Abstract: Context-aware security frameworks to detect malicious behavior in a smart environment (e.g., a home, office, or other building) are provided. The framework can address the emerging threats to smart environments by observing the changing patterns of the conditions (e.g., active/inactive) of smart entities (e.g., sensors and other devices) of the smart environment for different user activities, and building a contextual model to detect malicious activities in the smart environment.

Abstract: A wireless Internet-of-Things (IoT) device identification method and framework incorporates machine learning (ML) techniques with information from the protocol used (e.g., Bluetooth, Bluetooth Low Energy/Bluetooth Smart, and others). A passive, non-intrusive feature selection technique targets IoT device captures with an ML classifier selection algorithm for the identification of IoT devices (i.e., picking the best performing ML algorithm among multiple ML algorithms available). Using an input training label and training dataset (e.g., training wireless IoT packets) associated with the IoT device, a classifier and a filter are selected. An inter-arrival-time (IAT) associated with the filtered training data set and a density distribution for the IAT are then calculated.

Abstract: A smart device can include a data oriented sensor providing a numerical value, a logic oriented sensor providing a state, a sensor value collector connected to the data oriented sensor, a sensor logic state detector connected to the logic oriented sensor, a data processor connected to the sensor value collector and the sensor logic state detector, and a data analyzer connected to the data processor. The data processor can take the numerical value received from the sensor value collector, calculate an average value from the numerical value, sample the state receiving from the sensor logic state detector, and create an input matrix by using the average value and the sampled state. The data analyzer can receive the input matrix, train an analytical model, and check a data to indicate whether a state of the smart device is malicious or not.

Abstract: A smart device can include a data oriented sensor providing a numerical value, a logic oriented sensor providing a state, a sensor value collector connected to the data oriented sensor, a sensor logic state detector connected to the logic oriented sensor, a data processor connected to the sensor value collector and the sensor logic state detector, and a data analyzer connected to the data processor. The data processor can take the numerical value received from the sensor value collector, calculate an average value from the numerical value, sample the state receiving from the sensor logic state detector, and create an input matrix by using the average value and the sampled state. The data analyzer can receive the input matrix, train an analytical model, and check a data to indicate whether a state of the smart device is malicious or not.

Abstract: Methods for cyber physical systems device classification are provided. A method can include receiving system and function calls and parameters and a device performance index from an unknown CPS device and a device performance index of similar class of CPS devices, calculating an autocorrelation value between different realizations of the system and function calls and parameters of the known CPS device, determining whether the autocorrelation value is greater than a threshold amount, and storing the system and function calls and parameters and the device performance characteristics of the known CPS device in the database. A method can also include calculating a correlation between system and function calls and parameters of an unknown CPS device and known CPS devices classes included in the database, as well as determining whether the maximum correlation is also greater than a threshold amount.

Abstract: Systems and methods for continuous and transparent verification, authentication, and identification of individuals are provided. A method can include detecting a signal from a sensor embedded in a wearable device, determining a set of features unique to the wearer of the wearable device, creating a user profile of that individual, detecting a signal from a sensor of an unknown individual, determining a set of features unique to the unknown individual, and comparing the features of the unknown individual to the previously created user profile.

Abstract: Frameworks, methods, and systems for securing a smart grid are provided. A framework can include data collection, call tracing techniques, and preparing call lists to detect counterfeit or compromised devices. The call tracing techniques can include call tracing and compiling all system and function calls over a time interval. The framework can further include data processing, in which a genuine device is identified and compared to unknown devices. A first statistical correlation can be used for resource-rich systems, and a second statistical correlation can be used for resource-limited systems. Threats of information leakage, measurement poisoning and store-and-send-later can be considered.

Abstract: Large graph data in many application domains dynamically changes with vertices and edges inserted and deleted over time. The problem of identifying and maintaining densely connected regions in the graph thus becomes a challenge. Embodiments of the invention describe a method using a k-core measure as a metric of dense connectivity over large, partitioned graph data stored in multiple computing servers in a cluster. The method describes steps to identify a k-core subgraph in parallel and to maintain a k-core subgraph when a new edge is inserted or an existing edge is deleted. The embodiments thus enable practitioners to identify and monitor large scale graph data, such as exemplified by multiple topical communities in a social network, in a scalable and efficient manner.

Abstract: Large graph data in many application domains dynamically changes with vertices and edges inserted and deleted over time. The problem of identifying and maintaining densely connected regions in the graph thus becomes a challenge. Embodiments of the invention describe a method using a k-core measure as a metric of dense connectivity over large, partitioned graph data stored in multiple computing servers in a cluster. The method describes steps to identify a k-core subgraph in parallel and to maintain a k-core subgraph when a new edge is inserted or an existing edge is deleted. The embodiments thus enable practitioners to identify and monitor large scale graph data, such as exemplified by multiple topical communities in a social network, in a scalable and efficient manner.