@inproceedings{ceur-ws3329barbeau,

title = {Resilience via Blackbox Self-Piloting Plants},

author = {Michel Barbeau and Joaquin Garcia-Alfaro and Christian L\"{u}bben and Marc-Oliver Pahl and Lars W\"{u}strich},

editor = {Gurvan Guernic},

url = {https://ceur-ws.org/Vol-3329/paper-02.pdf},

year  = {2023},

date = {2023-01-01},

booktitle = {Proceedings of the 29th Computer \& Electronics Security Application Rendezvous co-located with the 7th European Cyber Week (ECW 2022), Rennes, France, November 15-16, 2022.},

volume = {3329},

pages = {35--46},

publisher = {CEUR-WS.org},

series = {CEUR Workshop Proceedings},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{lavaur:hal-03831515,

title = {Federated Learning as enabler for Collaborative Security between not Fully-Trusting Distributed Parties},

author = {L\'{e}o Lavaur and Benjamin Cost\'{e} and Marc-Oliver Pahl and Yann Busnel and Fabien Autrel},

url = {https://imt-atlantique.hal.science/hal-03831515},

year  = {2022},

date = {2022-11-01},

booktitle = {C\&ESAR 2022 - 29th Computer \& Electronics Security Application Rendezvous},

pages = {1-16},

address = {Rennes, France},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{chaitou2022secrypt,

title = {Threats to adversarial training for IDSs and mitigation},

author = {Hassan Chaitou and Thomas Robert and Jean Leneutre and Laurent Pautet},

issn = {2184-7711},

year  = {2022},

date = {2022-07-01},

booktitle = {Proceedings of the 19th International Conference on Security and Cryptography (Secrypt 2022), Lisbon, Portugal},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{meraneh2022secrypt,

title = {Blind Side Channel On The Elephant LFSR},

author = {Awaleh Houssein-Meraneh and Christophe Clavier and H\'{e}l\`{e}ne Le-Bouder and Julien Maillard and Ga\"{e}lle Thomas},

issn = {2184-7711},

year  = {2022},

date = {2022-07-01},

urldate = {2022-07-01},

booktitle = {Proceedings of the 19th International Conference on Security and Cryptography (Secrypt 2022), Lisbon, Portugal},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{segovia2022secrypt,

title = {Switched-based Control Testbed to Assure Cyber-physical Resilience by Design},

author = {Mariana Segovia and Jose Rubio-Hernan and Ana Cavalli and Joaquin Garcia-Alfaro},

issn = {2184-7711},

year  = {2022},

date = {2022-07-01},

booktitle = {Proceedings of the 19th International Conference on Security and Cryptography (Secrypt 2022), Lisbon, Portugal},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{221053,

title = {Autonomous convergence mechanisms for collaborative crowd-sourced data-modeling},

author = {Christian L\"{u}bben and Marc-Oliver Pahl},

url = {http://XXXXX/221053.pdf},

year  = {2022},

date = {2022-04-01},

booktitle = {NOMS 2022 - Full and short papers ()},

abstract = {Interoperability remains a central challenge of the Internet of Things (IoT). Standardized data representation can solve this problem. Data model convergence prevents redundancy and fosters reuse. The growth of the IoT demands a high number of data models. Collaborative approaches allow the creation of numerous data models. The question to investigate is: Can assisted distributed model creation improve model convergence? This paper presents an approach to unify IoT data models during creation. It analyzes existing models to find similarities to a new model candidate. Similar models shall be reused or extended to prevent information redundancy. Challenges are the accuracy of the similarity analysis and scalability. The evaluation shows linear scalability and high accuracy using a data set containing 1200 automatically converted data models from today's most relevant IoT data modeling initiatives: Project Haystack, IoTSchema, and BrickSchema.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{220803,

title = {Optimal Access Control Deployment in Network Function Virtualization},

author = {Manel Smine and David Espes and Marc-Oliver Pahl},

url = {http://XXXXX/220803.pdf},

year  = {2022},

date = {2022-04-01},

booktitle = {NOMS 2022 - Full and short papers ()},

abstract = {Network function virtualization (NFV) yields numerous advantages, specifically the ability to provide a cost-efficient alternative to hardware-based functionalities on software platforms to break the vendor lock-in problem. However, these advantages come at the cost of several security issues. These threats can be leveraged by controlling the information that flows between the different components that compose NFV services. We propose an approach allowing an optimal deployment of access control policies on NFV services. The proposed approach allows to find the best possible trade-offs between the impact in terms of latency resulting from the deployment of the access control policy and the used resources. In contrast to existing approaches, our solution prevents an insider adversary who compromises one or more unknown VNF(s) to go around the access control policy. We experimentally evaluate the return solutions according to the size of the NFV service, the size of the policy to be deployed and the number of physical servers that host the VNF service.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{222206,

title = {Continuous Microservice Re-Placement in the IoT},

author = {Christian L\"{u}bben and Simon Sch\"{a}ffner and Marc-Oliver Pahl},

url = {http://XXXXX/222206.pdf},

year  = {2022},

date = {2022-04-01},

booktitle = {NOMS 2022 Workshops - Manage-IoT 2022 ()},

abstract = {The Internet of Things (IoT) consists of constraint devices. There is a continuous increase in processing power and a recent trend towards microservice architectures. Both make it possible to place IoT microservices on the distributed edge nodes of an IoT site. The identification of a suitable placement of services creates an open challenge. The IoT sets special demands due to its heterogeneous, and often constraint resources. This paper presents a service placement strategy that is adapted to the IoT. It assesses the differences between the IoT and previous service placement problem domains. The results show that the presented service placement strategy outperforms existing ones from other domains. This particularly holds for the optimization of the overall system performance.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{222179,

title = {Resource tradeoffs for TLS-secured MQTT-based IoT Management},

author = {Valentin Dimov and Erkin Kirdan and Marc-Oliver Pahl},

url = {http://XXXXX/222179.pdf},

year  = {2022},

date = {2022-04-01},

booktitle = {NOMS 2022 Workshops - Manage-IoT 2022 ()},

abstract = {Transport Layer Security (TLS) is an established Internet security standard. TLS offers a variety of configuration options that affect resource consumption. For deployments of constrained devices in the Internet of Things (IoT), it is crucial to optimize TLSs resource consumption. This study examines how the TLS cryptographic algorithms, so-called cipher suites, affect an MQTT applications resource consumption. MQTT is a popular protocol for IoT. We construct a model application using the Mosquitto MQTT broker and client library. We measure the consumption of CPU cycles, memory, and network bandwidth with the IANA-recommended TLS 1.2 and TLS 1.3 cipher suites. We test and compare different variants for the key exchange, server authentication, client authentication, and symmetric encryption algorithms, as well as recommended elliptic curves for elliptic curve cryptography (ECC) algorithms. We identify ECDHE key exchange with the x25519 curve and mutual PSK authentication as the best handshake performance. Ed25519 provides the best performance among the certificate authentication options. The effect of choosing a faster symmetric cipher on CPU costs depends on message size. Changing symmetric ciphers does not affect the performance for 100 B messages, but more differences are observed for 10 kB messages. Overall, the findings show that resource consumption can be optimized by choosing the cipher suite and adjusting the length and rate of MQTT messages. Optimized resource consumption enables reliable management of MQTT-based IoT.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{Lavaur2021.gtsslr,

title = {Federated Security Approaches for IT and OT},

author = {Leo Lavaur and Marc-Oliver Pahl and Yann Busnel and Fabien Autrel},

year  = {2021},

date = {2021-05-11},

urldate = {2021-05-11},

pages = {2},

abstract = {The Internet of Things has begun to spread over a variety of domains, including industry and finance. It represents an increasing threat for both IT and OT. The lack of collaboration results in the same attacks targeting different organizations one after the other. Often employed as an answer to this problem, cyber threat-intelligence sharing induces its own set of challenges: trust, privacy, and traceability.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{213227,

title = {Cyber-Physical Anomaly Detection for ICS},

author = {Lars Wuestrich and Lukas Schr\"{o}der and Marc-Oliver Pahl},

url = {http://xxxxx/213227.pdf},

year  = {2021},

date = {2021-05-01},

booktitle = {IFIP/IEEE International Symposium on Integrated Network Management co-located with IM},

abstract = {Industrial Control Systems (ICS) are complex systems made up of many components with different tasks. For a safe and secure operation, each device needs to carry out its tasks correctly. To monitor a system and ensure the correct behavior of systems anomaly detection systems are used. Models of expected behavior often rely only on cyber or physical features for anomaly detection. We propose an anomaly detection system that combines both types of features to create a dynamic fingerprint of an ICS. We present how such a system can be designed and which challenges need to be overcome for a successful implementation.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{dernaika2021posteriori,

title = {A Posteriori Analysis of Policy Temporal Compliance},

author = {Farah Dernaika and Nora Cuppens-Boulahia and Fr\'{e}d\'{e}ric Cuppens and Olivier Raynaud},

year  = {2021},

date = {2021-01-01},

booktitle = {Risks and Security of Internet and Systems: 15th International Conference, CRiSIS 2020, Paris, France, November 4--6, 2020, Revised Selected Papers 15},

pages = {133--148},

organization = {Springer International Publishing},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{9565553,

title = {Detecting and Preventing Faked Mixed Reality},

author = {Fabian Kilger and Alexandre Kabil and Volker Tippmann and Gudrun Klinker and Marc-Oliver Pahl},

doi = {10.1109/MIPR51284.2021.00074},

year  = {2021},

date = {2021-01-01},

booktitle = {2021 IEEE 4th International Conference on Multimedia Information Processing and Retrieval (MIPR)},

pages = {399-405},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{bender2021open,

title = {Open-Source MQTT Evaluation},

author = {Melvin Bender and Erkin Kirdan and Marc-Oliver Pahl and Georg Carle},

year  = {2021},

date = {2021-01-01},

booktitle = {2021 IEEE 18th Annual Consumer Communications \& Networking Conference (CCNC)},

pages = {1--4},

organization = {IEEE},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{pahl2021priority,

title = {A Priority-Based Domain Type Enforcement for Exception Management},

author = {Manel Smine and David Espes and Nora Cuppens-Boulahia and Fr\'{e}d\'{e}ric Cuppens and Marc-Oliver Pahl},

year  = {2021},

date = {2021-01-01},

booktitle = {Foundations and Practice of Security: 13th International Symposium, FPS 2020, Montreal, QC, Canada, December 1--3, 2020, Revised Selected Papers},

volume = {12637},

pages = {65},

organization = {Springer Nature},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{pahl2021pipeline,

title = {Pipeline for Crowdsourced IoT Data-Modeling with AI-Supported Convergence},

author = {Marc-Oliver Pahl and Florian Bauer and Christian L\"{u}ubben},

year  = {2021},

date = {2021-01-01},

booktitle = {2021 IFIP/IEEE International Symposium on Integrated Network Management (IM)},

pages = {702--706},

organization = {IEEE},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{barbeau2021metrics,

title = {Metrics to enhance the resilience of cyber-physical systems},

author = {Michel Barbeau and Fr\'{e}d\'{e}ric Cuppens and Nora Cuppens and Romain Dagnas and Joaquin Garcia-Alfaro},

url = {https://doi.org/10.1109/TrustCom50675.2020.00156},

doi = {10.1109/TrustCom50675.2020.00156},

year  = {2021},

date = {2021-01-01},

booktitle = {2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)},

pages = {1167--1172},

organization = {IEEE},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{Bourget2020b,

title = {PROS2E, a Probabilistic Representation of Safety and Security Events for Diagnosis},

author = {Edwin Bourget and Fr\'{e}d\'{e}ric Cuppens and Nora Cuppens-Boulahia},

url = {https://dl.acm.org/doi/10.1145/3384941.3409590},

doi = {10.1145/3384941.3409590},

isbn = {9781450376082},

year  = {2020},

date = {2020-10-01},

booktitle = {Proceedings of the 6th ACM on Cyber-Physical System Security Workshop},

pages = {30--41},

publisher = {ACM},

address = {New York, NY, USA},

abstract = {The recent and increasing interconnection of industrial systems with information technologies creates a new paradigm in which new challenges arise. Being able to provide an explanation when accidents and attacks strike the system is one of them. This article presents an event model designed to provide useful and relevant information for diagnosis of safety and security events. We provide a means for system experts to model elementary events that are automatically recombined in complex and complete scenarios. We specifically focus on the ability to represent countermeasures and sequences of events, recurrent problems in the literature. We also introduce a means to precisely measure the wear of components, an important feature for the model to obtain accurate values. We showcase the use of our model for diagnosis purposes on a cyber-physical system testbed.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{segovia2019cybericps,

title = {Reflective Attenuation of Cyber-Physical Attacks},

author = {Mariana Segovia and Ana Cavalli and Nora Cuppens and Jose Rubio-Hernan and Joaquin Garcia-Alfaro},

url = {https://doi.org/10.1007/978-3-030-42048-2_2},

doi = {10.1007/978-3-030-42048-2_2},

year  = {2020},

date = {2020-02-01},

booktitle = {5th Workshop on the Security of Industrial Control Systems \& of Cyber-Physical Systems (CyberICPS 2019), 24th European Symposium on Research in Computer Security (ESORICS 2019), vol 11980},

pages = {19--34},

publisher = {Springer},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{pahl2020ilab,

title = {iLab@ Home: Hands-On Networking Classes without Lab Access},

author = {Marc-Oliver Pahl},

year  = {2020},

date = {2020-01-01},

booktitle = {Sigcomm 2020 Education},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{dernaika2020accountability,

title = {Accountability in the A Posteriori Access Control: A Requirement and a Mechanism},

author = {Farah Dernaika and Nora Cuppens-Boulahia and Fr\'{e}d\'{e}ric Cuppens and Olivier Raynaud},

year  = {2020},

date = {2020-01-01},

booktitle = {International Conference on the Quality of Information and Communications Technology},

pages = {332--342},

organization = {Springer},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{piccoli2020ensuring,

title = {Ensuring Consistency for Asynchronous Group-Key Management in the Industrial IoT},

author = {Alessandro Piccoli and Marc-Oliver Pahl and Steffen Fries and Tolga Sel},

year  = {2020},

date = {2020-01-01},

booktitle = {International Conference on Network and Service Management (CNSM 2020)(CNSM 2020), Izmir, Turkey},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{sharma2020anonymous,

title = {Anonymous Proof-of-Asset Transactions Using Designated Blind Signatures},

author = {Neetu Sharma and Rajeev Anand Sahu and Vishal Saraswat and Joaquin Garcia-Alfaro},

url = {https://doi.org/10.1007/978-3-030-70881-8_9},

doi = {10.1007/978-3-030-70881-8_9},

year  = {2020},

date = {2020-01-01},

booktitle = {Foundations and Practice of Security - 13th International Symposium, 

 FPS 2020, Montreal, QC, Canada, December 1-3, 2020, Revised Selected 

 Papers},

volume = {12637},

pages = {137--146},

publisher = {Springer},

series = {Lecture Notes in Computer Science},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{Piccoli2020,

title = {Group Key Management in constrained IoT Settings},

author = {A Piccoli and M-O Pahl and L W\"{u}strich},

doi = {10.1109/ISCC50000.2020.9219619},

issn = {15301346},

year  = {2020},

date = {2020-01-01},

booktitle = {Proceedings - IEEE Symposium on Computers and Communications},

volume = {2020-July},

abstract = {textcopyright 2020 IEEE. The Internet of Things (IoT) enables software to orchestrate physical spaces. Due to the increased impact, IoT communication in factories, households, or critical infrastructures has to be highly secured. Besides point-to-point communication, group communication is frequently used in the IoT. Securing it typically requires the exchange of cryptographic keys. Several protocols have been proposed for such Group Key Management (GKM). They vary in their targeted settings, in their Key Distribution Model, Architecture Model, Reliability Properties, and Protocol Overhead. This paper surveys existing GKM mechanisms, analyzes their suitability for constrained IoT settings, and identifies open issues that require further research.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{segovia2020nca,

title = {Cyber-Resilience Evaluation of Cyber-Physical Systems},

author = {Mariana Segovia and Jose Rubio-Hernan and Ana R Cavalli and Joaquin Garcia-Alfaro},

url = {https://doi.org/10.1109/NCA51143.2020.9306741},

doi = {10.1109/NCA51143.2020.9306741},

year  = {2020},

date = {2020-01-01},

booktitle = {2020 IEEE 19th International Symposium on Network Computing and Applications (NCA)},

pages = {1--8},

organization = {IEEE},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{barbeau2020geocaching,

title = {Geocaching-Inspired Navigation for Micro Aerial Vehicles with Fallible Place Recognition},

author = {Michel Barbeau and Joaquin Garcia-Alfaro and Evangelos Kranakis},

url = {https://doi.org/10.1007/978-3-030-61746-2_5},

doi = {10.1007/978-3-030-61746-2_5},

year  = {2020},

date = {2020-01-01},

booktitle = {International Conference on Ad-Hoc Networks and Wireless},

pages = {55--70},

organization = {Springer},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}

@inproceedings{Kabil2020b,

title = {Alert characterization by non-expert users in a cybersecurity virtual environment: A usability study},

author = {Alexandre Kabil and Thierry Duval and Nora Cuppens},

doi = {10.1007/978-3-030-58465-8_6},

issn = {16113349},

year  = {2020},

date = {2020-01-01},

booktitle = {Lecture Notes in Computer Science},

volume = {12242 LNCS},

pages = {82--101},

abstract = {Although cybersecurity is a domain where data analysis and training are considered of the highest importance, few virtual environments for cybersecurity are specifically developed, while they are used efficiently in other domains to tackle these issues. By taking into account cyber analysts' practices and tasks, we have proposed the 3D Cyber Common Operational Picture model (3D CyberCOP), that aims at mediating analysts' activities into a Collaborative Virtual Environment (CVE), in which users can perform alert analysis scenarios. In this article, we present a usability study we have performed with non-expert users. We have proposed three virtual environments (a graph-based, an office-based, and the coupling of the two previous ones) in which users should perform a simplified alert analysis scenario based on the WannaCry ransomware. In these environments, users must switch between three views (alert, cyber and physical ones) which all contain different kinds of data sources. These data have to be used to perform the investigations and to determine if alerts are due to malicious activities or if they are caused by false positives. We have had 30 users, with no prior knowledge in cybersecurity. They have performed very well at the cybersecurity task and they have managed to interact and navigate easily. SUS usability scores were above 70 for the three environments and users have shown a preference towards the coupled environment, which was considered more practical and useful.},

keywords = {},

pubstate = {published},

tppubtype = {inproceedings}

}