Analysis of Automotive Cybersecurity - Attack surfaces and users’ privacy concerns

Modern automobiles are no longer just mechanical tools. The electronics and computing services they are shipping with are making them not less than a computer. They are massive kinetic devices with sophisticated computing power. Most of the modern vehicles are made with the added connectivity in mind which may be vulnerable to outside attack. Researchers have shown that it is possible to infiltrate into a vehicle’s internal system remotely and control the physical entities such as steering and brakes. It is quite possible to experience such attacks on a moving vehicle and unable to use the controls. These massive connected computers can be life threatening as they are related to everyday lifestyle. First part of this research studied the attack surfaces in the automotive cybersecurity domain. It also illustrated the attack methods and capabilities of the damages. Online survey has been deployed as data collection tool to learn about the consumers’ usage of such vulnerable automotive services. The second part of the research portrayed the consumers’ privacy in automotive world. It has been found that almost hundred percent of modern vehicles has the capabilities to send vehicle diagnostic data as well as user generated data to their manufacturers, and almost thirty five percent automotive companies are collecting them already. Internet privacy has been studies before in many related domain but no privacy scale were matched for automotive consumers. It created the research gap and motivation for this thesis. A study has been performed to use well established consumers privacy scale – IUIPC to match with the automotive consumers’ privacy situation. Hypotheses were developed based on the IUIPC model for internet consumers’ privacy and they were studied by the finding from the data collection methods. Based on the key findings of the research, all the hypotheses were accepted and hence it is found that automotive consumers’ privacy did follow the IUIPC model under certain conditions. It is also found that a majority of automotive consumers use the services and devices that are vulnerable and prone to cyber-attacks. It is also established that there is a market for automotive cybersecurity services and consumers are willing to pay certain fees to avail that.

Applied web traffic analysis for numerical encoding of SQL Injection attack features.

SQL Injection Attack (SQLIA) remains a technique used by a computer network intruder to pilfer an organisation’s confidential data. This is done by an intruder re-crafting web form’s input and query strings used in web requests with malicious intent to compromise the security of an organisation’s confidential data stored at the back-end database. The database is the most valuable data source, and thus, intruders are unrelenting in constantly evolving new techniques to bypass the signature’s solutions currently provided in Web Application Firewalls (WAF) to mitigate SQLIA. There is therefore a need for an automated scalable methodology in the pre-processing of SQLIA features fit for a supervised learning model. However, obtaining a ready-made scalable dataset that is feature engineered with numerical attributes dataset items to train Artificial Neural Network (ANN) and Machine Leaning (ML) models is a known issue in applying artificial intelligence to effectively address ever evolving novel SQLIA signatures. This proposed approach applies numerical attributes encoding ontology to encode features (both legitimate web requests and SQLIA) to numerical data items as to extract scalable dataset for input to a supervised learning model in moving towards a ML SQLIA detection and prevention model. In numerical attributes encoding of features, the proposed model explores a hybrid of static and dynamic pattern matching by implementing a Non-Deterministic Finite Automaton (NFA). This combined with proxy and SQL parser Application Programming Interface (API) to intercept and parse web requests in transition to the back-end database. In developing a solution to address SQLIA, this model allows processed web requests at the proxy deemed to contain injected query string to be excluded from reaching the target back-end database. This paper is intended for evaluating the performance metrics of a dataset obtained by numerical encoding of features ontology in Microsoft Azure Machine Learning (MAML) studio using Two-Class Support Vector Machines (TCSVM) binary classifier. This methodology then forms the subject of the empirical evaluation.

Analyse de survie sur les prédicteurs de la durée d’un processus thérapeutique individuel chez les hommes auteurs de violence conjugale

La violence conjugale est un problème social qui engendre des coûts sérieux (Statistique Canada, 2016). Son traitement est important. Les taux d’abandon thérapeutique observés dans les programmes de traitement en groupe pour les hommes auteurs de comportements violents en contexte conjugal se situent entre 15 et 58 % (Jewell & Wormith, 2010). Ces hauts taux d’abandon réduisent l’efficacité réelle des suivis pour violence conjugale (Bowen & Gilchrist, 2006). Des études montrent que l’âge, l’occupation, le statut conjugal, le faible revenu, l’expérience de violence physique à l’enfance, la consommation de drogue et d’alcool, ainsi que la personnalité colérique et la fréquence des comportements de violence sont des variables qui permettent de prédire l’abandon d’un programme de traitement de la violence conjugale en format de groupe et de type fermé (Jewell & Wormith, 2010). Aucune étude recensée n’a étudié les prédicteurs liés à l’abandon thérapeutique d’un traitement en format individuel de type ouvert. Cette étude visait à identifier quels sont les moments-clés où il y a cessation du suivi pour violence conjugale et à vérifier quelles variables sont associées à une cessation plus ou moins précoce du traitement individuel des hommes auteurs de violence conjugale. Une batterie de questionnaires auto-rapportés a été soumise à 206 hommes francophones qui amorcent une consultation individuelle pour un problème de violence conjugale dans un centre communautaire de la province de Québec. Parmi ceux-ci se trouvaient des questionnaires évaluant l’expérience de la colère, les comportements de violence conjugale, les insécurités d’attachement amoureux et la désirabilité sociable. Le nombre de séances complétées par chaque participant a également été obtenu par le biais de l’organisme. Une première analyse de survie a permis de produire une table de survie et d’identifier trois moments où la cessation du suivi est la plus fréquente, soient une cessation précoce (1 ou 2 séances), une cessation à court terme (3 à 5 séances) et une cessation à moyen terme (après la 11e séance). L’analyse de survie par régression de Cox a ensuite permis de montrer que l’âge, le fait d’avoir complété ou non des études post-secondaires, le fait d’avoir une occupation stable (emploi ou études à temps plein) ou non, le fait de consulter sous ordonnance légale, le niveau de violence psychologique émise, ainsi que les insécurités d’attachement (évitement de l’intimité, anxiété d’abandon) sont tous des prédicteurs significatifs du moment de cessation d’un suivi individuel de type ouvert pour violence conjugale. Plus précisément, les participants qui n’ont pas complété d’études post-secondaires, qui sont sans occupation stable, qui consultent sous ordonnance de la Cour ou de la DPJ et qui présentent peu d’évitement de l’intimité ont davantage tendance à cesser leur suivi de façon précoce; les participants qui ont complété des études post-secondaires et qui présentent peu d’anxiété d’abandon ont davantage tendance à cesser leur suivi à court terme; les clients qui posent moins d’actes de violence psychologique ont davantage tendance à mettre fin à leur suivi à moyen terme. Les implications cliniques de ces résultats sont discutées

Minimalist Hardware Architectures for Agent Tracking and Guidance

The philosophy of minimalism in robotics promotes gaining an understanding of sensing and computational requirements for solving a task. This minimalist approach lies in contrast to the common practice of first taking an existing sensory motor system, and only afterwards determining how to apply the robotic system to the task. While it may seem convenient to simply apply existing hardware systems to the task at hand, this design philosophy often proves to be wasteful in terms of energy consumption and cost, along with unnecessary complexity and decreased reliability. While impressive in terms of their versatility, complex robots such as the PR2 (which cost hundreds of thousands of dollars) are impractical for many common applications. Instead, if a specific task is required, sensing and computational requirements can be determined specific to that task, and a clever hardware implementation can be built to accomplish the task. Since this minimalist hardware would be designed around accomplishing the specified task, significant reductions in hardware complexity can be obtained. This can lead to huge advantages in battery life, cost, and reliability. Even if cost is of no concern, battery life is often a limiting factor in many applications. Thus, a minimalist hardware system is critical in achieving the system requirements. In this thesis, we will discuss an implementation of a counting, tracking, and actuation system as it relates to ergodic bodies to illustrate a minimalist design methodology.

Fighting Evasive Malware with DVasion

Malware is a foundational component of cyber crime that enables an attacker to modify the normal operation of a computer or access sensitive, digital information. Despite the extensive research performed to identify such programs, existing schemes fail to detect evasive malware, an increasingly popular class of malware that can alter its behavior at run-time, making it difficult to detect using today’s state of the art malware analysis systems. In this thesis, we present DVasion, a comprehensive strategy that exposes such evasive behavior through a multi-execution technique. DVasion successfully detects behavior that would have been missed by traditional, single-execution approaches, while addressing the limitations of previously proposed multi-execution systems. We demonstrate the accuracy of our system through strong parallels with existing work on evasive malware, as well as uncover the hidden behavior within 167 of 1,000 samples.

Developing smart services by Internet of Things in manufacturing business

Manufacturing companies have passed from selling uniquely tangible products to adopting a service-oriented approach to generate steady and continuous revenue streams. Nowadays, equipment and machine manufacturers possess technologies to track and analyze product-related data for obtaining relevant information from customers’ use towards the product after it is sold. The Internet of Things on Industrial environments will allow manufacturers to leverage lifecycle product traceability for innovating towards an information-driven services approach, commonly referred as “Smart Services”, for achieving improvements in support, maintenance and usage processes. The aim of this study is to conduct a literature review and empirical analysis to present a framework that describes a customer-oriented approach for developing information-driven services leveraged by the Internet of Things in manufacturing companies. The empirical study employed tools for the assessment of customer needs for analyzing the case company in terms of information requirements and digital needs. The literature review supported the empirical analysis with a deep research on product lifecycle traceability and digitalization of product-related services within manufacturing value chains. As well as the role of simulation-based technologies on supporting the “Smart Service” development process. The results obtained from the case company analysis show that the customers mainly demand information that allow them to monitor machine conditions, machine behavior on different geographical conditions, machine-implement interactions, and resource and energy consumption. Put simply, information outputs that allow them to increase machine productivity for maximizing yields, save time and optimize resources in the most sustainable way. Based on customer needs assessment, this study presents a framework to describe the initial phases of a “Smart Service” development process, considering the requirements of Smart Engineering methodologies.

La loi applicable aux transferts de biens virtuels

Thèse réalisée en cotutelle avec l'université Paris1-Sorbonne

La voix du castrat ou le sexe de l’ange

Ce texte a été écrit en hommage à l’Italie, un pays si nourri d’art en général, si amoureux des belles voix en particulier, qu’il a toléré pendant au moins deux siècles, en particulier au 17ème et 18ème siècles, l’âge baroque, la mutilation d’environ 3000 à 4000 jeunes garçons chaque année, afin de créer les plus étranges de toutes les voix de chanteurs, les voix de castrats.

Cyberbullying: competencia social, motivación y relaciones entre iguales

El reconocimiento de cierto solapamiento entre el acoso cara a cara (bullying) y el ciberacoso (cyberbullying) puede indicar que variables de cognición social, cuya influencia ha sido reconocida en el bullying, también estén presentes en el acoso cibernético. El objetivo de la investigación fue estudiar el ajuste social de los implicados en cyberbullying y analizar las diferencias en la percepción de la competencia social, la motivación y el apoyo de los iguales, entre víctimas, agresores y agresores victimizados del cyberbullying. Un total de 505 adolescentes (47,3% chicas) con edades comprendidas entre los 12 y 16 años (M=13.95; DT=1.42) participaron en el estudio. Se utilizaron instrumentos para adolescentes validados en español y se analizaron las propiedades psicométricas para la adaptación de la escala de competencia social. Análisis factoriales exploratorios y confirmatorios mostraron índices óptimos de fiabilidad y validez. Se observó una mayor implicación de los ciberagresores victimizados. Las comparaciones entre roles a través de pruebas no paramétricas mostraron en los ciberagresores un mayor apoyo social que el resto de perfiles y altos niveles en metas de popularidad. Las cibervíctimas destacaron por su alta percepción de competencia social. Los ciberagresores victimizados mostraron altos niveles de metas de popularidad y baja aceptación social. Los resultados obtenidos permiten concluir que la forma en que el grupo de iguales gestiona su vida emocional y social puede estar explicando la situación de cyberbullying entre los adolescentes.

Mi pareja me controla y acosa

[ES]El presente trabajo de fin de grado tiene como objetivo la investigación del cibercontrol y del ciberacoso durante las relaciones de noviazgo. Para ello se aplicó el cuestionario de Actitudes hacia el Género y la Violencia de Género, creado por Díaz-Aguado y que ha sido validado y utilizado en numerosos estudios, a adolescentes y jóvenes de edades comprendidas entre 14 y 17 años residentes en Txurdinaga-Otxarkoaga del municipio de Bilbao. Nuestra investigación nos ayudará a recabar información sobre la posible victimización padecida por adolescentes y jóvenes de la mano de su pareja actual o pasada. Una problemática que va en aumento con la incorporación de las TIC a todos los aspectos de nuestra vida.

Infomobility for “Car-Driver” Systems: Reference Model and Case Study

Part 21: Mobility and Logistics

Twitter e ciberativismo: o movimento social da hashtag #ForaMicarla em Natal-RN

The spatial and temporal fluidity conditioned by the technologies of social interaction online have been allowing that collective actions of protest and activism arise every day in cyberspace - the cyber-activism. If before these actions were located in geographical boundaries, today's demands and mobilizations extrapolate the location, connect to the global, and at the same time, return to the regional through digital virtuality. Within this context of the relationship between digital technology and global flow of sociability, emerges in October 2010 the social movement of the hashtag "#ForaMicarla", which means the dissatisfaction of cibernauts from Natal of Twitter with the current management of the municipality of Natal-RN, Micarla de Sousa (Green Party). We can find in the center of this movement and others who appeared in the world at the same time a technological condition of Twitter, with the hashtag "#". Given this scenario, this research seeks to analyze how the relationship of the agents of movement hashtag "ForaMicarla", based on the principle that it was formed in the Twitter network and is maintained on the platform on a daily basis, it can create a new kind of political culture. Thus, this study discusses theoretically the importance of Twitter and movements that emerge on the platform and through it to understand the social and political demands of the contemporary world and this public sphere, which now seems to include cyberspace

A Framework for Energy-Efficiency in Smart Home Environments

Part 7: Cyber-Physical Systems

The Sensing Enterprise: Towards the Next Generation Dynamic Virtual Organisations

Part 6: Engineering and Implementation of Collaborative Networks

Intrusion Detection Systems in SDN-based Self-Healing PMU Networks

Nowadays, Power grids are critical infrastructures on which everything else relies, and their correct behavior is of the highest priority. New smart devices are being deployed to be able to manage and control power grids more efficiently and avoid instability. However, the deployment of such smart devices like Phasor Measurement Units (PMU) and Phasor Data Concentrators (PDC), open new opportunities for cyber attackers to exploit network vulnerabilities. If a PDC is compromised, all data coming from PMUs to that PDC is lost, reducing network observability. Our approach to solve this problem is to develop an Intrusion detection System (IDS) in a Software-defined network (SDN). allowing the IDS system to detect compromised devices and use that information as an input for a self-healing SDN controller, which redirects the data of the PMUs to a new, uncompromised PDC, maintaining the maximum possible network observability at every moment. During this research, we have successfully implemented Self-healing in an example network with an SDN controller based on Ryu controller. We have also assessed intrinsic vulnerabilities of Wide Area Management Systems (WAMS) and SCADA networks, and developed some rules for the Intrusion Detection system which specifically protect vulnerabilities of these networks. The integration of the IDS and the SDN controller was also successful. \\To achieve this goal, the first steps will be to implement an existing Self-healing SDN controller and assess intrinsic vulnerabilities of Wide Area Measurement Systems (WAMS) and SCADA networks. After that, we will integrate the Ryu controller with Snort, and create the Snort rules that are specific for SCADA or WAMS systems and protocols.