology over the Smart Grid communication architecture. Specifically, we introduce three novel SDN deployment scenarios in local networks of Smart Grid. Moreover, we also investigate the pertinent security aspects with each deployment scenario along with possible solutions.},

keywords = {Network Security, SDN Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{NunnallyInterSecIEEICC,

title = {InterSec: An interaction system for network security applications},

author = {Troy Nunnally and A Selcuk Uluagac and Raheem Beyah},

url = {https://ieeexplore.ieee.org/document/7249464},

year  = {2015},

date = {2015-01-01},

urldate = {2015-01-01},

booktitle = {In the Proceedings of the IEEE International Conference on Communications (ICC)},

abstract = {Traditional two-dimensional (2D) and three-dimensional (3D) visualization tools for network security applications often employ a desktop, mouse, and keyboard setup of WIMP (Windows, Icons, Menus, and a Pointer) interfaces, which use a serial set of command inputs (e.g., click, rotate, zoom). However, research has shown that multiple inputs (e.g., Microsoft Kinect [8] and multi-touch monitors) could reduce the selection time of objects, resulting in a quicker response time than its traditional counterparts. In this work, we investigate these alternative user interfaces that are “natural” to the user for multiple inputs that reduce response time as a user navigates within a complex three-dimensional (3D) visualization for network security applications. Specifically, we introduce a visualization tool called InterSec, an interaction system prototype for interacting with 3D network security visualizations. InterSec helps developers build and manage gestures that require the coordination of multiple inputs across multiple interaction technologies. To our knowledge, InterSec is the first tool that proposes a system to reduce number of interactions within 3D visualizations for network security tools. Through our evaluation of live Honeynet data and a user study, the results reveal InterSec's ability to reduce the number of interactions to aid in 3D navigation in comparison to the mouse user interface.},

keywords = {Network Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{WamplerInformationGLOBECOM,

title = {Information leakage in encrypted ip video traffic},

author = {Christopher Wampler and Selcuk Uluagac and Raheem Beyah},

url = {https://ieeexplore.ieee.org/document/7417767},

year  = {2015},

date = {2015-01-01},

urldate = {2015-01-01},

booktitle = {In the Proceedings of the IEEE Global Communications Conference (GLOBECOM)},

abstract = {Voice chat and conferencing services may be assumed to be private and secure because of strong encryption algorithms applied to the video stream. We show that information leakage is occurring in video over IP traffic, including for encrypted payloads. It is possible to detect motion and scene changes, such as a person standing up or walking past a camera streaming live video. We accomplish this through analysis of network traffic metadata including arrival time between packets, packet sizes, and video stream bandwidth. Event detection through metadata analysis is possible even when common encryption techniques are applied to the video stream such as SSL or AES. We have observed information leakage across multiple codes and cameras. Through measurements of the x264 codec, we establish a basis for detectability of events via packet timing. Our laboratory experiments confirm that this event detection is possible and repeatable with commercial video streaming software.},

keywords = {Network Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{AydegerSDNIEEE,

title = {SDN-based resilience for smart grid communications},

author = {Abdullah Aydeger and Kemal Akkaya and A. Selcuk Uluagac},

url = {https://ieeexplore.ieee.org/abstract/document/7387401},

year  = {2015},

date = {2015-01-01},

urldate = {2015-01-01},

booktitle = {In the Proceedings of the IEEE Conference on Network Function Virtualization and Software Defined Network (NFV-SDN)},

abstract = {With the recent advances in SDN-based technologies, there is a great interest from different communities to exploit SDN for their domain needs. One of such domains is Smart Grid where the underlying network is going through a massive upgrade to enable not only faster and reliable communications but also convenient control. To this end, SDN can be a viable option to provide resilience in Smart Grid SCADA and distribution networks. In this demo, we present such an opportunity by utilizing SDN for redundant communications. Specifically, we introduce multiple connection interfaces among distribution substations. In case of any failures of the wired connection, the backup connection that uses a wireless interface will be enabled by using an Open Daylight SDN controller. To be able to show this, we integrate a network simulator, namely, ns-3 with Mininet.},

keywords = {SDN Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{UluagacAuthenticationIEEE,

title = {A multi-factor re-authentication framework with user privacy},

author = {A. Selcuk Uluagac and Wenyi Liu and Raheem Beyah},

url = {https://ieeexplore.ieee.org/document/6997526},

year  = {2014},

date = {2014-01-01},

urldate = {2014-01-01},

booktitle = {In the Proceedings of the IEEE Conference on Communications and Network Security},

abstract = {Continuous re-authentication of users is a must to protect connections with long duration against any malicious activity. Users can be re-authenticated in numerous ways. One popular way is an approach that requires the presentation of two or more authentication factors (i.e., knowledge, possession, identity) called Multi-factor authentication (MFA). Given the market dominance of ubiquitous computing systems (e.g., cloud), MFA systems have become vital in re-authenticating users. Knowledge factor (i.e., passwords) is the most ubiquitous authentication factor; however, forcing a user to re-enter the primary factor, a password, at frequent intervals could significantly lower the usability of the system. Unfortunately, an MFA system with a possession factor (e.g., Security tokens) usually depends on the distribution of some specific device, which is cumbersome and not user-friendly. Similarly, MFA systems with an identity factor (e.g., physiological biometrics, keystroke pattern) suffer from a relatively low deployability and are highly intrusive and expose users sensitive information to untrusted servers. These servers can keep physically identifying elements of users, long after the user ends the relationship with the server. To address these concerns, in this poster, we introduce our initial design of a privacy-preserving multi-factor re-authentication framework. The first factor is a password while the second factor is a hybrid profile of user behavior with a large combination of host- and network-based features. Our initial results are very promising as our framework can successfully validate legitimate users while detecting impostors.},

keywords = {Authentication},

pubstate = {published},

tppubtype = {conference}

}

@conference{GoldmanCryptographicallyIEEE,

title = {Cryptographically-curated file system (CCFS): Secure, inter-operable, and easily implementable information-centric networking},

author = {Aaron D Goldman and A Selcuk Uluagac and John A Copeland},

url = {https://ieeexplore.ieee.org/document/6925766},

year  = {2014},

date = {2014-01-01},

urldate = {2014-01-01},

booktitle = {In the Proceedings of the 39th Annual IEEE Conference on Local Computer Networks},

abstract = {Cryptographically-Curated File System (CCFS) proposed in this work supports the adoption of Information-Centric Networking. CCFS utilizes content names that span trust boundaries, verify integrity, tolerate disruption, authenticate content, and provide non-repudiation. Irrespective of the ability to reach an authoritative host, CCFS provides secure access by binding a chain of trust into the content name itself. Curators cryptographically bind content to a name, which is a path through a series of objects that map human meaningful names to cryptographically strong content identifiers. CCFS serves as a network layer for storage systems unifying currently disparate storage technologies. The power of CCFS derives from file hashes and public keys used as a name with which to retrieve content and as a method of verifying that content. We present results from our prototype implementation. Our results show that the overhead associated with CCFS is not negligible, but also is not prohibitive.},

keywords = {Cryptojacking},

pubstate = {published},

tppubtype = {conference}

}

@conference{UluagacSensoryIEEE,

title = {Sensory channel threats to Cyber Physical Systems: A wake-up call},

author = {A. Selcuk Uluagac and Venkatachalam Subramanian and Raheem Beyah},

url = {https://ieeexplore.ieee.org/document/6997498},

year  = {2014},

date = {2014-01-01},

urldate = {2014-01-01},

booktitle = {In the Proceedings of the IEEE Conference on Communications and Network Security},

abstract = {Cyber-Physical Systems (CPS) is a relatively novel computing paradigm where there is a tight integration of communications, computation, and the physical environment. An important component of the CPS devices is the sensors they use to interact with each other and the physical world around them. With CPS applications, engineers monitor the structural health of highways and bridges, farmers check the health of their crops, and ecologists observe wildlife in their natural habitat. Nonetheless, current security models consider protecting only networking components of the CPS devices utilizing traditional security mechanisms (e.g., an intrusion detection system for the data that traverse the network protocol stacks). The protection mechanisms are not sufficient to protect CPS devices from threats emanating from sensory channels. Using sensory channels (e.g., light, temperature, infrared), an adversary can successfully attack systems. Specifically, the adversary can (1) trigger existing malware, (2) transfer malware, or (3) combine malicious use of different sensory channels to increase the impact of the attack on CPS devices. In this work, we focus on these novel sensory channel threats to CPS devices and applications. We first note how sensory channel threats are an emerging area for the CPS world. Then, we analyze the performance various sensory channel threats. Moreover, using an iRobot Create as our CPS platform, we exploit simple vulnerable programs on iRobot through its infrared channel. Finally, we introduce the design of a novel sensory channel aware intrusion detection system as a protection mechanism against the sensory channel threats for CPS devices.},

keywords = {CPS Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{LiaoS-matchIEEE2014,

title = {S-MATCH: Verifiable Privacy-Preserving Profile Matching for Mobile Social Services},

author = {Xiaojing Liao and A. Selcuk Uluagac and Raheem A. Beyah},

url = {https://ieeexplore.ieee.org/abstract/document/6903587/},

year  = {2014},

date = {2014-01-01},

urldate = {2014-01-01},

booktitle = {In the proceedings of the 44th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)},

abstract = {Mobile social services utilize profile matching to help users find friends with similar social attributes (e.g., interests, location, background). However, privacy concerns often hinder users from enabling this functionality. In this paper, we introduce S-MATCH, a novel framework for privacy-preserving profile matching based on property-preserving encryption (PPE). First, we illustrate that PPE should not be considered secure when directly used on social attribute data due to its key-sharing problem and information leakage problem. Then, we address the aforementioned problems of applying PPE to social network data and develop an efficient and verifiable privacy-preserving profile matching scheme. We implement both the client and server portions of S-MATCH and evaluate its performance under three real-world social network datasets. The results show that S-MATCH can achieve at least one order of magnitude better computational performance than the techniques that use homomorphic encryption.},

keywords = {Mobile Security , Privacy-preserving, Social Networks Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{LiuMACAIEEE2014,

title = {MACA: A privacy-preserving multi-factor cloud authentication system utilizing big data},

author = {Wenyi Liu and A. Selcuk Uluagac and Raheem Beyah},

url = {https://ieeexplore.ieee.org/abstract/document/6849285/},

year  = {2014},

date = {2014-01-01},

urldate = {2014-01-01},

booktitle = {In the proceedings of IEEE Conference on Computer Communications Workshops (INFOCOM Wksps)

},

abstract = {Multi-factor authentication (MFA) is an approach to user validation that requires the presentation of two or more authentication factors. Given the popularity of cloud systems, MFA systems become vital in authenticating users. However, MFA approaches are highly intrusive and expose users' sensitive information to untrusted cloud servers that can keep physically identifying elements of users, long after the user ends the relationship with the cloud. To address these concerns in this work, we present a privacy-preserving multi-factor authentication system utilizing the features of big data called MACA. In MACA, the first factor is a password while the second factor is a hybrid profile of user behavior. The hybrid profile is based on users' integrated behavior, which includes both host-based characteristics and network flow-based features. MACA is the first MFA that considers both user privacy and usability combining big data features (26 total configurable features). Furthermore, we adopt fuzzy hashing and fully homomorphic encryption (FHE) to protect users' sensitive profiles and to handle the varying nature of the user profiles. We evaluate the performance of our proposed approach through experiments with several public datasets. Our results show that our proposed system can successfully validate legitimate users while detecting impostors.},

keywords = {Authentication, Big Data Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{BrzeczkoActiveIEEE2014,

title = {Active deception model for securing cloud infrastructure},

author = {Albert Brzeczko and A. Selcuk Uluagac and Raheem Beyah and John Copeland},

url = {https://ieeexplore.ieee.org/abstract/document/6849288/},

year  = {2014},

date = {2014-01-01},

urldate = {2014-01-01},

booktitle = {In the proceedings of IEEE Conference on Computer Communications Workshops (INFOCOM)},

abstract = {The proliferation of cloud computing over the past several years has led to a variety of new use cases and enabling technologies for enterprise and consumer applications. Increased reliance on cloud-based platforms has also necessitated an increased emphasis on securing the services and data hosted within those platforms. From a security standpoint, an advantage of cloud platforms over traditional production networks is that they have a dynamic, mutable structure that can change as a result of a variety of factors, so reconnaissance on the part of an attacker is far less predictable. In this work, we propose a novel technique that leverages the amorphous nature of cloud architectures to deceive and redirect potential intruders with decoy assets implanted among production hosts. In this way, attackers encounter and probe decoys that lead them to reveal their motives and cause them to be less likely to compromise their intended target, particularly once they have revealed their tactics against decoy assets. We show that our technique, after having been exposed to live traffic for approximately one month, detected 1,255 highly malicious hosts and was able to divert 97.5% of malicious traffic from these hosts. This traffic would have otherwise reached production hosts and potentially led to compromise.},

keywords = {Cloud Security, Honeypot/Honeynet},

pubstate = {published},

tppubtype = {conference}

}

@conference{ChoEfficientIEEE2014,

title = {Efficient safety message forwarding using multi-channels in low density VANETs},

author = {Jinyoun Cho and A. Selcuk Uluagac and John Copeland and Yusun Chang},

url = {https://ieeexplore.ieee.org/abstract/document/7036786/},

year  = {2014},

date = {2014-01-01},

urldate = {2014-01-01},

booktitle = {In the proceedings of the IEEE Global Communications Conference (GLOBECOM)},

abstract = {Vehicular Ad-hoc networks (VANETs) provide a way for a vehicle to deliver various types of information to users or drivers in other vehicles. Distributing a large amount of information such as multimedia messages in a single control channel makes the control channel easily congested. Transmitting multimedia messages through multi-channel to avoid this congestion becomes a feasible solution. However, low-connectivity in a low vehicle density in multi-channel poses unique challenges and can produce connection failure if this issue is not carefully addressed. In this paper, a network coding technique with divide-and-deliver is introduced to solve this unique challenge for delivering multimedia contents through multiple service channels in a low vehicle density. Through the rigorous analytical derivation and extensive simulation, we show the proposed scheme significantly improves reliability with minimum usage of the control channels in a typical VANETs environment.},

keywords = {Vehicle security, Wireless Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{NunnallyP3DIEEE2013,

title = {P3D: A parallel 3D coordinate visualization for advanced network scans},

author = {Troy Nunnally and Penyen Chi and Kulsoom Abdullah and A. Selcuk Uluagac and John A. Copeland and Raheem Beyah},

url = {https://ieeexplore.ieee.org/abstract/document/6654828/},

year  = {2013},

date = {2013-01-01},

urldate = {2013-01-01},

booktitle = {In the proceedings of the IEEE International Conference on Communications (ICC)},

abstract = {As network attacks increase in complexity, network administrators will continue to struggle with analyzing security data immediately and efficiently. To alleviate these challenges, researchers are looking into various visualization techniques (e.g., two-dimensional (2D) and three-dimensional (3D)) to detect, identify, and analyze malicious attacks. This paper discusses the benefits of using a stereoscopic 3D parallel visualization techniques for network scanning, in particular, when addressing occlusion-based visualization attacks intended to confuse network administrators. To our knowledge, no 2D or 3D tool exists that analyzes these attacks. Hence, we propose a novel 3D Parallel coordinate visualization tool for advanced network scans and attacks called P3D. P3D uses flow data, filtering techniques, and state-of-the art 3D technologies to help network administrators detect distributed and coordinated network scans. Compared to other 2D and 3D network security visualization tools, P3D prevents occlusion-based visualization attacks (e.g., Windshield Wiper and Port Source Confusion attacks). We validate our tool with use-cases from emulated distributed scanning attacks. Our evaluation shows P3D allows users to extract new information about scans and minimize information overload by adding an extra dimension and awareness region in the visualization.},

keywords = {Network Security, Security Visualization},

pubstate = {published},

tppubtype = {conference}

}

@conference{NunnallyNAVSECVizSec2013,

title = {NAVSEC: A Recommender System for 3D Network Security Visualizations},

author = {Troy Nunnally and Kulsoom Abdullah and A. Selcuk Uluagac and John A. Copeland and Raheem Beyah},

url = {https://dl.acm.org/doi/abs/10.1145/2517957.2517963},

year  = {2013},

date = {2013-01-01},

urldate = {2013-01-01},

booktitle = {In the proceedings of the 10th Workshop on Visualization for Cyber Security},

abstract = {As network attacks increase in complexity, the ability to quickly analyze security data and mitigate the effect of these attacks becomes a difficult problem. To alleviate these challenges, researchers are looking into various two-dimensional (2D) and three-dimensional (3D) visualization tools to detect, identify, and analyze malicious attacks. These visualization tools often require advanced knowledge in networking, visualization, and information security to operate, navigate, and successfully examine malicious attacks. Novice users, deficient in the required advanced knowledge, may find navigation within these visualization tools difficult. Furthermore, expert users may be limited and costly. We discuss the use of a modern recommender system to aid in navigating within a complex 3D visualization for network security applications. We developed a visualization module called NAVSEC, a recommender system prototype for navigating in 3D network security visualization tools. NAVSEC recommends visualizations and interactions to novice users. Given visualization interaction input from a novice user and expert communities, NAVSEC is instrumental in reducing confusion for a novice user while navigating in a 3D visualization. We illustrate NAVSEC with a use-case from an emulated stealthy scanning attack disguised as a file transfer with multiple concurrent connections. We show that using NAVSEC, a novice user's visualization converges towards a visualization used to identify or detect a suspected attack by an expert user. As a result, NAVSEC can successfully guide the novice user in differentiating between complex network attacks and benign legitimate traffic with step-by-step created visualizations and suggested user interactions.},

keywords = {Network Security, Security Visualization},

pubstate = {published},

tppubtype = {conference}

}

@conference{RadhakrishnanRealizingIEEE2013,

title = {Realizing an 802.11-based covert timing channel using off-the-shelf wireless cards},

author = {Sakthi V. Radhakrishnan and A. Selcuk Uluagac and Raheem Beyah},

url = {https://ieeexplore.ieee.org/abstract/document/6831158/},

year  = {2013},

date = {2013-01-01},

urldate = {2013-01-01},

booktitle = {In the proceedings of the IEEE Global Communications Conference (GLOBECOM)},

abstract = {By using covert channels, a malicious entity can hide messages within regular traffic and can thereby circumvent security mechanisms. This same method of obfuscation can be used by legitimate users to transmit messages over hostile networks. A promising area for covert channels is wireless networks employing carrier sense multiple access with collision avoidance (CSMA/CA) (e.g., 802.11 networks). These schemes introduce randomness in the network that provides good cover for a covert timing channel. Hence, by exploiting the random back-off in distributed coordination function (DCF) of 802.11, we realize a relatively high bandwidth covert timing channel for 802.11 networks, called Covert-DCF. As opposed to many works in the literature focusing on theory and simulations, Covert-DCF is the first fully implemented covert timing channel for 802.11 MAC using off-the-self wireless cards. In this paper, we introduce the design and implementation of Covert-DCF that is transparent to the users of the shared medium. We also evaluate the performance of Covert-DCF and provide discussions on the feasibility of this technique in a real world scenario.},

keywords = {Covert channels, Network Security},

pubstate = {published},

tppubtype = {conference}

}

@conference{UluagacFingerprintingIEEE2013,

title = {A passive technique for fingerprinting wireless devices with Wired-side Observations},

author = {A. Selcuk Uluagac and Sakthi V. Radhakrishnan and Cherita Corbett and Antony Baca and Raheem Beyah},

url = {https://ieeexplore.ieee.org/abstract/document/6682720/},

year  = {2013},

date = {2013-01-01},

urldate = {2013-01-01},

booktitle = {In the proceedings of the IEEE Conference on Communications and Network Security (CNS)

},

abstract = {In this paper, we introduce GTID, a technique that passively fingerprints wireless devices and their types from the wired backbone. GTID exploits the heterogeneity of devices, which is a function of different device hardware compositions and variations in devices' clock skew. We use statistical techniques to create unique, reproducible device and device type signatures that represent time variant behavior in network traffic and use artificial neural networks (ANNs) to classify devices and device types. We demonstrate the efficacy of our technique on both an isolated testbed and a live campus network (during peak hours) using a corpus of 27 devices representing a wide range of device classes. We collected more than 100 GB of traffic captures for ANN training and classification. We assert that for any fingerprinting technique to be practical, it must be able to detect previously unseen devices (i.e., devices for which no stored signature is available) and must be able to withstand various attacks. GTID is the first fingerprinting technique to detect previously unseen devices and to illustrate its resilience under various attacker models. We measure the performance of GTID by considering accuracy, recall, and processing time and illustrate how it can be used to complement existing authentication systems and to detect counterfeit devices.},

keywords = {Fingerprinting, Wireless Security},

pubstate = {published},

tppubtype = {conference}

}