Italy

We consider the problem of predicting cyber-attacks based on known Common Vulnerability &amp; Exposure (CVE) numbers. Given a CVE, we wish to answer 3 questions: (i) Will the CVE be exploited by malicious hackers? (ii) If so, when? (iii) How severe will the attack be? The answers to these questions are critical for almost all companies with significant software/hardware investments, for manufacturers of those software/hardware components, and for governments of the nations involved. In this talk, I will primarily focus on when a vulnerability will be exploited. Using a 23-month dataset gleaned from 5 sources, I will present a novel family of CAT (CVE-Author-Tweet) graphs. Each CAT graph has a massive associated system of recursive equations whose solution yields ``popularity scores’’ for the CVE-Author-Tweet nodes in the graph. Using these scores for different CAT graphs, we show a model that can predict when a vulnerability will be exploited – and we will use real world case studies to illustrate the efficacy of the approach. The talk will briefly describe progress on problems (i) and (iii) as well.

SECRYPT 2021

VEST: An Early Warning System for Future Cyber-Attacks

The mission of ENASE (Evaluation of Novel Approaches to Software Engineering) is to be a prime international forum to discuss and publish research findings and IT industry experiences with relation to novel approaches to software engineering.

ENASE 2020

We consider the problem of predicting cyber-attacks based on known Common Vulnerability & Exposure (CVE) numbers. Given a CVE, we wish to answer 3 questions: (i) Will the CVE be exploited by malicious hackers? (ii) If so, when? (iii) How severe will the attack be? The answers to these questions are critical for almost all companies with significant software/hardware investments, for manufacturers of those software/hardware components, and for governments of the nations involved. In this talk, I will primarily focus on when a vulnerability will be exploited. Using a 23-month dataset gleaned from 5 sources, I will present a novel family of CAT (CVE-Author-Tweet) graphs. Each CAT graph has a massive associated system of recursive equations whose solution yields ``popularity scores’’ for the CVE-Author-Tweet nodes in the graph. Using these scores for different CAT graphs, we show a model that can predict when a vulnerability will be exploited – and we will use real world case studies to illustrate the efficacy of the approach. The talk will briefly describe progress on problems (i) and (iii) as well.

keynote

SECRYPT is an annual international conference covering research in information and communication security. The 18th International Conference on Security and Cryptography (SECRYPT 2021) presents novel research on all theoretical and practical aspects of data protection, privacy, security, and cryptography. 

In the current digital age, data is continually being collected by organizations and governments alike. While the goal is to use this data to derive insight and improve services, the ubiquitous collection and analysis of data creates a threat to privacy. Furthermore, the digitization and centralization of data creates attractive targets for cyber criminals, with security breaches harming both individuals and organizations. In this talk, we present a vision for how privacy-preserving analytics can be done in the big data environment which will require a combination of technological advances to ensure both process and output privacy as well as socio-cognitive approaches to ensure the widespread use and deployment of such work.

Privacy-Preserving Analytics in the Big Data Environment

There havebeen a handfulof ground-breaking concepts in access control over the past half century whichhave received significanttraction in practical deployments. These include the fundamental policy-mechanism and operational-administrative distinctions, alongwith the authorization models of discretionary access control (DAC), mandatory access control (MAC), role-based access control (RBAC), attribute-based access control (ABAC) and relationship-based access control (ReBAC). In this talk we will argue that modern cyber systems require an effective convergence of these concepts, in that they must coexist in mutuallysupportive synergy. We will highlight some challenges and opportunities in making this vision a practical reality.

VEST: An Early Warning System for Future Cyber-Attacks

Downloads

Next from SECRYPT 2021

Privacy-Preserving Analytics in the Big Data Environment

Similar lecture

Software Similarities and Clones: A Curse or Blessing?

Stay up to date with the latest Underline news!

PRESENTATIONS

CONFERENCES

COMPANY

RESOURCES