TY - CHAP A1 - Graf, Julian A1 - Neubauer, Katrin A1 - Fischer, Sebastian A1 - Hackenberg, Rudolf T1 - Architecture of an intelligent Intrusion Detection System for Smart Home T2 - 2020 IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops): 2020, Austin, Texas, USA N2 - Increasing cyber-attacks on Internet of Things (IoT) environments are a growing problem of digitized households worldwide. The purpose of this study is to investigate how an intelligent Intrusion Detection System (iIDS) can provide more security in IoT networks with a novel architecture, combining multiple classical and machine learning approaches. By combining classical security analysis methods and modern concepts of artificial intelligence, we increase the quality of attack detection and can therefore conduct dedicated attack suppression. The architectural image of the iIDS consists of different layers, which in parts achieve self-sufficient results. The results of the different modules are calculated by means of statement variables and evaluation techniques adapted for the individual module elements and subsequently combined by limit value considerations. The architecture image combines approaches for the analysis and processing of IoT network traffic and evaluates it to an aggregated score. From this result it can be determined whether the analyzed data indicates device misuse or attempted break-ins into the network. This study answers the questions whether a connection between classical and modern concepts for monitoring and analyzing IoT network traffic can be implemented meaningfully within a reliable architecture of an iIDS. KW - Internet of Things KW - artificial intelligence KW - smart Home KW - Intrusion KW - Detection System Y1 - 2020 SN - 978-1-7281-4716-1 U6 - https://doi.org/10.1109/PerComWorkshops48775.2020.9156168 SP - 1 EP - 6 PB - IEEE ER - TY - CHAP A1 - Vogl, Peter A1 - Weber, Sergei A1 - Graf, Julian A1 - Neubauer, Katrin A1 - Hackenberg, Rudolf T1 - Design and Implementation of an Intelligent and Model-based Intrusion Detection System for Iot Networks T2 - Cloud Computing 2022: The Thirteenth International Conference on Cloud Computing, GRIDs, and Virtualization, Special Track FAST-CSP, Barcelona, Spain, 24.-28.04.2022 N2 - The ongoing digitization and digitalization entails the increasing risk of privacy breaches through cyber attacks. Internet of Things (IoT) environments often contain devices monitoring sensitive data such as vital signs, movement or surveil-lance data. Unfortunately, many of these devices provide limited security features. The purpose of this paper is to investigate how artificial intelligence and static analysis can be implemented in practice-oriented intelligent Intrusion Detection Systems to monitor IoT networks. In addition, the question of how static and dynamic methods can be developed and combined to improve net-work attack detection is discussed. The implementation concept is based on a layer-based architecture with a modular deployment of classical security analysis and modern artificial intelligent methods. To extract important features from the IoT network data a time-based approach has been developed. Combined with network metadata these features enhance the performance of the artificial intelligence driven anomaly detection and attack classification. The paper demonstrates that artificial intelligence and static analysis methods can be combined in an intelligent Intrusion Detection System to improve the security of IoT environments. KW - Intrusion Detection KW - Artificial Intelligence KW - Machine Learning KW - Network Security KW - Internet of Things Y1 - 2022 UR - https://www.thinkmind.org/index.php?view=article&articleid=cloud_computing_2022_1_20_28003 SN - 978-1-61208-948-5 SP - 7 EP - 12 PB - IARIA CY - [Wilmington, DE, USA] ER - TY - JOUR A1 - Fuxen, Philipp A1 - Schönhärl, Stefan A1 - Schmidt, Jonas A1 - Gerstner, Mathias A1 - Jahn, Sabrina A1 - Graf, Julian A1 - Hackenberg, Rudolf A1 - Mottok, Jürgen T1 - A Cybersecurity Education Platform for Automotive Penetration Testing JF - International Journal On Advances in Security N2 - The paper presents a penetration testing framework for automotive IT security education and evaluates its realization. The automotive sector is changing due to automated driving functions, connected vehicles, and electric vehicles. This development also creates new and more critical vulnerabilities. This paper addresses a possible countermeasure, automotive IT security education. Some existing solutions are evaluated and compared with the created Automotive Penetration Testing Education Platform (APTEP) framework. In addition, the APTEP architecture is described. It consists of three layers representing different attack points of a vehicle. The realization of the APTEP is a hardware case and a virtual platform referred to as the Automotive Network Security Case (ANSKo). The hardware case contains emulated control units and different communication protocols. The virtual platform uses Docker containers to provide a similar experience over the internet. Both offer two kinds of challenges. The first introduces users to a specific interface, while the second combines multiple interfaces, to a complex and realistic challenge. This concept is based on modern didactic theories, such as constructivism and problem-based/challenge-based learning. Computer Science students from the Ostbayerische Technische Hochschule (OTH) Regensburg experienced the challenges as part of a elective subject. In an online survey evaluated in this paper, they gave positive feedback. Also, a part of the evaluation is the mapping of the ANSKo and the maturity levels in the Software Assurance Maturity Model (SAMM) practice Education & Guidance as well as the SAMM practice Security Testing. The scientific contribution of this paper is to present an APTEP, a corresponding learning concept and an evaluation method. KW - Challenge-based Learning KW - Education Framework KW - Penetration Testing KW - Automotive KW - IT-Security Education Y1 - 2022 UR - http://www.iariajournals.org/security/sec_v15_n34_2022_paged.pdf SN - 1942-2636 VL - 15 IS - 3&4 SP - 106 EP - 118 PB - IARIA ER - TY - CHAP A1 - Folger, Fabian A1 - Hachani, Murad A1 - Fuxen, Philipp A1 - Graf, Julian A1 - Fischer, Sebastian A1 - Hackenberg, Rudolf T1 - A Transformer-Based Framework for Anomaly Detection in Multivariate Time Series T2 - CLOUD COMPUTING 2025, The Sixteenth International Conference on Cloud Computing, GRIDs, and Virtualization, April 06, 2025 to April 10, 2025, Valencia, Spain N2 - This paper introduces a comprehensive Transformer-based architecture for anomaly detection in multivariate time series. Using self-attention, the framework efficiently processes high-dimensional sensor data without extensive feature engineering, enabling early detection of unusual patterns to prevent critical system failures. In a subsequent laboratory setup, the framework will be applied using fuzzing techniques to induce anomalies in an Electronic Control Unit, while monitoring side channels, such as temperature, voltage, and Controller Area Network messages. The overall structure of the architecture, as well as the necessary preprocessing steps, such as temporal aggregation and classification up to the optimization of the hyperparameters of the model, are presented. The evaluation of the model architecture with the postulated restrictions shows that the model handles anomaly scenarios in the dataset robustly. It is necessary to evaluate the extent to which the model can be used in practical applications in areas, such as cloud environments or the industrial Internet of Things. Overall, the results highlight the potential of Transformer models for the automated and reliable monitoring of complex time series data for deviations. KW - Artificial Intelligence KW - Transformer KW - Time Series KW - Anomaly Detection KW - Temporal Aggregation KW - ECU Y1 - 2025 UR - https://www.thinkmind.org/library/CLOUD_COMPUTING/CLOUD_COMPUTING_2025/cloud_computing_2025_1_80_20078.html SN - 978-1-68558-258-6 SN - 2308-4294 SP - 52 EP - 57 PB - IARIA ER - TY - CHAP A1 - Hachani, Murad A1 - Stey, Miguel A1 - Fuxen, Philipp A1 - Graf, Julian A1 - Hackenberg, Rudolf T1 - GFDG: a genetic fuzzing method for the Controller Area Network Protocol T2 - Cloud Computing 2025 : The Sixteenth International Conference on Cloud Coud Computing, GRIDs, and Virtualization, 06.-10. April 2025, Valencia N2 - Ensuring the security of modern automotive systems is critical due to their increasing complexity and reliance on interconnected Electronic Control Units. The Controller Area Network still serves as a key communication protocol within these systems, making it a primary target for security testing. Traditional fuzz testing approaches for Controller Area Networks often rely on random or brute-force message generation, not leveraging the system’s feedback to improve the generation process. This paper introduces the Genetic Fuzz Data Generator, a fuzzing method that leverages Genetic Algorithms and side-channel analysis to enhance Controller Area Network security testing. The Genetic Fuzz Data Generator dynamically refines its fuzzing strategy by evaluating system responses through side-channel data, such as processing unit temperatures and power supply variations. By structuring Controller Area Network messages as genetic individuals and applying evolutionary principles—including selection, crossover, and mutation—the Genetic Fuzz Data Generator systematically identifies active Controller Area Network IDs and generates targeted fuzz messages. Experimental validation was conducted on a real automotive electronic control unit within a controlled laboratory setup. The first results demonstrated the approach’s effectiveness, revealing system anomalies, including a Denial of Service vulnerability that disrupted functions of the investigated Electronic Control Unit. The findings highlight the potential of feedback-driven fuzzing for improving the efficiency of black-box security testing in Controller Area Network-based systems. Future research could further optimize fitness functions or explore additional side-channel metrics. Y1 - 2025 UR - https://www.thinkmind.org/library/CLOUD_COMPUTING/CLOUD_COMPUTING_2025/cloud_computing_2025_1_60_28009.html SN - 978-1-68558-258-6 SN - 2308-4294 SP - 40 EP - 45 ER - TY - CHAP A1 - Graf, Julian A1 - Hachani, Murad A1 - Fischer, Sebastian A1 - Hackenberg, Rudolf T1 - A heuristic packet processing model for improved encrypted network analysis T2 - CSCS '25: Proceedings of the 2nd Cyber Security in CarS Workshop N2 - Modern networked systems, such as those in the automotive sector, face increasing complexity and growing attack surfaces due to the rise of interconnected and data-driven technologies. Detecting malicious behavior in these environments requires efficient and scalable methods that can operate reliably despite limited resources and high communication volumes. This paper proposes a heuristic packet processing model designed to support intrusion detection based on structural and temporal characteristics of encrypted network traffic. The model follows a modular architecture consisting of four key phases: recording, sorting, prioritizing, and analyzing. At the core of the approach is the Polymetric Queueing Topology Space, a feature space that combines statistical and time series attributes derived from model structure and flow data. These features serve as input for machine learning models, which can effectively distinguish between benign and intrusion traffic patterns without relying on packet data beyond the transport layer. The approach was evaluated using the publicly available ToN_IoT dataset and demonstrated that reliable classification is achievable using a subset of the developed feature space that contains model-derived traffic features. We used Random Forest for supervised binary and multi-class classification achieving high accuracy scores of 99% for binary and 98% for multi-class classification. Additionally, for unsupervised anomaly detection, we created an Isolation Forest model accomplishing F1-scores of 0.92 for the benign and 0.96 for intrusion class. The architecture is designed to enable dynamic traffic prioritization and to offer a flexible foundation that can observe diverse network domains while maintaining efficient performance under constrained computational conditions. Y1 - 2025 U6 - https://doi.org/10.1145/3736130.3764510 PB - ACM CY - New York, USA ER - TY - GEN A1 - Hauser, Dominic A1 - Graf, Julian A1 - Fischer, Sebastian T1 - SEPP – Security Education and Penetration-Testing Platform for IoT T2 - Conference programme & abstract book N2 - The Internet of Things (IoT) is becoming a major part of our everyday lives, offering convenience and smarter solutions, but also bringing significant security challenges. While theoretical knowledge in IoT security is essential, studies have shown that practical content can be an essential part of internalizing understanding. To address this, we developed the Security Education and Penetration-Testing Platform (SEPP) as the practical component of an existing IoT security course at the OTH Regensburg. SEPP uses real IoT devices like smart locks, cameras, and plugs, simulating a smart home environment to make learning interactive and engaging. Students can explore vulnerabilities, conduct penetration tests, and document their findings through structured exercises. By working on tasks like network scanning, analyzing data traffic, and simulating attacks, students gain a deeper understanding of IoT security risks. Initial tests show that this approach helps students apply their theoretical knowledge and significantly improve their practical skills. This paper explains how SEPP was built, the exercises it offers, and why it’s an important step forward in teaching IoT security effectively. Furthermore, we aim to share the findings and tasks from this paper with other universities, providing them with a solid foundation to teach practical IoT security knowledge in their own courses. Y1 - 2025 UR - https://iafor.org/archives/conference-programmes/ece/ece-programme-2025.pdf SN - 2433-7544 SP - 101 PB - IAFOR ER - TY - CHAP A1 - Schönhärl, Stefan A1 - Fuxen, Philipp A1 - Graf, Julian A1 - Schmidt, Jonas A1 - Hackenberg, Rudolf A1 - Mottok, Jürgen T1 - An Automotive Penetration Testing Framework for IT-Security Education T2 - Cloud Computing 2022: The Thirteenth International Conference on Cloud Computing, GRIDs, and Virtualization, Special Track FAST-CSP, Barcelona, Spain, 24.-28.04.2022 N2 - Automotive Original Equipment Manufacturer (OEM) and suppliers started shifting their focus towards the security of their connected electronic programmable products recently since cars used to be mainly mechanical products. However, this has changed due to the rising digitalization of vehicles. Security and functional safety have grown together and need to be addressed as a single issue, referred to as automotive security, in the following article. One way to accomplish security is automotive security education. The scientific contribution of this paper is to establish an Automotive Penetration Testing Education Platform (APTEP). It consists of three layers representing different attack points of a vehicle. The layers are the outer, inner, and core layers. Each of those contains multiple interfaces, such as Wireless Local Area Network (WLAN) or electric vehicle charging interfaces in the outer layer, message bus systems in the inner layer, and debug or diagnostic interfaces in the core layer. One implementation of APTEP is in a hardware case and as a virtual platform, referred to as the Automotive Network Security Case (ANSKo). The hardware case contains emulated control units and different communication protocols. The virtual platform uses Docker containers to provide a similar experience over the internet. Both offer two kinds of challenges. The first introduces users to a specific interface, while the second combines multiple interfaces, to a complex and realistic challenge. This concept is based on modern didactic theory, such as constructivism and problem-based learning. Computer Science students from the Ostbayerische Technische Hochschule (OTH)Regensburg experienced the challenges as part of a special topic course and provided positive feedback. KW - IT-Security KW - Education KW - Automotive KW - Penetration testing KW - Education framework Y1 - 2022 UR - https://www.thinkmind.org/index.php?view=article&articleid=cloud_computing_2022_1_10_28001 SN - 978-1-61208-948-5 SP - 1 EP - 6 PB - IARIA CY - [Wilmington, DE, USA] ER -