Abstract: Systems, methods, and frameworks for detecting cryptocurrency wallet artifacts in a file system of a device are provided. The cryptocurrency wallet artifacts can be automatically detected and can include: (i) cryptocurrency wallet application folders; (ii) images containing cryptocurrency artifacts (e.g., mnemonics phrases and/or transactions information); and/or (iii) web browsers artifacts (e.g., cache data, credentials, cookies, and/or bookmarks). This information can be analyzed and extracted using machine learning (ML), natural language processing (NLP), a convolution neural network (CNN), a recurrent neural network (RNN), and/or a string search algorithm.

Abstract: Systems and methods for authentication and key agreement are provided and can utilize a scheme that uses dynamic key generation to achieve replay-attack resistance in zero round trip time (0-RTT). The hash-chain concept can be integrated with the Diffie-Hellman (DH) key exchange scheme. With this scheme, a device can securely determine the new shared key immediately (i.e., in 0-RTT) and start using it.

Abstract: A lightweight, fast, and reliable authentication mechanism compatible with the 5G D2D ProSe standard mechanisms is provided. A distributed authentication with a delegation-based scheme avoids repeated access to the 5G core network key management functions. Hence, a legitimate user equipment device (e.g., a drone) is authorized by the cellular network (e.g., 5G cellular network) via offering a proxy signature to authenticate itself to other drones. Test results demonstrate that the protocol is lightweight and reliable.

Abstract: Novel hardware-based frameworks and methods for the detection and inhibition or prevention of insider threats utilizing machine learning methods and data collection done at the physical layer are provided. Analysis is done on unknown USB-powered devices, such as a keyboard or mouse, introduced to a computing environment and, through the utilization of machine learning, the behavior of the unknown device is determined before it can potentially cause harm to the computing environment.

Abstract: A cost-effective and reliable digital forensics framework is provided by exploiting multiple blockchain networks in two levels. The selected data collected from sensors on a boat is sent to a remote company database and calculated hash of the data is saved in two blockchain platforms in the first level. Hash of each block is retrieved and inserted onto a Merkle tree on a periodic basis to be stored on another blockchain in the second level which is used to detect any error in the first level blockchains. A secure platform is created with the combination of several blockchains.

Abstract: Systems and methods for monitoring activity within High Definition Multimedia Interface (HDMI) enabled consumer electronics control (CEC) devices and their networks and identifying unexpected and/or suspicious activity within the network are provided. CEC message packets and packet attribute analysis can be used to identify unexpected and/or suspicious CEC activity within two or more interconnected HDMI devices. Three fundamental steps can be used: a data collection step can capture CEC activity occurring within an HDMI distribution; a data processing step can correlate data into a packet analysis process to create a model later used for evaluation; and a decision process step can use the model created in the data processing step to determine if activity occurring within the HDMI distribution is expected or unexpected.

Abstract: Systems and methods for certificate revocation management for advanced metering infrastructure networks are provided. An accumulation manager can be used to accumulate certificate revocation list (CRL) information and determine an accumulator value and a proof value based on the accumulated CRL information using a plurality of functions. These values can be sent on to smart meters, which can then use them for authentication purposes.

Abstract: Systems and methods for certificate revocation management for advanced metering infrastructure networks are provided. An accumulation manager can be used to accumulate certificate revocation list (CRL) information and determine an accumulator value and a proof value based on the accumulated CRL information using a plurality of functions. These values can be sent on to smart meters, which can then use them for authentication purposes.

Abstract: Novel hardware-based frameworks and methods for the detection and inhibition or prevention of insider threats utilizing machine learning methods and data collection done at the physical layer are provided. Analysis is done on unknown USB-powered devices, such as a keyboard or mouse, introduced to a computing environment and, through the utilization of machine learning, the behavior of the unknown device is determined before it can potentially cause harm to the computing environment.

Abstract: Systems and methods for continuous and transparent verification, authentication, and identification of individuals are provided. A method can include detecting a signal from a sensor embedded in a wearable device, determining a set of features unique to the wearer of the wearable device, creating a user profile of that individual, detecting a signal from a sensor of an unknown individual, determining a set of features unique to the unknown individual, and comparing the features of the unknown individual to the previously created user profile.

Abstract: Methods, systems, and devices for instituting a new type of attack on Zigbee networks are provided. Targeting the data-collection aspect of Zigbee's use cases, a denial-of-service attack can be implemented, and can induce loss of the data transmitted from an end device to the coordinator of the network. Such an attack can exploit the fact that the handshake for a newly joining node to the Zigbee coordinator is not encrypted. Methods, systems, and devices to mitigate such an attack are also provided. To mitigate such a type of attack, a low-overhead countermeasure can be implemented, based on a challenge-response.