Advanced Evasion Techniques

Malicious payloads by splitting them into smaller frames and sending frames across rarely used protocols

Targeted Cyber-Attacks

Intelligence Gathering

Point of Entry

Command and Control

Attacker use internal servers to control a compromised machine before progressing to other compromised machines inside the target network

To defend the application-based complex attacks a new generation of firewalls is required as threat move up the OSI layers.

Next generation firewalls must have the following advanced features to analyze and inspect traffic in a fine level of granularity.

1) Encrypted traffic control: SSL/TLS provides authentication but creates blind spot which challenges traditional layered defenses. This help attackers to leverage SSL tunnels to inject malware into the network, hide command and control traffic and steal confidential data. Therefore, next generation firewalls must have the ability to decrypt and inspect SSL/TLS traffic to eliminate blind spots threats. Gartner estimates that more than 50% of the attacks will use SSL/TLS by 2017.

2) Port hopping: Attackers often use random port hopping to get beyond traditional firewalls. Thus, the next generation firewall must be able to detect those ports when being used.

3) Application control: the next generation firewall should not look at layer 3 and layer 4 header rather it must be more application aware, so that it has the ability to restrict access to web apps.

4) Identity based control: the next generation firewall must be able to map specific security policies to defined user groups and individuals.

5) URL filtering: the next generation firewall must be able to restrict web surfing to limit the exposure to harmful and inappropriate sites.

6) Data leakage protection: the next generation firewall must be able to restrict the egress of confidential data.

7) WiFi network control: the next generation firewall must ensure that Wi-Fi networks have the same level of security stance and abilities.

8) Network access control: the next generation firewall must ensure that each connecting end point device has appropriate security.

9) WAN Routing & Optimization: the next generation firewall should be backed by QoS and priority capabilities.

detecting malicious nodes

ETAREE security evaluations have demonstrated faster detection of malicious behaviors.

Reputation evaluation measures are considered an effective method to defend against packet forwarding attacks

and detect malicious or selfish activities.

An adversary could take advantage of the dynamicity of reflecting behavioral changes from malicious to

benign to launch more sophisticated attacks.

ETAREE still needs further evaluations within a trust system that considers indirect recommendations from other

nodes.

A legitimate node, which is authenticated and may have a copy of the keys, may get compromised, and thereby

it may selectively forward some packets and drop others.

The most common packet forwarding attack are, Selective Forwarding Attack, Sink Hole Attack, Black Hole Attack,

On-off Attack.

A reason why a node may launch a packet forwarding attack, is the node

got compromised and intentionally stops forwarding packets due to the malicious piece of software.

A reason why a node may launch a packet forwarding attack, is due to a benign node to selfishly stop forwarding

packets for others in order to save power.

ETAREE has faster detection than RFSN and ReTrust, and continues to decrease the reputation value further over

time, which allows it to detect attack for even lower threshold.

WSN fails to detect attacks when the rate is less than 60%, RFSN and ReTrust

are still able to detect attacks down to 50%, ETAREE is the only scheme that is able to detect attacks with

packets drop rate as low as 30%

The security of the CAN has not been an issue in the past, but with newer research showing multiple vulnerabilities, there is now a rising concern about the security of the CAN.

The paper's artefact is an anomaly detector for malicious attacks targeting the CAN bus. The algorithm was trained only using benign/non-malicious data from a public dataset and has had a 100% accuracy of detecting two types of attacks within 100ms. These results are great but the authors would recommend having more varied datasets and types of attacks in the future to verify the accuracy of the detection of malicious attacks on the CAN. One issue the paper notes is that abnormal activities such as an emergency brake might be considered malicious by the algorithm, the authors are considering to cover this in their future work.

Despite the successful implementation of the detection algorithm, the paper is still concerned with the current lack in security in CANs.

In the end, the paper plans to provide a cyber-security solution to vehicle CANs, but is unsure of what the bottleneck of this system will be as the implementation of the algorithm used an Intel i7 CPU. Such processors do not usually exist in current automotive hardware. Further work will be needed.