@article{PilgermannVielhauerPetrovetal.2025, author = {Pilgermann, Michael and Vielhauer, Claus and Petrov, Denis and Dittmann, Jana and Kr{\"a}tzer, Christian}, title = {Attribution im IT-Grundschutz des BSI: Ausweitung der Detektion von Cyberangriffen im IT-Sicherheitsprozess}, series = {Datenschutz und Datensicherheit (DuD)}, volume = {49}, journal = {Datenschutz und Datensicherheit (DuD)}, number = {11}, publisher = {Springer}, doi = {10.1007/s11623-025-2173-5}, pages = {731 -- 736}, year = {2025}, abstract = {Inzwischen hat sich die Einsicht durchgesetzt, dass Cyberangriffe nicht komplett verhindert werden k{\"o}nnen. Stattdessen sollen die m{\"o}glichen Auswirkungen von Vorf{\"a}llen sinnvoll reduziert werden. Damit steigt die Bedeutung der Erkennung von Sicherheitsvorf{\"a}llen, um schnell reagieren und das Schadensausmaß begrenzen zu k{\"o}nnen. Damit die Fortschritte bei der Erkennung k{\"u}nftig auch in der Praxis angewendet werden k{\"o}nnen, ist eine Verankerung in den entsprechenden Vorgehensweisen erforderlich. Dies erfolgt nachfolgend am Beispiel des IT-Grundschutzes, dessen Methoden in der deutschsprachigen IT-Sicherheitscommunity verbreitet sind.}, language = {de} } @article{NeubertSchuelerUllrichetal.2025, author = {Neubert, Tom and Schueler, Eric and Ullrich, Henning and Buxhoidt, Laura and Vielhauer, Claus}, title = {Extended Analysis, Detection and Attribution of Steganographic Embedding Methods in Network Data of Industrial Controls Systems}, series = {International Journal on Advances in Security}, volume = {18}, journal = {International Journal on Advances in Security}, number = {1\&2}, publisher = {IARIA}, pages = {112 -- 122}, year = {2025}, abstract = {Since the last decade, it is well known that Industrial Control Systems (ICS) are under attack and attackers nowadays increasingly use stealthy malware (i.e., stegomalware) imple- mented by steganographic embedding methods to in- and exfil- trate hidden information. Unfortunately, current mechanisms to distinguish between network steganographic embedding methods and embedded message types need improvement for a potential attribution of attackers. For the analysis of steganographic em- bedding methods which are utilized in stealthy malware, the work presented in this paper builds upon a state-of-the-art analysis testbed proposed earlier, which is recapitulated here. It offers the opportunity to analyze network steganographic embedding methods in ICS to elaborate methods to detect and distinguish between them to gain forensic information for attribution of potential attackers and their methods. In this work, we introduce a novel machine learning based approach to distinguish between five selected embedding methods and two embedded message types. We use the analysis testbed to evaluate and determine the accuracy of the novel approach compared to a state-of-the-art approach. In our extensive evaluation, our novel approach has shown to be able to distinguish between network steganographic embedding methods with an average accuracy of 85.7\%, which is an improvement in comparison to the state-of-the-art by +5.9\% and enables a more accurate attribution of attackers. Additionally, the novel approach is able to improve the accuracy of distinction between embedding method and embedded message type by +9.3\% in comparison to the evaluated state-of-the-art approach.}, language = {en} } @article{NeubertVielhauer2020, author = {Neubert, Tom and Vielhauer, Claus}, title = {Kill Chain Attack Modelling for Hidden Channel Attack Scenarios in Industrial Control Systems}, series = {IFAC-PapersOnLine}, journal = {IFAC-PapersOnLine}, publisher = {Elsevier}, issn = {24058963}, doi = {10.1016/j.ifacol.2020.12.246}, pages = {11074 -- 11080}, year = {2020}, language = {en} } @article{LamshoeftNeubertHielscheretal.2022, author = {Lamsh{\"o}ft, Kevin and Neubert, Tom and Hielscher, Jonas and Vielhauer, Claus}, title = {Knock, knock, log: Threat analysis, detection \& mitigation of covert channels in syslog using port scans as cover}, series = {Forensic Science International: Digital Investigation}, volume = {40}, journal = {Forensic Science International: Digital Investigation}, publisher = {Elsevier}, issn = {2666-2817}, doi = {10.1016/j.fsidi.2022.301335}, year = {2022}, language = {en} } @article{WhiskerdKoertgeJuergensetal.2020, author = {Whiskerd, Nicholas and K{\"o}rtge, Nicklas and J{\"u}rgens, Kris and Ezennaya-Gomez, Salatiel and Vielhauer, Claus and Dittmann, Jana and Hildebrandt, Mario}, title = {Keystroke biometrics in the encrypted domain: a first study on search suggestion functions of web search engines}, series = {EURASIP Journal on Information Security}, journal = {EURASIP Journal on Information Security}, number = {2020:2}, publisher = {Springer}, doi = {10.1186/s13635-020-0100-8}, year = {2020}, language = {en} } @article{ScheidatKalbitzVielhauer2017, author = {Scheidat, Tobias and Kalbitz, Michael and Vielhauer, Claus}, title = {Biometric authentication based on 2D/3D sensing of forensic handwriting traces}, series = {IET Biometrics}, volume = {6}, journal = {IET Biometrics}, number = {4}, doi = {10.1049/iet-bmt.2016.0127}, pages = {316 -- 324}, year = {2017}, language = {en} } @article{MerkelDittmannVielhauer2017, author = {Merkel, Ronny and Dittmann, Jana and Vielhauer, Claus}, title = {A first public research collection of high-resolution latent fingerprint time series for short- and long-term print age estimation}, series = {IEEE transactions on information forensics and security}, volume = {12}, journal = {IEEE transactions on information forensics and security}, number = {10}, doi = {10.1109/TIFS.2017.2705622}, pages = {2276 -- 2291}, year = {2017}, language = {en} } @article{KoeppenKraetzerDittmannetal.2015, author = {K{\"o}ppen, Veit and Kr{\"a}tzer, Christian and Dittmann, Jana and Saake, Gunter and Vielhauer, Claus}, title = {Impacts on Database Performance in a Privacy-Preserving Biometric Authentication : Scenario}, series = {International Journal on Advances in Security}, volume = {8}, journal = {International Journal on Advances in Security}, number = {1/2}, publisher = {IARIA}, pages = {99 -- 108}, year = {2015}, language = {en} } @article{MerkelGruhnDittmannetal.2012, author = {Merkel, Ronny and Gruhn, Stefan and Dittmann, Jana and Vielhauer, Claus and Br{\"a}utigam, Anja}, title = {On non-invasive 2D and 3D Chromatic White Light image sensors for age determination of latent fingerprints}, series = {Forensic science international : an international journal dedicated to the applications of medicine and science in the administration of justice}, volume = {222}, journal = {Forensic science international : an international journal dedicated to the applications of medicine and science in the administration of justice}, number = {1-3}, publisher = {Elsevier Science}, address = {Amsterdam}, doi = {10.1016/j.forsciint.2012.05.001}, pages = {52 -- 70}, year = {2012}, language = {en} } @article{MakrushinScheidatVielhauer2012, author = {Makrushin, Andrey and Scheidat, Tobias and Vielhauer, Claus}, title = {Improving Reliability of Biometric Hash Generation through the Selection of Dynamic Handwriting Features}, series = {Transactions on Data Hiding and Multimedia Security VIII}, journal = {Transactions on Data Hiding and Multimedia Security VIII}, publisher = {Springer}, address = {Berlin}, isbn = {978-3-642-31971-6}, doi = {10.1007/978-3-642-31971-6_2}, pages = {19 -- 41}, year = {2012}, language = {en} } @article{DittmannVielhauerUlrichetal.2012, author = {Dittmann, Jana and Vielhauer, Claus and Ulrich, Michael and Pocs, Matthias}, title = {Fingerspuren in der Tatortforensik}, series = {Digma : Zeitschrift f{\"u}r Datenrecht und Informationssicherheit}, volume = {12}, journal = {Digma : Zeitschrift f{\"u}r Datenrecht und Informationssicherheit}, number = {2}, publisher = {Z{\"u}rich}, address = {Schulthess Juristische Medien}, issn = {1424-9944}, pages = {80 -- 83}, year = {2012}, language = {de} }