Laszlo Tibor Erdodi

• Chetwyn, Robert Andrew & Erdodi, Laszlo Tibor (2026). Using Indicators of Behavior to Contextualise SQL Injection Attacks. Acta Polytechnica Hungarica (APH). ISSN 1785-8860. 23(5), s. 67–86. doi: 10.12700/APH.23.5.2026.5.4. Fulltekst i vitenarkiv
• Mishchenko, Denys; Oleinikova, Irina & Erdodi, Laszlo Tibor (2025). Coordinated Reconnaissance Strategy for Digital Substations: Risks and Countermeasures. I PowerTech, IEEE Kiel (Red.), 2025 IEEE Kiel PowerTech. IEEE (Institute of Electrical and Electronics Engineers). ISSN 9798331543976. doi: 10.1109/powertech59965.2025.11180300. Fulltekst i vitenarkiv Vis sammendrag

  Digital substations are a critical component of modern power systems, integrating advanced communication protocols to ensure reliable and efficient grid operation. However, the coexistence of protection systems using the IEC 61850 standard and monitoring systems relying on the IEEE C37.118.2-2011 protocol introduces new cybersecurity vulnerabilities. This paper explores the risks posed by coordinated reconnaissance strategy, a key phase of cyberattacks during which attackers gather intelligence about the system to identify potential points of exploitation. This strategy targeting both protocols is analyzed through a cyber-physical testbed, focusing on passive and active reconnaissance scenarios. The paper proposes a multi-stage protection framework, encompassing deterrence, prevention, detection, and mitigation measures to counter reconnaissance threats. The results highlight the importance of adopting cybersecurity strategies to safeguard digital substations and ensure the stability of modern power grids.

• Abraham, Doney; Houmb, Siv Hilde & Erdodi, Laszlo Tibor (2025). Cyber-Attacks on Energy Infrastructure—A Literature Overview and Perspectives on the Current Situation. Applied Sciences. 15(17). doi: 10.3390/app15179233. Fulltekst i vitenarkiv Vis sammendrag

  Advanced Persistent Threats (APT) are stealthy multi-step attacks, often executed over an extensive time period and tailored for a specific attack target. APTs represent a “low and slow” type of cyberattack, meaning that they most often remain undetected until the consequence of the attack becomes evident. Energy infrastructure, including power grids, oil and gas infrastructure, offshore wind installations, etc., form the basis of a modern digital nation. In addition to loss of power, financial systems, banking systems, digital national services, etc., become non-operational without electricity. Loss of power from an APT cyberattack could result in loss of life and the possibility of creating digital chaos. Digital payments becomes unavailable, digital identification is affected, and even POS terminals need to run on emergency power, which is limited in time, resulting in challenges in paying for food and beverages. Examples of Advanced Persistent Threats (APTs) targeting energy infrastructures include Triton, which in 2017 aimed to manipulate the safety systems of a petrochemical plant in Saudi Arabia, potentially leading to catastrophic physical consequences. Another significant incident is the Industroyer2 malware attack in 2022, which targeted a Ukrainian energy provider in an attempt to disrupt operations. The paper combines APT knowledge with energy infrastructure domain expertise, focusing on technical aspects while at the same time providing perspectives on societal consequences that could result from APTs.

• Erdodi, Laszlo Tibor; Abraham, Doney & Houmb, Siv Hilde (2025). Improving Detectability of Advanced Persistent Threats (APT) by Use of APT Group Digital Fingerprints. Information. 16(9). doi: 10.3390/info16090811. Fulltekst i vitenarkiv Vis sammendrag

  Over the last 15 years, cyberattacks have moved from attacking IT systems to targeted attacks on Operational Technology (OT) systems, also known as Cyber–Physical Systems (CPS). The first targeted OT cyberattack was Stuxnet in 2010, at which time the term Advanced Persistent Threat (APT) appeared. An APT often refers to a sophisticated two-stage cyberattack requiring an extensive reconnaissance period before executing the actual attack. Following Stuxnet, a sizable number of APTs have been discovered and documented. APTs are difficult to detect due to the many steps involved, the large number of attacker capabilities that are in use, and the timeline. Such attacks are carried out over an extended time period, sometimes spanning several years, which means that they cannot be recognized using signatures, anomalies, or similar patterns. APTs require detection capabilities beyond what current detection paradigms are capable of, such as behavior-based, signature-based, protocol-based, or other types of Intrusion Detection and Prevention Systems (IDS/IPS). This paper describes steps towards improving the detection of APTs by means of APT group digital fingerprints. An APT group fingerprint is a digital representation of the attacker’s capabilities, their relations and dependencies, and their technical implementation for an APT group. The fingerprint is represented as a directed graph, which models the relationships between the relevant capabilities. This paper describes part of the analysis behind establishing the APT group digital fingerprint for the Russian Cyberspace Operations Group - Sandworm.

• Hegyi, Henrietta & Erdodi, Laszlo Tibor (2025). Modern Passenger Vehicles as Cyber Threat Source: Analyses of Surveillance Options through Smart Vehicles. Acta Polytechnica Hungarica (APH). ISSN 1785-8860. 22(2), s. 9–28. doi: 10.12700/APH.22.2.2025.2.2. Fulltekst i vitenarkiv
• Marinelli, Ryan Anthony; Erdodi, Laszlo Tibor; Sommervoll, Åvald Åslaugson & Zennaro, Fabio Massimo (2024). Extending Q-Learning Agents in SQLi Environments. I Ukjent (Red.), 2024 Cyber Awareness and Research Symposium (CARS). IEEE (Institute of Electrical and Electronics Engineers). ISSN 9798350386417. doi: 10.1109/cars61786.2024.10778889. Fulltekst i vitenarkiv
• Pettersen, Storm Jon-Martin; Houmb, Siv Hilde; Kaliyar, Pallavi; Erdodi, Laszlo Tibor & Hagen, Janne Merete (2024). Testing Commercial Intrusion Detection Systems for Industrial Control Systems in a Substation Hardware in the Loop Testlab. Electronics (Basel). 13(60). doi: 10.3390/electronics13010060. Fulltekst i vitenarkiv Vis sammendrag

  Industrial Control Systems (ICS) are increasingly integrated with Information Technology (IT) systems, blending Operational Technology (OT) and IT components. This evolution introduces new cyber-attack risks, necessitating specialized security measures like Intrusion Detection Systems (IDS). This paper presents our work on both developing an experimental protocol and conducting tests of various IDS types in a digital substation hardware in the loop (HIL) testbed, offering insights into their performance in realistic scenarios. Our findings reveal significant variations in IDS effectiveness against industrial-specific cyber-attacks, with IT-specific IDSs struggling to detect certain attacks and changing testlab conditions affecting the assessment of ICS-specific IDSs. The challenges faced in creating valid and reliable evaluation metrics underscore the complexities of replicating operational ICS conditions. This research enhances our understanding of IDS effectiveness in ICS settings and underscores the importance of further experimental research in HIL testlab environments.

• Akbarzadeh, Aida; Chockalingam, Sabarathinam; Ramaj, Xhesika; Amro, Lama Mohammad Saed; Gordon, Mary Luz Sanchez & Gkioulos, Vasileios [Vis alle 10 forfattere av denne artikkelen] (2024). Workshop on Cybersecurity of Critical Infrastructures, Privacy and Identity Management. Sharing in a Digital World. Springer Nature. ISSN 9783031579783. s. 325–339. doi: https:/link.springer.com/content/pdf/10.1007/978-3-031-57978-3.pdf#page=334. Fulltekst i vitenarkiv Vis sammendrag

  This paper reports the presentation and discussion during the Cybersecurity of Critical Infrastructures workshop organized as a part of the 18 th IFIP Summer School on Privacy and Identity Management. Furthermore, this paper also pointed to several promising future research directions. This workshop was primarily aimed at empowering PhD candidates, MSc students, and early-career researchers with insights into Critical Infrastructure (CI) security. The workshop provided participants with guidance on navigating the intricacies of safeguarding CIs, such as those in the energy and oil and gas sectors. It encompasses various aspects, from familiarizing participants with cybersecurity standards and frameworks to understanding tools and approaches that adversaries might leverage to target a system. Additionally, it also addresses how to mitigate socio-legal implications and security issues, particularly in relation to human factors. This initiative embraced a holistic approach to cybersecurity education, covering vital components like rigorous risk management, comprehensive cybersecurity training and awareness programs. This in turn would equip participants with some essential knowledge and skills to fortify critical operations against the ever-evolving cyber threat landscape.

• Mishchenko, Denys; Oleinikova, Irina; Erdodi, Laszlo Tibor & Pokhrel, Basanta Raj (2024). The Impact of Stealthy Data Integrity Attacks on Wide-Area Monitoring System Applications. I Holjevac, Ninoslav; Baškarad, Tomislav; Zidar, Matija & Kuzle, Igor (Red.), 2024 IEEE PES Innovative Smart Grid Technologies Europe Conference – ISGT Europe 2024. IEEE (Institute of Electrical and Electronics Engineers). ISSN 9798350390421. doi: 10.1109/ISGTEUROPE62998.2024.10863661. Fulltekst i vitenarkiv
• Akbarzadeh, Aida; Erdodi, Laszlo Tibor; Houmb, Siv Hilde & Soltvedt, Tore Geir (2024). Two-stage advanced persistent threat (APT) attack on an IEC 61850 power grid substation. International Journal of Information Security. ISSN 1615-5262. 23, s. 2739–2758. doi: 10.1007/s10207-024-00856-6. Fulltekst i vitenarkiv
• Mishchenko, Denys; Oleinikova, Irina; Erdodi, Laszlo Tibor & Pokhrel, Basanta Raj (2024). Multidomain Cyber-Physical Testbed for Power System Vulnerability Assessment. IEEE Access. 12, s. 38135–38149. doi: 10.1109/ACCESS.2024.3375401. Fulltekst i vitenarkiv Vis sammendrag

  The rapid digitalization of power systems involves enhanced interconnectivity, intelligence, and cost-efficiency across all components. In the era of Industry 5.0, the criticality of energy supply makes power systems prime targets for attacks, highlighting the need for the creation and evaluation of solutions against cyber-physical threats. Testbeds have emerged as essential tools for these purposes by representing real-world power systems in controlled environments and simulating cyber-physical attack-defense experiments. This paper introduces a Cyber-Physical Security (CPS) testbed rooted in the Smart Grid Architecture Model (SGAM) and developed adversary setup within the National Smart Grid Laboratory at the Norwegian University of Science and Technology. By adhering to the SGAM framework, this study delves into the classification and assessment of threats within the structure of the CPS testbed, examining vulnerabilities at distinct structural levels. Significantly, the strategic placement of the adversary setup within these levels enables a comprehensive evaluation of cyber-physical vulnerabilities in simulated systems, thereby facilitating the assessment of protective measures. Furthermore, this research presents case studies using three data sources as an aggregated dynamic power system model simulated in the real-time digital simulator OPAL-RT, real power grid, and playback of previously recorded data frames using virtual phasor measurement units functionality. The focus of this work is on the analysis of the five most common cyberattacks on power systems, such as passive and active reconnaissance, interruption in communication, TCP packet injection, and men-in-the-middle attacks utilizing the C37.118.2-2011 protocol. The results of the case studies illustrate the framework for the adversary setup and provide proof-of-concept attack scenarios for evaluation purposes. As part of future work, we intend to expand upon this research with a defender setup and implement more sophisticated, stealthy attacks

• Marinelli, Ryan Anthony; Sommervoll, Åvald Åslaugson & Erdodi, Laszlo Tibor (2024). Optimizing Deployment of Homomorphic Encryption and SQL using Reinforcement Learning. I Ding, Wei (Red.), 2024 IEEE International Conference on Big Data, Dec 15 - Dec 18, 2024 • Washington DC, USA - Proceedings. IEEE (Institute of Electrical and Electronics Engineers). ISSN 9798350362480. doi: 10.1109/BigData62323.2024.10825773. Fulltekst i vitenarkiv
• Chetwyn, Robert Andrew & Erdodi, Laszlo Tibor (2023). Towards Dynamic Capture-The-Flag Training Environments For Reinforcement Learning Offensive Security Agents. I Tsumoto, Shusaku; Ohsawa, Yukio; Chen, Lei; Poel, Dirk Van den; Hu, Xiaohua; Motomura, Yoichi; Takagi, Takuya; Wu, Lingfei; Xie, Ying; Abe, Akihiro & Raghavan, Vijay (Red.), 2022 IEEE International Conference on Big Data. IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781665480451. doi: 10.1109/BigData55660.2022.10020389. Fulltekst i vitenarkiv
• Sommervoll, Åvald Åslaugson; Erdodi, Laszlo Tibor & Zennaro, Fabio Massimo (2023). Simulating all archetypes of SQL injection vulnerability exploitation using reinforcement learning agents. International Journal of Information Security. ISSN 1615-5262. doi: 10.1007/s10207-023-00738-3. Fulltekst i vitenarkiv
• Zennaro, Fabio Massimo & Erdodi, Laszlo Tibor (2023). Modelling penetration testing with reinforcement learning using capture-the-flag challenges: Trade-offs between model-free learning and a priori knowledge. IET Information Security. ISSN 1751-8709. doi: 10.1049/ise2.12107. Fulltekst i vitenarkiv Vis sammendrag

  Penetration testing is a security exercise aimed at assessing the security of a system by simulating attacks against it. So far, penetration testing has been carried out mainly by trained human attackers and its success critically depended on the available expertise. Automating this practice constitutes a non-trivial problem because of the range and complexity of actions that a human expert may attempt. The authors focus their attention on simplified penetration testing problems expressed in the form of capture the flag hacking challenges, and analyse how model-free reinforcement learning algorithms may help solving them. In modelling these capture the flag competitions as reinforcement learning problems the authors highlight the specific challenges that characterize penetration testing. The authors show how this challenge may be eased by relying on different forms of prior knowledge that may be provided to the agent. Since complexity scales exponentially as soon as the set of states and actions for the reinforcement learning agent is extended, the need to restrict the exploration space by using techniques to inject a priori knowledge is highlighted, thus making it possible to achieve solutions more efficiently.

• Akbarzadeh, Aida; Erdodi, Laszlo Tibor; Houmb, Siv Hilde; Soltvedt, Tore Geir & Muggerud, Hans Kristian (2023). Attacking IEC 61850 Substations by Targeting the PTP Protocol. Electronics (Basel). 12(12). doi: 10.3390/electronics12122596. Fulltekst i vitenarkiv Vis sammendrag

  Digital substations, also referred to as modern power grid substations, utilize the IEC 61850 station and process bus in conjunction with IP-based communication. This includes communication with switch yard equipment within the substation as well as the dispatch center. IEC 61850 is a global standard developed to standardize power grid communications, covering multiple communication needs related to modern power grid substations or digital substations. Unlike the legacy communication standards, IEC 60870-5-104 and DNP3, IEC 61850 is specifically designed for IP-based communication. It comprises several communication models and supports real-time communication by introducing the process bus to replace traditional peer-to-peer communication with standard network communication between substation equipment and the switch yard. The process bus, especially Sampled Measured Values (SMV) communication, in modern power grid substations relies on extremely accurate and synchronized time to prevent equipment damage, maintain power grid system balance, and ensure safety. In IEC 61850, time synchronization is provided by the Precision Time Protocol (PTP). This paper discusses the significance and challenges of time synchronization in IEC 61850 substations, particularly those associated with PTP. It presents the results of a controlled experiment that subjects time synchronization and PTP to cyber-attacks and discusses the potential consequences of such attacks. The paper also provides recommendations for potential mitigation strategies. The contribution of this paper is to provide insights and recommendations for enhancing the security of IEC 61850-based substations against cyber-attacks targeting time synchronization. The paper also explores the potential consequences of cyber-attacks and provides recommendations for potential mitigation strategies.

• Yamin, Muhammad Mudassar; Erdodi, Laszlo Tibor; Torseth, Espen & Katt, Basel (2022). Selecting and Training Young Cyber Talent: A Recurrent European Cyber Security Challenge Case Study. Lecture Notes in Computer Science (LNCS). ISSN 0302-9743. 13310, s. 304–321. doi: 10.1007/978-3-031-05457-0_24. Fulltekst i vitenarkiv Vis sammendrag

  Cyber security is a big challenge nowadays. However, the lack of qualified individuals and awareness is making the current situation more problematic. One way to address this problem is through National cyber security competitions. Such competitions provide large-scale awareness of cyber security issues and motivate individuals to join the cyber security workforce. ENISA (European Network and Information Security Argent) motivated European countries to organize national-level cyber security competitions in early 2014, similar to national-level football competitions. After that, ENISA organized a European-level competition similar to UEFA football league in which multiple countries participated with their national teams. This cyber security competition is known as a ECSC (European Cyber Security Challenge). Individuals aged between 14–25 participate and try to solve different cyber security challenges related to web, forensics, crypto, OSINT (Open Source Intelligence), and reversing. To select individuals and to teach those skills, different countries apply different strategies. In this study, we focus on how different countries select cyber talent and train them for national competitions and how they impact their overall cyber security ecosystem to produce skilled individuals for a cyber security workforce.

• Erdodi, Laszlo; Kaliyar, Pallavi; Houmb, Siv Hilde; Akbarzadeh, Aida & Waltoft-Olsen, Andrè Jung (2022). Attacking Power Grid Substations: An Experiment Demonstrating How to Attack the SCADA Protocol IEC 60870-5-104, ARES 2022: The 17th International Conference on Availability, Reliability and Security. Association for Computing Machinery (ACM). ISSN 9781450396707. doi: 10.1145/3538969.3544475. Fulltekst i vitenarkiv
• Kaliyar, Pallavi; Erdodi, Laszlo & Katsikas, Sokratis (2022). LIST: Lightweight Solutions for Securing IoT Devices against Mirai Malware Attack. I Yee, George O. M. (Red.), Proceedings, SECURWARE 2022, The Sixteenth International Conference on Emerging Security Information, Systems and Technologies. International Academy, Research and Industry Association (IARIA). ISSN 9781685580070. s. 63–69. Fulltekst i vitenarkiv Vis sammendrag

  Recently, the number of Internet of Things (IoT) devices has increased significantly, as they have become affordable to most people. This spread has highlighted a critical security threat, namely the increasing number of Distributed Denial of Service (DDoS) attacks. As these resource-constrained IoT devices are built to be cost-efficient, their security measures are limited. Moreover, most users are not aware of the security measures that they must apply. Nowadays, almost every IoT device (e.g., fridge, air conditioner, thermostat, toaster) is able to connect to the internet, and this allows the user to access and control it with its own smartphone application. The lack of security measures in these devices was highlighted in September 2016, when a large-scale DDoS attack was launched using a botnet of compromised IoT devices. This type of attack has been since used in different forms and has been classified as Mirai DDoS Botnet Attack. This paper presents a detailed analysis of the Mirai attack and of the source code of the Mirai malware, reports on the implementation of the attack in a controlled environment, and proposes possible solutions that could help in mitigating the attack.

• Chetwyn, Robert Andrew & Erdodi, Laszlo (2021). Cheat Detection In Cyber Security Capture The Flag Games - An Automated Cyber Threat Hunting Approach. CEUR Workshop Proceedings. Vol-3056, s. 175–190. Fulltekst i vitenarkiv
• Erdodi, Laszlo; Sommervoll, Åvald Åslaugson & Zennaro, Fabio Massimo (2021). Simulating SQL injection vulnerability exploitation using Q-learning reinforcement learning agents. Journal of Information Security and Applications. ISSN 2214-2134. 61. doi: 10.1016/j.jisa.2021.102903. Fulltekst i vitenarkiv
• Erdodi, Laszlo & Zennaro, Fabio Massimo (2021). The Agent Web Model - Modelling web hacking for reinforcement learning. International Journal of Information Security. ISSN 1615-5262. doi: 10.1007/s10207-021-00554-7. Fulltekst i vitenarkiv
• Erdodi, Laszlo & Jøsang, Audun (2020). Exploitation vs. Prevention: The ongoing saga of software vulnerabilities. Acta Polytechnica Hungarica (APH). ISSN 1785-8860. 17(7), s. 199–218. doi: 10.12700/APH.17.7.2020.7.11. Fulltekst i vitenarkiv
• Erdodi, Laszlo & Jøsang, Audun (2017). Exploit prevention, quo vadis? Lecture Notes in Computer Science (LNCS). ISSN 0302-9743. 10547 LNCS, s. 180–190. doi: 10.1007/978-3-319-68063-7_12. Fulltekst i vitenarkiv
• Ulltveit-Moe, Nils; Pfrang, Steffen; Erdödi, Lazlo & Nebot, Héctor (2016). Mitigating Local Attacks Against a City Traffic Controller. I Camp, Olivier; Furnell, Steven & Mori, Paolo (Red.), Proceedings of the 2nd International Conference on Information Systems Security and Privacy, ICISSP 2016, February 19-21, 2016, in Rome, Italy. SciTePress. ISSN 9789897581670. s. 209–218. doi: 10.5220/0005649802090218. Fulltekst i vitenarkiv Vis sammendrag

  This paper demonstrates how a local attack against a city traffic controller located in a public area can be detected and mitigated in a cost-effective way. This is done by applying a general security methodology, an architecture and a set of new and existing tools integrated by the PRECYSE EU-project. The traffic controller does not contain built-in security and is connected to an information panel which is used for displaying traffic messages. The proposed solution is integrated with the incident management system of the city traffic control centre. This allows for increasing the situation awareness about attacks, as well as supporting a workflow for restoring the attacked device to its normal state and ensuring attack investigation.

• Erdodi, Laszlo (2015). Applying Return Oriented and Jump Oriented Programming Exploitation Techniques with Heap Spraying. Acta Polytechnica Hungarica (APH). ISSN 1785-8860. 12(5), s. 155–172. Fulltekst i vitenarkiv
• Erdodi, Laszlo & Nemeth, Zoltan (2015). When Every Byte Counts – Writing Minimal Length Shellcodes. I Kovacs, Levente (Red.), 2015 IEEE 13th International Symposium on Intelligent Systems and Informatics (SISY). IEEE Press. ISSN 9781467393881. doi: 10.1109/sisy.2015.7325392. Fulltekst i vitenarkiv

Se alle arbeider i NVA

• Iversen, Fionn; Erdodi, Laszlo Tibor & Ewald, Robert (2026). Attack Scenarios and Diagnostics for the Industrial Drilling Control System. Fulltekst i vitenarkiv Vis sammendrag

  Attack Scenarios and Diagnostics for the Industrial Drilling Control System using the Dragos Platform This session presents findings from a research initiative conducted by NORCE and the Norwegian University of Science and Technology (NTNU) using the Dragos Platform to evaluate its detection capabilities against staged cyberattacks on an industrial drilling control system. By deploying Dragos in a controlled Hardware in the Loop research environment, the study put the Platform’s intrusion detection and threat characterization capabilities to the test — assessing how effectively it can identify adversary behavior at each stage of an attack chain, reduce false positives, and surface actionable insight for OT security teams operating in high-stakes upstream energy environments.

• Oleinikova, Irina & Erdodi, Laszlo Tibor (2025). Security of Wide-Area Monitoring, Protection, and Control Systems: Evaluation of Stealthy Data Integrity Attacks. Fulltekst i vitenarkiv
• Mishchenko, Denys; Oleinikova, Irina & Erdodi, Laszlo Tibor (2025). Security of Wide-Area Monitoring, Protection, and Control Systems: Evaluation of Stealthy Data Integrity Attacks. Fulltekst i vitenarkiv
• Mishchenko, Denys; Oleinikova, Irina & Erdodi, Laszlo Tibor (2025). Coordinated Reconnaissance Strategy for Digital Substations: Risks and Countermeasures. Fulltekst i vitenarkiv
• Marinelli, Ryan Anthony; Erdodi, Laszlo Tibor; Sommervoll, Åvald Åslaugson & Zennaro, Fabio Massimo (2024). Function Approximation Techniques to Empower Complex Agents for SQLi. Fulltekst i vitenarkiv Vis sammendrag

  Poster is located at https://drive.google.com/file/d/1kNmswe01EGW-Tg2tou6mToAb3NAnBPEf/view

• Mishchenko, Denys; Oleinikova, Irina; Erdodi, Laszlo Tibor & Pokhrel, Basanta Raj (2024). The Impact of Stealthy Data Integrity Attacks on Wide-Area Monitoring System Applications. Fulltekst i vitenarkiv
• Gabioud, Dominique; Erdodi, Laszlo; Basso, Gillian; Unander, Harald; Werlen, Karl & Ulltveit-Moe, Nils [Vis alle 10 forfattere av denne artikkelen] (2015). SEMIAH D3.2 – Overall System Requirements and Functional Specifications. SEMIAH Consortium. Fulltekst i vitenarkiv

Se alle arbeider i NVA