Abstract: Context-aware security frameworks to detect malicious behavior in a smart environment (e.g., a home, office, or other building) are provided. The framework can address the emerging threats to smart environments by observing the changing patterns of the conditions (e.g., active/inactive) of smart entities (e.g., sensors and other devices) of the smart environment for different user activities, and building a contextual model to detect malicious activities in the smart environment.

Abstract: Novel hardware-based frameworks and methods for the detection and inhibition or prevention of insider threats utilizing machine learning methods and data collection done at the physical layer are provided. Analysis is done on unknown USB-powered devices, such as a keyboard or mouse, introduced to a computing environment and, through the utilization of machine learning, the behavior of the unknown device is determined before it can potentially cause harm to the computing environment.

Abstract: A cost-effective and reliable digital forensics framework is provided by exploiting multiple blockchain networks in two levels. The selected data collected from sensors on a boat is sent to a remote company database and calculated hash of the data is saved in two blockchain platforms in the first level. Hash of each block is retrieved and inserted onto a Merkle tree on a periodic basis to be stored on another blockchain in the second level which is used to detect any error in the first level blockchains. A secure platform is created with the combination of several blockchains.

Abstract: Systems and methods for monitoring activity within High Definition Multimedia Interface (HDMI) enabled consumer electronics control (CEC) devices and their networks and identifying unexpected and/or suspicious activity within the network are provided. CEC message packets and packet attribute analysis can be used to identify unexpected and/or suspicious CEC activity within two or more interconnected HDMI devices. Three fundamental steps can be used: a data collection step can capture CEC activity occurring within an HDMI distribution; a data processing step can correlate data into a packet analysis process to create a model later used for evaluation; and a decision process step can use the model created in the data processing step to determine if activity occurring within the HDMI distribution is expected or unexpected.

Abstract: Novel hardware-based frameworks and methods for the detection and inhibition or prevention of insider threats utilizing machine learning methods and data collection done at the physical layer are provided. Analysis is done on unknown USB-powered devices, such as a keyboard or mouse, introduced to a computing environment and, through the utilization of machine learning, the behavior of the unknown device is determined before it can potentially cause harm to the computing environment.

Abstract: A wireless Internet-of-Things (IoT) device identification method and framework incorporates machine learning (ML) techniques with information from the protocol used (e.g., Bluetooth, Bluetooth Low Energy/Bluetooth Smart, and others). A passive, non-intrusive feature selection technique targets IoT device captures with an ML classifier selection algorithm for the identification of IoT devices (i.e., picking the best performing ML algorithm among multiple ML algorithms available). Using an input training label and training dataset (e.g., training wireless IoT packets) associated with the IoT device, a classifier and a filter are selected. An inter-arrival-time (IAT) associated with the filtered training data set and a density distribution for the IAT are then calculated.

Abstract: A smart device can include a data oriented sensor providing a numerical value, a logic oriented sensor providing a state, a sensor value collector connected to the data oriented sensor, a sensor logic state detector connected to the logic oriented sensor, a data processor connected to the sensor value collector and the sensor logic state detector, and a data analyzer connected to the data processor. The data processor can take the numerical value received from the sensor value collector, calculate an average value from the numerical value, sample the state receiving from the sensor logic state detector, and create an input matrix by using the average value and the sampled state. The data analyzer can receive the input matrix, train an analytical model, and check a data to indicate whether a state of the smart device is malicious or not.

Abstract: A smart device can include a data oriented sensor providing a numerical value, a logic oriented sensor providing a state, a sensor value collector connected to the data oriented sensor, a sensor logic state detector connected to the logic oriented sensor, a data processor connected to the sensor value collector and the sensor logic state detector, and a data analyzer connected to the data processor. The data processor can take the numerical value received from the sensor value collector, calculate an average value from the numerical value, sample the state receiving from the sensor logic state detector, and create an input matrix by using the average value and the sampled state. The data analyzer can receive the input matrix, train an analytical model, and check a data to indicate whether a state of the smart device is malicious or not.

Abstract: Methods for cyber physical systems device classification are provided. A method can include receiving system and function calls and parameters and a device performance index from an unknown CPS device and a device performance index of similar class of CPS devices, calculating an autocorrelation value between different realizations of the system and function calls and parameters of the known CPS device, determining whether the autocorrelation value is greater than a threshold amount, and storing the system and function calls and parameters and the device performance characteristics of the known CPS device in the database. A method can also include calculating a correlation between system and function calls and parameters of an unknown CPS device and known CPS devices classes included in the database, as well as determining whether the maximum correlation is also greater than a threshold amount.

Abstract: Systems and methods for continuous and transparent verification, authentication, and identification of individuals are provided. A method can include detecting a signal from a sensor embedded in a wearable device, determining a set of features unique to the wearer of the wearable device, creating a user profile of that individual, detecting a signal from a sensor of an unknown individual, determining a set of features unique to the unknown individual, and comparing the features of the unknown individual to the previously created user profile.

Abstract: Frameworks, methods, and systems for securing a smart grid are provided. A framework can include data collection, call tracing techniques, and preparing call lists to detect counterfeit or compromised devices. The call tracing techniques can include call tracing and compiling all system and function calls over a time interval. The framework can further include data processing, in which a genuine device is identified and compared to unknown devices. A first statistical correlation can be used for resource-rich systems, and a second statistical correlation can be used for resource-limited systems. Threats of information leakage, measurement poisoning and store-and-send-later can be considered.

Abstract: Methods, systems, and devices for instituting a new type of attack on Zigbee networks are provided. Targeting the data-collection aspect of Zigbee's use cases, a denial-of-service attack can be implemented, and can induce loss of the data transmitted from an end device to the coordinator of the network. Such an attack can exploit the fact that the handshake for a newly joining node to the Zigbee coordinator is not encrypted. Methods, systems, and devices to mitigate such an attack are also provided. To mitigate such a type of attack, a low-overhead countermeasure can be implemented, based on a challenge-response.