STAM

The 4th International Workshop on Safety and Security Testing and Monitoring

Jul 30, 2024
SR04
13:00 — 18:30

Workshop Chairs

→ Ana Rosa Cavalli
→ Valentina Casola
→ Erkuden Rios
→ Wissam Mallouli
→ Edgardo Montes de Oca

Accepted Paper

A Multi-layer Approach through Threat Modelling and Attack Simulation for Enhanced Cyber Security Assessment

Eider Iturbe (TECNALIA Research Innovation, Basque Research and Technology Alliance (BRTA), Spain), Javier Arcas (TECNALIA Research Innovation, Basque Research and Technology Alliance (BRTA), Spain), Erkuden Rios (TECNALIA Research Innovation, Basque Research and Technology Alliance (BRTA), Spain)

Full Paper

There is a growing concern about the dynamic landscape of cyber security threats escalating, and the need for improvement in defence capabilities against emerging sophisticated incidents. In response, this paper presents a solution called the Cyber Incident Simulation System, which enables system security engineers to simulate cyber-physical attacks and incidents without the requirement to affect or disrupt the ongoing business operation of the system. Leveraging graph-based threat modelling and AI-generated incident data, the system empowers professionals to predict the effect of the incident within the system under study. The synthetic data is used by anomaly-based Intrusion Detection Systems (IDSs) and other additional security controls to improve their detection algorithms to enhance their accuracy and effectiveness. The Cyber Incident Simulation System is designed to enhance the cyber security measures through the simulation of various incident scenarios.

Workshop STAM Workshop STAM

Automated Passport Control: Mining and Checking Models of Machine Readable Travel Documents

Stefan Marksteiner (AVL List Gmbh, Austria / Mälardalen University, Sweden), Marjan Sirjani (Mälardalen University, Sweden), Mikael Sjödin (Mälardalen University, Sweden)

Full Paper

Passports are part of critical infrastructure for a very long time. They also have been pieces of automatically processable information devices, more recently through the ISO/IEC 14443 (Near-Field Communication - NFC) protocol. For obvious reasons, it is crucial that the information stored on devices are sufficiently protected. The International Civil Aviation Organization (ICAO) specifies exactly what information should be stored on electronic passports (also Machine Readable Travel Documents - MRTDs) and how and under which conditions they can be accessed. We propose a model-based approach for checking the conformance with this specification in an automated and very comprehensive manner: we use automata learning to learn a full model of passport documents and use equivalence checking techniques (trace equivalence and bisimlarity) to check the conformance with an automaton modeled after the ICAO standard. The result is an automated (non-interactive), yet very thorough test for compliance. This approach can also be used with other applications for which a specification automaton can be modeled and is therfore broadly applicable.

Workshop STAM Workshop STAM

A Framework for In-network Inference using P4

Huu Nghia Nguyen (Montimage, France), Manh-Dung Nguyen (Montimage, France), Edgardo Montes de Oca (Montimage, France)

Full Paper

Machine learning (ML) has been widely used in network security monitoring. Although, its application to highly data intensive use cases and those requiring ultra-low latency remains challenging. It is caused by the large amounts of network data and the need of transferring data to a central location hosting analyses services.

In this paper, we present a framework to perform in-network analysis by offloading ML inference tasks from end servers to P4-capable programmable network devices. This helps reducing transfer latency and, thus, allows faster attack detection and mitigation. It also improves privacy since the data is processed at the networking devices.

The paper also presents an experimental use-case of the framework to classify network traffic, and to early detect and rapidly mitigate against IoT malicious traffic.

Workshop STAM Workshop STAM

AI-Powered Penetration Testing using Shennina: From Simulation to Validation

Stylianos Karagiannis (Ionian University - Department of Informatics, PDM, Greece), Camilla Fusco (University of Naples Federico II, Italy), Leonidas Agathos (PDM, Portugal), Wissam Mallouli (Montimage, France), Valentina Casola (University of Naples Federico II, Italy), Christoforos Ntantogian (Ionian University - Department of Informatics, Greece), Emmanouil Magkos (Department of Informatics, Ionian University, Corfu, Greece, Greece)

Full Paper

Artificial intelligence has been greatly improved nowadays, providing innovative approaches in cybersecurity both on offensive and defensive tactics. AI can be specifically utilized to automate and conduct penetration testing, a task that is usually time-intensive, involves high-costs, and requires cybersecurity professionals of high expertise. This research paper utilizes an AI penetration testing framework to validate and identify the impact and potential benefits of using AI on that perspective. More specifically, the research involves a validation process and tests the approach in a realistic environment to collect information and collect the relevant datasets. The research analyzes the behavior of the AI penetration testing framework in order to adapt and upgrade further. Finally, the research provides as a result the importance of using such frameworks or approaches to generate datasets and a methodology to retrieve the deep details of the attack simulation.

Workshop STAM Workshop STAM

A comprehensive evaluation of interrupt measurement techniques for predictability in safety-critical systems

Daniele Lombardi (University of Naples Federico II Department of Electrical Engineering and Information Technologies, Italy), Mario Barbareschi (University of Naples Federico II Department of Electrical Engineering and Information Technologies, Italy), Salvatore Barone (Università degli Studi di Napoli - Federico II Department of Electrical Engineering and Information Technologies, Italy), Valentina Casola (University of Naples Federico II Department of Electrical Engineering and Information Technologies, Italy)

Full Paper

In the last few decades, the increasing adoption of computer systems for monitoring and control applications has fostered growing attention to real-time behavior, i.e., the property that ensures predictable reaction times to external events. In this perspective, performance of the interrupt management mechanisms are among the most relevant aspects to be considered. Therefore, the service-latency of interrupts is one of the metrics considered while assessing the predictability of such systems. To this purpose, there are different techniques to estimate it, including the use of on-board timers, oscilloscopes and logic analyzers, or even real-time tracers. Each of these techniques, however, is affected by some degrees of inaccuracy, and choosing one over the other have pros and cons. In this paper, we review methodologies for measuring interrupt-latency from the scientific literature and, for the first time, we define an analytical model that we exploit to figure out measurement errors committed. Finally, we prove the effectiveness of the model relying on measurements taken from Xilinx MPSoC devices and present a case study whose purpose is to validate the proposed model.

Workshop STAM Workshop STAM

AI4SOAR: A Security Intelligence Tool for Automated Incident Response

Manh-Dung Nguyen (Montimage EURL, France), Wissam Mallouli (Montimage EURL, France), Ana Rosa Cavalli (Montimage EURL, France), Edgardo Montes de Oca (Montimage EURL, France)

Full Paper

The cybersecurity landscape is fraught with challenges stemming from the increasing volume and complexity of security alerts. Traditional manual or semi-automated approaches to threat analysis and incident response often result in significant delays in identifying and mitigating security threats. In this paper, we address these challenges by proposing AI4SOAR, a security intelligence tool for automated incident response. AI4SOAR leverages similarity learning techniques and integrates seamlessly with the open-source SOAR platform Shuffle. We conduct a comprehensive survey of existing open-source SOAR platforms, highlighting their strengths and weaknesses. Additionally, we present a similarity-based learning approach to quickly identify suitable playbooks for incoming alerts. We implement AI4SOAR and demonstrate its application through a use case for automated incident response against SSH brute-force attacks.

Workshop STAM Workshop STAM

Transfer Adversarial Attacks through Approximate Computing

Valentina Casola (University of Naples Federico II, Italy), Salvatore Della Torca (Università degli Studi di Napoli Federico II, Italy)

Full Paper

Convolutional Neural Networks (CNNs), have demonstrated remarkable performance across a range of domains, including computer vision and healthcare. However, they encounter challenges related to the increasing demands for resources and their susceptibility to adversarial attacks. Despite the significance of these challenges, they are often addressed independently in the scientific literature, which has led to conflicting findings.

In addressing the issue of resource demands, approaches have been developed which leverage the inherent error resilience of DNNs. The Approximate Computing (AxC) design paradigm reduces the resource requirements of DNNs by introducing controlled errors. With regard to the security domain, the objective is to develop precise adversarial attacks.

This paper introduces a novel technique for transferring adversarial attacks from CNN approximated through the AxC design paradigm (AxNNs), and other CNNs, regardless of their architecture and implementations. AxNNs are created by replacing components that require significant resources with approximate ones. Subsequently, adversarial attacks are generated targeting AxNNs and transferred to new CNNs.

The experimental results indicate that it is possible to transfer adversarial samples from an AxNN to target CNNs, especially whne the source AxNN has either a high accuracy, or an architecture that is deeper than the ones of the target CNNs.

Workshop STAM Workshop STAM

NERO: Advanced Cybersecurity Awareness Ecosystem for SMEs

Charalambos Klitis (eBOS Technologies Ltd, Cyprus), Ioannis Makris (METAMIND INNOVATIONS IKE, Greece), Pavlos Bouzinis (METAMIND INNOVATIONS IKE, Greece), Dimitrios Christos Asimopoulos (METAMIND INNOVATIONS IKE, Greece), Wissam Mallouli (MONTIMAGE EURL, France), Kitty Kioskli (TRUSTILIO BV, Netherlands), Eleni Seralidou (TRUSTILIO BV, Netherlands), Christos Douligeris (UNIVERSITY OF PIRAEUS RESEARCH CENTER, Greece), Loizos Christofi (eBOS Technologies Ltd, Cyprus)

Full Paper

NERO represents a sophisticated Cybersecurity Ecosystem comprising five interconnected frameworks designed to deliver a Cybersecurity Awareness initiative, as advocated by ENISA as the optima
method for cultivating a security-centric mindset among employees to mitigate the impact of cyber threats. It integrates activities, resources, and training to nurture a culture of cybersecurity. NERO primarily equips SMEs with a repository of Cyber Immunity Toolkits, a Cyber Resilience Program, and Gamified Cyber Awareness Training, all accessible through a user-friendly Marketplace. The efficacy and performance of this concept will be affirmed through three distinct use case demonstrations across various sectors: Improving Patient Data Security in Healthcare with Cybersecurity Tools, Enhancing Supply Chain Resilience in the Transportation and Logistics Industry through Cybersecurity Awareness, and Elevating Financial Security via Enhanced Cybersecurity Awareness and Tools.

Workshop STAM Workshop STAM

The PRECINCT Ecosystem Platform for Critical Infrastructure Protection: Architecture, Deployment and Transferability

Djibrilla Amadou Kountche (AKKODIS Reaserach, France), Jocelyn Aubert (Luxembourg Institute of Science and Technology, Luxembourg), Manh Dung Nguyen (Montimage, France), Natalia Kalfa (ATTD, Greece), Nicola Durante (ENGINEERING, Italy), Cristiano Passerini (LEPIDA, Italy), Stephane Kuding (KONNECTA, Greece)

Full Paper

Critical infrastructures (CIs) are equipped with sensors and actuators which communicate using open (for e.g., MQTT, AMQP, CoAP, Modbus, DNP3) or commercially licensed protocols (LoRA, IEC 6870-5-101, Profibus) to share data and commands. The management of these systems are also built on Information Communication Technologies (ICT) which are considered as Critical Information Infrastructure (CII). As identified by a recent European Union Agency for Cybersecurity (ENISA) study, the software used in CIs are subjected to supply chain compromise of software dependencies, human error (misconfigurations), ransomware attack, Artificial Intelligence abuse, the usage of legacy systems inside cyber-physical systems within CIs. This paper presents an approach to re-use ICT tools for Critical Infrastructures Protection (CIP) exploiting Topology and Orchestration Specification for Cloud Applications (TOSCA), reference architectures and ICT automation tools as well as to describe, deploy and orchestrate them. Therefore, our proposed approach will help in the re-usability of the outcomes of CIP research projects and the transferability of knowledge gained during these projects and help researchers to identify human errors, ease system updates, recovery and identify conceptual errors in the CI software architectures

Workshop STAM Workshop STAM

Automating Side-Channel Testing for Embedded Systems: A Continuous Integration Approach

Philipp Schloyer (Technical University of Applied Sciences Augsburg, Germany), Peter Knauer (Technical University of Applied Sciences Augsburg, Germany), Bernhard Bauer (Uni Augsburg, Germany), Dominik Merli (Technical University of Applied Sciences Augsburg, Germany)

Full Paper

Software testing is vital for strengthening the security of embedded systems by identifying and rectifying code errors, flaws and vulnerabilities. This is particularly significant when addressing vulnerabilities associated with side-channel attacks, given that they introduce a distinctive class of vulnerabilities, primarily subject to manual testing procedures. Manual testing remains prevalent despite advances in automation, posing challenges, particularly for complex environments. This research aims to automate embedded software testing on hardware in a modular and scalable manner, addressing the limitations of manual testing. We present a system designed to automate testing, including Side-Channel Analysis (SCA), in Continuous Integration (CI) environments, emphasizing accessibility and collaboration through open-source tools. Our evaluation setup based on GitLab, Jenkins and the ChipWhisperer framework shows that automating and integrating SCA in CI environments is possible in an efficient way.

Workshop STAM Workshop STAM

A Framework Towards Assessing the Resilience of Urban Transport Systems

Gérald Rocher (Université Côte d'Azur (UniCA), Centre National de la Recherche Scientifique (CNRS, I3S), France), Jean-Yves Tigli (Université Côte d'Azur (UniCA), Centre National de la Recherche Scientifique (CNRS, I3S), France), Stéphane Lavirotte (Université Côte d'Azur (UniCA), Centre National de la Recherche Scientifique (CNRS, I3S), France), Nicolas Ferry (Université Côte d'Azur (UCA), Institut national de recherche en sciences et technologies du numérique (INRIA, Kairos), France)

Full Paper

As critical cyber-physical systems, urban transport systems are vul- nerable to natural disasters and deliberate attacks. Ensuring their resilience is crucial for sustainable operations and includes the abil- ity to withstand, absorb and recover efficiently from disruptions. Assessing the resilience of such systems requires a comprehensive set of performance indicators covering social, economic, organi- sational, environmental and technical concerns. In addition, the interdependence of the different modes of transport and the result- ing human activities requires the inclusion of the spatial dimension to capture potential cascading failures. Furthermore, the integration of both aleatory (data) and epistemic (modelling) uncertainties is essential for robust performance indicators.

Current methods for assessing the resilience of transport systems lack standardised performance indicator systems and assessment methods, making comparative analysis and benchmarking of dis- ruption management strategies difficult. This paper proposes a unified framework for modelling and assessing performance indica- tors for urban transport systems. The framework is demonstrated using a simulated scenario in Eclipse SUMO and paves the way for future research in this area.

Workshop STAM Workshop STAM

Detail STAM 02/05

The 4th International Workshop on Safety and Security Testing and Monitoring to be held in the conjunction with the ARES Workshops EU Projects Symposium 2024 at the 19th International Conference on Availability, Reliability and Security

Distributed computer networked systems and services have become a crucial infrastructure element for the organization of modern society. These networks and services are required to be more and more open and new technology is designed to facilitate the interoperation between these networks composed of heterogeneous, communicating devices. Guaranteeing that they interoperate in a secure way has become a major concern for individuals, enterprises and governments.

Since the environment may be potentially hostile and contain malicious components, it is crucial to define frameworks adapted to distributed systems to enforce security and privacy. By distributed systems, we mean all systems that are composed of more than one communicating device such as telecommunication networks, cloud/Edge computer environment, industrial systems, smart communities, internet of things, distributed operating systems and middleware etc.

The STAM workshop tries to answer how miss-behaviours and attacks modeling can help users understand the occurrence of malicious behaviors in order to avoid them, and what are the advantages and drawbacks of the existing models. At the same time, the workshop tries to understand how to solve the challenging security testing and monitoring problem given that testing distributed systems is a complex task and security and artificial intelligence will add new challenges and difficulties to be solved.

The objective of this workshop is to share ideas, methods, techniques, and tools about security testing and monitoring in distributed systems to improve the state of the art. In addition to scientific paper presentations, we intend to have one or two keynotes describing ongoing activities in the related areas and demonstrations of some innovative security tools.

STAM workshop is supported by projects:
HE-AI4Cyber
HE-DETERMINISTIC6G
HE-DYNABIC
HE-NERO
HE-RESILMESH
HE-NATWORK
H2020-ECSEL AIDOART

The goal of STAM workshop is to bring together safety & security practitioners and researchers to exchange ideas, perspectives on problems, and solutions. Papers proposing novel models, methods, and algorithms are welcomed as well as papers reporting experiences on the application of existing methods on case studies and industrial examples.

Topics of interest include, but are not limited to 03/05

Security requirements definition, modeling and analysis automation
CI/CD practices for requirements analysis, testing and monitoring
Vulnerability, threats and attacks modelling techniques
Risk assessment frameworks for complex systems
Security testing techniques and tools
Security monitoring techniques and tools
Testing and monitoring automation
Attacks tolerance in distributed environments
Resilience techniques evaluation for critical systems
ML/AI and Cybersecurity solutions
Trust and privacy assessment in complex environments
Cybersecurity for small businesses (MSEs and SMEs)
Security testing and monitoring for 5G/6G networks, cloud/Edge, CPS/IoT,
Critical Industrial systems, e-health etc.
Industrial experience reports

Workshop Chairs 04/05

Workshop Chairs

Ana Rosa Cavalli

(HE ResilMesh) Institut Mines Telecom, France

Valentina Casola

University of Naples Federico II, Italy

Erkuden Rios

(HE DYNABIC, HE AI4CYBER) Tecnalia, Spain

Wissam Mallouli

(HE NERO, HE AI4CYBER) Montimage, France

Edgardo Montes de Oca

(HE DETERMINISTIC-6G, NATWORK) Montimage, France

Program Committee

Stefan Marksteiner | AVL, Austria

Andrea Pferscher | University of Oslo, Norway

Eider Iturbe | Tecnalia, Spain

Dragos Truscan | abo, Finland

Cristina Seceleanu | MDU, Sweden

Phu H. Nguyen | SINTEF, Norway

Panagiotis Radoglou-Grammatikis | University of Western Macedonia, Greece

Nicolas Ferry | University Cote d’Azur, France

Gürkan Gür | Zurich University of Applied Sciences (ZHAW), Switzerland

Charalambos Klitis | EBOS Technologies Limited, Cyprus

Martin Schneider | Fraunhofer FOKUS, Germany

Hui Song | SINTEF ICT, Norway

Menno Visscher | Massive Dynamic Sweden, Sweden

Alessandra De Benedictis | University of Naples Federico II, Italy

Fatiha Zaidi | University of Paris-Sud, France

Submission 05/05

Submission Guidelines

The submission guidelines valid for the workshop are the same as for the ARES conference.

More Information

Important Dates

Submission Deadline Apr 30, 2024

Author Notification May 29, 2024

Proceedings Version Jun 18, 2024

ARES EU Projects Symposium Jul 30, 2024

Conference Jul 30 — Aug 02, 2024