Vasileios Mavroeidis

• Gruschka, Nils; Mavroeidis, Vasileios; Vishi, Kamer & Jensen, Meiko (2018). Privacy Issues and Data Protection in Big Data: A Case Study Analysis under GDPR, In Naoki Abe; Huan Liu; Xiaohua Hu; Nesreen Ahmed; Mu Qiao; Yang Song; Donald Kossmann; Bing Liu; Kisung Lee; Jiliang Tang; Jingrui He & Jeffrey Saltz (ed.),  2018 IEEE International Conference on Big Data (Big Data), Seattle, 10-13 Dec. 2018.  IEEE.  ISBN 978-1-5386-5035-6.  1.  s 5027 - 5033 Show summary

  Big data has become a great asset for many organizations, promising improved operations and new business opportunities. However, big data has increased access to sensitive information that when processed can directly jeopardize the privacy of individuals and violate data protection laws. As a consequence, data controllers and data processors may be imposed tough penalties for non-compliance that can result even to bankruptcy. In this paper, we discuss the current state of the legal regulations and analyse different data protection and privacy-preserving techniques in the context of big data analysis. In addition, we present and analyse two real-life research projects as case studies dealing with sensitive data and actions for complying with the data regulation laws. We show which types of information might become a privacy risk, the employed privacy-preserving techniques in accordance with the legal requirements, and the influence of these techniques on the data processing phase and the research results.

• Mavroeidis, Vasileios & Jøsang, Audun (2018). Data-Driven Threat Hunting Using Sysmon, In Yulin Wang (ed.),  2018 the 2nd International Conference on Cryptography, Security and Privacy.  Association for Computing Machinery (ACM).  ISBN 978-1-4503-6361-7.  1.  s 82 - 88 Show summary

  Threat actors can be persistent, motivated and agile, and they leverage a diversified and extensive set of tactics, techniques, and procedures to attain their goals. In response to that, organizations establish threat intelligence programs to improve their defense capabilities and mitigate risk. Actionable threat intelligence is integrated into security information and event management systems (SIEM) forming a threat intelligence platform. A threat intelligence platform aggregates log data from multiple disparate sources by deploying numerous collection agents and provides centralized analysis and reporting of an organization's security events for identifying malicious activity. Sysmon logs is a data source that has received considerable attention for endpoint visibility. Approaches for threat detection using Sysmon have been proposed mainly focusing on search engines (NoSQL database systems). This paper presents a new automated threat assessment system that relies on the analysis of continuous incoming feeds of Sysmon logs. The system is based on a cyber threat intelligence ontology and analyses Sysmon logs to classify software in different threat levels and augment cyber defensive capabilities through situational awareness, prediction, and automated courses of action.

• Mavroeidis, Vasileios; Vishi, Kamer & Jøsang, Audun (2018). A framework for data-driven physical security and insider threat detection, In  2018 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM).  IEEE conference proceedings.  ISBN 978-1-5386-6051-5.  1.  s 1108 - 1115 Show summary

  This paper presents PS0, an ontological framework and a methodology for improving physical security and insider threat detection. PS0 can facilitate forensic data analysis and proactively mitigate insider threats by leveraging rule-based anomaly detection. In all too many cases, rule-based anomaly detection can detect employee deviations from organizational security policies. In addition, PS0 can be considered a security provenance solution because of its ability to fully reconstruct attack patterns. Provenance graphs can be further analyzed to identify deceptive actions and overcome analytical mistakes that can result in bad decision-making, such as false attribution. Moreover, the information can be used to enrich the available intelligence (about intrusion attempts) that can form use cases to detect and remediate limitations in the system, such as loosely-coupled provenance graphs that in many cases indicate weaknesses in the physical security architecture. Ultimately, validation of the framework through use cases demonstrates and proves that PS0 can improve an organization's security posture in terms of physical security and insider threat detection.

• Mavroeidis, Vasileios; Vishi, Kamer; Zych, Mateusz & Jøsang, Audun (2018). The impact of quantum computing on present cryptography. International Journal of Advanced Computer Science and Applications (IJACSA).  ISSN 2158-107X.  9(3), s 405- 414 . doi: 10.14569/IJACSA.2018.090354 Full text in Research Archive. Show summary

  The aim of this paper is to elucidate the implications of quantum computing in present cryptography and to introduce the reader to basic post-quantum algorithms. In particular the reader can delve into the following subjects: present cryptographic schemes (symmetric and asymmetric), differences between quantum and classical computing, challenges in quantum computing, quantum algorithms (Shor’s and Grover’s), public key encryption schemes affected, symmetric schemes affected, the impact on hash functions, and post quantum cryptography. Specifically, the section of Post-Quantum Cryptography deals with different quantum key distribution methods and mathematical-based solutions, such as the BB84 protocol, lattice-based cryptography, multivariate-based cryptography, hash-based signatures and code-based cryptography.

• Lison, Pierre & Mavroeidis, Vasileios (2017). Automatic Detection of Malware-Generated Domains with Recurrent Neural Models. Norsk Informasjonssikkerhetskonferanse (NISK).  ISSN 1893-6563. Show summary

  Modern malware families often rely on domain-generation algorithms (DGAs) to determine rendezvous points to their command-and-control server. Traditional defence strategies (such as blacklisting domains or IP addresses) are inadequate against such techniques due to the large and continuously changing list of domains produced by these algorithms. This paper demonstrates that a machine learning approach based on recurrent neural networks is able to detect domain names generated by DGAs with high precision. The neural models are estimated on a large training set of domains generated by various malwares. Experimental results show that this data-driven approach can detect malware-generated domain names with a F1 score of 0.971. To put it differently, the model can automatically detect 93 % of malware-generated domain names for a false positive rate of 1:100.

• Lison, Pierre & Mavroeidis, Vasileios (2017). Neural Reputation Models learned from Passive DNS data, In  IEEE Big Data 1st International Workshop on Big Data Analytic for Cyber Crime Investigation and Prevention 2017.  IEEE.  ISBN 978-1-5386-2715-0.  1.  s 3662 - 3671 Show summary

  Blacklists and whitelists are often employed to filter outgoing and incoming traffic on computer networks. One central function of these lists is to mitigate the security risks posed by malware threats by associating a reputation (for instance benign or malicious) to end-point hosts. The creation and maintenance of these lists is a complex and time-consuming process for security experts. As a consequence, blacklists and whitelists are prone to various errors, inconsistencies and omissions, as only a tiny fraction of end-point hosts are effectively covered by the reputation lists. In this paper, we present a machine learning model that is able to automatically detect whether domain names and IP addresses are benign, malicious or sinkholes. The model relies on a deep neural architecture and is trained on a large passive DNS database. Evaluation results demonstrate the effectiveness of the approach, as the model is able to detect malicious DNS records with a F1 score of 0.96. In other words, the model is able to detect 95 % of the malicious hosts with a false positive rate of 1:1000.

• Mavroeidis, Vasileios & Bromander, Siri (2017). Cyber Threat Intelligence Model: An Evaluation of Taxonomies, Sharing Standards, and Ontologies within Cyber Threat Intelligence., In Panagiotis Karampelas & Joel Brynielsson (ed.),  Proceedings of European Intelligence and Security Informatics Conference (EISIC) 2017.  IEEE conference proceedings.  ISBN 978-1-5386-2385-5.  Konferanseartikkel.
• Mavroeidis, Vasileios & Mathew, Nicho (2017). Quick Response Code Secure: A Cryptographically Secure Anti-Phishing Tool for QR Code Attacks. Lecture Notes in Computer Science (LNCS).  ISSN 0302-9743.  10446, s 313- 324 . doi: 10.1007/978-3-319-65127-9_25
• Vishi, Kamer & Mavroeidis, Vasileios (2017). An Evaluation of Score Level Fusion Approaches for Fingerprint and Finger-vein Biometrics. Norsk Informasjonssikkerhetskonferanse (NISK).  ISSN 1893-6563.  10(1), s 111- 122 Full text in Research Archive.

View all works in Cristin