نشریه منادی امنیت فضای تولید و تبادل اطلاعات (افتا)
سال هشتم شماره 2 (پیاپی 16، پاییز و زمستان 1398)

Intrusion detection systems are responsible for diagnosing and detecting any unauthorized use of the system, exploitation or destruction, which is able to prevent cyber-attacks using the network package analysis. one of the major challenges in the use of these tools is lack of educational patterns of attacks on the part of the engine analysis; engine failure that caused the complete training,  the result is in production of high volumes of false warnings. On the other hand, the high level of intrusion detection training time will cause a significant delay in the training system. Therefore, in the analysis section of the intrusion detection system, we need to use an algorithm that shows significant performance with the least educational data, hidden Markov model is one of these successful algorithms in this field. This Research also is trying to provide a misuse based intrusion detection solution with the focus of the evolutionary Hidden Markov model, the EHMM, which is designed to overcome the challenges posed. The most important part of hidden Markov model is to adjust the values of the parameters, the more adjusted values, optimal values would be more effective. The hidden Markov model is more likely to predict the probability of future values.  Therefore, it has been trying to end the mail based on the causative analysis of NSL data sets-KDD using evolutionary programming algorithm for hidden Markov model for the optimal parameters and sort of teach it. Then, using it, the types of attacks in the dataset were identified. To evaluate the success rate in improving the accuracy percentage EHMM proposal intrusion detection, MATLAB System simulation environment has been implemented. The results of the investigation show fitted, EHMM plan, the percentage of the average is 87% of intrusion detection (if hidden Markov model is used normal) to over 92% (in the case of the hidden Markov model using evolutionary) increases. Also after training the training data in both methods based on conventional and evolutionary Markov model, the time of the target system for a training data set is approximately two hundred thousand record from  low average of 489 minutes to more than 400 minutes has been dropped in the proposed method. This outcome achievement and making it operational on intrusion detection for the native system, can cause a defensive improvement which can be fitted in front of the other country for hostile cyber.

One of the usual ways to find sensitive data or secret parameters of cryptographic devices is to use their physical leakages. Power analysis is one of the attacks which lay in such a model. In comparison with other types of side-channels, power analysis is so efficient and has a high success rate. So it is important to provide a countermeasure against it. Different types of countermeasures use different methods and can be applied at different levels. Masking is an effective one which provides provable security in algorithm level. however even masked algorithms are sometimes suspected to leak kind of information in a condition that implemented in hardware leads to power analysis attacks. Threshold implementation is a way to secure hardware implementations against such probable challenges. In this paper, first we will introduce the different attack models in block ciphers, then we will concentrate on the gray-box model and explain the concepts of power analysis attacks and fundamentals of masking countermeasure. Later we will discuss the challenges of masking method in hardware implementations and introduce threshold implementation and its different aspects.

Increased broadband data rate for end users and the cost of resource provisioning to an agreed SLA in telecom service providers, are forcing operators in order to adhere to employment Virtual Network Functions (VNF) in an NFV solution. The newly 5G mobile telecom technology is also based on NFV and Software Define Network (SDN) which inherit opportunities and threats of such constructs. Thus a thorough understanding of security challenges and their solutions are required to reduce security concerns while developing new services. In this article, cloud computing, NFV and its VNFs from a security perspective is explained. Then, their security challenges with respect to cloud computing infrastructure and current solutions are discussed in a comparative scenario based way. Finally, proper security solutions for each scenario are proposed.

Advances in information and communication technologies lead to use of some new devices such as smart phones. The new devices provide more advantages for the adversaries hence with respect to them, one can define with-box cryptography. In this new model of cryptography, designers try to hide the key using as a kind of implementation. The Differential Computation Analysis (DCA) is a side channel attack on the with-box cryptography. The mentioned method influenced all with-box cryptography schemes when it was introduced. This attack is based on the software implementation of cryptography algorithms and is similar to the differential power analysis (DPA). In this paper, we introduce the principles of the DCA and also describe how one can use this attack to find the key of a with-box cryptography scheme.

The purpose of this study is to identify and prioritize the effective technical and technical stress factors of information security by IT experts identified in Aghajari oil and gas Exploitation Company. The statistical population of the study consisted of 100 ICT managers and experts in Aghajari Oil and Gas Co. which directly related to the security of information in the company, 80 of them were selected as samples. In this research, the first questionnaire was designed with the aim of identifying the factors and half-openness. The second questionnaire was designed with the aim of screening the identified factors as closed and based on Likertchr('39')s five-choice spectrum. Finally, a third questionnaire was designed with the aim of determining the weights and rank of each one of the factors and in a pair comparison. The necessary analysis was carried out through the software SSS, Excel, ExpressChevis and MATLAB. The results of the research led to the identification of two main factors (occupational stressors and technical stressful factors influencing information security by IT experts in Aghajari oil and gas Exploitation Company) and 14 sub factors and then their rank were determined.

There is no doubt that malicious programs are one of the permanent threats to computer systems. Malicious programs distract the normal process of computer systems to apply their roguish purposes. Meanwhile, there is also a type of malware known as the ransomware that limits victims to access their computer system either by encrypting the victimchr('39')s files or by locking the system. Despite other malicious families, ransomware families explicitly warn victims against its existence on the computer system. Although ransomwares are serious problems with computers, they can be detected with restricted footprints on victims’ computers. In this research, we provide a ransomware monitoring system which requires special environments to extract the malware filesystemchr('39')s activities. A set of features based on filesystemchr('39')s activities is extracted to classify ransomware families with an accuracy 98% by applying machine learning technique.