@misc{MauererRexhepajMonkmanetal., author = {Mauerer, Wolfgang and Rexhepaj, Tanja and Monkman, Gareth J. and Sindersberger, Dirk and Diermeier, Andreas and Neidhart, Thomas and Wolfrum, Dominik and Sterner, Michael and Heberl, Michael and Nusko, Robert and Maier, Georg and Nagl, Klaus and Reuter, Monika and Hofrichter, Andreas and Lex, Thomas and Lesch, Florian and Kieninger, B{\"a}rbel and Szalo, Alexander Eduard and Zehner, Alexander and Palm, Christoph and Joblin, Mitchell and Apel, Sven and Ramsauer, Ralf and Lohmann, Daniel and Westner, Markus and Strasser, Artur and Munndi, Maximilian and Ebner, Lena and Elsner, Michael and Weiß, Nils and Segerer, Matthias and Hackenberg, Rudolf and Steger, Sebastian and Schmailzl, Anton and Dostalek, Michael and Armbruster, Dominik and Koch, Fabian and Hierl, Stefan and Thumann, Philipp and Swidergal, Krzysztof and Wagner, Marcus and Briem, Ulrich and Diermeier, Andreas and Spreitzer, Stefan and Beiderbeck, Sabrina and Hook, Christian and Zobel, Martin and Weber, Tim and Groß, Simon and Penzkofer, Rainer and Dendorfer, Sebastian and Schillitz, Ingo and Bauer, Thomas and Rudolph, Clarissa and Schmidt, Katja and Liebetruth, Thomas and Hamer, Markus and Haug, Sonja and Vernim, Matthias and Weber, Karsten and Saßmannshausen, Sean Patrick and Books, Sebastian and Neuleitner, Nikolaus and Rechenauer, Christian and Steffens, Oliver and Kusterle, Wolfgang and G{\"o}mmel, Roland and Wellnitz, Felix and Stierstorfer, Johannes and Stadler, Dominik and Hofmann, Matthias J. and Motschmann, Hubert and Shamonin (Chamonine), Mikhail and Bleicher, Veronika and Fischer, Sebastian and Hackenberg, Rudolf and Horn, Anton and Kawasch, Raphael and Petzenhauser, Michael and Probst, Tobias and Udalzow, Anton and Dams, Florian and Schreiner, Rupert and Langer, Christoph and Prommesberger, Christian and Ławrowski, Robert Damian}, title = {Forschungsbericht 2016}, editor = {Baier, Wolfgang}, address = {Regensburg}, organization = {Ostbayerische Technische Hochschule Regensburg}, doi = {10.35096/othr/pub-1384}, url = {http://nbn-resolving.de/urn:nbn:de:bvb:898-opus4-13840}, language = {de} } @inproceedings{TaoLiuMottoketal., author = {Tao, Ye and Liu, Guozhu and Mottok, J{\"u}rgen and Hackenberg, Rudolf and Hagel, Georg and Mottok, J{\"u}rgen}, title = {Just-in-Time Teaching in software engineering: A Chinese-German empirical case study}, series = {2014 IEEE Global Engineering Education Conference (EDUCON), 3-5 April 2014, Istanbul, Turkey}, booktitle = {2014 IEEE Global Engineering Education Conference (EDUCON), 3-5 April 2014, Istanbul, Turkey}, publisher = {IEEE}, doi = {10.1109/EDUCON.2014.6826220}, pages = {983 -- 986}, abstract = {Learning centered teaching becomes an important factor in a global perspective of learning software engineering. The Just-in-Time Teaching approach is used in a Chinese-German empirical case study. In a one year terminated project we will analyze the performance of our students in an active learning scenario with Just-in-Time Teaching and Peer Instruction. We will contribute an inter-cultural comparison of achieved competencies by student's self-assessment and teacher's observation.}, language = {en} } @inproceedings{YeTaoGuozhuLiuMottoketal., author = {Ye Tao, and Guozhu Liu, and Mottok, J{\"u}rgen and Hackenberg, Rudolf and Hagel, Georg}, title = {Just-in-Time-Teaching experience in a Software Design Pattern course}, series = {2015 IEEE Global Engineering Education Conference (EDUCON), 18-20 March 2015, Tallinn, Estonia}, booktitle = {2015 IEEE Global Engineering Education Conference (EDUCON), 18-20 March 2015, Tallinn, Estonia}, pages = {915 -- 919}, language = {en} } @inproceedings{TaoLiuMottoketal., author = {Tao, Ye and Liu, Guozhu and Mottok, J{\"u}rgen and Hackenberg, Rudolf and Hagel, Georg}, title = {Ranking task activity in teaching software engineering}, series = {IEEE Global Engineering Education Conference (EDUCON), 10-13 April 2016, Abu Dhabi, UAE}, booktitle = {IEEE Global Engineering Education Conference (EDUCON), 10-13 April 2016, Abu Dhabi, UAE}, doi = {10.1109/EDUCON.2016.7474678}, pages = {1023 -- 1027}, abstract = {In this research, we investigate the possibility of applying ranking task activity in teaching and learning software engineering courses. We introduce three types of ranking tasks, conceptual-, contextual- and sequential ranking questions, which cover most core topics such as requirement analysis, architecture design and quality validation in the course. We have also done experiments on a group of students to see if ranking tasks could increase their conceptual knowledge in specific areas. Assessments were given in order to evaluate the effectiveness of this activity, showing an obvious increase in complex conceptual understanding.}, language = {en} } @inproceedings{RennerPozzobonMottoketal., author = {Renner, Sebastian and Pozzobon, Enrico and Mottok, J{\"u}rgen and Hackenberg, Rudolf}, title = {Benchmarking Software Implementations of 1st Round Candidates of the NIST LWC Project on Microcontrollers}, series = {3rd Lightweight Cryptography Workshop at NIST, Gaithersburg, USA}, booktitle = {3rd Lightweight Cryptography Workshop at NIST, Gaithersburg, USA}, abstract = {This paper introduces a custom framework for benchmarking software implementations from the National Institute of Standards and Technology (NIST) Lightweight Cryptography (LWC) project on embedded devices. We present the design and core functions of the framework and apply it to various NIST LWC authenticated encryption with associated data (AEAD) ciphers. Altogether, we evaluate the speed of 213 submitted algorithm vari-ants on four different microcontroller units (MCUs), including 32 bit ARM and 8 bit AVR architectures. To allow a more meaningful comparison, we also conduct code size tests on all four boards and RAM utilization tests on one test platform.}, language = {en} } @inproceedings{HanschStaudteGerhageretal., author = {Hansch, G. and Staudte, Ch. and Gerhager, S. and Hackenberg, Rudolf and Mottok, J{\"u}rgen}, title = {Migration path for secure and economic smart power grid devices with transitional smart metering support}, series = {Applied Research Conference 2012 (ARC 2012), 25./26. June 2012 Nuremberg}, booktitle = {Applied Research Conference 2012 (ARC 2012), 25./26. June 2012 Nuremberg}, editor = {Mottok, J{\"u}rgen and Ziemann, Olaf}, publisher = {Shaker}, address = {Aachen}, isbn = {2012 978-3-8440-1093-0}, pages = {63 -- 69}, language = {en} } @inproceedings{PozzobonWeissRenneretal., author = {Pozzobon, Enrico and Weiss, Nils and Renner, Sebastian and Hackenberg, Rudolf}, title = {A Survey on Media Access Solutions for CAN Penetration Testing}, series = {ACM Computer Science in Cars Symposium (CSCS), 2nd, 2018, Munich, Germany}, booktitle = {ACM Computer Science in Cars Symposium (CSCS), 2nd, 2018, Munich, Germany}, abstract = {Controller Area Network (CAN) is still the most used network technology in today's connected cars. Now and in the near future, penetration tests in the area of automotive security will still require tools for CAN media access. More and more open source automotive penetration tools and frameworks are presented by researchers on various conferences, all with different properties in terms of usability, features and supported use-cases. Choosing a proper tool for security investigations in automotive network poses a challenge, since lots of different solutions are available. This paper compares currently available CAN media access solutions and gives advice on competitive hard-and software tools for automotive penetration testing.}, language = {en} } @article{KahlKrauseHackenbergetal., author = {Kahl, Matthias and Krause, Veronika and Hackenberg, Rudolf and Ul Haq, Anwar and Horn, Anton and Jacobsen, Hans-Arno and Kriechbaumer, Thomas and Petzenhauser, Michael and Shamonin (Chamonine), Mikhail and Udalzow, Anton}, title = {Measurement system and dataset for in-depth analysis of appliance energy consumption in industrial environment}, series = {tm - Technisches Messen}, volume = {86}, journal = {tm - Technisches Messen}, number = {1}, publisher = {De Gruyter}, doi = {10.1515/teme-2018-0038}, pages = {1 -- 13}, abstract = {To support a rational and efficient use of electrical energy in residential and industrial environments, Non-Intrusive Load Monitoring (NILM) provides several techniques to identify state and power consumption profiles of connected appliances. Design requirements for such systems include a low hardware and installations costs for residential, reliability and high-availability for industrial purposes, while keeping invasive interventions into the electrical infrastructure to a minimum. This work introduces a reference hardware setup that allows an in depth analysis of electrical energy consumption in industrial environments. To identify appliances and their consumption profile, appropriate identification algorithms are developed by the NILM community. To enable an evaluation of these algorithms on industrial appliances, we introduce the Laboratory-measured IndustriaL Appliance Characteristics (LILAC) dataset: 1302 measurements from one, two, and three concurrently running appliances of 15 appliance types, measured with the introduced testbed. To allow in-depth appliance consumption analysis, measurements were carried out with a sampling rate of 50 kHz and 16-bit amplitude resolution for voltage and current signals. We show in experiments that signal signatures, contained in the measurement data, allows one to distinguish the single measured electrical appliances with a baseline machine learning approach of nearly 100\% accuracy.}, language = {en} } @inproceedings{HackenbergWeissRenneretal., author = {Hackenberg, Rudolf and Weiss, Nils and Renner, Sebastian and Pozzobon, Enrico}, title = {Extending Vehicle Attack Surface Through Smart Devices}, series = {SECURWARE 2017 : The Eleventh International Conference on Emerging Security Information, Systems and Technologies, 11th, 2017, Rome, Italy}, booktitle = {SECURWARE 2017 : The Eleventh International Conference on Emerging Security Information, Systems and Technologies, 11th, 2017, Rome, Italy}, publisher = {IARIA}, isbn = {978-1-61208-582-1}, pages = {131 -- 135}, abstract = {Modern cars include more and more features that first emerged from the consumer electronics industry. Technologies like Bluetooth and Internet-connected services found their way into the vehicle industry. The secure implementation of these functions presents a great challenge for the manufacturers because products originating from the consumer industry can often not be easily transferred to the safety-sensitive traffic environment due to security concerns. However, common automotive interfaces like the diagnostics port are now also used to implement new services into the car. With dongles designed to read out certain vehicle data and transfer it to the Internet via the cellular network, the owner can access information about gas consumption or vehicle location through a mobile phone app, even when he is away from the car. This paper wants to emphasize new threats that appear due to the ongoing interconnection in modern cars by discussing the security of the diagnostics interface in combination with the use of an Internet-connected dongle. Potential attack vectors, as well as proof-of-concept exploits will be shown and the implications of security breaches on the safe state of the vehicle will be investigated.}, language = {en} } @inproceedings{WeissSchroetterHackenberg, author = {Weiss, Nils and Schr{\"o}tter, Markus and Hackenberg, Rudolf}, title = {On Threat Analysis and Risk Estimation of Automotive Ransomware}, series = {ACM Computer Science in Cars Symposium : [CSCS '19) 08.10.2019, Kaiserslautern, Germany}, booktitle = {ACM Computer Science in Cars Symposium : [CSCS '19) 08.10.2019, Kaiserslautern, Germany}, editor = {Hof, Hans-Joachim and Fritz, Mario and Krauß, Christoph and Wasenm{\"u}ller, Oliver}, publisher = {ACM}, address = {New York, NY, USA}, isbn = {9781450370042}, doi = {10.1145/3359999.3360492}, pages = {1 -- 9}, language = {en} } @inproceedings{GrafNeubauerFischeretal., author = {Graf, Julian and Neubauer, Katrin and Fischer, Sebastian and Hackenberg, Rudolf}, title = {Architecture of an intelligent Intrusion Detection System for Smart Home}, series = {2020 IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops): 2020, Austin, Texas, USA}, booktitle = {2020 IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops): 2020, Austin, Texas, USA}, publisher = {IEEE}, isbn = {978-1-7281-4716-1}, doi = {10.1109/PerComWorkshops48775.2020.9156168}, pages = {1 -- 6}, abstract = {Increasing cyber-attacks on Internet of Things (IoT) environments are a growing problem of digitized households worldwide. The purpose of this study is to investigate how an intelligent Intrusion Detection System (iIDS) can provide more security in IoT networks with a novel architecture, combining multiple classical and machine learning approaches. By combining classical security analysis methods and modern concepts of artificial intelligence, we increase the quality of attack detection and can therefore conduct dedicated attack suppression. The architectural image of the iIDS consists of different layers, which in parts achieve self-sufficient results. The results of the different modules are calculated by means of statement variables and evaluation techniques adapted for the individual module elements and subsequently combined by limit value considerations. The architecture image combines approaches for the analysis and processing of IoT network traffic and evaluates it to an aggregated score. From this result it can be determined whether the analyzed data indicates device misuse or attempted break-ins into the network. This study answers the questions whether a connection between classical and modern concepts for monitoring and analyzing IoT network traffic can be implemented meaningfully within a reliable architecture of an iIDS.}, language = {en} } @article{HinterbergerFischerWeberetal., author = {Hinterberger, Lukas and Fischer, Sebastian and Weber, Bernhard and Neubauer, Katrin and Hackenberg, Rudolf}, title = {Extended Definition of the Proposed Open Standard for IoT Device IdentificAtion and RecoGnition (IoTAG)}, series = {International Journal on Advances in Internet Technology}, volume = {13}, journal = {International Journal on Advances in Internet Technology}, number = {3 \& 4}, publisher = {IARIA}, pages = {110 -- 121}, abstract = {Internet of Things (IoT) devices are critical to operate and maintain, because of their number and high connectivity. A lot of security issues concern IoT devices and the networks they are integrated. To help getting an overview of an IoT network, the devices and the security, we propose a scoring system to get a good impression of IT security. This system generates single scores for each device, using features like encryption, update behavior, etc. Furthermore, a summarized score for the whole network is calculated, to show the status of the network security in an easy way for the administrator. To enable the scoring system, a precise list of the existing devices and their operating status is necessary. To achieve this, we present an open standard for the IoT Device IdentificAtion and RecoGnition (short IoTAG), which requires that devices report, e.g., their name, an unique ID, the firmware version and the supported encryption. The proposed standard is described in detail and an implementation guideline is given in this paper. Additionally, information about how to realize the serialization, the integrity and the communication with IoTAG.}, language = {en} } @inproceedings{NeubauerFischerHackenberg, author = {Neubauer, Katrin and Fischer, Sebastian and Hackenberg, Rudolf}, title = {Work in Progress: Security Analysis for Safety-critical Systems}, series = {ARCS Workshop 2019; 32nd International Conference on Architecture of Computing Systems, May 2019, Copenhagen, Denmark, Workshop FORMUS³IC}, booktitle = {ARCS Workshop 2019; 32nd International Conference on Architecture of Computing Systems, May 2019, Copenhagen, Denmark, Workshop FORMUS³IC}, editor = {Trinitis, Carsten and Pionteck, Thilo}, publisher = {VDE Verlag GmbH}, address = {Berlin}, isbn = {978-3-8007-4957-7}, pages = {101 -- 106}, abstract = {Internet of Thing (IoT) and Smart Grid (SG) are separate technologies. The digital transformation of the energy industry and the increasing digitalization in the private sector connect these technologies. Currently in Germany, the SG is under construction. In order to use future innovative services, SG and IoT must be combined. For this, we connect the SG Infrastructure with the IoT. A potential insecure device and network (IoT) should be able to transfer data to and from a critical infrastructure (SG). Open research question in this context are the security requirements architecture SG and IoT and the mechanism for authentication and authorisation in future application (SG and IoT). Due to the increasing networking of the systems (SG and IoT) new threats and attack vectors arise. The attacks to the architecture influence the target of authenticity, security and privacy. For the security analysis we focus on two communication points: the communication between the smart meter gateway, and the IoT device. In our example, a connected charging station with cloud services is connected with a SG infrastructure. To create a really smart service, the charging station needs a connection to the SG to get the current amount of renewable energy in the grid. With this two connections, new threats emerge. A security analysis over all the connections, including the vulnerability and the ability of an attacker, is developed in this paper. The analysis shows us challenges of the communication between IoT and SG. For this, we defined technical and organizational requirements for authentication and authorization. Current authentication and authorization mechanisms are no longer sufficient for the defined requirements. We present the Role-based trust model for Safety-critical Systems for these defined requirements. The new trust model is integrated into a role-based access control model. It defines data classes, which separate the sensitive and non-sensitive information.}, language = {en} } @inproceedings{GoertzFischerHackenberg, author = {G{\"o}rtz, Stefan and Fischer, Sebastian and Hackenberg, Rudolf}, title = {Generation of Distributed Denial of Service Network Data with Phyton and Scapy}, series = {CLOUD COMPUTING 2023 : The Fourteenth International Conference on Cloud Computing, GRIDs, and Virtualization, June 26 - 30, 2023, Nice, France}, booktitle = {CLOUD COMPUTING 2023 : The Fourteenth International Conference on Cloud Computing, GRIDs, and Virtualization, June 26 - 30, 2023, Nice, France}, publisher = {IARIA}, isbn = {978-1-68558-044-5}, pages = {8 -- 14}, abstract = {Distributed Denial of Service attacks are among the most common and widespread network attacks. Due to their nature, they are difficult to defend. Intrusion detection systems, based on machine learning, are a promising approach to counter this threat. But to train these systems, data sets with Distributed Denial of Service attacks are needed. An implemented Python program, which creates Denial of Services packets and simulates distributed sending by multithreading, is presented. Unlike synthetically generated data with the use of simulators, real network traffic is generated. This eliminates errors and offers a better basis of data, as machine learning algorithms need data that is as error-free as possible in order to learn efficiently.}, language = {en} } @inproceedings{VoglWeberGrafetal., author = {Vogl, Peter and Weber, Sergei and Graf, Julian and Neubauer, Katrin and Hackenberg, Rudolf}, title = {Design and Implementation of an Intelligent and Model-based Intrusion Detection System for Iot Networks}, series = {Cloud Computing 2022: The Thirteenth International Conference on Cloud Computing, GRIDs, and Virtualization, Special Track FAST-CSP, Barcelona, Spain, 24.-28.04.2022}, booktitle = {Cloud Computing 2022: The Thirteenth International Conference on Cloud Computing, GRIDs, and Virtualization, Special Track FAST-CSP, Barcelona, Spain, 24.-28.04.2022}, publisher = {IARIA}, address = {[Wilmington, DE, USA]}, isbn = {978-1-61208-948-5}, pages = {7 -- 12}, abstract = {The ongoing digitization and digitalization entails the increasing risk of privacy breaches through cyber attacks. Internet of Things (IoT) environments often contain devices monitoring sensitive data such as vital signs, movement or surveil-lance data. Unfortunately, many of these devices provide limited security features. The purpose of this paper is to investigate how artificial intelligence and static analysis can be implemented in practice-oriented intelligent Intrusion Detection Systems to monitor IoT networks. In addition, the question of how static and dynamic methods can be developed and combined to improve net-work attack detection is discussed. The implementation concept is based on a layer-based architecture with a modular deployment of classical security analysis and modern artificial intelligent methods. To extract important features from the IoT network data a time-based approach has been developed. Combined with network metadata these features enhance the performance of the artificial intelligence driven anomaly detection and attack classification. The paper demonstrates that artificial intelligence and static analysis methods can be combined in an intelligent Intrusion Detection System to improve the security of IoT environments.}, language = {en} } @inproceedings{HinterbergerWeberFischeretal., author = {Hinterberger, Lukas and Weber, Bernhard and Fischer, Sebastian and Neubauer, Katrin and Hackenberg, Rudolf}, title = {IoT Device IdentificAtion and RecoGnition (IoTAG)}, series = {CLOUD COMPUTING 2020, The Eleventh International Conference on Cloud Computing, GRIDs and Virtualization}, booktitle = {CLOUD COMPUTING 2020, The Eleventh International Conference on Cloud Computing, GRIDs and Virtualization}, publisher = {IARIA}, isbn = {978-1-61208-778-8}, pages = {17 -- 23}, abstract = {To ensure the secure operation of IoT devices in the future, they must be continuously monitored. This starts with an inventory of the devices, checking for a current software version and extends to the encryption algorithms and active services used. Based on this information, a security analysis and rating of the whole network is possible. To solve this challenge in the growing network environments, we present a proposal for a standard. With the IoT Device IdentificAtion and RecoGnition (IoTAG), each IoT device reports its current status to a central location as required and provides information on security. This information includes a unique ID, the exact device name, the current software version, active services, cryptographic methods used, etc. The information is signed to make misuse more difficult and to ensure that the device can always be uniquely identified. In this paper, we introduce IoTAG in detail and describe the necessary requirements.}, language = {en} } @article{FuxenSchoenhaerlSchmidtetal., author = {Fuxen, Philipp and Sch{\"o}nh{\"a}rl, Stefan and Schmidt, Jonas and Gerstner, Mathias and Jahn, Sabrina and Graf, Julian and Hackenberg, Rudolf and Mottok, J{\"u}rgen}, title = {A Cybersecurity Education Platform for Automotive Penetration Testing}, series = {International Journal On Advances in Security}, volume = {15}, journal = {International Journal On Advances in Security}, number = {3\&4}, publisher = {IARIA}, issn = {1942-2636}, pages = {106 -- 118}, abstract = {The paper presents a penetration testing framework for automotive IT security education and evaluates its realization. The automotive sector is changing due to automated driving functions, connected vehicles, and electric vehicles. This development also creates new and more critical vulnerabilities. This paper addresses a possible countermeasure, automotive IT security education. Some existing solutions are evaluated and compared with the created Automotive Penetration Testing Education Platform (APTEP) framework. In addition, the APTEP architecture is described. It consists of three layers representing different attack points of a vehicle. The realization of the APTEP is a hardware case and a virtual platform referred to as the Automotive Network Security Case (ANSKo). The hardware case contains emulated control units and different communication protocols. The virtual platform uses Docker containers to provide a similar experience over the internet. Both offer two kinds of challenges. The first introduces users to a specific interface, while the second combines multiple interfaces, to a complex and realistic challenge. This concept is based on modern didactic theories, such as constructivism and problem-based/challenge-based learning. Computer Science students from the Ostbayerische Technische Hochschule (OTH) Regensburg experienced the challenges as part of a elective subject. In an online survey evaluated in this paper, they gave positive feedback. Also, a part of the evaluation is the mapping of the ANSKo and the maturity levels in the Software Assurance Maturity Model (SAMM) practice Education \& Guidance as well as the SAMM practice Security Testing. The scientific contribution of this paper is to present an APTEP, a corresponding learning concept and an evaluation method.}, language = {en} } @inproceedings{WeberHinterbergerFischeretal., author = {Weber, Bernhard and Hinterberger, Lukas and Fischer, Sebastian and Hackenberg, Rudolf}, title = {How to Prevent Misuse of IoTAG?}, series = {Cloud Computing 2021: the Twelfth International Conference on Cloud Computing, GRIDs, and Virtualization: April 18-22, 2021, Porto, Portugal}, booktitle = {Cloud Computing 2021: the Twelfth International Conference on Cloud Computing, GRIDs, and Virtualization: April 18-22, 2021, Porto, Portugal}, editor = {Duncan, Bob and Lee, Yong Woo and Popescu, Manuela}, publisher = {IARIA}, address = {Wilmington, DE, USA}, isbn = {978-1-61208-845-7}, issn = {2308-4294}, abstract = {Since IoT devices are potentially insecure and offer great attack potential, in our past research we presented IoTAG, a solution where devices communicate security-related information about themselves. However, since this information can also be exploited by attackers, we present in this paper a solution against the misuse of IoTAG. In doing so, we address the two biggest problems: authentication and pairing with a trusted device. This is solved by introducing a pairing process, which uses the simultaneous authentication of equals algorithm to securely exchange and verify each others signature, and by using the server and client authentication provided by HTTP over TLS. We provide the minimum requirements and evaluate the methods used. The emphasis is on known and already proven methods. Additionally, we analyze the potential consequences of an attacker tapping the IoTAG information. Finally, we conclude that the solution successfully prevents access to IoTAG by unauthorized clients on the same network.}, language = {en} } @inproceedings{NeubauerFischerHackenberg, author = {Neubauer, Katrin and Fischer, Sebastian and Hackenberg, Rudolf}, title = {Risk Analysis of the Cloud Infrastructure of Smart Grid and Internet of Things}, series = {The Tenth International Conference on Cloud Computing, GRIDs, and Virtualization, (CLOUD COMPUTING 2019), 10th Mai 2019, Venice, Italy}, booktitle = {The Tenth International Conference on Cloud Computing, GRIDs, and Virtualization, (CLOUD COMPUTING 2019), 10th Mai 2019, Venice, Italy}, publisher = {IARIA}, isbn = {978-1-61208-703-0}, issn = {2308-4294}, pages = {82 -- 87}, abstract = {Cloud Computing (CC), Internet of Thing (IoT) and Smart Grid (SG) are separate technologies. The digital transformation of the energy industry and the increasing digitalization in the private sector connect these technologies. At the moment, CC is used as a service provider for IoT. Currently in Germany, the SG is under construction and a cloud connection to the infrastructure has not been implemented yet. To build the SG cloud, the new laws for privacy must be implemented and therefore it's important to know which data can be stored and distributed over a cloud. In order to be able to use future innovative services, SG and IoT must be combined. For this, in the next step we connect the SG infrastructure with the IoT. A potential insecure device and network (IoT) should be able to transfer data to and from a critical infrastructure (SG). In detail, we focus on two different connections: the communication between the smart meter switching box and the IoT device and the data transferred between the IoT and SG cloud. In our example, a connected charging station with cloud services is connected with a SG infrastructure. To create a really smart service, the charging station needs a connection to the SG to get the current amount of renewable energy in the grid. Private data, such as name, address and payment details, should not be transferred to the IoT cloud. With these two connections, new threads emerge. In this case, availability, confidentiality and integrity must be ensured. A risk analysis over all the cloud connections, including the vulnerability and the ability of an attacker and the resulting risk are developed in this paper.}, language = {en} } @inproceedings{FischerNeubauerHackenberg, author = {Fischer, Sebastian and Neubauer, Katrin and Hackenberg, Rudolf}, title = {A Study about the Different Categories of IoT in Scientific Publications}, series = {CLOUD COMPUTING 2020: the Eleventh International Conference on Cloud Computing, GRIDs and Virtualization, October 25-29, 2020, Nizza}, booktitle = {CLOUD COMPUTING 2020: the Eleventh International Conference on Cloud Computing, GRIDs and Virtualization, October 25-29, 2020, Nizza}, publisher = {IARIA}, isbn = {978-1-61208-778-8}, pages = {24 -- 30}, abstract = {The Internet of Things (IoT) is widely used as a synonym for nearly every connected device. This makes it really difficult to find the right kind of scientific publication for the intended category of IoT. Conferences and other events for IoT are confusing about the target group (consumer, enterprise, industrial, etc.) and standardisation organisations suffer from the same problem. To demonstrate these problems, this paper shows the results of an analyses over IoT publications in different research libraries. The number of results for IoT, consumer, enterprise and industrial search queries were evaluated and a manual study about 100 publications was done. According to the research library or search engine, different results about the distribution of consumer-, enterprise- and industrial- IoT are visible. The comparison with the results of the manual evaluation shows that some search queries do not show all desired publications or that considerably more, unwanted results are returned. Most researchers do not use the keywords right and the exact category of IoT can only be accessed via the abstract. This shows major problems with the use of the term IoT and its minor limitations.}, language = {en} } @inproceedings{FolgerHachaniFuxenetal., author = {Folger, Fabian and Hachani, Murad and Fuxen, Philipp and Graf, Julian and Fischer, Sebastian and Hackenberg, Rudolf}, title = {A Transformer-Based Framework for Anomaly Detection in Multivariate Time Series}, series = {CLOUD COMPUTING 2025, The Sixteenth International Conference on Cloud Computing, GRIDs, and Virtualization, April 06, 2025 to April 10, 2025, Valencia, Spain}, booktitle = {CLOUD COMPUTING 2025, The Sixteenth International Conference on Cloud Computing, GRIDs, and Virtualization, April 06, 2025 to April 10, 2025, Valencia, Spain}, publisher = {IARIA}, isbn = {978-1-68558-258-6}, issn = {2308-4294}, pages = {52 -- 57}, abstract = {This paper introduces a comprehensive Transformer-based architecture for anomaly detection in multivariate time series. Using self-attention, the framework efficiently processes high-dimensional sensor data without extensive feature engineering, enabling early detection of unusual patterns to prevent critical system failures. In a subsequent laboratory setup, the framework will be applied using fuzzing techniques to induce anomalies in an Electronic Control Unit, while monitoring side channels, such as temperature, voltage, and Controller Area Network messages. The overall structure of the architecture, as well as the necessary preprocessing steps, such as temporal aggregation and classification up to the optimization of the hyperparameters of the model, are presented. The evaluation of the model architecture with the postulated restrictions shows that the model handles anomaly scenarios in the dataset robustly. It is necessary to evaluate the extent to which the model can be used in practical applications in areas, such as cloud environments or the industrial Internet of Things. Overall, the results highlight the potential of Transformer models for the automated and reliable monitoring of complex time series data for deviations.}, language = {en} } @inproceedings{FuxenHackenbergHeinletal., author = {Fuxen, Philipp and Hackenberg, Rudolf and Heinl, M. P. and Schunck, C. H. and Yahalom, R.}, title = {MANTRA: A Graph-based Unified Information Aggregation Foundation for Enhancing Cybersecurity Management in Critical Infrastructures // Aufsatznr.: P-335}, series = {Lecture Notes in Informatics (LNI), Proceedings - Series of the Gesellschaft fur Informatik (GI),}, booktitle = {Lecture Notes in Informatics (LNI), Proceedings - Series of the Gesellschaft fur Informatik (GI),}, doi = {10.18420/OID2023_10}, pages = {123 -- 128}, abstract = {The digitization of almost all sectors of life and the quickly growing complexity of interrelationships between actors in this digital world leads to a dramatically increasing attack surface regarding both direct and also indirect attacks over the supply chain. These supply chain attacks can have different characters, e.g., vulnerabilities and backdoors in hardware and software, illegitimate access by compromised service providers, or trust relationships to suppliers and customers exploited in the course of business email compromise. To address this challenge and create visibility along these supply chains, threat-related data needs to be rapidly exchanged and correlated over organizational borders. The publicly funded project MANTRA is meant to create a secure and resilient framework for real-time exchange of cyberattack patterns and automated, contextualized risk management. The novel graph-based approach provides benefits for automation regarding cybersecurity management, especially when it comes to prioriization of measures for risk reduction and during active defense against cyberattacks. In this paper, we outline MANTRA's scope, objectives, envisioned scientific approach, and challenges.}, language = {en} } @inproceedings{HachaniSteyFuxenetal., author = {Hachani, Murad and Stey, Miguel and Fuxen, Philipp and Graf, Julian and Hackenberg, Rudolf}, title = {GFDG: a genetic fuzzing method for the Controller Area Network Protocol}, series = {Cloud Computing 2025 : The Sixteenth International Conference on Cloud Coud Computing, GRIDs, and Virtualization, 06.-10. April 2025, Valencia}, booktitle = {Cloud Computing 2025 : The Sixteenth International Conference on Cloud Coud Computing, GRIDs, and Virtualization, 06.-10. April 2025, Valencia}, organization = {IARIA}, isbn = {978-1-68558-258-6}, issn = {2308-4294}, pages = {40 -- 45}, abstract = {Ensuring the security of modern automotive systems is critical due to their increasing complexity and reliance on interconnected Electronic Control Units. The Controller Area Network still serves as a key communication protocol within these systems, making it a primary target for security testing. Traditional fuzz testing approaches for Controller Area Networks often rely on random or brute-force message generation, not leveraging the system's feedback to improve the generation process. This paper introduces the Genetic Fuzz Data Generator, a fuzzing method that leverages Genetic Algorithms and side-channel analysis to enhance Controller Area Network security testing. The Genetic Fuzz Data Generator dynamically refines its fuzzing strategy by evaluating system responses through side-channel data, such as processing unit temperatures and power supply variations. By structuring Controller Area Network messages as genetic individuals and applying evolutionary principles—including selection, crossover, and mutation—the Genetic Fuzz Data Generator systematically identifies active Controller Area Network IDs and generates targeted fuzz messages. Experimental validation was conducted on a real automotive electronic control unit within a controlled laboratory setup. The first results demonstrated the approach's effectiveness, revealing system anomalies, including a Denial of Service vulnerability that disrupted functions of the investigated Electronic Control Unit. The findings highlight the potential of feedback-driven fuzzing for improving the efficiency of black-box security testing in Controller Area Network-based systems. Future research could further optimize fitness functions or explore additional side-channel metrics.}, language = {en} } @inproceedings{ReichelGerstnerSchilleretal., author = {Reichel, Tobias and Gerstner, Mathias and Schiller, Leo and Attenberger, Andreas and Hackenberg, Rudolf and Dološ, Klara}, title = {A forensic analysis of GNSS spoofing attacks on autonomous vehicles}, series = {Cloud Computing 2025 : The Sixteenth International Conference on Cloud Computing, GRIDs, and Virtualization, 06.-10. April 2025, Valencia}, booktitle = {Cloud Computing 2025 : The Sixteenth International Conference on Cloud Computing, GRIDs, and Virtualization, 06.-10. April 2025, Valencia}, organization = {IARIA}, isbn = {978-1-68558-258-6}, issn = {2308-4294}, pages = {32 -- 39}, abstract = {Global Navigation Satellite Systems (GNSSs) are essential for modern technology, enabling precise geographic positioning in aviation, maritime shipping, and automotive systems. In the future, their role will be even more critical for autonomous vehicles, which rely on accurate localization for navigation and decision-making. However, the increasing connectivity of autonomous vehicles exposes them to cyber threats, including GNSS spoofing attacks, which manipulate location data to mislead onboard systems. As reliance on GNSS grows, so does the risk posed by spoofing attacks, making it a critical security concern. This paper describes GNSS spoofing attacks on autonomous vehicles, focusing on their detection both during and after an attack. Furthermore, we analyze data storage strategies to facilitate effective forensic analysis. We highlight the importance of position, signal, and camera data, which should be preserved to ensure a comprehensive forensic investigation. Finally, we suggest a simulation setup that enables studying which data could be used for a forensic investigation. Additionally, we examine established data frameworks and decide whether they are suitable for detecting GNSS spoofing attacks.}, language = {en} } @inproceedings{GerstnerHackenberg, author = {Gerstner, Mathias and Hackenberg, Rudolf}, title = {Context-aware forecasting of mobile network quality for autonomous vehicle connectivity}, series = {Vehicular analytics 2025 : the second conference on vehicular systems}, booktitle = {Vehicular analytics 2025 : the second conference on vehicular systems}, publisher = {IARIA}, isbn = {978-1-68558-320-0}, doi = {10.35096/othr/pub-8616}, url = {http://nbn-resolving.de/urn:nbn:de:bvb:898-opus4-86166}, pages = {7}, abstract = {As autonomous driving becomes increasingly feasible, the German government has introduced a legal framework to enable the operation with Level 4 automated driving functionality. A key requirement is the maintenance of a continuous connection between such vehicles and a remote technical supervisor. If this link is lost, the vehicle must transition into a safe state by bringing itself to a controlled stop. To mitigate the risk of connection loss, accurate forecasting of mobile network availability along routes is essential. This paper presents an Exploratory Data Analysis (EDA) based on 38 measurement runs collected over ten months along a rural 64 km route in Germany. The dataset includes passive mobile network signal quality parameters, Global Navigation Satellite System (GNSS) position and precision data, as well as contextual features, such as speed, driving direction, day of the week, weather, and distance to the connected base station. Although mean values capture overall tendencies for areas with consistently good or poor coverage, they fail to capture the variability necessary for reliable prediction on a per-trip basis. Notably, some route segments show high variance in signal quality across different measurement runs. This variability is assumed to result from changing environmental influences, such as weather or traffic conditions at different times. Our analysis reveals weak but statistically relevant correlations between several contextual features (e.g., temperature ≈ -0.2) and network quality indicators. The inclusion of weather parameters or the day of the week has been shown to lower the Mean Absolute Error (MAE) compared to a prediction based only on measurements from the past. These findings underscore the importance of contextual information and localized modeling to predict network availability for safety-critical systems, such as autonomous vehicles.}, language = {en} } @inproceedings{GrafHachaniFischeretal., author = {Graf, Julian and Hachani, Murad and Fischer, Sebastian and Hackenberg, Rudolf}, title = {A heuristic packet processing model for improved encrypted network analysis}, series = {CSCS '25: Proceedings of the 2nd Cyber Security in CarS Workshop}, booktitle = {CSCS '25: Proceedings of the 2nd Cyber Security in CarS Workshop}, publisher = {ACM}, address = {New York, USA}, doi = {10.1145/3736130.3764510}, pages = {12}, abstract = {Modern networked systems, such as those in the automotive sector, face increasing complexity and growing attack surfaces due to the rise of interconnected and data-driven technologies. Detecting malicious behavior in these environments requires efficient and scalable methods that can operate reliably despite limited resources and high communication volumes. This paper proposes a heuristic packet processing model designed to support intrusion detection based on structural and temporal characteristics of encrypted network traffic. The model follows a modular architecture consisting of four key phases: recording, sorting, prioritizing, and analyzing. At the core of the approach is the Polymetric Queueing Topology Space, a feature space that combines statistical and time series attributes derived from model structure and flow data. These features serve as input for machine learning models, which can effectively distinguish between benign and intrusion traffic patterns without relying on packet data beyond the transport layer. The approach was evaluated using the publicly available ToN_IoT dataset and demonstrated that reliable classification is achievable using a subset of the developed feature space that contains model-derived traffic features. We used Random Forest for supervised binary and multi-class classification achieving high accuracy scores of 99\% for binary and 98\% for multi-class classification. Additionally, for unsupervised anomaly detection, we created an Isolation Forest model accomplishing F1-scores of 0.92 for the benign and 0.96 for intrusion class. The architecture is designed to enable dynamic traffic prioritization and to offer a flexible foundation that can observe diverse network domains while maintaining efficient performance under constrained computational conditions.}, language = {en} } @article{NeubauerFischerHackenberg, author = {Neubauer, Katrin and Fischer, Sebastian and Hackenberg, Rudolf}, title = {Security risk analysis of the cloud infrastructure of Smart Grid and IoT - 4-Level-Trust-Model as a security solution}, series = {International Journal on Advances in Internet Technology}, volume = {13}, journal = {International Journal on Advances in Internet Technology}, number = {1\&2}, pages = {11 -- 20}, abstract = {The digital transformation has found its way into business and private life. It consists of digitization and digitaliza- tion. Digitization means the technical process and digitalization is the socio-technological process. Technologies of digitization are Cloud Computing (CC), Internet of Things (IoT) and Smart Grid (SG), which are separate technologies. The increasing digitalization in the private sector and of the energy industry connect these technologies. Actually, there is no connection between the CC infrastructure and the SG infrastructure at the moment, because in Germany the SG is currently under construction. If one looks at the CC and IoT, it must be stated there is an connection between the IoT infrastructure and the CC infrastructure as a service provider. To connect the technologies CC, IoT and SG and also build an SG cloud for innovative services, the new laws for privacy must be implemented. For privacy and security analyses it is important to know which data can be stored and distributed on a cloud. To illustrate this analysis, we connect the SG infrastructure with the IoT. An IoT device (car charging station) should be able to transfer data to and from the SG. SG is a critical infrastructure and the IoT device a potential insecure device and network. We show the communication between the smart meter switching box and the IoT device and the data transferred between their clouds. The charging station is connected to the SG to get the current amount of renewable energy in the grid. This is necessary to create a new smart service. But this service also generates private data (e.g., name, address, payment details). The private data should not be transferred to the IoT cloud. For the connection of SG and IoT, availability, confidentiality and integrity must be ensured. A risk analysis over all the cloud connections, including the vulnerability and the ability of an attacker, the resulting risk and the 4-Level- Trust-Model for security assessment are developed. Furthermore, we show the application of the 4-Level-Trust-Model in this paper.}, language = {en} } @inproceedings{SchoenhaerlFuxenGrafetal., author = {Sch{\"o}nh{\"a}rl, Stefan and Fuxen, Philipp and Graf, Julian and Schmidt, Jonas and Hackenberg, Rudolf and Mottok, J{\"u}rgen}, title = {An Automotive Penetration Testing Framework for IT-Security Education}, series = {Cloud Computing 2022: The Thirteenth International Conference on Cloud Computing, GRIDs, and Virtualization, Special Track FAST-CSP, Barcelona, Spain, 24.-28.04.2022}, booktitle = {Cloud Computing 2022: The Thirteenth International Conference on Cloud Computing, GRIDs, and Virtualization, Special Track FAST-CSP, Barcelona, Spain, 24.-28.04.2022}, publisher = {IARIA}, address = {[Wilmington, DE, USA]}, isbn = {978-1-61208-948-5}, pages = {1 -- 6}, abstract = {Automotive Original Equipment Manufacturer (OEM) and suppliers started shifting their focus towards the security of their connected electronic programmable products recently since cars used to be mainly mechanical products. However, this has changed due to the rising digitalization of vehicles. Security and functional safety have grown together and need to be addressed as a single issue, referred to as automotive security, in the following article. One way to accomplish security is automotive security education. The scientific contribution of this paper is to establish an Automotive Penetration Testing Education Platform (APTEP). It consists of three layers representing different attack points of a vehicle. The layers are the outer, inner, and core layers. Each of those contains multiple interfaces, such as Wireless Local Area Network (WLAN) or electric vehicle charging interfaces in the outer layer, message bus systems in the inner layer, and debug or diagnostic interfaces in the core layer. One implementation of APTEP is in a hardware case and as a virtual platform, referred to as the Automotive Network Security Case (ANSKo). The hardware case contains emulated control units and different communication protocols. The virtual platform uses Docker containers to provide a similar experience over the internet. Both offer two kinds of challenges. The first introduces users to a specific interface, while the second combines multiple interfaces, to a complex and realistic challenge. This concept is based on modern didactic theory, such as constructivism and problem-based learning. Computer Science students from the Ostbayerische Technische Hochschule (OTH)Regensburg experienced the challenges as part of a special topic course and provided positive feedback.}, language = {en} }