@inproceedings{FalterBrunkhWessetal., author = {Falter, Sandro and Brunkh, Gerald and Wess, Max and Fischer, Sebastian}, title = {Automated Vulnerability Scanner for the Cyber Resilience Act}, series = {CLOUD COMPUTING 2024 : The Fifteenth International Conference on Cloud Computing, GRIDs, and Virtualization, 15, 2024, Venice}, booktitle = {CLOUD COMPUTING 2024 : The Fifteenth International Conference on Cloud Computing, GRIDs, and Virtualization, 15, 2024, Venice}, publisher = {IARIA}, isbn = {978-1-68558-156-5}, pages = {13 -- 18}, abstract = {This paper explores the mitigation of the compliance burdens faced by manufacturers of digital products under the Cyber Resilience Act. After providing a concise overview of the Cyber Resilience Act and pinpointing pivotal areas where tool-based interventions could reduce the regulatory strain on manufacturers, we introduce two prototypes: a digital checklist for product classification and a prototype to streamline the analysis and monitoring of the security state of software along the software development life cycle. As the second prototype is based on Static Application Software Testing and Software Component Analysis, we validate the approach through benchmark tests. While Static Application Software Testing tools show promise in identifying vulnerabilities, additional tests are needed for full compliance with the Cyber Resilience Act. In general, the prototypes serve as an entry point for identifying possible automation potential to alleviate the compliance burdens of manufacturers.}, language = {en} } @inproceedings{GrafNeubauerFischeretal., author = {Graf, Julian and Neubauer, Katrin and Fischer, Sebastian and Hackenberg, Rudolf}, title = {Architecture of an intelligent Intrusion Detection System for Smart Home}, series = {2020 IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops): 2020, Austin, Texas, USA}, booktitle = {2020 IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops): 2020, Austin, Texas, USA}, publisher = {IEEE}, isbn = {978-1-7281-4716-1}, doi = {10.1109/PerComWorkshops48775.2020.9156168}, pages = {1 -- 6}, abstract = {Increasing cyber-attacks on Internet of Things (IoT) environments are a growing problem of digitized households worldwide. The purpose of this study is to investigate how an intelligent Intrusion Detection System (iIDS) can provide more security in IoT networks with a novel architecture, combining multiple classical and machine learning approaches. By combining classical security analysis methods and modern concepts of artificial intelligence, we increase the quality of attack detection and can therefore conduct dedicated attack suppression. The architectural image of the iIDS consists of different layers, which in parts achieve self-sufficient results. The results of the different modules are calculated by means of statement variables and evaluation techniques adapted for the individual module elements and subsequently combined by limit value considerations. The architecture image combines approaches for the analysis and processing of IoT network traffic and evaluates it to an aggregated score. From this result it can be determined whether the analyzed data indicates device misuse or attempted break-ins into the network. This study answers the questions whether a connection between classical and modern concepts for monitoring and analyzing IoT network traffic can be implemented meaningfully within a reliable architecture of an iIDS.}, language = {en} } @article{HinterbergerFischerWeberetal., author = {Hinterberger, Lukas and Fischer, Sebastian and Weber, Bernhard and Neubauer, Katrin and Hackenberg, Rudolf}, title = {Extended Definition of the Proposed Open Standard for IoT Device IdentificAtion and RecoGnition (IoTAG)}, series = {International Journal on Advances in Internet Technology}, volume = {13}, journal = {International Journal on Advances in Internet Technology}, number = {3 \& 4}, publisher = {IARIA}, pages = {110 -- 121}, abstract = {Internet of Things (IoT) devices are critical to operate and maintain, because of their number and high connectivity. A lot of security issues concern IoT devices and the networks they are integrated. To help getting an overview of an IoT network, the devices and the security, we propose a scoring system to get a good impression of IT security. This system generates single scores for each device, using features like encryption, update behavior, etc. Furthermore, a summarized score for the whole network is calculated, to show the status of the network security in an easy way for the administrator. To enable the scoring system, a precise list of the existing devices and their operating status is necessary. To achieve this, we present an open standard for the IoT Device IdentificAtion and RecoGnition (short IoTAG), which requires that devices report, e.g., their name, an unique ID, the firmware version and the supported encryption. The proposed standard is described in detail and an implementation guideline is given in this paper. Additionally, information about how to realize the serialization, the integrity and the communication with IoTAG.}, language = {en} } @inproceedings{NeubauerFischerHackenberg, author = {Neubauer, Katrin and Fischer, Sebastian and Hackenberg, Rudolf}, title = {Work in Progress: Security Analysis for Safety-critical Systems}, series = {ARCS Workshop 2019; 32nd International Conference on Architecture of Computing Systems, May 2019, Copenhagen, Denmark, Workshop FORMUS³IC}, booktitle = {ARCS Workshop 2019; 32nd International Conference on Architecture of Computing Systems, May 2019, Copenhagen, Denmark, Workshop FORMUS³IC}, editor = {Trinitis, Carsten and Pionteck, Thilo}, publisher = {VDE Verlag GmbH}, address = {Berlin}, isbn = {978-3-8007-4957-7}, pages = {101 -- 106}, abstract = {Internet of Thing (IoT) and Smart Grid (SG) are separate technologies. The digital transformation of the energy industry and the increasing digitalization in the private sector connect these technologies. Currently in Germany, the SG is under construction. In order to use future innovative services, SG and IoT must be combined. For this, we connect the SG Infrastructure with the IoT. A potential insecure device and network (IoT) should be able to transfer data to and from a critical infrastructure (SG). Open research question in this context are the security requirements architecture SG and IoT and the mechanism for authentication and authorisation in future application (SG and IoT). Due to the increasing networking of the systems (SG and IoT) new threats and attack vectors arise. The attacks to the architecture influence the target of authenticity, security and privacy. For the security analysis we focus on two communication points: the communication between the smart meter gateway, and the IoT device. In our example, a connected charging station with cloud services is connected with a SG infrastructure. To create a really smart service, the charging station needs a connection to the SG to get the current amount of renewable energy in the grid. With this two connections, new threats emerge. A security analysis over all the connections, including the vulnerability and the ability of an attacker, is developed in this paper. The analysis shows us challenges of the communication between IoT and SG. For this, we defined technical and organizational requirements for authentication and authorization. Current authentication and authorization mechanisms are no longer sufficient for the defined requirements. We present the Role-based trust model for Safety-critical Systems for these defined requirements. The new trust model is integrated into a role-based access control model. It defines data classes, which separate the sensitive and non-sensitive information.}, language = {en} } @inproceedings{GoertzFischerHackenberg, author = {G{\"o}rtz, Stefan and Fischer, Sebastian and Hackenberg, Rudolf}, title = {Generation of Distributed Denial of Service Network Data with Phyton and Scapy}, series = {CLOUD COMPUTING 2023 : The Fourteenth International Conference on Cloud Computing, GRIDs, and Virtualization, June 26 - 30, 2023, Nice, France}, booktitle = {CLOUD COMPUTING 2023 : The Fourteenth International Conference on Cloud Computing, GRIDs, and Virtualization, June 26 - 30, 2023, Nice, France}, publisher = {IARIA}, isbn = {978-1-68558-044-5}, pages = {8 -- 14}, abstract = {Distributed Denial of Service attacks are among the most common and widespread network attacks. Due to their nature, they are difficult to defend. Intrusion detection systems, based on machine learning, are a promising approach to counter this threat. But to train these systems, data sets with Distributed Denial of Service attacks are needed. An implemented Python program, which creates Denial of Services packets and simulates distributed sending by multithreading, is presented. Unlike synthetically generated data with the use of simulators, real network traffic is generated. This eliminates errors and offers a better basis of data, as machine learning algorithms need data that is as error-free as possible in order to learn efficiently.}, language = {en} } @inproceedings{HinterbergerWeberFischeretal., author = {Hinterberger, Lukas and Weber, Bernhard and Fischer, Sebastian and Neubauer, Katrin and Hackenberg, Rudolf}, title = {IoT Device IdentificAtion and RecoGnition (IoTAG)}, series = {CLOUD COMPUTING 2020, The Eleventh International Conference on Cloud Computing, GRIDs and Virtualization}, booktitle = {CLOUD COMPUTING 2020, The Eleventh International Conference on Cloud Computing, GRIDs and Virtualization}, publisher = {IARIA}, isbn = {978-1-61208-778-8}, pages = {17 -- 23}, abstract = {To ensure the secure operation of IoT devices in the future, they must be continuously monitored. This starts with an inventory of the devices, checking for a current software version and extends to the encryption algorithms and active services used. Based on this information, a security analysis and rating of the whole network is possible. To solve this challenge in the growing network environments, we present a proposal for a standard. With the IoT Device IdentificAtion and RecoGnition (IoTAG), each IoT device reports its current status to a central location as required and provides information on security. This information includes a unique ID, the exact device name, the current software version, active services, cryptographic methods used, etc. The information is signed to make misuse more difficult and to ensure that the device can always be uniquely identified. In this paper, we introduce IoTAG in detail and describe the necessary requirements.}, language = {en} } @inproceedings{WeberHinterbergerFischeretal., author = {Weber, Bernhard and Hinterberger, Lukas and Fischer, Sebastian and Hackenberg, Rudolf}, title = {How to Prevent Misuse of IoTAG?}, series = {Cloud Computing 2021: the Twelfth International Conference on Cloud Computing, GRIDs, and Virtualization: April 18-22, 2021, Porto, Portugal}, booktitle = {Cloud Computing 2021: the Twelfth International Conference on Cloud Computing, GRIDs, and Virtualization: April 18-22, 2021, Porto, Portugal}, editor = {Duncan, Bob and Lee, Yong Woo and Popescu, Manuela}, publisher = {IARIA}, address = {Wilmington, DE, USA}, isbn = {978-1-61208-845-7}, issn = {2308-4294}, abstract = {Since IoT devices are potentially insecure and offer great attack potential, in our past research we presented IoTAG, a solution where devices communicate security-related information about themselves. However, since this information can also be exploited by attackers, we present in this paper a solution against the misuse of IoTAG. In doing so, we address the two biggest problems: authentication and pairing with a trusted device. This is solved by introducing a pairing process, which uses the simultaneous authentication of equals algorithm to securely exchange and verify each others signature, and by using the server and client authentication provided by HTTP over TLS. We provide the minimum requirements and evaluate the methods used. The emphasis is on known and already proven methods. Additionally, we analyze the potential consequences of an attacker tapping the IoTAG information. Finally, we conclude that the solution successfully prevents access to IoTAG by unauthorized clients on the same network.}, language = {en} } @inproceedings{NeubauerFischerHackenberg, author = {Neubauer, Katrin and Fischer, Sebastian and Hackenberg, Rudolf}, title = {Risk Analysis of the Cloud Infrastructure of Smart Grid and Internet of Things}, series = {The Tenth International Conference on Cloud Computing, GRIDs, and Virtualization, (CLOUD COMPUTING 2019), 10th Mai 2019, Venice, Italy}, booktitle = {The Tenth International Conference on Cloud Computing, GRIDs, and Virtualization, (CLOUD COMPUTING 2019), 10th Mai 2019, Venice, Italy}, publisher = {IARIA}, isbn = {978-1-61208-703-0}, issn = {2308-4294}, pages = {82 -- 87}, abstract = {Cloud Computing (CC), Internet of Thing (IoT) and Smart Grid (SG) are separate technologies. The digital transformation of the energy industry and the increasing digitalization in the private sector connect these technologies. At the moment, CC is used as a service provider for IoT. Currently in Germany, the SG is under construction and a cloud connection to the infrastructure has not been implemented yet. To build the SG cloud, the new laws for privacy must be implemented and therefore it's important to know which data can be stored and distributed over a cloud. In order to be able to use future innovative services, SG and IoT must be combined. For this, in the next step we connect the SG infrastructure with the IoT. A potential insecure device and network (IoT) should be able to transfer data to and from a critical infrastructure (SG). In detail, we focus on two different connections: the communication between the smart meter switching box and the IoT device and the data transferred between the IoT and SG cloud. In our example, a connected charging station with cloud services is connected with a SG infrastructure. To create a really smart service, the charging station needs a connection to the SG to get the current amount of renewable energy in the grid. Private data, such as name, address and payment details, should not be transferred to the IoT cloud. With these two connections, new threads emerge. In this case, availability, confidentiality and integrity must be ensured. A risk analysis over all the cloud connections, including the vulnerability and the ability of an attacker and the resulting risk are developed in this paper.}, language = {en} } @inproceedings{FischerNeubauerHackenberg, author = {Fischer, Sebastian and Neubauer, Katrin and Hackenberg, Rudolf}, title = {A Study about the Different Categories of IoT in Scientific Publications}, series = {CLOUD COMPUTING 2020: the Eleventh International Conference on Cloud Computing, GRIDs and Virtualization, October 25-29, 2020, Nizza}, booktitle = {CLOUD COMPUTING 2020: the Eleventh International Conference on Cloud Computing, GRIDs and Virtualization, October 25-29, 2020, Nizza}, publisher = {IARIA}, isbn = {978-1-61208-778-8}, pages = {24 -- 30}, abstract = {The Internet of Things (IoT) is widely used as a synonym for nearly every connected device. This makes it really difficult to find the right kind of scientific publication for the intended category of IoT. Conferences and other events for IoT are confusing about the target group (consumer, enterprise, industrial, etc.) and standardisation organisations suffer from the same problem. To demonstrate these problems, this paper shows the results of an analyses over IoT publications in different research libraries. The number of results for IoT, consumer, enterprise and industrial search queries were evaluated and a manual study about 100 publications was done. According to the research library or search engine, different results about the distribution of consumer-, enterprise- and industrial- IoT are visible. The comparison with the results of the manual evaluation shows that some search queries do not show all desired publications or that considerably more, unwanted results are returned. Most researchers do not use the keywords right and the exact category of IoT can only be accessed via the abstract. This shows major problems with the use of the term IoT and its minor limitations.}, language = {en} } @inproceedings{FolgerHachaniFuxenetal., author = {Folger, Fabian and Hachani, Murad and Fuxen, Philipp and Graf, Julian and Fischer, Sebastian and Hackenberg, Rudolf}, title = {A Transformer-Based Framework for Anomaly Detection in Multivariate Time Series}, series = {CLOUD COMPUTING 2025, The Sixteenth International Conference on Cloud Computing, GRIDs, and Virtualization, April 06, 2025 to April 10, 2025, Valencia, Spain}, booktitle = {CLOUD COMPUTING 2025, The Sixteenth International Conference on Cloud Computing, GRIDs, and Virtualization, April 06, 2025 to April 10, 2025, Valencia, Spain}, publisher = {IARIA}, isbn = {978-1-68558-258-6}, issn = {2308-4294}, pages = {52 -- 57}, abstract = {This paper introduces a comprehensive Transformer-based architecture for anomaly detection in multivariate time series. Using self-attention, the framework efficiently processes high-dimensional sensor data without extensive feature engineering, enabling early detection of unusual patterns to prevent critical system failures. In a subsequent laboratory setup, the framework will be applied using fuzzing techniques to induce anomalies in an Electronic Control Unit, while monitoring side channels, such as temperature, voltage, and Controller Area Network messages. The overall structure of the architecture, as well as the necessary preprocessing steps, such as temporal aggregation and classification up to the optimization of the hyperparameters of the model, are presented. The evaluation of the model architecture with the postulated restrictions shows that the model handles anomaly scenarios in the dataset robustly. It is necessary to evaluate the extent to which the model can be used in practical applications in areas, such as cloud environments or the industrial Internet of Things. Overall, the results highlight the potential of Transformer models for the automated and reliable monitoring of complex time series data for deviations.}, language = {en} } @misc{Fischer, author = {Fischer, Sebastian}, title = {A Security-, Privacy-and Usability-Scoring System for IoT Devices}, language = {en} } @inproceedings{PellerZanklFischeretal., author = {Peller, Sebastian and Zankl, Tobias and Fischer, Christoph and Bierl, Rudolf}, title = {Fast sound field characterization of beamforming capable capacitive micromachined ultrasonic transducer (CMUT) arrays by refracto-vibrometry}, series = {IEEE IUS 2023, International Ultrasonics Symposium, Montr{\´e}al, September 3-8, 2023}, booktitle = {IEEE IUS 2023, International Ultrasonics Symposium, Montr{\´e}al, September 3-8, 2023}, publisher = {IEEE}, isbn = {979-8-3503-4645-9}, issn = {1948-5727}, doi = {10.1109/IUS51837.2023.10308126}, pages = {1 -- 3}, abstract = {We introduce a time-optimized setup based on refracto-vibrometry for the purpose of scanning the sound field of capacitive micromachined ultrasonic transducer (CMUT) arrays primarily for the qualification of their beamforming capability. In comparison to commonly used microphones on a traversing stage the proposed method is substantially faster and consumes only a few minutes of time for a complete two-dimensional sound field containing about 100.000 scan points.}, language = {en} } @inproceedings{GrafHachaniFischeretal., author = {Graf, Julian and Hachani, Murad and Fischer, Sebastian and Hackenberg, Rudolf}, title = {A heuristic packet processing model for improved encrypted network analysis}, series = {CSCS '25: Proceedings of the 2nd Cyber Security in CarS Workshop}, booktitle = {CSCS '25: Proceedings of the 2nd Cyber Security in CarS Workshop}, publisher = {ACM}, address = {New York, USA}, doi = {10.1145/3736130.3764510}, pages = {12}, abstract = {Modern networked systems, such as those in the automotive sector, face increasing complexity and growing attack surfaces due to the rise of interconnected and data-driven technologies. Detecting malicious behavior in these environments requires efficient and scalable methods that can operate reliably despite limited resources and high communication volumes. This paper proposes a heuristic packet processing model designed to support intrusion detection based on structural and temporal characteristics of encrypted network traffic. The model follows a modular architecture consisting of four key phases: recording, sorting, prioritizing, and analyzing. At the core of the approach is the Polymetric Queueing Topology Space, a feature space that combines statistical and time series attributes derived from model structure and flow data. These features serve as input for machine learning models, which can effectively distinguish between benign and intrusion traffic patterns without relying on packet data beyond the transport layer. The approach was evaluated using the publicly available ToN_IoT dataset and demonstrated that reliable classification is achievable using a subset of the developed feature space that contains model-derived traffic features. We used Random Forest for supervised binary and multi-class classification achieving high accuracy scores of 99\% for binary and 98\% for multi-class classification. Additionally, for unsupervised anomaly detection, we created an Isolation Forest model accomplishing F1-scores of 0.92 for the benign and 0.96 for intrusion class. The architecture is designed to enable dynamic traffic prioritization and to offer a flexible foundation that can observe diverse network domains while maintaining efficient performance under constrained computational conditions.}, language = {en} } @misc{HauserGrafFischer, author = {Hauser, Dominic and Graf, Julian and Fischer, Sebastian}, title = {SEPP - Security Education and Penetration-Testing Platform for IoT}, series = {Conference programme \& abstract book}, journal = {Conference programme \& abstract book}, publisher = {IAFOR}, issn = {2433-7544}, pages = {101}, abstract = {The Internet of Things (IoT) is becoming a major part of our everyday lives, offering convenience and smarter solutions, but also bringing significant security challenges. While theoretical knowledge in IoT security is essential, studies have shown that practical content can be an essential part of internalizing understanding. To address this, we developed the Security Education and Penetration-Testing Platform (SEPP) as the practical component of an existing IoT security course at the OTH Regensburg. SEPP uses real IoT devices like smart locks, cameras, and plugs, simulating a smart home environment to make learning interactive and engaging. Students can explore vulnerabilities, conduct penetration tests, and document their findings through structured exercises. By working on tasks like network scanning, analyzing data traffic, and simulating attacks, students gain a deeper understanding of IoT security risks. Initial tests show that this approach helps students apply their theoretical knowledge and significantly improve their practical skills. This paper explains how SEPP was built, the exercises it offers, and why it's an important step forward in teaching IoT security effectively. Furthermore, we aim to share the findings and tasks from this paper with other universities, providing them with a solid foundation to teach practical IoT security knowledge in their own courses.}, language = {en} } @misc{Fischer, author = {Fischer, Sebastian}, title = {The persistent problems with cybersecurity : a negative example and an outlook on the Cyber Resilience Act}, publisher = {IARIA}, pages = {44}, language = {en} } @article{NeubauerFischerHackenberg, author = {Neubauer, Katrin and Fischer, Sebastian and Hackenberg, Rudolf}, title = {Security risk analysis of the cloud infrastructure of Smart Grid and IoT - 4-Level-Trust-Model as a security solution}, series = {International Journal on Advances in Internet Technology}, volume = {13}, journal = {International Journal on Advances in Internet Technology}, number = {1\&2}, pages = {11 -- 20}, abstract = {The digital transformation has found its way into business and private life. It consists of digitization and digitaliza- tion. Digitization means the technical process and digitalization is the socio-technological process. Technologies of digitization are Cloud Computing (CC), Internet of Things (IoT) and Smart Grid (SG), which are separate technologies. The increasing digitalization in the private sector and of the energy industry connect these technologies. Actually, there is no connection between the CC infrastructure and the SG infrastructure at the moment, because in Germany the SG is currently under construction. If one looks at the CC and IoT, it must be stated there is an connection between the IoT infrastructure and the CC infrastructure as a service provider. To connect the technologies CC, IoT and SG and also build an SG cloud for innovative services, the new laws for privacy must be implemented. For privacy and security analyses it is important to know which data can be stored and distributed on a cloud. To illustrate this analysis, we connect the SG infrastructure with the IoT. An IoT device (car charging station) should be able to transfer data to and from the SG. SG is a critical infrastructure and the IoT device a potential insecure device and network. We show the communication between the smart meter switching box and the IoT device and the data transferred between their clouds. The charging station is connected to the SG to get the current amount of renewable energy in the grid. This is necessary to create a new smart service. But this service also generates private data (e.g., name, address, payment details). The private data should not be transferred to the IoT cloud. For the connection of SG and IoT, availability, confidentiality and integrity must be ensured. A risk analysis over all the cloud connections, including the vulnerability and the ability of an attacker, the resulting risk and the 4-Level- Trust-Model for security assessment are developed. Furthermore, we show the application of the 4-Level-Trust-Model in this paper.}, language = {en} }