@article{WhiskerdKoertgeJuergensetal.2020, author = {Whiskerd, Nicholas and K{\"o}rtge, Nicklas and J{\"u}rgens, Kris and Ezennaya-Gomez, Salatiel and Vielhauer, Claus and Dittmann, Jana and Hildebrandt, Mario}, title = {Keystroke biometrics in the encrypted domain: a first study on search suggestion functions of web search engines}, series = {EURASIP Journal on Information Security}, journal = {EURASIP Journal on Information Security}, number = {2020:2}, publisher = {Springer}, doi = {10.1186/s13635-020-0100-8}, year = {2020}, language = {en} } @inproceedings{HildebrandtLamshoeftDittmannetal.2020, author = {Hildebrandt, Mario and Lamsh{\"o}ft, Kevin and Dittmann, Jana and Neubert, Tom and Vielhauer, Claus}, title = {Information Hiding in Industrial Control Systems: An OPC UA based Supply Chain Attack and its Detection}, series = {Proceedings of the 2020 ACM Workshop on Information Hiding and Multimedia Security (IH\&MMSec'20), June 22-24, 2020, Denver, CO, USA}, booktitle = {Proceedings of the 2020 ACM Workshop on Information Hiding and Multimedia Security (IH\&MMSec'20), June 22-24, 2020, Denver, CO, USA}, publisher = {The Association for Computing Machinery}, address = {New York}, doi = {10.1145/3369412}, pages = {115 -- 120}, year = {2020}, language = {en} } @article{NeubertVielhauer2020, author = {Neubert, Tom and Vielhauer, Claus}, title = {Kill Chain Attack Modelling for Hidden Channel Attack Scenarios in Industrial Control Systems}, series = {IFAC-PapersOnLine}, journal = {IFAC-PapersOnLine}, publisher = {Elsevier}, issn = {24058963}, doi = {10.1016/j.ifacol.2020.12.246}, pages = {11074 -- 11080}, year = {2020}, language = {en} } @inproceedings{EzennayaGomezVielhauerDittmann2022, author = {Ezennaya-Gomez, Salatiel and Vielhauer, Claus and Dittmann, Jana}, title = {A Semantic Model for Embracing Privacy as Contextual Integrity in the Internet of Things}, series = {European Symposium on Research in Computer Security, Cham, 2022 Konferenzband: Computer Security. ESORICS 2021 International Workshops}, booktitle = {European Symposium on Research in Computer Security, Cham, 2022 Konferenzband: Computer Security. ESORICS 2021 International Workshops}, number = {13106}, editor = {Katsikas, Sokratis and Lambrinoudakis, Costas and Cuppens, Nora and Mylopoulos, John and Kalloniatis, Christos and Meng, Weizhi and Furnell, Steven and Pallas, Frank and Pohle, J{\"o}rg and Sasse, M. Angela and Abie, Habtamu and Ranise, Silvio and Verderame, Luca and Vidal, Jorge Maestre and Cambiaso, Enrico and Monge, Marco Antonio Sotelo}, publisher = {Springer}, address = {Cham}, isbn = {978-3-030-95483-3 978-3-030-95484-0}, doi = {10.1007/978-3-030-95484-0_24}, pages = {413 -- 423}, year = {2022}, abstract = {Due to the increasing number of complaints alleging privacy violations against companies to data protection authorities, the translation of business goals to system design goals and the subsequent consequences for customers' privacy poses a challenge for many companies. For this reason, there is a need to bridge the economics of privacy and threats to privacy. To this end, our work relies on the concept of privacy as contextual integrity. This framework defines privacy as appropriate information flows subjected to social norms within particular social contexts or spheres. In this paper, we introduce a preliminary version of a semantic model which aims to relate and provide understanding on how well-established business goals may affect their customers' privacy by designing IoT devices with permission access, data acquired by sensors, among other factors. Finally, we provide a use case application showing how to use the semantic model. The model aims to be an educational tool for professionals in business informatics during the modeling and designing process of a product which may gather sensitive data or may infer sensitive information, giving an understanding of the interaction of the product and its footprint with diverse actors (humans or machines). In the future, a further complete model of the presented may also target other groups, such as law enforcement bodies, as part of their educational training in such systems.}, language = {en} } @inproceedings{HildebrandtAltschaffelLamshoeftetal.2020, author = {Hildebrandt, Mario and Altschaffel, Robert and Lamsh{\"o}ft, Kevin and Lange, Mathias and Szemkus, Martin and Neubert, Tom and Vielhauer, Claus and Ding, Yongjian and Dittmann, Jana}, title = {Threat Analysis of Steganographic and Covert Communication in Nuclear I\&C Systems}, series = {Konferenz: International Conference on Nuclear Security: Sustaining and Strengthening Efforts (ICONS), Vienna, Austria, 2020/ Konferenzband: International Conference on Nuclear Security: Sustaining and Strengthening Efforts}, booktitle = {Konferenz: International Conference on Nuclear Security: Sustaining and Strengthening Efforts (ICONS), Vienna, Austria, 2020/ Konferenzband: International Conference on Nuclear Security: Sustaining and Strengthening Efforts}, publisher = {IAEA}, address = {Vienna, Austria}, pages = {14}, year = {2020}, abstract = {Steganographic and covert communication is increasingly used for hiding attacks. Often information hiding is used by attackers in advanced persistent threats in order to operate without being noticed. Attackers might use it to hide data exfiltration or control channels for persistent malware. The paper analyzes potential threats to operational technology by investigating different communication protocols towards their suitability as cover channels. Using a generalized network architecture model and the communication flows of nuclear power plants, the attack potential using information hiding is exemplary assessed. An example for a supply chain attack for command injection is given on the foundation of the OPC UA protocol and an off-theshelf programmable logic controller. Subsequently, recommendations for a strategic and operational preparation for operators towards the prevention and detection of information hiding attacks are derived.}, language = {en} } @inproceedings{KalbitzVielhauer2019, author = {Kalbitz, Michael and Vielhauer, Claus}, title = {Automated forensic ink determination in handwritten documents by clustering}, series = {2019 27th European Signal Processing Conference (EUSIPCO) Ort: A Coru{\~n}a, Spanien, 2. bis 6. September 2019}, booktitle = {2019 27th European Signal Processing Conference (EUSIPCO) Ort: A Coru{\~n}a, Spanien, 2. bis 6. September 2019}, publisher = {IEEE}, address = {New York}, isbn = {978-9-0827-9703-9}, issn = {2076-1465}, doi = {10.23919/EUSIPCO.2019.8903107}, pages = {1 -- 5}, year = {2019}, language = {en} } @inproceedings{VielhauerLoewePilgermann2025, author = {Vielhauer, Claus and Loewe, Fabian and Pilgermann, Michael}, title = {Towards Modeling Hidden \& Steganographic Malware Communication based on Images}, series = {IH\&MMSEC '25: ACM Workshop on Information Hiding and Multimedia Security, San Jose, CA, USA, 2025}, booktitle = {IH\&MMSEC '25: ACM Workshop on Information Hiding and Multimedia Security, San Jose, CA, USA, 2025}, doi = {10.1145/3733102.3733152}, pages = {52 -- 63}, year = {2025}, abstract = {Recently, an increasing number of IT security incidents involving malware, which makes use of hidden and steganographic channels for malicious communication (a.k.a. as "stegomalware"), can be observed in the wild. Especially the use of images to hide malicious code is rising. In consideration of this shift, a new model is proposed in this paper, which aims to help security professionals to identify and analyze incidents revolving around steganographic malware in the future. The model focuses on practical aspects of steganalysis of communication data to elaborate linking properties to previous code analysis knowledge. The model features two distinct roles that interact with a knowledge base which stores malware features and helps building a context for the incident. For evaluation, two image steganography malware types are chosen from popular databases (malpedia and MITRE ATT\&CK®), which are analyzed in multiple steps including steganalysis and code analysis. It is conceptually shown, how the extracted features can be stored in a knowledge base for later use to identify stegomalware from communication data without the need of a thorough code analysis. This allows to uncover previously hidden meta-information about the examined malicious programs, enrich the incident's forensic context traces and thus allows for thorough forensic insights, including attribution and improved preventive security measures in the future.}, language = {en} } @article{NeubertSchuelerUllrichetal.2025, author = {Neubert, Tom and Schueler, Eric and Ullrich, Henning and Buxhoidt, Laura and Vielhauer, Claus}, title = {Extended Analysis, Detection and Attribution of Steganographic Embedding Methods in Network Data of Industrial Controls Systems}, series = {International Journal on Advances in Security}, volume = {18}, journal = {International Journal on Advances in Security}, number = {1\&2}, publisher = {IARIA}, pages = {112 -- 122}, year = {2025}, abstract = {Since the last decade, it is well known that Industrial Control Systems (ICS) are under attack and attackers nowadays increasingly use stealthy malware (i.e., stegomalware) imple- mented by steganographic embedding methods to in- and exfil- trate hidden information. Unfortunately, current mechanisms to distinguish between network steganographic embedding methods and embedded message types need improvement for a potential attribution of attackers. For the analysis of steganographic em- bedding methods which are utilized in stealthy malware, the work presented in this paper builds upon a state-of-the-art analysis testbed proposed earlier, which is recapitulated here. It offers the opportunity to analyze network steganographic embedding methods in ICS to elaborate methods to detect and distinguish between them to gain forensic information for attribution of potential attackers and their methods. In this work, we introduce a novel machine learning based approach to distinguish between five selected embedding methods and two embedded message types. We use the analysis testbed to evaluate and determine the accuracy of the novel approach compared to a state-of-the-art approach. In our extensive evaluation, our novel approach has shown to be able to distinguish between network steganographic embedding methods with an average accuracy of 85.7\%, which is an improvement in comparison to the state-of-the-art by +5.9\% and enables a more accurate attribution of attackers. Additionally, the novel approach is able to improve the accuracy of distinction between embedding method and embedded message type by +9.3\% in comparison to the evaluated state-of-the-art approach.}, language = {en} } @article{PilgermannVielhauerPetrovetal.2025, author = {Pilgermann, Michael and Vielhauer, Claus and Petrov, Denis and Dittmann, Jana and Kr{\"a}tzer, Christian}, title = {Attribution im IT-Grundschutz des BSI: Ausweitung der Detektion von Cyberangriffen im IT-Sicherheitsprozess}, series = {Datenschutz und Datensicherheit (DuD)}, volume = {49}, journal = {Datenschutz und Datensicherheit (DuD)}, number = {11}, publisher = {Springer}, doi = {10.1007/s11623-025-2173-5}, pages = {731 -- 736}, year = {2025}, abstract = {Inzwischen hat sich die Einsicht durchgesetzt, dass Cyberangriffe nicht komplett verhindert werden k{\"o}nnen. Stattdessen sollen die m{\"o}glichen Auswirkungen von Vorf{\"a}llen sinnvoll reduziert werden. Damit steigt die Bedeutung der Erkennung von Sicherheitsvorf{\"a}llen, um schnell reagieren und das Schadensausmaß begrenzen zu k{\"o}nnen. Damit die Fortschritte bei der Erkennung k{\"u}nftig auch in der Praxis angewendet werden k{\"o}nnen, ist eine Verankerung in den entsprechenden Vorgehensweisen erforderlich. Dies erfolgt nachfolgend am Beispiel des IT-Grundschutzes, dessen Methoden in der deutschsprachigen IT-Sicherheitscommunity verbreitet sind.}, language = {de} }