Difference between revisions of "AFSecurity Seminar"

From mn/ifi/AFSecurity
Jump to: navigation, search
Line 3: Line 3:
 
{| border="0" cellpadding="1" cellspacing="1" width="100%"
 
{| border="0" cellpadding="1" cellspacing="1" width="100%"
 
|-
 
|-
| '''DATE:'''&nbsp; 6 June 2019<br />
+
| '''DATE:'''&nbsp; 30 August 2019<br />
 
'''PLACE:'''&nbsp;  Kristan Nygaards Hall (Room 5370), IFI, UiO - OJD House . <br /><br />
 
'''PLACE:'''&nbsp;  Kristan Nygaards Hall (Room 5370), IFI, UiO - OJD House . <br /><br />
 
'''AGENDA:'''<br />
 
'''AGENDA:'''<br />
15:00h Welcom at UiO<br /><br />15:15h Invited Talk:
+
14:00h Welcom at UiO<br /><br />14:15h Invited Talk:
| [[File:logo-CCDCOE.jpg|300px|link=https://ccdcoe.org/]]
+
| [[File:logo-ENSICAEN.jpg|300px|link=https://ccdcoe.org/]]
 
|}
 
|}
* '''TALK:''' &nbsp;''Frankenstack: Building a detection and feedback system for Red-Teaming exercise''<br />'''SPEAKER:''' ''Markus Kont'' (NATO CCDCOE) &nbsp; <br />'''ABSTRACT:''' Cyber Defense Exercises have received much attention in recent years. Crossed Swords is an exercise directed at training Red Team members for responsive cyber defense. However, these Red Teamers may not be aware how their actions are visible from the detection side, as they often lack expertise from defensive side. Yellow team role is to provide this feedback. However, this can be a delicate balancing act, as feedback should be given near real time without overwhelming the players who are already under intense time pressure. Furthermore, this system should not spoil the gameplay nor give unfair insights into the network topology of target systems. This presentation is about the tools and techniques used, as well as challenges encountered, while building Frankenstack, an open source toolbox for providing this feedback. Current iteration is a data pipeline and correlation stack build around Kafka message queue and SEC event correlation rules. Events were collected from network via Suricata, Zeek, Moloch and Mendel. Host logs were enhanced with Snoopy on Linux and Sysmon on Windows targets to generate a full audit trail, and collected via Syslog. A custom data normalization engine was written in Golang to enhance each message with meta information needed to correlate event fragments from multiple sources, and to anonymize targets. And to replay events post-mortem with correct temporal intervals, to enable offline correlation rule development. Correlated alerts were displayed on central screens using various custom and existing front-end dashboards.
+
* '''TALK:''' &nbsp;''Privacy Threat of Keystroke Profiling on the Web''<br />'''SPEAKER:''' ''Denis Migdal'' (ENSICAEN) &nbsp; <br />'''ABSTRACT:''' In a browser environment, Keystroke Dynamics (the way of typing on a keyboard) is an interesting biometric modality as it requires neither additional sensors (just your keyboard), nor additional actions from the user.  Keystroke Dynamics can easily be collected through a Web page to authenticate, identify,  or profile visitors...  even without their knowledge and consent. Contrary  to learning-based  Keystroke  Dynamics  (s.a.  based  on  Deep  learning  or SVM), distance-based Keystroke Dynamics can be used with very few data.  However, it generally provides deceiving authentication and identification performances.  In a first part, we will see how to improve such performances, and how Keystroke Dynamics can pose serious threats to users privacy, even with only few information. Fortunately, thanks to Keystroke Dynamics Anonymization Systems, it is possible to protect our Keystroke Dynamics, or at last to disturb identification and profiling systems. Several  Keystroke  Dynamics  Anonymization  Systems  will  be  presented  in  the second part, as well as some  recommendations  to  build and implement  Keystroke  Dynamics Anonymization Systems. In a third part, I will present a multi-modal privacy-compliant authentication based, among other, on Keystroke Dynamics, as well as some schemes and uses cases. Proof of authorship in an online collaborative document writing, or proof of identity on a Social Network constitute application of our proposed authentication. And if we still have time, the fourth part will be dedicated to synthetic generation of Keystroke Dynamics. Usurpation of Keystroke Dynamics, Keystroke Dynamics dataset creation or augmentation, and better understanding of Keystroke Dynamics are goals of Keystroke Dynamics synthetic generation
 
 
 
16:00h Discussion<br />
 
16:00h Discussion<br />
  
  
 
'''SPEAKER BIO''' <br/>
 
'''SPEAKER BIO''' <br/>
Markus Kont is a Researcher at the Technology branch of the NATO Cooperative Cyber Defence Centre of Excellence since 2015. His area of expertise is packet capture and log processing, DevOps tools and techniques, and data science. His current work involves researching stream processing techniques, and he is responsible for teaching network security monitoring tools in CCDCOE. In his prior life, he was server administrator in a hosting and software development company for over 5 years, focusing mostly on Linux systems and back-end infrastructure development. He holds a Master degree in Cyber Security from Tallinn University of Technology where he wrote a thesis on syslog and event correlation.  
+
Denis Migdal is PhD student at ENSICAEN in Caen, France. His PhD research project focuses on privacy protection against user profiling which can exploit biometric keystroke dynamics of normal user activity on the Web.
 
{| border="0" cellpadding="1" cellspacing="1" width="90%"
 
{| border="0" cellpadding="1" cellspacing="1" width="90%"
 
|-
 
|-

Revision as of 07:24, 16 August 2019

Red Teaming in Cyber Exercises

DATE:  30 August 2019

PLACE:  Kristan Nygaards Hall (Room 5370), IFI, UiO - OJD House .

AGENDA:
14:00h Welcom at UiO

14:15h Invited Talk:

300px
  • TALK:  Privacy Threat of Keystroke Profiling on the Web
    SPEAKER: Denis Migdal (ENSICAEN)  
    ABSTRACT: In a browser environment, Keystroke Dynamics (the way of typing on a keyboard) is an interesting biometric modality as it requires neither additional sensors (just your keyboard), nor additional actions from the user. Keystroke Dynamics can easily be collected through a Web page to authenticate, identify, or profile visitors... even without their knowledge and consent. Contrary to learning-based Keystroke Dynamics (s.a. based on Deep learning or SVM), distance-based Keystroke Dynamics can be used with very few data. However, it generally provides deceiving authentication and identification performances. In a first part, we will see how to improve such performances, and how Keystroke Dynamics can pose serious threats to users privacy, even with only few information. Fortunately, thanks to Keystroke Dynamics Anonymization Systems, it is possible to protect our Keystroke Dynamics, or at last to disturb identification and profiling systems. Several Keystroke Dynamics Anonymization Systems will be presented in the second part, as well as some recommendations to build and implement Keystroke Dynamics Anonymization Systems. In a third part, I will present a multi-modal privacy-compliant authentication based, among other, on Keystroke Dynamics, as well as some schemes and uses cases. Proof of authorship in an online collaborative document writing, or proof of identity on a Social Network constitute application of our proposed authentication. And if we still have time, the fourth part will be dedicated to synthetic generation of Keystroke Dynamics. Usurpation of Keystroke Dynamics, Keystroke Dynamics dataset creation or augmentation, and better understanding of Keystroke Dynamics are goals of Keystroke Dynamics synthetic generation

16:00h Discussion


SPEAKER BIO
Denis Migdal is PhD student at ENSICAEN in Caen, France. His PhD research project focuses on privacy protection against user profiling which can exploit biometric keystroke dynamics of normal user activity on the Web.

AFSecurity-small.png AFSecurity is organised by the UiO Research Group on Information & Cyber Security Sec-uio-light-1000.png