@inproceedings{VoglWeberGrafetal., author = {Vogl, Peter and Weber, Sergei and Graf, Julian and Neubauer, Katrin and Hackenberg, Rudolf}, title = {Design and Implementation of an Intelligent and Model-based Intrusion Detection System for Iot Networks}, series = {Cloud Computing 2022: The Thirteenth International Conference on Cloud Computing, GRIDs, and Virtualization, Special Track FAST-CSP, Barcelona, Spain, 24.-28.04.2022}, booktitle = {Cloud Computing 2022: The Thirteenth International Conference on Cloud Computing, GRIDs, and Virtualization, Special Track FAST-CSP, Barcelona, Spain, 24.-28.04.2022}, publisher = {IARIA}, address = {[Wilmington, DE, USA]}, isbn = {978-1-61208-948-5}, pages = {7 -- 12}, abstract = {The ongoing digitization and digitalization entails the increasing risk of privacy breaches through cyber attacks. Internet of Things (IoT) environments often contain devices monitoring sensitive data such as vital signs, movement or surveil-lance data. Unfortunately, many of these devices provide limited security features. The purpose of this paper is to investigate how artificial intelligence and static analysis can be implemented in practice-oriented intelligent Intrusion Detection Systems to monitor IoT networks. In addition, the question of how static and dynamic methods can be developed and combined to improve net-work attack detection is discussed. The implementation concept is based on a layer-based architecture with a modular deployment of classical security analysis and modern artificial intelligent methods. To extract important features from the IoT network data a time-based approach has been developed. Combined with network metadata these features enhance the performance of the artificial intelligence driven anomaly detection and attack classification. The paper demonstrates that artificial intelligence and static analysis methods can be combined in an intelligent Intrusion Detection System to improve the security of IoT environments.}, language = {en} } @inproceedings{GrafNeubauerFischeretal., author = {Graf, Julian and Neubauer, Katrin and Fischer, Sebastian and Hackenberg, Rudolf}, title = {Architecture of an intelligent Intrusion Detection System for Smart Home}, series = {2020 IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops): 2020, Austin, Texas, USA}, booktitle = {2020 IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops): 2020, Austin, Texas, USA}, publisher = {IEEE}, isbn = {978-1-7281-4716-1}, doi = {10.1109/PerComWorkshops48775.2020.9156168}, pages = {1 -- 6}, abstract = {Increasing cyber-attacks on Internet of Things (IoT) environments are a growing problem of digitized households worldwide. The purpose of this study is to investigate how an intelligent Intrusion Detection System (iIDS) can provide more security in IoT networks with a novel architecture, combining multiple classical and machine learning approaches. By combining classical security analysis methods and modern concepts of artificial intelligence, we increase the quality of attack detection and can therefore conduct dedicated attack suppression. The architectural image of the iIDS consists of different layers, which in parts achieve self-sufficient results. The results of the different modules are calculated by means of statement variables and evaluation techniques adapted for the individual module elements and subsequently combined by limit value considerations. The architecture image combines approaches for the analysis and processing of IoT network traffic and evaluates it to an aggregated score. From this result it can be determined whether the analyzed data indicates device misuse or attempted break-ins into the network. This study answers the questions whether a connection between classical and modern concepts for monitoring and analyzing IoT network traffic can be implemented meaningfully within a reliable architecture of an iIDS.}, language = {en} } @article{FuxenSchoenhaerlSchmidtetal., author = {Fuxen, Philipp and Sch{\"o}nh{\"a}rl, Stefan and Schmidt, Jonas and Gerstner, Mathias and Jahn, Sabrina and Graf, Julian and Hackenberg, Rudolf and Mottok, J{\"u}rgen}, title = {A Cybersecurity Education Platform for Automotive Penetration Testing}, series = {International Journal On Advances in Security}, volume = {15}, journal = {International Journal On Advances in Security}, number = {3\&4}, publisher = {IARIA}, issn = {1942-2636}, pages = {106 -- 118}, abstract = {The paper presents a penetration testing framework for automotive IT security education and evaluates its realization. The automotive sector is changing due to automated driving functions, connected vehicles, and electric vehicles. This development also creates new and more critical vulnerabilities. This paper addresses a possible countermeasure, automotive IT security education. Some existing solutions are evaluated and compared with the created Automotive Penetration Testing Education Platform (APTEP) framework. In addition, the APTEP architecture is described. It consists of three layers representing different attack points of a vehicle. The realization of the APTEP is a hardware case and a virtual platform referred to as the Automotive Network Security Case (ANSKo). The hardware case contains emulated control units and different communication protocols. The virtual platform uses Docker containers to provide a similar experience over the internet. Both offer two kinds of challenges. The first introduces users to a specific interface, while the second combines multiple interfaces, to a complex and realistic challenge. This concept is based on modern didactic theories, such as constructivism and problem-based/challenge-based learning. Computer Science students from the Ostbayerische Technische Hochschule (OTH) Regensburg experienced the challenges as part of a elective subject. In an online survey evaluated in this paper, they gave positive feedback. Also, a part of the evaluation is the mapping of the ANSKo and the maturity levels in the Software Assurance Maturity Model (SAMM) practice Education \& Guidance as well as the SAMM practice Security Testing. The scientific contribution of this paper is to present an APTEP, a corresponding learning concept and an evaluation method.}, language = {en} } @inproceedings{SchoenhaerlFuxenGrafetal., author = {Sch{\"o}nh{\"a}rl, Stefan and Fuxen, Philipp and Graf, Julian and Schmidt, Jonas and Hackenberg, Rudolf and Mottok, J{\"u}rgen}, title = {An Automotive Penetration Testing Framework for IT-Security Education}, series = {Cloud Computing 2022: The Thirteenth International Conference on Cloud Computing, GRIDs, and Virtualization, Special Track FAST-CSP, Barcelona, Spain, 24.-28.04.2022}, booktitle = {Cloud Computing 2022: The Thirteenth International Conference on Cloud Computing, GRIDs, and Virtualization, Special Track FAST-CSP, Barcelona, Spain, 24.-28.04.2022}, publisher = {IARIA}, address = {[Wilmington, DE, USA]}, isbn = {978-1-61208-948-5}, pages = {1 -- 6}, abstract = {Automotive Original Equipment Manufacturer (OEM) and suppliers started shifting their focus towards the security of their connected electronic programmable products recently since cars used to be mainly mechanical products. However, this has changed due to the rising digitalization of vehicles. Security and functional safety have grown together and need to be addressed as a single issue, referred to as automotive security, in the following article. One way to accomplish security is automotive security education. The scientific contribution of this paper is to establish an Automotive Penetration Testing Education Platform (APTEP). It consists of three layers representing different attack points of a vehicle. The layers are the outer, inner, and core layers. Each of those contains multiple interfaces, such as Wireless Local Area Network (WLAN) or electric vehicle charging interfaces in the outer layer, message bus systems in the inner layer, and debug or diagnostic interfaces in the core layer. One implementation of APTEP is in a hardware case and as a virtual platform, referred to as the Automotive Network Security Case (ANSKo). The hardware case contains emulated control units and different communication protocols. The virtual platform uses Docker containers to provide a similar experience over the internet. Both offer two kinds of challenges. The first introduces users to a specific interface, while the second combines multiple interfaces, to a complex and realistic challenge. This concept is based on modern didactic theory, such as constructivism and problem-based learning. Computer Science students from the Ostbayerische Technische Hochschule (OTH)Regensburg experienced the challenges as part of a special topic course and provided positive feedback.}, language = {en} }