TY - CHAP A1 - Schuster, Franka A1 - Paul, Andreas A1 - Rietz, René A1 - König, Hartmut T1 - Potentials of Using One-class SVM for Detecting Protocol-specific Anomalies in Industrial Networks T2 - Proceedings of the 2015 IEEE Symposium on Computational Intelligence in Cyber Security (IEEE CICS 2015) Y1 - 2015 U6 - https://doi.org/10.1109/SSCI.2015.22 SP - 83 EP - 90 PB - IEEE Press CY - New York ER - TY - GEN A1 - Stritter, Benjamin A1 - Freiling, Felix A1 - König, Hartmut A1 - Rietz, René A1 - Ullrich, Steffen A1 - Gernler, Alexander von A1 - Erlacher, Felix T1 - Cleaning up Web 2.0's Security Mess - at Least Partly T2 - IEEE Security & Privacy Y1 - 2016 UR - http://online.qmags.com/SNP0316?pg=92&mode=2#pg92&mode2 SN - 1540-7993 VL - 14 IS - 2 SP - 48 EP - 71 ER - TY - CHAP A1 - Paul, Andreas A1 - Schuster, Franka A1 - König, Hartmut T1 - Network Topology Exploration for Industrial Networks T2 - 2nd EAI International Conference on Industrial Networks and Intelligent Systems (INISCOM 2016), October 31 - November 1, 2016, Leicester, Great Britain Y1 - 2017 UR - http://www.springer.com/de/book/9783319525686 SN - 978-3-319-52568-6 U6 - https://doi.org/10.1007/978-3-319-52569-3 SP - 63 EP - 76 PB - Springer International Publishing CY - Cham ER - TY - CHAP A1 - Cwalinski, Radoslaw A1 - König, Hartmut T1 - RADIator - An approach for controllable wireless networks T2 - IEEE NetSoft Conference and workshops, 6-10 June 2016, Seoul, South Corea N2 - In this paper we propose a novel software-defined networking architecture for enterprise wireless local area networks (WLANs). The goal is to build a framework that exposes tools and methods for a centralized processing of IEEE 802.11 frames. In our architecture all management tasks, including beaconing, client authentication and association, are performed by the central controller instead of the distributed wireless access points as in traditional networks. The generated frames are tunneled to lightweight wireless access points (APs) or thin APs that perform the media access and radio frequency (RF) conversion. Agents executed on thin APs allow scheduling of simple tasks like traffic filtering for local execution. Additionally, the agents provide functions found in modern WLAN chipsets, such as precise frame transmit timings or RF spectrum analysis to the controller. Our architecture allows to delegate computationally intensive tasks to a central instance with enough processing power. Thus, it is best suited for devices with limited resources that we use as thin APs. We present applications that can be built using our framework, e.g., client geolocalization or energy consumption optimization. Finally we evaluate the performance of our architecture in a testbed using COTS devices with open-source software. Y1 - 2016 UR - http://ieeexplore.ieee.org/document/7502421/ SN - 978-1-4673-9486-4 U6 - https://doi.org/10.1109/NETSOFT.2016.7502421 SP - 260 EP - 268 PB - IEEE CY - Piscataway, NJ ER - TY - CHAP A1 - Rietz, René A1 - König, Hartmut A1 - Ullrich, Steffen A1 - Stritter, Benjamin T1 - Firewalls for the Web 2.0 T2 - Proceedings of the 2016 IEEE International Conference on Software Quality, Reliability and Security (QRS), 1-3 Aug. 2016 N2 - The widespread use of Web 2.0 technologies yields an increasing threat potential for users and related systems. Modern web applications and online services are nowadays based on Web 2.0 technologies, such as JavaScript and AJAX, and thus on the execution of active content in the browsers of the users. Firewalls are a common practice to securely connecting to the internet. In this paper, we propose a novel perimeter firewall architecture for web applications that addresses the entire process chain starting from the data transfer with HTTP via the analysis of manipulated web documents to the extraction and analysis of active contents. The basic idea is to allow only a restricted set of web applications to pass the firewall based on a model of their HTML and JavaScript structure. We evaluate the capability of the resulting models for identifying the underlying web applications and their ability to ward off additional malicious inputs. Y1 - 2016 UR - http://ieeexplore.ieee.org/document/7589804/ SN - 978-1-5090-4127-5 SN - 978-1-5090-4128-2 U6 - https://doi.org/10.1109/QRS.2016.36 SP - 242 EP - 253 PB - IEEE CY - Piscataway, NJ ER - TY - CHAP A1 - Dacier, Marc C. A1 - Dietrich, Sven A1 - Kargl, Frank A1 - König, Hartmut T1 - Network Attack Detection and Defense – Security Challenges and Opportunities of Software-Defined Networking T2 - Network Attack Detection and Defense, Dagstuhl Seminar 16361 N2 - This report documents the program and the outcomes of Dagstuhl Seminar 16361 "Network Attack Detection and Defense: Security Challenges and Opportunities of Software-Defined Networking". Software-defined networking (SDN) has attracted a great attention both in industry and academia since the beginning of the decade. This attention keeps undiminished. Security-related aspects of software-defined networking have only been considered more recently. Opinions differ widely. The main objective of the seminar was to discuss the various contrary facets of SDN security. The seminar continued the series of Dagstuhl events Network Attack Detection and Defense held in 2008, 2012, and 2014. The objectives of the seminar were threefold, namely (1) to discuss the security challenges of SDN, (2) to debate strategies to monitor and protect SDN-enabled networks, and (3) to propose methods and strategies to leverage on the flexibility brought by SDN for designing new security mechanisms. At the seminar, which brought together participants from academia and industry, we discussed the advantages and disadvantages of using software-defined networks from the security point of view. We agreed that SDN provides new possibilities to better secure networks, but also offers a number of serious security problems which require further research. The outcome of these discussions and the proposed research directions are presented in this report. Y1 - 2016 U6 - http://nbn-resolving.de/urn/resolver.pl?urn:nbn:de:0030-drops-69122 UR - http://drops.dagstuhl.de/opus/volltexte/2017/6912/ SP - 1 EP - 28 PB - Schloss Dagstuhl CY - Wadern ER - TY - CHAP A1 - Gäbler, Jan A1 - König, Hartmut T1 - Distributed Cluster-Topology Maintenance for Mobile Collaborative Applications T2 - IEEE 41st Conference on Local Computer Networks (LCN), 7-10 Nov. 2016 N2 - Nowadays, collaborative applications play an increasing role in mobile communications in order to enable cooperation among mobile and/or stationary participants – often using the peer-to-peer (P2P) group communication paradigm. The probability of communication failures increases in mobile environments. As a consequence, frequent leaving and joining of partners can be observed resulting in unstable group topologies. A widely used approach is to divide the group into peer clusters that are fully meshed among each other. In this paper, we propose an application-independent approach for a periodic maintenance of distributed cluster-based group topologies for mobile collaborative applications. The proposed approach also dynamically adapts the overlay structure to changing network conditions. The maintenance strategy can be parametrized by several metrics. It outperforms simple overlay maintenance strategies, such as round-robin, by respecting the resource and computation limitations of mobile devices. The run-time is increased by 10% in the best case compared to LEACH, and by 3 — 5% on average. We describe the approach and evaluate its performance w.r.t. different metrics. Y1 - 2016 UR - http://ieeexplore.ieee.org/document/7796799/ SN - 978-1-5090-2054-6 SN - 978-1-5090-2055-3 U6 - https://doi.org/10.1109/LCN.2016.55 SP - 271 EP - 279 PB - IEEE CY - Piscataway, NJ ER - TY - GEN A1 - Schuster, Franka A1 - Paul, Andreas A1 - König, Hartmut T1 - Messung der technischen IT-Sicherheit in Energieversorgungsanlagen zur Erfüllung des IT-Sicherheitsgesetzes T2 - International Journal for Electricy and Heat Generation, VGB Powertech Y1 - 2017 SN - 1435-3199 VL - 97 IS - 3 SP - 76 EP - 82 ER - TY - CHAP A1 - König, Hartmut A1 - Ulrich, Andreas A1 - Heiner, Monika ED - Kim, Myungchul ED - Kang, Sungwon ED - Hong, Keesoo T1 - Design for Testability: A Step-wise Approach to Protocol Testing T2 - Testing of Communicating Systems, IFIP TC6 10th International Workshop on Testing of Communicating Systems, 8-10 September 1997, Cheju Island, Korea Y1 - 1997 SN - 978-1-4757-6701-8 SN - 978-0-387-35198-8 U6 - https://doi.org/10.1007/978-0-387-35198-8_9 N1 - referiert SP - 125 EP - 140 PB - Springer CY - Boston ER - TY - CHAP A1 - Cwalinski, Radoslaw A1 - König, Hartmut T1 - Identifying Malicious Traffic in Software-Defined Wireless Local Area Networks T2 - 2018 International Conference on Computing, Networking and Communications (ICNC), Maui, HI, USA, 2018 KW - Communication system security KW - Hardware KW - IEEE 802.11 Standard KW - Security KW - Wireless LAN KW - Wireless networks Y1 - 2018 UR - http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=8390307&isnumber=8390234 SN - 978-1-5386-3652-7 U6 - https://doi.org/10.1109/ICCNC.2018.8390307 SP - 195 EP - 199 PB - IEEE ER - TY - CHAP A1 - Schuster, Franka A1 - Kopp, Fabian Malte A1 - Paul, Andreas A1 - König, Hartmut T1 - Attack and Fault Detection in Process Control Communication Using Unsupervised Machine Learning T2 - IEEE 16th International Conference on Industrial Informatics (INDIN), Porto, Portugal, 18-20 July 2018 Y1 - 2018 SN - 978-1-5386-4829-2 U6 - https://doi.org/10.1109/INDIN.2018.8472054 SP - 433 EP - 438 PB - IEEE CY - Piscataway, NJ ER - TY - CHAP A1 - Schuster, Franka A1 - Paul, Andreas A1 - Kopp, Fabian Malte A1 - König, Hartmut T1 - Catching Intrusions: Classifier Performances for Detecting Network-specific Anomalies in Energy Systems T2 - 2018 International Conference on Smart Energy Systems and Technologies (SEST), Seville, Spain, September 2018 Y1 - 2018 SN - 978-1-5386-5326-5 U6 - https://doi.org/10.1109/SEST.2018.8495702 PB - IEEE CY - Piscataway, NJ ER - TY - CHAP A1 - Cwalinski, Radoslaw A1 - König, Hartmut T1 - SDN-based Attack Detection in Wireless Local Area Networks T2 - 4th IEEE Conference on Network Softwarization and Workshops (NetSoft), Montreal, QC, 2018 Y1 - 2018 SN - 978-1-5386-4633-5 U6 - https://doi.org/10.1109/NETSOFT.2018.8460121 SP - 207 EP - 211 PB - IEEE CY - Piscataway, NJ ER - TY - GEN A1 - Rietz, René A1 - Cwalinski, Radoslaw A1 - König, Hartmut A1 - Brinner, Andreas T1 - An SDN-based Approach to Ward of LAN Attacks T2 - Journal Computer Networks and Communications Y1 - 2018 U6 - https://doi.org/10.1155/2018/4127487 VL - 2018 ER - TY - GEN A1 - Cwalinski, Radoslaw A1 - Rietz, René A1 - Vogel, Michael A1 - König, Hartmut T1 - An SDN-based Approach to Protect Communication Between Virtual Machines T2 - IEEE 44th Conference on Local Computer Networks (LCN), October 14-17, 2019, Osnabrück, Germany. Y1 - 2019 UR - https://www.ieeelcn.org/prior/LCN44/index.html SN - 978-1-7281-1028-8 SP - 465 EP - 468 PB - IEEE ER - TY - GEN A1 - Böhm, Sebastian A1 - König, Hartmut T1 - SEmulate: Seamless Network Protocol Simulation and Radio Channel Emulation for Wireless Sensor Networks T2 - 15th Annual Conference on Wireless On-demand Network Systems and Services (WONS), 22-24 Jan. 2019, Wengen, Switzerland. N2 - Low-rate and low-power wireless communications are still the main drivers for innovative industrial automation and the Internet of Things (IoT). Physical mobility is one of the most important challenges for them. Common wireless technologies and protocols, e.g., WirelessHART and ISA100.11a Wireless for industrial process plants, ZigBee for building automation, or 6LoWPAN and 6TiSCH in context of the IoT, are based on the IEEE 802.15.4 standard. Event-based simulation is the method of choice for analyzing network protocols and algorithmic applications of such distributed sensor applications. Performance measurements and holistic evaluations, however, are greatly influenced by the underlying hardware resources, physical layer protocols, and radio channel conditions, which are usually not considered or highly abstracted in network simulations. In this paper we present SEmulate, a hybrid system for seamless (network) simulation and hardware-based emulation for wireless sensor networks based on the IEEE 802.15.4 protocol standard, which takes the hardware aspects into account by applying an Hardware-in-the-Loop (HIL) approach. Y1 - 2019 UR - https://ieeexplore.ieee.org/document/8795495 SN - 978-3-903176-13-3 SN - 978-1-5386-8192-3 U6 - https://doi.org/10.23919/WONS.2019.8795495 PB - IEEE ER - TY - GEN A1 - Mehner, Stefan A1 - König, Hartmut ED - Perdisci, Roberto ED - Maurice, Clémentine ED - Giacinto, Giorgio ED - Almgren, Magnus T1 - No Need to Marry to Change Your Name! Attacking Profinet IO Automation Networks Using DCP T2 - Detection of Intrusions and Malware, and Vulnerability Assessment 16th International Conference, DIMVA 2019, Gothenburg, Sweden, June 19–20, 2019, Proceedings N2 - Current developments in digitization and industry 4.0 bear new challenges for automation systems. In order to enable interoperability and vertical integration of corporate management systems, these networks have evolved from formerly proprietary solutions to the application of Ethernet-based communication and internet standards. This development is accompanied by an increase in the number of threats. Although the most critical IT protection objective for automation systems is availability, usually no security mechanisms have been integrated into automation protocols. Also Ethernet offers no protection by design for these protocols. One of the most popular real-time protocols for industrial applications is Profinet IO. In this paper, we describe a Denial-of-Service attack on Profinet IO that exploits a vulnerability in the Discovery and Basic Configuration Protocol (DCP) which interrupts the Application Relationship between an IO Controller and an IO Device, and thus prevents the system from being repaired by the operator. The attack combines port stealing with the sending of forged DCP packets and causes a system downtime, which in affected production networks probably lead to a serious financial damage and, in case of critical infrastructures, even represents a high risk for the supply of society. We demonstrate the practical feasibility of the attack using realistic hardware and scenarios and discuss its significance for also other setups. Y1 - 2019 UR - https://link.springer.com/chapter/10.1007/978-3-030-22038-9_19 SN - 978-3-030-22037-2 SN - 978-3-030-22038-9 U6 - https://doi.org/10.1007/978-3-030-22038-9_19 SP - 396 EP - 414 PB - Springer ER -