One of the primary concerns of data security specialists is to mitigate insider threats and prevent data leaks. Often, unfortunately, insider threats go unnoticed. In most cases, the longer such activity goes unnoticed, the greater the resulting damages are likely to be. This paper provides an overview of the basic data exfiltration techniques that deal with file structures and were utilized in multiple scenarios in an attempt to bypass a Data Loss Prevention system. Details show which of the scenarios have been detected and which have not been by the Data Loss Prevention system. The paper also proposed solutions for the undetected scenarios.
01369nas a2200169 4500000000100000000000100001008004100002260001200043100002400055700002300079700001900102700001900121245008800140856007000228520085200298022004901150 2021 d c10/2021 1 aMohammed Nasereddin 1 aAshaar ALKhamaiseh 1 aMalik Qasaimeh 1 aRaad Al-Qassas 00 aA systematic review of detection and prevention techniques of SQL injection attacks uhttps://www.tandfonline.com/doi/abs/10.1080/19393555.2021.1995537 3 aSQL injection is a type of database-targeted attack for data-driven applications. It is performed by inserting malicious code in the SQL query to alter and modify its meaning, enabling the attacker to retrieve sensitive data or to access the database. Many techniques have been improved and proposed to detect and mitigate these types of attacks. This paper provides a systematic review for a pool of 60 papers on web applications’ SQL injection detection methods. The pool was selected using a developed searching and filtering methodology for the existing literature based on scholar databases (IEEE, ScienceDirect, and Springer) with the aim to provide specific answering for several research questions in the area of SQL injection detection. This provides a basis for the design and use of effective SQL injection detection methods.
aPrint ISSN: 1939-3555 Online ISSN: 1939-3547 01089nas a2200145 4500000000100000000000100001008004100002260003800043100002400081700001500105700001700120245008300137856005000220520067300270 2023 d bIEEE aDaytona Beach, Florida, USA 1 aMohammed Nasereddin 1 aMert Nakip 1 aErol Gelenbe 00 aMeasurement Based Evaluation and Mitigation of Flood Attacks on a LAN Test-Bed uhttps://ieeexplore.ieee.org/document/10223358 3 aThe IoT is vulnerable to network attacks, and Intrusion Detection Systems (IDS) can provide high attack detection accuracy and are easily installed in IoT Servers. However, IDS are seldom evaluated in operational conditions which are seriously impaired by attack overload. Thus a Local Area Network testbed is used to evaluate the impact of UDP Flood Attacks on an IoT Server, whose first line of defence is an accurate IDS. We show that attacks overload the multi-core Server and paralyze its IDS. Thus a mitigation scheme that detects attacks rapidly, and drops packets within milli-seconds after the attack begins, is proposed and experimentally evaluated.
01516nas a2200133 4500000000100000000000100001008004100002260002100043100001700064700002400081245009800105856005900203520112000262 2023 d bIEEE aExeter, UK 1 aErol Gelenbe 1 aMohammed Nasereddin 00 aProtecting IoT Servers Against Flood Attacks with the Quasi Deterministic Transmission Policy uhttps://ieeexplore.ieee.org/abstract/document/10538961 3 aServers at Supply Chains that receive packets from IoT devices should meet the QoS needs of incoming packets, and protect the system from Cyberattacks. UDP Floods are often part of Cyberattacks that overwhelm Supply Chains and the IoT through congestion that paralyzes their operation and limits their ability for timely Attack Detection.Thus this paper proposes an architecture that protects a connected Server using a Smart Quasi-Deterministic Transmission Policy Forwarder placed at its input port. This Forwarder shapes the incoming traffic, sends it to the Server without modifying the overall packet delay, and avoids Server congestion. The relevant theoretical background is reviewed, and measurements during a UDP Flood Attack are provided to compare the Server performance, with and without the Forwarder. It is seen that during a UDP Flood Attack, the Forwarder protects the Server from congestion allowing it to effectively identify Attack Packets. The resulting Forwarder congestion is also eliminated with “drop” commands generated by the Forwarder, or sent by the Server to the Forwarder.
01759nas a2200121 4500000000100000000000100001008004100002260001200043100002400055700001900079245008100098520145800179 2024 d c03/2024 1 aMohammed Nasereddin 1 aRaad Al-Qassas 00 aA New Approach for Detecting Process Injection Attacks Using Memory Analysis 3 aThis paper introduces a new approach for examining and analyzing fileless malware artifacts in computer memory. The proposed approach offers the distinct advantage of conducting a comprehensive live analysis of memory without the need for periodic memory dumping. Once a new process arrives, log files are collected by monitoring the Event Tracing forWindows facility as well as listing the executables of the active process for violation detection. The proposed approach significantly reduces detection time and minimizes resource consumption by adopting parallel computing (programming), where the main software (Master) divides the work, organizes the process of searching for artifacts, and distributes tasks to several agents (Slaves). A dataset of 17411 malware samples is used in the assessment of the new approach. It provided satisfactory and reliable results in dealing with at least six different process injection techniques including classic DLL injection, reflective DLL injection, process hollowing, hook injection, registry modifications, and .NET DLL injection. The detection accuracy rate has reached 99.93% with a false-positive rate of 0.068%. Moreover, the accuracy was monitored in the case of launching several malwares using different process injection techniques simultaneously, and the detector was able to detect them efficiently. Also, it achieved a detection time with an average of 0.052 msec per detected malware.
01049nas a2200121 4500000000100000000000100001008004100002260003400043100002400077700001900101245005900120520074800179 2021 d c06/2021 bACM aOnline - Jordan 1 aMohammed Nasereddin 1 aAbdallah Qusef 00 aRisk Assessment in Smartphones: Comprehensive Analysis 3 aSmartphones are multi-purpose and widely used devices in various fields, in terms of personal use, and companies and governments. Increasing dependence on them opened the way for increased violations on its users, as it became a fat substance for criminals, for their illegal practices, so it encountered serious and targeted security threats. This paper presents a set of rules and controls that will reduce the risks that threaten smartphone users. Furthermore, this work provides the methods of risk assessment that are related to smartphones. It identifies the assets and lists several different threats that are relevant. Each risk has its impact on the assets, this is described by mapping it with the likelihood of each threat.
01127nas a2200145 4500000000100000000000100001008004100002260002500043100002400068700001500092700001700107245006800124856005900192520073000251 2024 d bIEEE aKrakow, Poland 1 aMohammed Nasereddin 1 aMert Nakip 1 aErol Gelenbe 00 aDeep Learning Intrusion Detection and Mitigation of DoS Attacks uhttps://ieeexplore.ieee.org/abstract/document/10786560 3 aInternet of Things (IoT) networks are highly vulnerable to common network DoS and DDoS attacks, which flood limited system resources or IoT devices, overwhelming them with large numbers of attack packets. In order to mitigate such attacks, this paper develops a lightweight yet effective Intrusion Detection and Prevention System (IDPS), that sequentially detects and mitigates the attack via a Deep Random Neural Network (DRNN) and a Drop-Idle-Repeat process. The IDPS is evaluated for UDP Floods, attacks on an experimental test-bed. The results show that UDP Flood attacks can be mitigated with the proposed IDPS, allowing the system to continue routine operations, and resume communications when the attack ends.
02038nas a2200145 4500000000100000000000100001008004100002260001200043100001700055700002400072245005300096856007600149490000700225520166000232 2025 d c03/2025 1 aErol Gelenbe 1 aMohammed Nasereddin 00 aAdaptive attack mitigation for IoV Flood Attacks u https://drive.google.com/file/d/1UPsgRyMDKUv4sT6oiOQQXxDgQ8bFTXQM/view 0 v12 3 aGateway Servers for the Internet of Vehicles (IoV) must meet stringent Security and Quality of Service (QoS) requirements, including cyberattack protection, low delays and minimal packet loss, to offer secure real-time data exchange for human and vehicle safety and efficient road traffic management. Therefore, it is vital to protect these systems from cyberattacks with adequate Attack Detection (AD) and Mitigation mechanisms. Such attacks often include packet Floods that impair the QoS of the networks and Gateways and even impede the Gateways’ capability to carry out AD. Thus, this paper first evaluates these effects using system measurements during Flood attacks. It then demonstrates how a Smart Quasi-Deterministic Policy Forwarder (SQF) at the entrance of the Gateway can regulate the incoming traffic to ensure that the Gateway supports
the AD to operate promptly during an attack. Since Flood attacks create substantial packet backlogs, we propose a novel Adaptive Attack Mitigation (AAM) system that is activated after an attack is detected to dynamically sample the incoming packet stream, determine whether the attack is continuing, and also drop batches of packets at the input to reduce the effects of the attack. The AAM is designed to minimize a cost function that includes the sampling overhead and the cost of lost benign packets. We show experimentally that the Optimum AAM approach is effective in mitigating attacks and present theoretical and experimental results that validate the proposed approach.
The growing prevalence of cyberattacks against network-connected systems increases the need for accurate intrusion and attack detection (AD) systems that can react rapidly at the network access ports. Machine learning has often been used for AD because of the high accuracy it can offer, and its fast testing speed for real-time attack detection. On the other hand, the data sampling methods used to transform incoming traffic streams into data for real-time testing by AD systems can have an important effect on the detection accuracy, and are seldom discussed in the literature. Here, we address this often neglected aspect, with the Auto-Associative Dense Random Neural Network (AADRNN), a state-of-the-art AD system. After briefly reviewing the literature and comparing the AADRNN attack detector with other state-of-the-art approaches, this paper focuses on choosing the values of the data sampling parameters and the decision threshold to obtain the best accuracy from this AD method. Experiments regarding Botnet attack detection using the Mirai dataset, as well as synthetic flood attacks conducted on an experimental IoT test-bed are used to illustrate the results, and to guide the parameter choices that maximize the AADRNN’s True Positive Rate and minimize its False Positive Rate.
01461nas a2200109 4500000000100000000000100001008004100002100001700043700002400060245004700084520122000131 2025 d 1 aErol Gelenbe 1 aMohammed Nasereddin 00 aData Driven Optimum Cyberattack Mitigation 3 aGateways to the Internet of Things (IoT) are typically servers that communicate with IoT devices, providing them with low-latency services, and connecting them to the internet and other backbone networks. Since IoT devices are often simple and have limited storage and computational capabilities, gateways can be equipped with Attack Detection (AD) software to analyze incoming traffic, detect potential cyberattacks, and protect both the gateway and connected devices from threats that could overwhelm the system as a whole. This paper presents an enhanced gateway system that combines a traffic shaping technique with an attack detection module and an optimum attack mitigation scheme aimed at protecting the gateway and the overall system from cyberattacks. The optimum mitigation approach selects a sampling interval for the AD, that minimizes the total overhead of AD and mitigation. The proposed approach is implemented in a practical test-bed, so that the performance of the mitigation scheme may be evaluated in the presence of flood attacks. The experiments show its practical value and illustrate the agreement obtained between the analysis and the measurements obtained from several experiments.
02133nas a2200157 4500000000100000000000100001008004100002260001200043100002000055700001700075700002400092700001600116245010500132490000800237520173000245 2025 d c11/2025 1 aJacob Bergquist 1 aErol Gelenbe 1 aMohammed Nasereddin 1 aKarl Sigman 00 aMitigating massive access with Quasi-Deterministic Transmission: Experiments and stationary analysis 0 v170 3 aThe Massive Access Problem arises due to devices that forward packets simultaneously to servers in rapid succession, or by malevolent software in devices that flood network nodes with high-intensity traffic. To protect servers from such events, attack detection (AD) software is installed on servers, and the Quasi-Deterministic Transmission Policy (QDTP) has been proposed to “shape traffic” and protect servers, allowing attack detection to proceed in a timely fashion by delaying some of the incoming packets individually based on their arrival times. QDTP does not cause packet loss, and can be designed so that it does not increase end-to-end packet delay. Starting with measurements taken on an experimental test-bed where the QDPT algorithm is installed on a dedicated processor, which precedes the server itself, we show that QDPT protects the server from attacks by accumulating arriving packets at the input of the QDTP processor, then forwarding them at regular intervals to the server. We compare the behaviour of the server, with and without the use of QDTP, showing the improvement it achieves, provided that its “delay” parameter is correctly selected. We analyze the sample paths associated with QDTP and prove that when its delay parameter is chosen in a specific manner, the end-to-end delay of each packet remains unchanged as compared to an ordinary First-In-First-Out system. An approach based on stationary ergodic processes is developed for the stability conditions. Assuming mutually independent and identically distributed inter-arrival times, service times and QDTP delays, we exhibit the positive recurrent structure of a two-dimensional Markov process and its regeneration points.