@inproceedings{GrafNeubauerFischeretal., author = {Graf, Julian and Neubauer, Katrin and Fischer, Sebastian and Hackenberg, Rudolf}, title = {Architecture of an intelligent Intrusion Detection System for Smart Home}, series = {2020 IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops): 2020, Austin, Texas, USA}, booktitle = {2020 IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops): 2020, Austin, Texas, USA}, publisher = {IEEE}, isbn = {978-1-7281-4716-1}, doi = {10.1109/PerComWorkshops48775.2020.9156168}, pages = {1 -- 6}, abstract = {Increasing cyber-attacks on Internet of Things (IoT) environments are a growing problem of digitized households worldwide. The purpose of this study is to investigate how an intelligent Intrusion Detection System (iIDS) can provide more security in IoT networks with a novel architecture, combining multiple classical and machine learning approaches. By combining classical security analysis methods and modern concepts of artificial intelligence, we increase the quality of attack detection and can therefore conduct dedicated attack suppression. The architectural image of the iIDS consists of different layers, which in parts achieve self-sufficient results. The results of the different modules are calculated by means of statement variables and evaluation techniques adapted for the individual module elements and subsequently combined by limit value considerations. The architecture image combines approaches for the analysis and processing of IoT network traffic and evaluates it to an aggregated score. From this result it can be determined whether the analyzed data indicates device misuse or attempted break-ins into the network. This study answers the questions whether a connection between classical and modern concepts for monitoring and analyzing IoT network traffic can be implemented meaningfully within a reliable architecture of an iIDS.}, language = {en} } @inproceedings{VoglWeberGrafetal., author = {Vogl, Peter and Weber, Sergei and Graf, Julian and Neubauer, Katrin and Hackenberg, Rudolf}, title = {Design and Implementation of an Intelligent and Model-based Intrusion Detection System for Iot Networks}, series = {Cloud Computing 2022: The Thirteenth International Conference on Cloud Computing, GRIDs, and Virtualization, Special Track FAST-CSP, Barcelona, Spain, 24.-28.04.2022}, booktitle = {Cloud Computing 2022: The Thirteenth International Conference on Cloud Computing, GRIDs, and Virtualization, Special Track FAST-CSP, Barcelona, Spain, 24.-28.04.2022}, publisher = {IARIA}, address = {[Wilmington, DE, USA]}, isbn = {978-1-61208-948-5}, pages = {7 -- 12}, abstract = {The ongoing digitization and digitalization entails the increasing risk of privacy breaches through cyber attacks. Internet of Things (IoT) environments often contain devices monitoring sensitive data such as vital signs, movement or surveil-lance data. Unfortunately, many of these devices provide limited security features. The purpose of this paper is to investigate how artificial intelligence and static analysis can be implemented in practice-oriented intelligent Intrusion Detection Systems to monitor IoT networks. In addition, the question of how static and dynamic methods can be developed and combined to improve net-work attack detection is discussed. The implementation concept is based on a layer-based architecture with a modular deployment of classical security analysis and modern artificial intelligent methods. To extract important features from the IoT network data a time-based approach has been developed. Combined with network metadata these features enhance the performance of the artificial intelligence driven anomaly detection and attack classification. The paper demonstrates that artificial intelligence and static analysis methods can be combined in an intelligent Intrusion Detection System to improve the security of IoT environments.}, language = {en} } @article{FuxenSchoenhaerlSchmidtetal., author = {Fuxen, Philipp and Sch{\"o}nh{\"a}rl, Stefan and Schmidt, Jonas and Gerstner, Mathias and Jahn, Sabrina and Graf, Julian and Hackenberg, Rudolf and Mottok, J{\"u}rgen}, title = {A Cybersecurity Education Platform for Automotive Penetration Testing}, series = {International Journal On Advances in Security}, volume = {15}, journal = {International Journal On Advances in Security}, number = {3\&4}, publisher = {IARIA}, issn = {1942-2636}, pages = {106 -- 118}, abstract = {The paper presents a penetration testing framework for automotive IT security education and evaluates its realization. The automotive sector is changing due to automated driving functions, connected vehicles, and electric vehicles. This development also creates new and more critical vulnerabilities. This paper addresses a possible countermeasure, automotive IT security education. Some existing solutions are evaluated and compared with the created Automotive Penetration Testing Education Platform (APTEP) framework. In addition, the APTEP architecture is described. It consists of three layers representing different attack points of a vehicle. The realization of the APTEP is a hardware case and a virtual platform referred to as the Automotive Network Security Case (ANSKo). The hardware case contains emulated control units and different communication protocols. The virtual platform uses Docker containers to provide a similar experience over the internet. Both offer two kinds of challenges. The first introduces users to a specific interface, while the second combines multiple interfaces, to a complex and realistic challenge. This concept is based on modern didactic theories, such as constructivism and problem-based/challenge-based learning. Computer Science students from the Ostbayerische Technische Hochschule (OTH) Regensburg experienced the challenges as part of a elective subject. In an online survey evaluated in this paper, they gave positive feedback. Also, a part of the evaluation is the mapping of the ANSKo and the maturity levels in the Software Assurance Maturity Model (SAMM) practice Education \& Guidance as well as the SAMM practice Security Testing. The scientific contribution of this paper is to present an APTEP, a corresponding learning concept and an evaluation method.}, language = {en} } @inproceedings{FolgerHachaniFuxenetal., author = {Folger, Fabian and Hachani, Murad and Fuxen, Philipp and Graf, Julian and Fischer, Sebastian and Hackenberg, Rudolf}, title = {A Transformer-Based Framework for Anomaly Detection in Multivariate Time Series}, series = {CLOUD COMPUTING 2025, The Sixteenth International Conference on Cloud Computing, GRIDs, and Virtualization, April 06, 2025 to April 10, 2025, Valencia, Spain}, booktitle = {CLOUD COMPUTING 2025, The Sixteenth International Conference on Cloud Computing, GRIDs, and Virtualization, April 06, 2025 to April 10, 2025, Valencia, Spain}, publisher = {IARIA}, isbn = {978-1-68558-258-6}, issn = {2308-4294}, pages = {52 -- 57}, abstract = {This paper introduces a comprehensive Transformer-based architecture for anomaly detection in multivariate time series. Using self-attention, the framework efficiently processes high-dimensional sensor data without extensive feature engineering, enabling early detection of unusual patterns to prevent critical system failures. In a subsequent laboratory setup, the framework will be applied using fuzzing techniques to induce anomalies in an Electronic Control Unit, while monitoring side channels, such as temperature, voltage, and Controller Area Network messages. The overall structure of the architecture, as well as the necessary preprocessing steps, such as temporal aggregation and classification up to the optimization of the hyperparameters of the model, are presented. The evaluation of the model architecture with the postulated restrictions shows that the model handles anomaly scenarios in the dataset robustly. It is necessary to evaluate the extent to which the model can be used in practical applications in areas, such as cloud environments or the industrial Internet of Things. Overall, the results highlight the potential of Transformer models for the automated and reliable monitoring of complex time series data for deviations.}, language = {en} } @inproceedings{HachaniSteyFuxenetal., author = {Hachani, Murad and Stey, Miguel and Fuxen, Philipp and Graf, Julian and Hackenberg, Rudolf}, title = {GFDG: a genetic fuzzing method for the Controller Area Network Protocol}, series = {Cloud Computing 2025 : The Sixteenth International Conference on Cloud Coud Computing, GRIDs, and Virtualization, 06.-10. April 2025, Valencia}, booktitle = {Cloud Computing 2025 : The Sixteenth International Conference on Cloud Coud Computing, GRIDs, and Virtualization, 06.-10. April 2025, Valencia}, organization = {IARIA}, isbn = {978-1-68558-258-6}, issn = {2308-4294}, pages = {40 -- 45}, abstract = {Ensuring the security of modern automotive systems is critical due to their increasing complexity and reliance on interconnected Electronic Control Units. The Controller Area Network still serves as a key communication protocol within these systems, making it a primary target for security testing. Traditional fuzz testing approaches for Controller Area Networks often rely on random or brute-force message generation, not leveraging the system's feedback to improve the generation process. This paper introduces the Genetic Fuzz Data Generator, a fuzzing method that leverages Genetic Algorithms and side-channel analysis to enhance Controller Area Network security testing. The Genetic Fuzz Data Generator dynamically refines its fuzzing strategy by evaluating system responses through side-channel data, such as processing unit temperatures and power supply variations. By structuring Controller Area Network messages as genetic individuals and applying evolutionary principles—including selection, crossover, and mutation—the Genetic Fuzz Data Generator systematically identifies active Controller Area Network IDs and generates targeted fuzz messages. Experimental validation was conducted on a real automotive electronic control unit within a controlled laboratory setup. The first results demonstrated the approach's effectiveness, revealing system anomalies, including a Denial of Service vulnerability that disrupted functions of the investigated Electronic Control Unit. The findings highlight the potential of feedback-driven fuzzing for improving the efficiency of black-box security testing in Controller Area Network-based systems. Future research could further optimize fitness functions or explore additional side-channel metrics.}, language = {en} } @inproceedings{GrafHachaniFischeretal., author = {Graf, Julian and Hachani, Murad and Fischer, Sebastian and Hackenberg, Rudolf}, title = {A heuristic packet processing model for improved encrypted network analysis}, series = {CSCS '25: Proceedings of the 2nd Cyber Security in CarS Workshop}, booktitle = {CSCS '25: Proceedings of the 2nd Cyber Security in CarS Workshop}, publisher = {ACM}, address = {New York, USA}, doi = {10.1145/3736130.3764510}, pages = {12}, abstract = {Modern networked systems, such as those in the automotive sector, face increasing complexity and growing attack surfaces due to the rise of interconnected and data-driven technologies. Detecting malicious behavior in these environments requires efficient and scalable methods that can operate reliably despite limited resources and high communication volumes. This paper proposes a heuristic packet processing model designed to support intrusion detection based on structural and temporal characteristics of encrypted network traffic. The model follows a modular architecture consisting of four key phases: recording, sorting, prioritizing, and analyzing. At the core of the approach is the Polymetric Queueing Topology Space, a feature space that combines statistical and time series attributes derived from model structure and flow data. These features serve as input for machine learning models, which can effectively distinguish between benign and intrusion traffic patterns without relying on packet data beyond the transport layer. The approach was evaluated using the publicly available ToN_IoT dataset and demonstrated that reliable classification is achievable using a subset of the developed feature space that contains model-derived traffic features. We used Random Forest for supervised binary and multi-class classification achieving high accuracy scores of 99\% for binary and 98\% for multi-class classification. Additionally, for unsupervised anomaly detection, we created an Isolation Forest model accomplishing F1-scores of 0.92 for the benign and 0.96 for intrusion class. The architecture is designed to enable dynamic traffic prioritization and to offer a flexible foundation that can observe diverse network domains while maintaining efficient performance under constrained computational conditions.}, language = {en} } @misc{HauserGrafFischer, author = {Hauser, Dominic and Graf, Julian and Fischer, Sebastian}, title = {SEPP - Security Education and Penetration-Testing Platform for IoT}, series = {Conference programme \& abstract book}, journal = {Conference programme \& abstract book}, publisher = {IAFOR}, issn = {2433-7544}, pages = {101}, abstract = {The Internet of Things (IoT) is becoming a major part of our everyday lives, offering convenience and smarter solutions, but also bringing significant security challenges. While theoretical knowledge in IoT security is essential, studies have shown that practical content can be an essential part of internalizing understanding. To address this, we developed the Security Education and Penetration-Testing Platform (SEPP) as the practical component of an existing IoT security course at the OTH Regensburg. SEPP uses real IoT devices like smart locks, cameras, and plugs, simulating a smart home environment to make learning interactive and engaging. Students can explore vulnerabilities, conduct penetration tests, and document their findings through structured exercises. By working on tasks like network scanning, analyzing data traffic, and simulating attacks, students gain a deeper understanding of IoT security risks. Initial tests show that this approach helps students apply their theoretical knowledge and significantly improve their practical skills. This paper explains how SEPP was built, the exercises it offers, and why it's an important step forward in teaching IoT security effectively. Furthermore, we aim to share the findings and tasks from this paper with other universities, providing them with a solid foundation to teach practical IoT security knowledge in their own courses.}, language = {en} } @inproceedings{SchoenhaerlFuxenGrafetal., author = {Sch{\"o}nh{\"a}rl, Stefan and Fuxen, Philipp and Graf, Julian and Schmidt, Jonas and Hackenberg, Rudolf and Mottok, J{\"u}rgen}, title = {An Automotive Penetration Testing Framework for IT-Security Education}, series = {Cloud Computing 2022: The Thirteenth International Conference on Cloud Computing, GRIDs, and Virtualization, Special Track FAST-CSP, Barcelona, Spain, 24.-28.04.2022}, booktitle = {Cloud Computing 2022: The Thirteenth International Conference on Cloud Computing, GRIDs, and Virtualization, Special Track FAST-CSP, Barcelona, Spain, 24.-28.04.2022}, publisher = {IARIA}, address = {[Wilmington, DE, USA]}, isbn = {978-1-61208-948-5}, pages = {1 -- 6}, abstract = {Automotive Original Equipment Manufacturer (OEM) and suppliers started shifting their focus towards the security of their connected electronic programmable products recently since cars used to be mainly mechanical products. However, this has changed due to the rising digitalization of vehicles. Security and functional safety have grown together and need to be addressed as a single issue, referred to as automotive security, in the following article. One way to accomplish security is automotive security education. The scientific contribution of this paper is to establish an Automotive Penetration Testing Education Platform (APTEP). It consists of three layers representing different attack points of a vehicle. The layers are the outer, inner, and core layers. Each of those contains multiple interfaces, such as Wireless Local Area Network (WLAN) or electric vehicle charging interfaces in the outer layer, message bus systems in the inner layer, and debug or diagnostic interfaces in the core layer. One implementation of APTEP is in a hardware case and as a virtual platform, referred to as the Automotive Network Security Case (ANSKo). The hardware case contains emulated control units and different communication protocols. The virtual platform uses Docker containers to provide a similar experience over the internet. Both offer two kinds of challenges. The first introduces users to a specific interface, while the second combines multiple interfaces, to a complex and realistic challenge. This concept is based on modern didactic theory, such as constructivism and problem-based learning. Computer Science students from the Ostbayerische Technische Hochschule (OTH)Regensburg experienced the challenges as part of a special topic course and provided positive feedback.}, language = {en} }