Publications

• [ Article ]
• [ Conference ]
• [ Incollection ]
• [ Inproceedings ]
• [ Mastersthesis ]
• [ Misc ]
• [ PhD thesis ]
• [ Techreport ]

• 
  Attack-Aware Security Function Chaining. Iffländer, Lukas; Beierlieb, Lukas; Kounev, Samuel; in Electronics (2024). 13(17)
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  • [ URL ]
  • [ DOI ]
  Cyberattacks have become more frequent and more violent in recent years. To date, defensive infrastructure has been relatively static, and security functions are usually placed in a common order that does not depend on the current situation. We propose the concept of attack-aware Security Service Function Chain reordering. The idea is to change the order of security functions depending on the malicious traffic observed. We present the basic idea, evaluate the impact of the function chain order, and introduce a framework for function chain reordering. Our evaluation shows that the order often has a significant impact on the performance of the security function chain and that there is no single order that outperforms all other orders in every situation. The proposed proof-of-concept framework successfully validates the feasibility of attack-aware security function chain reordering, and we propose additional extensions to eliminate the remaining deficiencies.

  @article{electronics13173357, abstract = {Cyberattacks have become more frequent and more violent in recent years. To date, defensive infrastructure has been relatively static, and security functions are usually placed in a common order that does not depend on the current situation. We propose the concept of attack-aware Security Service Function Chain reordering. The idea is to change the order of security functions depending on the malicious traffic observed. We present the basic idea, evaluate the impact of the function chain order, and introduce a framework for function chain reordering. Our evaluation shows that the order often has a significant impact on the performance of the security function chain and that there is no single order that outperforms all other orders in every situation. The proposed proof-of-concept framework successfully validates the feasibility of attack-aware security function chain reordering, and we propose additional extensions to eliminate the remaining deficiencies.}, author = {Iffländer, Lukas and Beierlieb, Lukas and Kounev, Samuel}, journal = {Electronics}, keywords = {t_journalmagazine}, number = 17, title = {Attack-Aware Security Function Chaining}, volume = 13, year = 2024 }

  %0 Journal Article %1 electronics13173357 %A Iffländer, Lukas %A Beierlieb, Lukas %A Kounev, Samuel %D 2024 %J Electronics %N 17 %R 10.3390/electronics13173357 %T Attack-Aware Security Function Chaining %U https://www.mdpi.com/2079-9292/13/17/3357 %V 13 %X Cyberattacks have become more frequent and more violent in recent years. To date, defensive infrastructure has been relatively static, and security functions are usually placed in a common order that does not depend on the current situation. We propose the concept of attack-aware Security Service Function Chain reordering. The idea is to change the order of security functions depending on the malicious traffic observed. We present the basic idea, evaluate the impact of the function chain order, and introduce a framework for function chain reordering. Our evaluation shows that the order often has a significant impact on the performance of the security function chain and that there is no single order that outperforms all other orders in every situation. The proposed proof-of-concept framework successfully validates the feasibility of attack-aware security function chain reordering, and we propose additional extensions to eliminate the remaining deficiencies.
• 
  A literature review of IoT and CPS—What they are, and what they are not. Lesch, Veronika; Z{ü}fle, Marwin; Bauer, Andr{é}; Iffl{ä}nder, Lukas; Krupitzer, Christian; Kounev, Samuel; in Journal of Systems and Software (2023). 111631.
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  • [ URL ]
  • [ Download ]
  Today, we are confronted with many concepts such as Cyber–Physical-Systems (CPS), Internet of Things (IoT), Industry 4.0, Industrial Internet, Ubiquitous Computing, Pervasive Computing and many more. Some researchers use all of these terms interchangeably, while others interpret them in ways that contradict each other. The inconsistent and interchangeable usage of these terms creates the impression that authors abuse them as buzzwords to attract attention. Hence, the question arises: Is the existence of all these terms justified? In this paper, we first look at the origin of the terms. Then, we focus on Internet of Things (IoT) and Cyber-Physical-Systems (CPS) as those terms are more often used as the others and further often seen as underlying technologies. We presentthe results of a literature review, including academic, industry and gray literature, with the objective to identify and discuss several clusters of similar statements on both terms. Building on this, we present definitions for IoT and CPS that reflect the core intuition of the terms as found in the literature review while providing a clear demarcation of the two terms. Then, we illustrate the applicability of our findings on several use cases. Finally, we discuss the relation to the other topics closely related to adaptive systems, namely Industry 4.0, Industrial Internet, Ubiquitous Computing, and Pervasive Computing.

  @article{lesch2023literature, abstract = {Today, we are confronted with many concepts such as Cyber–Physical-Systems (CPS), Internet of Things (IoT), Industry 4.0, Industrial Internet, Ubiquitous Computing, Pervasive Computing and many more. Some researchers use all of these terms interchangeably, while others interpret them in ways that contradict each other. The inconsistent and interchangeable usage of these terms creates the impression that authors abuse them as buzzwords to attract attention. Hence, the question arises: Is the existence of all these terms justified? In this paper, we first look at the origin of the terms. Then, we focus on Internet of Things (IoT) and Cyber-Physical-Systems (CPS) as those terms are more often used as the others and further often seen as underlying technologies. We presentthe results of a literature review, including academic, industry and gray literature, with the objective to identify and discuss several clusters of similar statements on both terms. Building on this, we present definitions for IoT and CPS that reflect the core intuition of the terms as found in the literature review while providing a clear demarcation of the two terms. Then, we illustrate the applicability of our findings on several use cases. Finally, we discuss the relation to the other topics closely related to adaptive systems, namely Industry 4.0, Industrial Internet, Ubiquitous Computing, and Pervasive Computing.}, author = {Lesch, Veronika and Z{\"u}fle, Marwin and Bauer, Andr{\'e} and Iffl{\"a}nder, Lukas and Krupitzer, Christian and Kounev, Samuel}, journal = {Journal of Systems and Software}, keywords = {t_journalmagazine}, pages = 111631, publisher = {Elsevier}, title = {A literature review of IoT and CPS—What they are, and what they are not}, year = 2023 }

  %0 Journal Article %1 lesch2023literature %A Lesch, Veronika %A Z{ü}fle, Marwin %A Bauer, Andr{é} %A Iffl{ä}nder, Lukas %A Krupitzer, Christian %A Kounev, Samuel %D 2023 %I Elsevier %J Journal of Systems and Software %P 111631 %T A literature review of IoT and CPS—What they are, and what they are not %U https://www.sciencedirect.com/science/article/pii/S0164121223000262 %X Today, we are confronted with many concepts such as Cyber–Physical-Systems (CPS), Internet of Things (IoT), Industry 4.0, Industrial Internet, Ubiquitous Computing, Pervasive Computing and many more. Some researchers use all of these terms interchangeably, while others interpret them in ways that contradict each other. The inconsistent and interchangeable usage of these terms creates the impression that authors abuse them as buzzwords to attract attention. Hence, the question arises: Is the existence of all these terms justified? In this paper, we first look at the origin of the terms. Then, we focus on Internet of Things (IoT) and Cyber-Physical-Systems (CPS) as those terms are more often used as the others and further often seen as underlying technologies. We presentthe results of a literature review, including academic, industry and gray literature, with the objective to identify and discuss several clusters of similar statements on both terms. Building on this, we present definitions for IoT and CPS that reflect the core intuition of the terms as found in the literature review while providing a clear demarcation of the two terms. Then, we illustrate the applicability of our findings on several use cases. Finally, we discuss the relation to the other topics closely related to adaptive systems, namely Industry 4.0, Industrial Internet, Ubiquitous Computing, and Pervasive Computing.
• 
  Recommendation of Secure Group Communication Schemes using Multi Objective Optimization. Prantl, Thomas; Bauer, André; Iffländer, Lukas; Krupitzer, Christian; Kounev, Samuel; in International Journal of Information Security (2023).
  • [ BibTeX ]
  • [ EndNote ]
  @article{PrBaIfKrKo_IJoIS_SGC_Pareto, author = {Prantl, Thomas and Bauer, André and Iffländer, Lukas and Krupitzer, Christian and Kounev, Samuel}, journal = {International Journal of Information Security}, keywords = {t_journalmagazine}, title = {Recommendation of Secure Group Communication Schemes using Multi Objective Optimization}, year = 2023 }

  %0 Journal Article %1 PrBaIfKrKo_IJoIS_SGC_Pareto %A Prantl, Thomas %A Bauer, André %A Iffländer, Lukas %A Krupitzer, Christian %A Kounev, Samuel %D 2023 %J International Journal of Information Security %T Recommendation of Secure Group Communication Schemes using Multi Objective Optimization
• 
  Technologie- und Securityprognose System Bahn – Bedrohungen rechtzeitig erkennen. Heinrich, Markus; Iffländer, Lukas; Scheuermann, Dirk; Katzenbeisser, Stefan; Unger, Simon; in Signal+Draht (2022). 114 96–103.
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  Im Rahmen des Forschungsprojekts „Prognose Securitybedarf und Bewertung möglicher Sicherheitskonzepte für das System Bahn“ wurden Prognosen erstellt, wie digitale Technologien im System Bahn künftig eingesetzt werden und wie diese durch Angriffe missbraucht werden können. Die Beschreibungen der Angriffe wiederum erlaubten eine Abschätzung künftiger Bedrohungen, die durch Standards oder Normen behandelt werden müssen.

  @article{heinrich2022technology, abstract = {Im Rahmen des Forschungsprojekts „Prognose Securitybedarf und Bewertung möglicher Sicherheitskonzepte für das System Bahn“ wurden Prognosen erstellt, wie digitale Technologien im System Bahn künftig eingesetzt werden und wie diese durch Angriffe missbraucht werden können. Die Beschreibungen der Angriffe wiederum erlaubten eine Abschätzung künftiger Bedrohungen, die durch Standards oder Normen behandelt werden müssen.}, author = {Heinrich, Markus and Iffländer, Lukas and Scheuermann, Dirk and Katzenbeisser, Stefan and Unger, Simon}, journal = {Signal+Draht}, keywords = {myown}, month = {09}, pages = {96-103}, title = {Technologie- und Securityprognose System Bahn – Bedrohungen rechtzeitig erkennen}, volume = 114, year = 2022 }

  %0 Journal Article %1 heinrich2022technology %A Heinrich, Markus %A Iffländer, Lukas %A Scheuermann, Dirk %A Katzenbeisser, Stefan %A Unger, Simon %D 2022 %J Signal+Draht %P 96-103 %T Technologie- und Securityprognose System Bahn – Bedrohungen rechtzeitig erkennen %V 114 %X Im Rahmen des Forschungsprojekts „Prognose Securitybedarf und Bewertung möglicher Sicherheitskonzepte für das System Bahn“ wurden Prognosen erstellt, wie digitale Technologien im System Bahn künftig eingesetzt werden und wie diese durch Angriffe missbraucht werden können. Die Beschreibungen der Angriffe wiederum erlaubten eine Abschätzung künftiger Bedrohungen, die durch Standards oder Normen behandelt werden müssen.
• 
  Technology and security forecast for the railway system – the timely identification of threats. Heinrich, Markus; Iffländer, Lukas; Scheuermann, Dirk; Katzenbeisser, Stefan; Unger, Simon; in Signalling+Datacommunication (2022). 114 96–103.
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  Prognoses pertaining to the application of digital technology in the railway system and its abuse through attacks have been undertaken as part of the „Security Requirements Forecast and Evaluation of Possible Security Concepts for the Railway System” research project. They in turn have allowed us to assess any future threats that have yet to be considered by the standards or norms.

  @article{noauthororeditor, abstract = {Prognoses pertaining to the application of digital technology in the railway system and its abuse through attacks have been undertaken as part of the „Security Requirements Forecast and Evaluation of Possible Security Concepts for the Railway System” research project. They in turn have allowed us to assess any future threats that have yet to be considered by the standards or norms.}, author = {Heinrich, Markus and Iffländer, Lukas and Scheuermann, Dirk and Katzenbeisser, Stefan and Unger, Simon}, journal = {Signalling+Datacommunication}, keywords = {select}, month = {09}, pages = {96-103}, title = {Technology and security forecast for the railway system – the timely identification of threats}, volume = 114, year = 2022 }

  %0 Journal Article %1 noauthororeditor %A Heinrich, Markus %A Iffländer, Lukas %A Scheuermann, Dirk %A Katzenbeisser, Stefan %A Unger, Simon %D 2022 %J Signalling+Datacommunication %P 96-103 %T Technology and security forecast for the railway system – the timely identification of threats %V 114 %X Prognoses pertaining to the application of digital technology in the railway system and its abuse through attacks have been undertaken as part of the „Security Requirements Forecast and Evaluation of Possible Security Concepts for the Railway System” research project. They in turn have allowed us to assess any future threats that have yet to be considered by the standards or norms.
• 
  Softwaregestützte Bedrohungsanalyse durch Angriffsgraphen. Heinrich, Markus; Iffländer, Lukas; in Signal + Draht (2022). 114 28–34.
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  Zur Bestimmung von Bedarfen im Cybersecurity-Kontext ist eine Bewertung der Bedrohungen unter anderem nach Auswirkung und Eintrittswahrscheinlichkeit notwendig. Bisherige Softwarewerkzeuge sind nicht in der Lage, die Komplexität im Eisenbahnsektor ausreichend abzubilden. Die Methodik der Angriffsgraphen und ein quelloffenes Softwarewerkzeug unterstützen die Risikoanalyse der IT- und OT-Sicherheit durch Darstellung der Bedrohungen und ihrer Wirkung auf das Asset. Die vorgenommene Bewertung in einem Attributvektor wird durch das Werkzeug zu einem Gesamtrisiko aggregiert. Die Aggregation erfolgt unter Berücksichtigung der bereits etablierten Gegenmaßnahmen und ihrer risikomindernden Wirkung.

  @article{heinrich2022softwaregesttzte, abstract = {Zur Bestimmung von Bedarfen im Cybersecurity-Kontext ist eine Bewertung der Bedrohungen unter anderem nach Auswirkung und Eintrittswahrscheinlichkeit notwendig. Bisherige Softwarewerkzeuge sind nicht in der Lage, die Komplexität im Eisenbahnsektor ausreichend abzubilden. Die Methodik der Angriffsgraphen und ein quelloffenes Softwarewerkzeug unterstützen die Risikoanalyse der IT- und OT-Sicherheit durch Darstellung der Bedrohungen und ihrer Wirkung auf das Asset. Die vorgenommene Bewertung in einem Attributvektor wird durch das Werkzeug zu einem Gesamtrisiko aggregiert. Die Aggregation erfolgt unter Berücksichtigung der bereits etablierten Gegenmaßnahmen und ihrer risikomindernden Wirkung.}, author = {Heinrich, Markus and Iffländer, Lukas}, journal = {Signal + Draht}, keywords = {security}, month = {05}, pages = {28-34}, title = {Softwaregestützte Bedrohungsanalyse durch Angriffsgraphen}, volume = 114, year = 2022 }

  %0 Journal Article %1 heinrich2022softwaregesttzte %A Heinrich, Markus %A Iffländer, Lukas %D 2022 %J Signal + Draht %P 28-34 %T Softwaregestützte Bedrohungsanalyse durch Angriffsgraphen %V 114 %X Zur Bestimmung von Bedarfen im Cybersecurity-Kontext ist eine Bewertung der Bedrohungen unter anderem nach Auswirkung und Eintrittswahrscheinlichkeit notwendig. Bisherige Softwarewerkzeuge sind nicht in der Lage, die Komplexität im Eisenbahnsektor ausreichend abzubilden. Die Methodik der Angriffsgraphen und ein quelloffenes Softwarewerkzeug unterstützen die Risikoanalyse der IT- und OT-Sicherheit durch Darstellung der Bedrohungen und ihrer Wirkung auf das Asset. Die vorgenommene Bewertung in einem Attributvektor wird durch das Werkzeug zu einem Gesamtrisiko aggregiert. Die Aggregation erfolgt unter Berücksichtigung der bereits etablierten Gegenmaßnahmen und ihrer risikomindernden Wirkung.
• 
  Software-supported threat analysis using attack graphs. Heinrich, Markus; Iffländer, Lukas; in Signalling & Datacommunication (2022). 114 28–34.
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  Threat assessments, including assessments of their impact and probability of occurrence, are necessary in order to determine the requirements within the cybersecurity context. Previous software tools have not been able to adequately depict the complexity of the railway sector. The attack graph methodology supported by an open-source software tool supports IT and OT security risk analysis by displaying the threats and their effects on the asset. The tool aggregates the assessment made in an attribute vector in order to form an overall risk that takes into consideration any established countermeasures and their risk-reducing effect.

  @article{heinrich2022softwaresupported, abstract = {Threat assessments, including assessments of their impact and probability of occurrence, are necessary in order to determine the requirements within the cybersecurity context. Previous software tools have not been able to adequately depict the complexity of the railway sector. The attack graph methodology supported by an open-source software tool supports IT and OT security risk analysis by displaying the threats and their effects on the asset. The tool aggregates the assessment made in an attribute vector in order to form an overall risk that takes into consideration any established countermeasures and their risk-reducing effect.}, author = {Heinrich, Markus and Iffländer, Lukas}, journal = {Signalling & Datacommunication}, keywords = {security}, month = {05}, pages = {28-34}, title = {Software-supported threat analysis using attack graphs}, volume = 114, year = 2022 }

  %0 Journal Article %1 heinrich2022softwaresupported %A Heinrich, Markus %A Iffländer, Lukas %D 2022 %J Signalling & Datacommunication %P 28-34 %T Software-supported threat analysis using attack graphs %V 114 %X Threat assessments, including assessments of their impact and probability of occurrence, are necessary in order to determine the requirements within the cybersecurity context. Previous software tools have not been able to adequately depict the complexity of the railway sector. The attack graph methodology supported by an open-source software tool supports IT and OT security risk analysis by displaying the threats and their effects on the asset. The tool aggregates the assessment made in an attribute vector in order to form an overall risk that takes into consideration any established countermeasures and their risk-reducing effect.
• 
  A Survey on Secure Group Communication Schemes with Focus on IoT Communication. Prantl, Thomas; Zeck, Timo; Bauer, André; Ten, Peter; Prantl, Dominik; Ben Yahya, Ala Eddine; Iffländer, Lukas; Dmitrienko, Alexandra; Krupitzer, Christian; Kounev, Samuel; in IEEE Access (2022).

  Accepted but not yet published
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  @article{PrZeBaTePrYaIfDmKrKo_IEEEAccess_SGCSurvey, author = {Prantl, Thomas and Zeck, Timo and Bauer, André and Ten, Peter and Prantl, Dominik and Ben Yahya, Ala Eddine and Iffländer, Lukas and Dmitrienko, Alexandra and Krupitzer, Christian and Kounev, Samuel}, journal = {IEEE Access}, keywords = {t_journalmagazine}, note = {Accepted but not yet published}, publisher = {IEEE}, title = {A Survey on Secure Group Communication Schemes with Focus on IoT Communication}, year = 2022 }

  %0 Journal Article %1 PrZeBaTePrYaIfDmKrKo_IEEEAccess_SGCSurvey %A Prantl, Thomas %A Zeck, Timo %A Bauer, André %A Ten, Peter %A Prantl, Dominik %A Ben Yahya, Ala Eddine %A Iffländer, Lukas %A Dmitrienko, Alexandra %A Krupitzer, Christian %A Kounev, Samuel %D 2022 %I IEEE %J IEEE Access %T A Survey on Secure Group Communication Schemes with Focus on IoT Communication
• 
  Demonstrating the Prospects of Dynamic Application-Aware Networking in a Home Environment. Wamser, Florian; Zinner, Thomas; Iffländer, Lukas; Tran-Gia, Phuoc; in ACM SIGCOMM Computer Communication Review (2015). 44(4) 149–150.
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  @article{wamser2015demonstrating, author = {Wamser, Florian and Zinner, Thomas and Iffländer, Lukas and Tran-Gia, Phuoc}, journal = {ACM SIGCOMM Computer Communication Review}, keywords = {t_journalmagazine}, month = {08}, number = 4, pages = {149–150}, publisher = {ACM}, title = {Demonstrating the Prospects of Dynamic Application-Aware Networking in a Home Environment}, volume = 44, year = 2015 }

  %0 Journal Article %1 wamser2015demonstrating %A Wamser, Florian %A Zinner, Thomas %A Iffländer, Lukas %A Tran-Gia, Phuoc %D 2015 %I ACM %J ACM SIGCOMM Computer Communication Review %N 4 %P 149--150 %T Demonstrating the Prospects of Dynamic Application-Aware Networking in a Home Environment %V 44

• 
  Ransomware Detection in Databases through Dynamic Analysis of Query Sequences. Sendner, Christoph; Iffländer, Lukas; Schindler, Sebastian; Jobst, Michael; Dmitrienko, Alexandra; Kounev, Samuel; in 2022 IEEE Conference on Communications and Network Security (CNS) (2022).
  • [ BibTeX ]
  • [ EndNote ]
  @conference{sendner2022ransomware, author = {Sendner, Christoph and Iffländer, Lukas and Schindler, Sebastian and Jobst, Michael and Dmitrienko, Alexandra and Kounev, Samuel}, booktitle = {2022 IEEE Conference on Communications and Network Security (CNS)}, keywords = {sss-group}, title = {Ransomware Detection in Databases through Dynamic Analysis of Query Sequences}, year = 2022 }

  %0 Generic %1 sendner2022ransomware %A Sendner, Christoph %A Iffländer, Lukas %A Schindler, Sebastian %A Jobst, Michael %A Dmitrienko, Alexandra %A Kounev, Samuel %B 2022 IEEE Conference on Communications and Network Security (CNS) %D 2022 %T Ransomware Detection in Databases through Dynamic Analysis of Query Sequences

• 
  Der Grader PABS. Iffländer, Lukas; Dallmann, Alexander; in Automatische Bewertung in der Programmierausbildung, O. J. Bott, P. Fricke, U. Priss, M. Striewe (Hrsg.) (2017). (Bd. 6) 241–254.
  • [ BibTeX ]
  • [ EndNote ]
  @incollection{IfDaPabs, author = {Iffländer, Lukas and Dallmann, Alexander}, booktitle = {Automatische Bewertung in der Programmierausbildung}, chapter = 15, editor = {Bott, Oliver J. and Fricke, Peter and Priss, Uta and Striewe, Michael}, keywords = {t_bookchapter}, pages = {241-254}, publisher = {ELAN e.V. and Waxmann Verlag}, series = {Digitale Medien in der Hochschullehre}, title = {Der Grader PABS}, volume = 6, year = 2017 }

  %0 Book Section %1 IfDaPabs %A Iffländer, Lukas %A Dallmann, Alexander %B Automatische Bewertung in der Programmierausbildung %D 2017 %E Bott, Oliver J. %E Fricke, Peter %E Priss, Uta %E Striewe, Michael %I ELAN e.V. and Waxmann Verlag %P 241-254 %T Der Grader PABS %V 6 %& 15

• 
  Cybersecurity in the German Railway Sector. Möller, Dietmar; Iffländer, Lukas; Nord, Michael; Leppla, Bernd; Krause, Patrick; Czerkewski, Peter; Lenski, Nikolai; Mühl, Kristin; in Proceedings of the 17th International Conference on Critical Information Infrastructure Security (CRITIS 2022) (2022).
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  Cybersecurity breaches are on the rise. Due to increased network interconnection, industrial systems are becoming more attractive targets for such attacks. Therefore, various industries must acquire knowledge and experience regarding cybersecurity for their IT and OT systems. One such sector is the safety-critical railway and public transport sector. Technological leaps like digital interlocking, fifth-generation networking, and the move from proprietary field busses to IP networking are driving the sector into an interconnected age. This work scrutinizes the sector’s cybersecurity awareness, knowledge, and preparedness. To this end, we created a two-stage study comprising a quantitative online survey to gain comprehensive insight and qualitative interviews to deepen selected issues in a SWOT analysis. The results show that the sector still has a long way to go regarding cybersecurity, with the average company not meeting basic implementation levels. Furthermore, we identified multiple factors contributing to this result. Key issues are a lack of staff and management sensitivity to cybersecurity and support from authorities.

  @inproceedings{moller2022cybersecurity, abstract = {Cybersecurity breaches are on the rise. Due to increased network interconnection, industrial systems are becoming more attractive targets for such attacks. Therefore, various industries must acquire knowledge and experience regarding cybersecurity for their IT and OT systems. One such sector is the safety-critical railway and public transport sector. Technological leaps like digital interlocking, fifth-generation networking, and the move from proprietary field busses to IP networking are driving the sector into an interconnected age. This work scrutinizes the sector’s cybersecurity awareness, knowledge, and preparedness. To this end, we created a two-stage study comprising a quantitative online survey to gain comprehensive insight and qualitative interviews to deepen selected issues in a SWOT analysis. The results show that the sector still has a long way to go regarding cybersecurity, with the average company not meeting basic implementation levels. Furthermore, we identified multiple factors contributing to this result. Key issues are a lack of staff and management sensitivity to cybersecurity and support from authorities.}, author = {Möller, Dietmar and Iffländer, Lukas and Nord, Michael and Leppla, Bernd and Krause, Patrick and Czerkewski, Peter and Lenski, Nikolai and Mühl, Kristin}, booktitle = {Proceedings of the 17th International Conference on Critical Information Infrastructure Security (CRITIS 2022)}, keywords = {security}, month = {09}, publisher = {Springer}, title = {Cybersecurity in the German Railway Sector}, year = 2022 }

  %0 Conference Paper %1 moller2022cybersecurity %A Möller, Dietmar %A Iffländer, Lukas %A Nord, Michael %A Leppla, Bernd %A Krause, Patrick %A Czerkewski, Peter %A Lenski, Nikolai %A Mühl, Kristin %B Proceedings of the 17th International Conference on Critical Information Infrastructure Security (CRITIS 2022) %D 2022 %I Springer %T Cybersecurity in the German Railway Sector %X Cybersecurity breaches are on the rise. Due to increased network interconnection, industrial systems are becoming more attractive targets for such attacks. Therefore, various industries must acquire knowledge and experience regarding cybersecurity for their IT and OT systems. One such sector is the safety-critical railway and public transport sector. Technological leaps like digital interlocking, fifth-generation networking, and the move from proprietary field busses to IP networking are driving the sector into an interconnected age. This work scrutinizes the sector’s cybersecurity awareness, knowledge, and preparedness. To this end, we created a two-stage study comprising a quantitative online survey to gain comprehensive insight and qualitative interviews to deepen selected issues in a SWOT analysis. The results show that the sector still has a long way to go regarding cybersecurity, with the average company not meeting basic implementation levels. Furthermore, we identified multiple factors contributing to this result. Key issues are a lack of staff and management sensitivity to cybersecurity and support from authorities.
• 
  Emerging Technologies in the Era of Digital Transformation: State of the Art in the Railway Sector. Möller, Dietmar; Iffländer, Lukas; Nord, Michael; Krause, Patrik; Leppla, Bernd; Mühl, Kristin; Lenski, Nikolai; Czerkewski, Peter; in Proceedings of the 19th International Conference on Informatics in Control, Automation and Robotics - ICINCO, (2022). 721–728.
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  • [ URL ]
  • [ DOI ]
  • [ Download ]
  Emerging technologies and digital transformation are essential indicators in today’s industrial sectors. The railway and public transportation sectors are undergoing a substantial transformation through digitalization and emerging technologies. However, little is known about the manifold of applications in the industrial sectors and progress so far. In this study, we consider various emerging technologies and proposed use-cases. Next, using a two-step survey and a SWOTA analysis, we analyze both sector’s maturity levels regarding these technologies. The analysis indicates technologies currently permeating the analyzed sectors, shows discrepancies between technology application and knowledge, and multiple issues hamper their implementation.

  @inproceedings{icinco22, abstract = {Emerging technologies and digital transformation are essential indicators in today’s industrial sectors. The railway and public transportation sectors are undergoing a substantial transformation through digitalization and emerging technologies. However, little is known about the manifold of applications in the industrial sectors and progress so far. In this study, we consider various emerging technologies and proposed use-cases. Next, using a two-step survey and a SWOTA analysis, we analyze both sector’s maturity levels regarding these technologies. The analysis indicates technologies currently permeating the analyzed sectors, shows discrepancies between technology application and knowledge, and multiple issues hamper their implementation.}, author = {Möller, Dietmar and Iffländer, Lukas and Nord, Michael and Krause, Patrik and Leppla, Bernd and Mühl, Kristin and Lenski, Nikolai and Czerkewski, Peter}, booktitle = {Proceedings of the 19th International Conference on Informatics in Control, Automation and Robotics - ICINCO,}, keywords = {security}, organization = {INSTICC}, pages = {721-728}, publisher = {SciTePress}, title = {Emerging Technologies in the Era of Digital Transformation: State of the Art in the Railway Sector}, year = 2022 }

  %0 Conference Paper %1 icinco22 %A Möller, Dietmar %A Iffländer, Lukas %A Nord, Michael %A Krause, Patrik %A Leppla, Bernd %A Mühl, Kristin %A Lenski, Nikolai %A Czerkewski, Peter %B Proceedings of the 19th International Conference on Informatics in Control, Automation and Robotics - ICINCO, %D 2022 %I SciTePress %P 721-728 %R 10.5220/0011141900003271 %T Emerging Technologies in the Era of Digital Transformation: State of the Art in the Railway Sector %U https://www.scitepress.org/PublicationsDetail.aspx?ID=oWO4/Loc7rw=&t=1 %X Emerging technologies and digital transformation are essential indicators in today’s industrial sectors. The railway and public transportation sectors are undergoing a substantial transformation through digitalization and emerging technologies. However, little is known about the manifold of applications in the industrial sectors and progress so far. In this study, we consider various emerging technologies and proposed use-cases. Next, using a two-step survey and a SWOTA analysis, we analyze both sector’s maturity levels regarding these technologies. The analysis indicates technologies currently permeating the analyzed sectors, shows discrepancies between technology application and knowledge, and multiple issues hamper their implementation. %@ 978-989-758-585-2
• 
  Towards a Cryptography Benchmark: A View on Attribute Based Encryption Schemes. Prantl, Thomas; Zeck, Timo; Iffländer, Lukas; Beierlieb, Lukas; Dmitrenko, Alexandra; Krupitzer, Christian; Kounev, Samuel; in 2022 5th Conference on Cloud and Internet of Things (CIoT) (2022).
  • [ BibTeX ]
  • [ EndNote ]
  @inproceedings{PrZeIfBeDmKrKo2022-CIoT-ABEBenchmark, author = {Prantl, Thomas and Zeck, Timo and Iffländer, Lukas and Beierlieb, Lukas and Dmitrenko, Alexandra and Krupitzer, Christian and Kounev, Samuel}, booktitle = {2022 5th Conference on Cloud and Internet of Things (CIoT)}, keywords = {descartes}, organization = {IEEE}, title = {Towards a Cryptography Benchmark: A View on Attribute Based Encryption Schemes}, year = 2022 }

  %0 Conference Paper %1 PrZeIfBeDmKrKo2022-CIoT-ABEBenchmark %A Prantl, Thomas %A Zeck, Timo %A Iffländer, Lukas %A Beierlieb, Lukas %A Dmitrenko, Alexandra %A Krupitzer, Christian %A Kounev, Samuel %B 2022 5th Conference on Cloud and Internet of Things (CIoT) %D 2022 %T Towards a Cryptography Benchmark: A View on Attribute Based Encryption Schemes
• 
  An Experience Report on the Suitability of a Distributed Group Encryption Scheme for an IoT Use Case. Prantl, Thomas; Engel, Simon; Bauer, Andre; Ben Yahya, Ala Eddine; Herrnleben, Stefan; Iffländer, Lukas; Dmitrienko, Alexandra; Kounev, Samuel; in 2022 IEEE 95th Vehicular Technology Conference (VTC2022) (2022).
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  @inproceedings{PrEnBaAlHeIfDmKo2022-IoT/CPS-DistributedGroupEncryption, author = {Prantl, Thomas and Engel, Simon and Bauer, Andre and Ben Yahya, Ala Eddine and Herrnleben, Stefan and Iffländer, Lukas and Dmitrienko, Alexandra and Kounev, Samuel}, booktitle = {2022 IEEE 95th Vehicular Technology Conference (VTC2022)}, keywords = {t_workshop}, organization = {IEEE}, title = {An Experience Report on the Suitability of a Distributed Group Encryption Scheme for an IoT Use Case}, year = 2022 }

  %0 Conference Paper %1 PrEnBaAlHeIfDmKo2022-IoT/CPS-DistributedGroupEncryption %A Prantl, Thomas %A Engel, Simon %A Bauer, Andre %A Ben Yahya, Ala Eddine %A Herrnleben, Stefan %A Iffländer, Lukas %A Dmitrienko, Alexandra %A Kounev, Samuel %B 2022 IEEE 95th Vehicular Technology Conference (VTC2022) %D 2022 %T An Experience Report on the Suitability of a Distributed Group Encryption Scheme for an IoT Use Case
• 
  Software-gestützte Bedrohungsanalyse durch Angriffsgraphen. Heinrich, Markus; Iffl{ä}nder, Lukas; in Scientific Railway Signalling Symposium 2022 - Mehr Schiene - mehr Klimaschutz: Wie kann die Bahn das wachsende Verkehrsaufkommen nachhaltig meistern?, A. Oetting (Hrsg.) (2022). 19–26.
  • [ BibTeX ]
  • [ EndNote ]
  • [ URL ]
  • [ DOI ]
  • [ Download ]
  @inproceedings{tuprints22101, address = {Darmstadt}, author = {Heinrich, Markus and Iffl{\"a}nder, Lukas}, booktitle = {Scientific Railway Signalling Symposium 2022 - Mehr Schiene - mehr Klimaschutz: Wie kann die Bahn das wachsende Verkehrsaufkommen nachhaltig meistern?}, editor = {Oetting, Andreas}, keywords = {security}, pages = {19-26}, title = {Software-gestützte Bedrohungsanalyse durch Angriffsgraphen}, year = 2022 }

  %0 Conference Paper %1 tuprints22101 %A Heinrich, Markus %A Iffl{ä}nder, Lukas %B Scientific Railway Signalling Symposium 2022 - Mehr Schiene - mehr Klimaschutz: Wie kann die Bahn das wachsende Verkehrsaufkommen nachhaltig meistern? %C Darmstadt %D 2022 %E Oetting, Andreas %P 19-26 %R https://doi.org/10.26083/tuprints-00022101 %T Software-gestützte Bedrohungsanalyse durch Angriffsgraphen %U http://tuprints.ulb.tu-darmstadt.de/22101/
• 
  Measuring the Performance Impact of Branching Instructions. Beierlieb, Lukas; Iffländer, Lukas; Milenkoski, Aleksandar; Prantl, Thomas; Kounev, Samuel; in Proceedings of the 12th Symposium on Software Performance 2021 (SSP’21) (2021).
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  @inproceedings{Beierlieb_2021_MeasuringthePerformanceImpactofBranchingInstructions., author = {Beierlieb, Lukas and Iffländer, Lukas and Milenkoski, Aleksandar and Prantl, Thomas and Kounev, Samuel}, booktitle = {Proceedings of the 12th Symposium on Software Performance 2021 (SSP'21)}, keywords = {sys:relevantfor:se-group}, month = 11, title = {Measuring the Performance Impact of Branching Instructions}, year = 2021 }

  %0 Conference Paper %1 Beierlieb_2021_MeasuringthePerformanceImpactofBranchingInstructions. %A Beierlieb, Lukas %A Iffländer, Lukas %A Milenkoski, Aleksandar %A Prantl, Thomas %A Kounev, Samuel %B Proceedings of the 12th Symposium on Software Performance 2021 (SSP'21) %D 2021 %T Measuring the Performance Impact of Branching Instructions
• 
  Towards a Group Encryption Scheme Benchmark: A View on Centralized Schemes with focus on IoT. Prantl, Thomas; Ten, Peter; Iffländer, Lukas; Herrnleben, Stefan; Dmitrenko, Alexandra; Kounev, Samuel; Krupitzer, Christian; in 2021 ACM/SPEC International Conference on Performance Engineering (ICPE) (2021).
  • [ BibTeX ]
  • [ EndNote ]
  @inproceedings{PrTeIfHeDmKo2021-ICPE-GroupEncryptionCentralizedBenchmark, author = {Prantl, Thomas and Ten, Peter and Iffländer, Lukas and Herrnleben, Stefan and Dmitrenko, Alexandra and Kounev, Samuel and Krupitzer, Christian}, booktitle = {2021 ACM/SPEC International Conference on Performance Engineering (ICPE)}, keywords = {Group\_Encyrption\_Scheme}, month = {04}, series = {ICPE'21}, title = {Towards a Group Encryption Scheme Benchmark: A View on Centralized Schemes with focus on IoT}, year = 2021 }

  %0 Conference Paper %1 PrTeIfHeDmKo2021-ICPE-GroupEncryptionCentralizedBenchmark %A Prantl, Thomas %A Ten, Peter %A Iffländer, Lukas %A Herrnleben, Stefan %A Dmitrenko, Alexandra %A Kounev, Samuel %A Krupitzer, Christian %B 2021 ACM/SPEC International Conference on Performance Engineering (ICPE) %D 2021 %T Towards a Group Encryption Scheme Benchmark: A View on Centralized Schemes with focus on IoT
• 
  Performance Impact Analysis of Securing MQTT Using TLS. Prantl, Thomas; Iffländer, Lukas; Herrnleben, Stefan; Engel, Simon; Kounev, Samuel; Krupitzer, Christian; in 2021 ACM/SPEC International Conference on Performance Engineering (ICPE) (2021).
  • [ BibTeX ]
  • [ EndNote ]
  @inproceedings{PrTeIfHeDmKo2021-ICPE-MQTT_TLS, author = {Prantl, Thomas and Iffländer, Lukas and Herrnleben, Stefan and Engel, Simon and Kounev, Samuel and Krupitzer, Christian}, booktitle = {2021 ACM/SPEC International Conference on Performance Engineering (ICPE)}, keywords = {IoT}, month = {04}, series = {ICPE'21}, title = {Performance Impact Analysis of Securing MQTT Using TLS}, year = 2021 }

  %0 Conference Paper %1 PrTeIfHeDmKo2021-ICPE-MQTT_TLS %A Prantl, Thomas %A Iffländer, Lukas %A Herrnleben, Stefan %A Engel, Simon %A Kounev, Samuel %A Krupitzer, Christian %B 2021 ACM/SPEC International Conference on Performance Engineering (ICPE) %D 2021 %T Performance Impact Analysis of Securing MQTT Using TLS
• 
  Teaching Software Testing Using Automated Grading. Beierlieb, Lukas; Iffländer, Lukas; Schneider, Tobias; Prantl, Thomas; Kounev, Samuel; in Proceedings of the Fifth Workshop "Automatische Bewertung von Programmieraufgaben" (ABP 2021),virtual event, October 28-29, 2021, A. Greubel, S. Strickroth, M. Striewe (Hrsg.) (2021).
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  @inproceedings{Beierlieb_2021_TeachingSoftwareTestingUsingAutomatedGrading, author = {Beierlieb, Lukas and Iffländer, Lukas and Schneider, Tobias and Prantl, Thomas and Kounev, Samuel}, booktitle = {Proceedings of the Fifth Workshop "Automatische Bewertung von Programmieraufgaben" (ABP 2021),virtual event, October 28-29, 2021}, editor = {Greubel, André and Strickroth, Sven and Striewe, Michael}, keywords = {sys:relevantfor:se-group}, publisher = {Gesellschaft für Informatik}, title = {Teaching Software Testing Using Automated Grading}, year = 2021 }

  %0 Conference Paper %1 Beierlieb_2021_TeachingSoftwareTestingUsingAutomatedGrading %A Beierlieb, Lukas %A Iffländer, Lukas %A Schneider, Tobias %A Prantl, Thomas %A Kounev, Samuel %B Proceedings of the Fifth Workshop "Automatische Bewertung von Programmieraufgaben" (ABP 2021),virtual event, October 28-29, 2021 %D 2021 %E Greubel, André %E Strickroth, Sven %E Striewe, Michael %I Gesellschaft für Informatik %T Teaching Software Testing Using Automated Grading
• 
  Performance Evaluation of a Post-Quantum Public-Key Cryptosystem. Prantl, Thomas; Prantl, Dominik; Beierlieb, Lukas; Iffländer, Lukas; Dmitrienko, Alexandra; Krupitzer, Christian; Kounev, Samuel; in 2021 IEEE 40th International Performance Computing and Communications Conference (IPCCC) (2021).
  • [ BibTeX ]
  • [ EndNote ]
  @inproceedings{PrPrBeIfDnKrKo2021-IPCCC-QuantumPublicKeyCryposystem, author = {Prantl, Thomas and Prantl, Dominik and Beierlieb, Lukas and Iffländer, Lukas and Dmitrienko, Alexandra and Krupitzer, Christian and Kounev, Samuel}, booktitle = {2021 IEEE 40th International Performance Computing and Communications Conference (IPCCC)}, keywords = {t_workshop}, organization = {IEEE}, title = {Performance Evaluation of a Post-Quantum Public-Key Cryptosystem}, year = 2021 }

  %0 Conference Paper %1 PrPrBeIfDnKrKo2021-IPCCC-QuantumPublicKeyCryposystem %A Prantl, Thomas %A Prantl, Dominik %A Beierlieb, Lukas %A Iffländer, Lukas %A Dmitrienko, Alexandra %A Krupitzer, Christian %A Kounev, Samuel %B 2021 IEEE 40th International Performance Computing and Communications Conference (IPCCC) %D 2021 %T Performance Evaluation of a Post-Quantum Public-Key Cryptosystem
• 
  Benchmarking of Pre- and Post-Quantum Group Encryption Schemes with Focus on IoT. Prantl, Thomas; Prantl, Dominik; Bauer, André; Iffländer, Lukas; Dmitrenko, Alexandra; Krupitzer, Christian; Kounev, Samuel; in 2021 IEEE 40th International Performance Computing and Communications Conference (IPCCC) (2021).
  • [ BibTeX ]
  • [ EndNote ]
  @inproceedings{PrPrBaIfDmKrKo2021-IPCCC-QuantumGroupEncryption, author = {Prantl, Thomas and Prantl, Dominik and Bauer, André and Iffländer, Lukas and Dmitrenko, Alexandra and Krupitzer, Christian and Kounev, Samuel}, booktitle = {2021 IEEE 40th International Performance Computing and Communications Conference (IPCCC)}, keywords = {sss-group}, title = {Benchmarking of Pre- and Post-Quantum Group Encryption Schemes with Focus on IoT}, year = 2021 }

  %0 Conference Paper %1 PrPrBaIfDmKrKo2021-IPCCC-QuantumGroupEncryption %A Prantl, Thomas %A Prantl, Dominik %A Bauer, André %A Iffländer, Lukas %A Dmitrenko, Alexandra %A Krupitzer, Christian %A Kounev, Samuel %B 2021 IEEE 40th International Performance Computing and Communications Conference (IPCCC) %D 2021 %T Benchmarking of Pre- and Post-Quantum Group Encryption Schemes with Focus on IoT
• 
  Software Testing Strategies for Detecting Hypercall Handlers{\textquotesingle} Aging-related Bugs. Beierlieb, Lukas; Avritzer, Alberto; Ifflander, Lukas; Antunes, Nuno; Milenkoski, Aleksandar; Kounev, Samuel; in 2021 {IEEE} International Symposium on Software Reliability Engineering Workshops ({ISSREW}) (2021).
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  @inproceedings{Beierlieb_2021_SoftwareTestingStrategiesforDetectingHypercallHandlersAgingRelatedBugs, author = {Beierlieb, Lukas and Avritzer, Alberto and Ifflander, Lukas and Antunes, Nuno and Milenkoski, Aleksandar and Kounev, Samuel}, booktitle = {2021 {IEEE} International Symposium on Software Reliability Engineering Workshops ({ISSREW})}, keywords = {security}, publisher = {{IEEE}}, title = {Software Testing Strategies for Detecting Hypercall Handlers{\textquotesingle} Aging-related Bugs}, year = 2021 }

  %0 Conference Paper %1 Beierlieb_2021_SoftwareTestingStrategiesforDetectingHypercallHandlersAgingRelatedBugs %A Beierlieb, Lukas %A Avritzer, Alberto %A Ifflander, Lukas %A Antunes, Nuno %A Milenkoski, Aleksandar %A Kounev, Samuel %B 2021 {IEEE} International Symposium on Software Reliability Engineering Workshops ({ISSREW}) %D 2021 %I {IEEE} %T Software Testing Strategies for Detecting Hypercall Handlers{\textquotesingle} Aging-related Bugs
• 
  Evaluating the Performance of a State-of-the-Art Group-oriented Encryption Scheme for Dynamic Groups in an IoT Scenario. Prantl, Thomas; Ten, Peter; Iffländer, Lukas; Dmitrenko, Alexandra; Kounev, Samuel; Krupitzer, Christian; in 2020 IEEE 28th International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems (MASCOTS) (2020).

  Acceptance Rate: 27\%
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  New emerging technologies, such as autonomous driving, intelligent buildings, and smart cities, are promising to revolutionize user experience and offer new services. The world has to undergo large scale deployment of billions of things — cost-efficient intelligent sensors that will be interconnected into extensive networks and will collect and supply data to intelligent algorithms — to make it happen. To date, however, it is challenging to secure such an infrastructure for many-fold reasons, such as resource constraints of things, large scale deployment, manyto-many communication patterns, and dynamically changing communication groups. All these factors rule out most of the state-of-the-art encryption and key-management techniques. Group encryption algorithms are well-suitable for many-tomany communication patterns typical for IoT networks, and many of them can deal with dynamic groups. There are, however, very few constructions that could potentially fulfill the computational and storage constraints of IoT devices while providing sufficient scalability for large networks. The promising candidates, such as construction by Nishat et al. [1], were not evaluated using IoT platforms and under constraints typical for IoT networks. In this paper, we aim to fill this gap and present the evaluation of a state-of-the-art group-oriented encryption scheme by Nishat et al. to identify its applicability to IoT systems. In detail, we provide a measurement workflow, a revised version of the approach, and describe a reproducible hardware testbed. Using this evaluation environment, we analyze the performance of the encryption scheme in a typical IoT scenario from a group member perspective. The results show that all calculation times can be assumed to be constant and are always below 2 seconds. The memory requirement for permanent parameters can also be considered to be constant and are below 8.5 kbit in each case. However, the information that has to be stored temporarily for group updates has turned out to be the bottleneck of the scheme, since their memory requirements increase linearly with the group size.

  @inproceedings{PrTeIfDmKo2020-MASCOTS-GroupEncryption, abstract = {New emerging technologies, such as autonomous driving, intelligent buildings, and smart cities, are promising to revolutionize user experience and offer new services. The world has to undergo large scale deployment of billions of things — cost-efficient intelligent sensors that will be interconnected into extensive networks and will collect and supply data to intelligent algorithms — to make it happen. To date, however, it is challenging to secure such an infrastructure for many-fold reasons, such as resource constraints of things, large scale deployment, manyto-many communication patterns, and dynamically changing communication groups. All these factors rule out most of the state-of-the-art encryption and key-management techniques. Group encryption algorithms are well-suitable for many-tomany communication patterns typical for IoT networks, and many of them can deal with dynamic groups. There are, however, very few constructions that could potentially fulfill the computational and storage constraints of IoT devices while providing sufficient scalability for large networks. The promising candidates, such as construction by Nishat et al. [1], were not evaluated using IoT platforms and under constraints typical for IoT networks. In this paper, we aim to fill this gap and present the evaluation of a state-of-the-art group-oriented encryption scheme by Nishat et al. to identify its applicability to IoT systems. In detail, we provide a measurement workflow, a revised version of the approach, and describe a reproducible hardware testbed. Using this evaluation environment, we analyze the performance of the encryption scheme in a typical IoT scenario from a group member perspective. The results show that all calculation times can be assumed to be constant and are always below 2 seconds. The memory requirement for permanent parameters can also be considered to be constant and are below 8.5 kbit in each case. However, the information that has to be stored temporarily for group updates has turned out to be the bottleneck of the scheme, since their memory requirements increase linearly with the group size.}, author = {Prantl, Thomas and Ten, Peter and Iffländer, Lukas and Dmitrenko, Alexandra and Kounev, Samuel and Krupitzer, Christian}, booktitle = {2020 IEEE 28th International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems (MASCOTS)}, keywords = {Performance_Evaluation}, month = 11, note = {Acceptance Rate: 27\%}, series = {MASCOTS '20}, title = {Evaluating the Performance of a State-of-the-Art Group-oriented Encryption Scheme for Dynamic Groups in an IoT Scenario}, year = 2020 }

  %0 Conference Paper %1 PrTeIfDmKo2020-MASCOTS-GroupEncryption %A Prantl, Thomas %A Ten, Peter %A Iffländer, Lukas %A Dmitrenko, Alexandra %A Kounev, Samuel %A Krupitzer, Christian %B 2020 IEEE 28th International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems (MASCOTS) %D 2020 %T Evaluating the Performance of a State-of-the-Art Group-oriented Encryption Scheme for Dynamic Groups in an IoT Scenario %X New emerging technologies, such as autonomous driving, intelligent buildings, and smart cities, are promising to revolutionize user experience and offer new services. The world has to undergo large scale deployment of billions of things — cost-efficient intelligent sensors that will be interconnected into extensive networks and will collect and supply data to intelligent algorithms — to make it happen. To date, however, it is challenging to secure such an infrastructure for many-fold reasons, such as resource constraints of things, large scale deployment, manyto-many communication patterns, and dynamically changing communication groups. All these factors rule out most of the state-of-the-art encryption and key-management techniques. Group encryption algorithms are well-suitable for many-tomany communication patterns typical for IoT networks, and many of them can deal with dynamic groups. There are, however, very few constructions that could potentially fulfill the computational and storage constraints of IoT devices while providing sufficient scalability for large networks. The promising candidates, such as construction by Nishat et al. [1], were not evaluated using IoT platforms and under constraints typical for IoT networks. In this paper, we aim to fill this gap and present the evaluation of a state-of-the-art group-oriented encryption scheme by Nishat et al. to identify its applicability to IoT systems. In detail, we provide a measurement workflow, a revised version of the approach, and describe a reproducible hardware testbed. Using this evaluation environment, we analyze the performance of the encryption scheme in a typical IoT scenario from a group member perspective. The results show that all calculation times can be assumed to be constant and are always below 2 seconds. The memory requirement for permanent parameters can also be considered to be constant and are below 8.5 kbit in each case. However, the information that has to be stored temporarily for group updates has turned out to be the bottleneck of the scheme, since their memory requirements increase linearly with the group size.
• 
  Towards Testing the Software Aging Behavior of Hypervisor Hypercall Interfaces. Beierlieb, Lukas; Iffländer, Lukas; Milenkoski, Aleksandar; Goncalves, Charles F.; Antunes, Nuno; Kounev, Samuel; in 2019 {IEEE} International Symposium on Software Reliability Engineering Workshops ({ISSREW}) (2019).
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  With the continuing rise of cloud technology hypervisors play a vital role in the performance and reliability of current services. As long-running applications, they are susceptible to software aging. Hypervisors offer so-called hypercall interfaces for communication with the hosted virtual machines. These interfaces require thorough robustness to assure performance, security, and reliability. Existing research either deals with the aging properties of hypervisors in general without considering the hypercalls or focuses on finding hypercall-related vulnerabilities. In this work, we discuss open challenges regarding hypercall interfaces. To address these challenges, we propose an extensive framework architecture to perform robustness testing on hypercall interfaces. This framework supports extensive test campaigns as well as the modeling of hypercall interfaces.

  @inproceedings{Beierlieb_2019_TowardsTestingtheSoftwareAgingBehaviorofHypervisorHypercallInterfaces, abstract = {With the continuing rise of cloud technology hypervisors play a vital role in the performance and reliability of current services. As long-running applications, they are susceptible to software aging. Hypervisors offer so-called hypercall interfaces for communication with the hosted virtual machines. These interfaces require thorough robustness to assure performance, security, and reliability. Existing research either deals with the aging properties of hypervisors in general without considering the hypercalls or focuses on finding hypercall-related vulnerabilities. In this work, we discuss open challenges regarding hypercall interfaces. To address these challenges, we propose an extensive framework architecture to perform robustness testing on hypercall interfaces. This framework supports extensive test campaigns as well as the modeling of hypercall interfaces.}, author = {Beierlieb, Lukas and Iffländer, Lukas and Milenkoski, Aleksandar and Goncalves, Charles F. and Antunes, Nuno and Kounev, Samuel}, booktitle = {2019 {IEEE} International Symposium on Software Reliability Engineering Workshops ({ISSREW})}, keywords = {t_workshop}, month = 11, organization = {{IEEE}}, title = {Towards Testing the Software Aging Behavior of Hypervisor Hypercall Interfaces}, year = 2019 }

  %0 Conference Paper %1 Beierlieb_2019_TowardsTestingtheSoftwareAgingBehaviorofHypervisorHypercallInterfaces %A Beierlieb, Lukas %A Iffländer, Lukas %A Milenkoski, Aleksandar %A Goncalves, Charles F. %A Antunes, Nuno %A Kounev, Samuel %B 2019 {IEEE} International Symposium on Software Reliability Engineering Workshops ({ISSREW}) %D 2019 %T Towards Testing the Software Aging Behavior of Hypervisor Hypercall Interfaces %X With the continuing rise of cloud technology hypervisors play a vital role in the performance and reliability of current services. As long-running applications, they are susceptible to software aging. Hypervisors offer so-called hypercall interfaces for communication with the hosted virtual machines. These interfaces require thorough robustness to assure performance, security, and reliability. Existing research either deals with the aging properties of hypervisors in general without considering the hypercalls or focuses on finding hypercall-related vulnerabilities. In this work, we discuss open challenges regarding hypercall interfaces. To address these challenges, we propose an extensive framework architecture to perform robustness testing on hypercall interfaces. This framework supports extensive test campaigns as well as the modeling of hypercall interfaces.
• 
  Towards Testing the Performance Influence of Hypervisor Hypercall Interface Behavior. Beierlieb, Lukas; Iffländer, Lukas; Kounev, Samuel; Milenkoski, Aleksandar; in Proceedings of the 10th Symposium on Software Performance 2019 (SSP’19) (2019).
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  With the continuing rise of cloud technology hypervisors play a vital role in the performance and reliability of current services. Hypervisors offer so-called hypercall interfaces for communication with the hosted virtual machines. These interfaces require thorough robustness to assure performance, security, and reliability. Existing research focusses on finding hypercall-related vulnerabilities. In this work, we discuss open challenges regarding hypercall interfaces. To address these challenges, we propose an extensive framework architecture to perform robustness testing on hypercall interfaces. This framework supports test campaigns and modeling of hypercall interfaces.

  @inproceedings{Beierlieb_2019_TowardsTestingthePerformanceInfluenceofHypervisorHypercallInterfaceBehavior, abstract = {With the continuing rise of cloud technology hypervisors play a vital role in the performance and reliability of current services. Hypervisors offer so-called hypercall interfaces for communication with the hosted virtual machines. These interfaces require thorough robustness to assure performance, security, and reliability. Existing research focusses on finding hypercall-related vulnerabilities. In this work, we discuss open challenges regarding hypercall interfaces. To address these challenges, we propose an extensive framework architecture to perform robustness testing on hypercall interfaces. This framework supports test campaigns and modeling of hypercall interfaces.}, author = {Beierlieb, Lukas and Iffländer, Lukas and Kounev, Samuel and Milenkoski, Aleksandar}, booktitle = {Proceedings of the 10th Symposium on Software Performance 2019 (SSP'19)}, keywords = {t_workshop}, month = 11, title = {Towards Testing the Performance Influence of Hypervisor Hypercall Interface Behavior}, year = 2019 }

  %0 Conference Paper %1 Beierlieb_2019_TowardsTestingthePerformanceInfluenceofHypervisorHypercallInterfaceBehavior %A Beierlieb, Lukas %A Iffländer, Lukas %A Kounev, Samuel %A Milenkoski, Aleksandar %B Proceedings of the 10th Symposium on Software Performance 2019 (SSP'19) %D 2019 %T Towards Testing the Performance Influence of Hypervisor Hypercall Interface Behavior %X With the continuing rise of cloud technology hypervisors play a vital role in the performance and reliability of current services. Hypervisors offer so-called hypercall interfaces for communication with the hosted virtual machines. These interfaces require thorough robustness to assure performance, security, and reliability. Existing research focusses on finding hypercall-related vulnerabilities. In this work, we discuss open challenges regarding hypercall interfaces. To address these challenges, we propose an extensive framework architecture to perform robustness testing on hypercall interfaces. This framework supports test campaigns and modeling of hypercall interfaces.
• 
  Online Power Consumption Estimation for Functions in Cloud Applications. Schmitt, Norbert; Iffländer, Lukas; Bauer, André; Kounev, Samuel; in Proceedings of the 16th IEEE International Conference on Autonomic Computing (ICAC) (2019).
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  @inproceedings{ScIfBaKo2019-ICAC-OnlinePowerEstimation, author = {Schmitt, Norbert and Iffländer, Lukas and Bauer, André and Kounev, Samuel}, booktitle = {Proceedings of the 16th IEEE International Conference on Autonomic Computing (ICAC)}, keywords = {Power}, month = {06}, publisher = {IEEE}, title = {Online Power Consumption Estimation for Functions in Cloud Applications}, year = 2019 }

  %0 Conference Paper %1 ScIfBaKo2019-ICAC-OnlinePowerEstimation %A Schmitt, Norbert %A Iffländer, Lukas %A Bauer, André %A Kounev, Samuel %B Proceedings of the 16th IEEE International Conference on Autonomic Computing (ICAC) %D 2019 %I IEEE %T Online Power Consumption Estimation for Functions in Cloud Applications
• 
  Performance Influence of Security Function Chain Ordering. Iffländer, Lukas; Fella, Nicolas; in Companion of the 2019 ACM/SPEC International Conference on Performance Engineering (2019). 45–46.
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  • [ URL ]
  • [ Download ]
  In modern days security systems often reach their performance peak and limit the protected application. Utilizing the available resources for security more efficiently is becoming more critical. In this paper, we introduce the claim, that no static security function chain is optimal in every situation. First experiments prove our claim.

  @inproceedings{Ifflaender2019_PerformanceInfluenceofSecurityFunctionChainOrdering, abstract = {In modern days security systems often reach their performance peak and limit the protected application. Utilizing the available resources for security more efficiently is becoming more critical. In this paper, we introduce the claim, that no static security function chain is optimal in every situation. First experiments prove our claim.}, address = {New York, NY, USA}, author = {Iffländer, Lukas and Fella, Nicolas}, booktitle = {Companion of the 2019 ACM/SPEC International Conference on Performance Engineering}, keywords = {Self-adaptive-systems}, pages = {45–46}, publisher = {ACM}, series = {ICPE '19}, title = {Performance Influence of Security Function Chain Ordering}, year = 2019 }

  %0 Conference Paper %1 Ifflaender2019_PerformanceInfluenceofSecurityFunctionChainOrdering %A Iffländer, Lukas %A Fella, Nicolas %B Companion of the 2019 ACM/SPEC International Conference on Performance Engineering %C New York, NY, USA %D 2019 %I ACM %P 45--46 %T Performance Influence of Security Function Chain Ordering %U http://doi.acm.org/10.1145/3302541.3311965 %X In modern days security systems often reach their performance peak and limit the protected application. Utilizing the available resources for security more efficiently is becoming more critical. In this paper, we introduce the claim, that no static security function chain is optimal in every situation. First experiments prove our claim.
• 
  Performance Oriented Dynamic Bypassing for Intrusion Detection Systems. Iffländer, Lukas; Stoll, Jonathan; Rawtani, Nishant; Lesch, Veronika; Lange, Klaus-Dieter; Kounev, Samuel; in Proceedings of the 2019 ACM/SPEC International Conference on Performance Engineering (2019). 159–166.
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  • [ URL ]
  • [ Download ]
  Attacks on software systems are becoming more and more frequent, aggressive and sophisticated. With the changing threat landscape, in 2018, organizations are looking at when they will be attacked, not if. Intrusion Detection Systems (IDSs) can help in defending against these attacks. The systems that host IDSs require extensive computing resources as IDSs tend to detect attacks under overloaded conditions wrongfully. With the end of Moore's law and the growing adoption of Internet of Things, designers of security systems can no longer expect processing power to keep up the pace with them. This limitation requires ways to increase the performance of these systems without adding additional compute power. In this work, we present two dynamic and a static approach to bypass IDS for traffic deemed benign. We provide its prototype implementation and evaluate our solution. Our evaluation shows promising results. Performance is increased up to the level of a system without an IDS. Attack detection is within the margin of error from the 100% rate. However, our findings show that dynamic approaches perform best when using software switches. The use of a hardware switch reduces the detection rate and performance significantly.

  @inproceedings{Ifflaender2019_PerformanceOrientedDynamicBypassingforIntrusionDetectionSystems, abstract = {Attacks on software systems are becoming more and more frequent, aggressive and sophisticated. With the changing threat landscape, in 2018, organizations are looking at when they will be attacked, not if. Intrusion Detection Systems (IDSs) can help in defending against these attacks. The systems that host IDSs require extensive computing resources as IDSs tend to detect attacks under overloaded conditions wrongfully. With the end of Moore's law and the growing adoption of Internet of Things, designers of security systems can no longer expect processing power to keep up the pace with them. This limitation requires ways to increase the performance of these systems without adding additional compute power. In this work, we present two dynamic and a static approach to bypass IDS for traffic deemed benign. We provide its prototype implementation and evaluate our solution. Our evaluation shows promising results. Performance is increased up to the level of a system without an IDS. Attack detection is within the margin of error from the 100% rate. However, our findings show that dynamic approaches perform best when using software switches. The use of a hardware switch reduces the detection rate and performance significantly.}, address = {New York, NY, USA}, author = {Iffländer, Lukas and Stoll, Jonathan and Rawtani, Nishant and Lesch, Veronika and Lange, Klaus-Dieter and Kounev, Samuel}, booktitle = {Proceedings of the 2019 ACM/SPEC International Conference on Performance Engineering}, keywords = {Optimization}, pages = {159–166}, publisher = {ACM}, series = {ICPE '19}, title = {Performance Oriented Dynamic Bypassing for Intrusion Detection Systems}, year = 2019 }

  %0 Conference Paper %1 Ifflaender2019_PerformanceOrientedDynamicBypassingforIntrusionDetectionSystems %A Iffländer, Lukas %A Stoll, Jonathan %A Rawtani, Nishant %A Lesch, Veronika %A Lange, Klaus-Dieter %A Kounev, Samuel %B Proceedings of the 2019 ACM/SPEC International Conference on Performance Engineering %C New York, NY, USA %D 2019 %I ACM %P 159--166 %T Performance Oriented Dynamic Bypassing for Intrusion Detection Systems %U http://doi.acm.org/10.1145/3297663.3310313 %X Attacks on software systems are becoming more and more frequent, aggressive and sophisticated. With the changing threat landscape, in 2018, organizations are looking at when they will be attacked, not if. Intrusion Detection Systems (IDSs) can help in defending against these attacks. The systems that host IDSs require extensive computing resources as IDSs tend to detect attacks under overloaded conditions wrongfully. With the end of Moore's law and the growing adoption of Internet of Things, designers of security systems can no longer expect processing power to keep up the pace with them. This limitation requires ways to increase the performance of these systems without adding additional compute power. In this work, we present two dynamic and a static approach to bypass IDS for traffic deemed benign. We provide its prototype implementation and evaluate our solution. Our evaluation shows promising results. Performance is increased up to the level of a system without an IDS. Attack detection is within the margin of error from the 100% rate. However, our findings show that dynamic approaches perform best when using software switches. The use of a hardware switch reduces the detection rate and performance significantly.
• 
  Efficient and Effective Ransomware Detection in Databases. Hagen, Christoph; Dmitrienko, Alexandra; Iffländer, Lukas; Jobst, Michael; Kounev, Samuel; in 34th Annual Computer Security Applications Conference (ACSAC) (2018).
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  @inproceedings{Hagen2018_EfficientandEffectiveRansomwareDetectioninDatabases, author = {Hagen, Christoph and Dmitrienko, Alexandra and Iffländer, Lukas and Jobst, Michael and Kounev, Samuel}, booktitle = {34th Annual Computer Security Applications Conference (ACSAC)}, keywords = {t_poster}, month = 12, organization = {ACM}, title = {Efficient and Effective Ransomware Detection in Databases}, year = 2018 }

  %0 Conference Paper %1 Hagen2018_EfficientandEffectiveRansomwareDetectioninDatabases %A Hagen, Christoph %A Dmitrienko, Alexandra %A Iffländer, Lukas %A Jobst, Michael %A Kounev, Samuel %B 34th Annual Computer Security Applications Conference (ACSAC) %D 2018 %T Efficient and Effective Ransomware Detection in Databases
• 
  Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking. Iffländer, Lukas; Geißler, Stefan; Walter, Jürgen; Beierlieb, Lukas; Kounev, Samuel; in Proceedings of the 9th Symposium on Software Performance 2018 (SSP’18) (2018).
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  Attacks on software systems are becoming more and more frequent, aggressive and sophisticated. With the changing threat landscape, in 2018, organizations are looking at when they will be attacked, not if. Intrusion Detection Systems (IDSs) can help in defending against these attacks. The systems that host IDSs require extensive computing resources as IDSs tend to detect attacks under overloaded conditions wrongfully. With the end of Moore’s law and the growing adoption of Internet of Things, designers of security systems can no longer expect processing power to keep up the pace with them. This limitation requires ways to increase the performance of these systems without adding additional compute power. In this work, we present two dynamic and a static approach to bypass IDS for traffic deemed benign. We provide its prototype implementation and evaluate our solution. Our evaluation shows promising results. Performance is increased up to the level of a system without an IDS. Attack detection is within the margin of error from the 100% rate. However, our findings show that dynamic approaches perform best when using software switches. The use of a hardware switch reduces the detection rate and performance significantly.

  @inproceedings{Ifflaender2018_AddressingShortcomingsofExistingDDoSProtectionSoftwareUsingSoftware-DefinedNetworking, abstract = {Attacks on software systems are becoming more and more frequent, aggressive and sophisticated. With the changing threat landscape, in 2018, organizations are looking at when they will be attacked, not if. Intrusion Detection Systems (IDSs) can help in defending against these attacks. The systems that host IDSs require extensive computing resources as IDSs tend to detect attacks under overloaded conditions wrongfully. With the end of Moore’s law and the growing adoption of Internet of Things, designers of security systems can no longer expect processing power to keep up the pace with them. This limitation requires ways to increase the performance of these systems without adding additional compute power. In this work, we present two dynamic and a static approach to bypass IDS for traffic deemed benign. We provide its prototype implementation and evaluate our solution. Our evaluation shows promising results. Performance is increased up to the level of a system without an IDS. Attack detection is within the margin of error from the 100% rate. However, our findings show that dynamic approaches perform best when using software switches. The use of a hardware switch reduces the detection rate and performance significantly.}, author = {Iffländer, Lukas and Geißler, Stefan and Walter, Jürgen and Beierlieb, Lukas and Kounev, Samuel}, booktitle = {Proceedings of the 9th Symposium on Software Performance 2018 (SSP'18)}, keywords = {t_workshop}, month = 11, title = {Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking}, year = 2018 }

  %0 Conference Paper %1 Ifflaender2018_AddressingShortcomingsofExistingDDoSProtectionSoftwareUsingSoftware-DefinedNetworking %A Iffländer, Lukas %A Geißler, Stefan %A Walter, Jürgen %A Beierlieb, Lukas %A Kounev, Samuel %B Proceedings of the 9th Symposium on Software Performance 2018 (SSP'18) %D 2018 %T Addressing Shortcomings of Existing DDoS Protection Software Using Software-Defined Networking %X Attacks on software systems are becoming more and more frequent, aggressive and sophisticated. With the changing threat landscape, in 2018, organizations are looking at when they will be attacked, not if. Intrusion Detection Systems (IDSs) can help in defending against these attacks. The systems that host IDSs require extensive computing resources as IDSs tend to detect attacks under overloaded conditions wrongfully. With the end of Moore’s law and the growing adoption of Internet of Things, designers of security systems can no longer expect processing power to keep up the pace with them. This limitation requires ways to increase the performance of these systems without adding additional compute power. In this work, we present two dynamic and a static approach to bypass IDS for traffic deemed benign. We provide its prototype implementation and evaluate our solution. Our evaluation shows promising results. Performance is increased up to the level of a system without an IDS. Attack detection is within the margin of error from the 100% rate. However, our findings show that dynamic approaches perform best when using software switches. The use of a hardware switch reduces the detection rate and performance significantly.
• 
  The Vision of Self-aware Reordering of Security Network Function Chains. Iffländer, Lukas; Walter, Jürgen; Eismann, Simon; Kounev, Samuel; in Proceedings of the 2018 ACM/SPEC International Conference on Performance Engineering (2018). 1–4.
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  • [ URL ]
  • [ Download ]
  Services provided online are subject to various types of attacks. Security appliances can be chained to protect a system against multiple types of network attacks. The sequence of appliances has a significant impact on the efficiency of the whole chain. While the operation of security appliance chains is currently based on a static order, traffic-aware reordering of security appliances may significantly improve efficiency and accuracy. In this paper, we present the vision a self-aware system to automatically reorder security appliances according to incoming traffic. To achieve this, we propose to apply a model-based learning, reasoning, and acting (LRA-M) loop. To this end, we describe a corresponding system architecture and explain its building blocks.

  @inproceedings{IfWaEiKo2018-ICPE-SSFC-Vision, abstract = {Services provided online are subject to various types of attacks. Security appliances can be chained to protect a system against multiple types of network attacks. The sequence of appliances has a significant impact on the efficiency of the whole chain. While the operation of security appliance chains is currently based on a static order, traffic-aware reordering of security appliances may significantly improve efficiency and accuracy. In this paper, we present the vision a self-aware system to automatically reorder security appliances according to incoming traffic. To achieve this, we propose to apply a model-based learning, reasoning, and acting (LRA-M) loop. To this end, we describe a corresponding system architecture and explain its building blocks.}, address = {New York, NY, USA}, author = {Iffländer, Lukas and Walter, Jürgen and Eismann, Simon and Kounev, Samuel}, booktitle = {Proceedings of the 2018 ACM/SPEC International Conference on Performance Engineering}, keywords = {Self-adaptive-systems}, pages = {1–4}, publisher = {ACM}, series = {ICPE '18}, title = {The Vision of Self-aware Reordering of Security Network Function Chains}, year = 2018 }

  %0 Conference Paper %1 IfWaEiKo2018-ICPE-SSFC-Vision %A Iffländer, Lukas %A Walter, Jürgen %A Eismann, Simon %A Kounev, Samuel %B Proceedings of the 2018 ACM/SPEC International Conference on Performance Engineering %C New York, NY, USA %D 2018 %I ACM %P 1--4 %T The Vision of Self-aware Reordering of Security Network Function Chains %U https://dl.acm.org/doi/10.1145/3185768.3186309 %X Services provided online are subject to various types of attacks. Security appliances can be chained to protect a system against multiple types of network attacks. The sequence of appliances has a significant impact on the efficiency of the whole chain. While the operation of security appliance chains is currently based on a static order, traffic-aware reordering of security appliances may significantly improve efficiency and accuracy. In this paper, we present the vision a self-aware system to automatically reorder security appliances according to incoming traffic. To achieve this, we propose to apply a model-based learning, reasoning, and acting (LRA-M) loop. To this end, we describe a corresponding system architecture and explain its building blocks.
• 
  Performance Assessment of Cloud Migrations from Network and Application Point of View. Iffländer, Lukas; Wamser, Florian; Metter, Christopher; Tran-Gia, Phuoc; Kounev, Samuel; in {Proceedings of 9th EAI International Conference on Mobile Networks and Management (MONAMI 2018)} (2017).
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  @inproceedings{IfWaMeTrKo-Monami-Migration-Performance, author = {Iffländer, Lukas and Wamser, Florian and Metter, Christopher and Tran-Gia, Phuoc and Kounev, Samuel}, booktitle = {{Proceedings of 9th EAI International Conference on Mobile Networks and Management (MONAMI 2018)}}, keywords = {Virtualization}, month = 12, title = {Performance Assessment of Cloud Migrations from Network and Application Point of View}, year = 2017 }

  %0 Conference Paper %1 IfWaMeTrKo-Monami-Migration-Performance %A Iffländer, Lukas %A Wamser, Florian %A Metter, Christopher %A Tran-Gia, Phuoc %A Kounev, Samuel %B {Proceedings of 9th EAI International Conference on Mobile Networks and Management (MONAMI 2018)} %D 2017 %T Performance Assessment of Cloud Migrations from Network and Application Point of View
• 
  PABS-a Programming Assignment Feedback System. Iffländer, Lukas; Dallmann, Alexander; Beck, Philip-Daniel; Ifland, Marianus; in ABP (2015).
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  @inproceedings{ifflander2015pabs, author = {Iffländer, Lukas and Dallmann, Alexander and Beck, Philip-Daniel and Ifland, Marianus}, booktitle = {ABP}, keywords = {t_workshop}, title = {PABS-a Programming Assignment Feedback System.}, year = 2015 }

  %0 Conference Paper %1 ifflander2015pabs %A Iffländer, Lukas %A Dallmann, Alexander %A Beck, Philip-Daniel %A Ifland, Marianus %B ABP %D 2015 %T PABS-a Programming Assignment Feedback System.
• 
  Implementing Application-Aware Resource Allocation on a Home Gateway for the Example of YouTube. Wamser, Florian; Iffländer, Lukas; Zinner, Thomas; Tran-Gia, Phuoc; in International Conference on Mobile Networks and Management (2014). 301–312.
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  @inproceedings{wamser2014implementing, author = {Wamser, Florian and Iffländer, Lukas and Zinner, Thomas and Tran-Gia, Phuoc}, booktitle = {International Conference on Mobile Networks and Management}, keywords = {Application-aware}, month = 10, organization = {Springer International Publishing}, pages = {301–312}, title = {Implementing Application-Aware Resource Allocation on a Home Gateway for the Example of YouTube}, year = 2014 }

  %0 Conference Paper %1 wamser2014implementing %A Wamser, Florian %A Iffländer, Lukas %A Zinner, Thomas %A Tran-Gia, Phuoc %B International Conference on Mobile Networks and Management %D 2014 %P 301--312 %T Implementing Application-Aware Resource Allocation on a Home Gateway for the Example of YouTube
• 
  Demonstrating the Prospects of Dynamic Application-Aware Networking in a Home Environment. Wamser, Florian; Zinner, Thomas; Iffländer, Lukas; Tran-Gia, Phuoc; in Proceedings of the 2014 ACM conference on SIGCOMM (2014).
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  @inproceedings{WaZiIfTr-SIGCOMM-2014-demonstrating, author = {Wamser, Florian and Zinner, Thomas and Iffländer, Lukas and Tran-Gia, Phuoc}, booktitle = {Proceedings of the 2014 ACM conference on SIGCOMM}, keywords = {Optimization}, month = {08}, title = {Demonstrating the Prospects of Dynamic Application-Aware Networking in a Home Environment}, year = 2014 }

  %0 Conference Paper %1 WaZiIfTr-SIGCOMM-2014-demonstrating %A Wamser, Florian %A Zinner, Thomas %A Iffländer, Lukas %A Tran-Gia, Phuoc %B Proceedings of the 2014 ACM conference on SIGCOMM %D 2014 %T Demonstrating the Prospects of Dynamic Application-Aware Networking in a Home Environment

• 
  Performance Assessment of Service Migration Strategies. Iffländer, Lukas; Thesis; University of Würzburg; Am Hubland, Informatikgebäude, 97074 Würzburg, Germany. (2016, Januar).
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  @mastersthesis{Ifflaender2016, address = {Am Hubland, Informatikgebäude, 97074 Würzburg, Germany}, author = {Iffländer, Lukas}, keywords = {Virtualization}, month = {01}, school = {University of Würzburg}, title = {Performance Assessment of Service Migration Strategies}, type = {Master Thesis}, year = 2016 }

  %0 Thesis %1 Ifflaender2016 %A Iffländer, Lukas %C Am Hubland, Informatikgebäude, 97074 Würzburg, Germany %D 2016 %T Performance Assessment of Service Migration Strategies
• 
  {Entwicklung und Evaluierung eines Systems zur Bestimmung der Orientierung und Position eines Objektes durch inertiale und magnetische Sensoren}. Iffl{ä}nder, Lukas; Gageik, Nils; Thesis; University of W{ü}rzburg. (2012, Dezember).
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  @mastersthesis{ifflanderentwicklung, author = {Iffl{\"a}nder, Lukas and Gageik, Nils}, keywords = {se2}, month = 12, school = {University of W{\"u}rzburg}, title = {{Entwicklung und Evaluierung eines Systems zur Bestimmung der Orientierung und Position eines Objektes durch inertiale und magnetische Sensoren}}, type = {Bachelor Thesis}, year = 2012 }

  %0 Thesis %1 ifflanderentwicklung %A Iffl{ä}nder, Lukas %A Gageik, Nils %D 2012 %T {Entwicklung und Evaluierung eines Systems zur Bestimmung der Orientierung und Position eines Objektes durch inertiale und magnetische Sensoren}

• 
  Die Mehrbelastung der Sicherheit im IoT mit neuen Techniken bewältigen. Stoll, Jonathan; Iffländer, Lukas; (2019, April).
  • [ BibTeX ]
  • [ EndNote ]
  @misc{talk-StIf-SDN-buildingIoT, author = {Stoll, Jonathan and Iffländer, Lukas}, howpublished = {building IoT 2019}, keywords = {descartes}, month = {04}, title = {Die Mehrbelastung der Sicherheit im IoT mit neuen Techniken bewältigen}, year = 2019 }

  %0 Generic %1 talk-StIf-SDN-buildingIoT %A Stoll, Jonathan %A Iffländer, Lukas %D 2019 %T Die Mehrbelastung der Sicherheit im IoT mit neuen Techniken bewältigen
• 
  Performance and Security Influence of Augmenting IDS using SDN and NFV. Iffländer, Lukas; Stoll, Jonathan; (2017, November).
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  @misc{talk-IfSt-SSP2017-IDS-SDN-NFV, author = {Iffländer, Lukas and Stoll, Jonathan}, howpublished = {Technical Talk at Symposion on Software Performance (SSP) 2017}, keywords = {SDN}, month = 11, title = {Performance and Security Influence of Augmenting IDS using SDN and NFV}, year = 2017 }

  %0 Generic %1 talk-IfSt-SSP2017-IDS-SDN-NFV %A Iffländer, Lukas %A Stoll, Jonathan %D 2017 %T Performance and Security Influence of Augmenting IDS using SDN and NFV

• 
  Attack-aware Security Function Management. Iffl{ä}nder, Lukas; Thesis; Universit{ä}t W{ü}rzburg. (2021, Januar).
  • [ Abstract ]
  • [ BibTeX ]
  • [ EndNote ]
  • [ Download ]
  Over the last decades, cybersecurity has become an increasingly important issue. Between 2019 and 2011 alone, the losses from cyberattacks in the United States grew by 6217%. At the same time, attacks became not only more intensive but also more and more versatile and diverse. Cybersecurity has become everyone’s concern. Today, service providers require sophisticated and extensive security infrastructures comprising many security functions dedicated to various cyberattacks. Still, attacks become more violent to a level where infrastructures can no longer keep up. Simply scaling up is no longer sufficient. To address this challenge, in a whitepaper, the Cloud Security Alliance (CSA) proposed multiple work packages for security infrastructure, leveraging the possibilities of Software-defined Networking (SDN) and Network Function Virtualization (NFV). Security functions require a more sophisticated modeling approach than regular network functions. Notably, the property to drop packets deemed malicious has a significant impact on Security Service Function Chains (SSFCs)—service chains consisting of multiple security functions to protect against multiple at- tack vectors. Under attack, the order of these chains influences the end-to-end system performance depending on the attack type. Unfortunately, it is hard to predict the attack composition at system design time. Thus, we make a case for dynamic attack-aware SSFC reordering. Also, we tackle the issues of the lack of integration between security functions and the surrounding network infrastructure, the insufficient use of short term CPU frequency boosting, and the lack of Intrusion Detection and Prevention Systems (IDPS) against database ransomware attacks. Current works focus on characterizing the performance of security functions and their behavior under overload without considering the surrounding infrastructure. Other works aim at replacing security functions using network infrastructure features but do not consider integrating security functions within the network. Further publications deal with using SDN for security or how to deal with new vulnerabilities introduced through SDN. However, they do not take security function performance into account. NFV is a popular field for research dealing with frameworks, benchmarking methods, the combination with SDN, and implementing security functions as Virtualized Network Functions (VNFs). Research in this area brought forth the concept of Service Function Chains (SFCs) that chain multiple network functions after one another. Nevertheless, they still do not consider the specifics of security functions. The mentioned CSA whitepaper proposes many valuable ideas but leaves their realization open to others. This thesis presents solutions to increase the performance of single security functions using SDN, performance modeling, a framework for attack-aware SSFC reordering, a solution to make better use of CPU frequency boosting, and an IDPS against database ransomware. Specifically, the primary contributions of this work are: • We present approaches to dynamically bypass Intrusion Detection Systems (IDS) in order to increase their performance without reducing the security level. To this end, we develop and implement three SDN-based approaches (two dynamic and one static). We evaluate the proposed approaches regarding security and performance and show that they significantly increase the performance com- pared to an inline IDS without significant security deficits. We show that using software switches can further increase the performance of the dynamic approaches up to a point where they can eliminate any throughput drawbacks when using the IDS. • We design a DDoS Protection System (DPS) against TCP SYN flood at tacks in the form of a VNF that works inside an SDN-enabled network. This solution eliminates known scalability and performance drawbacks of existing solutions for this attack type. Then, we evaluate this solution showing that it correctly handles the connection establishment and present solutions for an observed issue. Next, we evaluate the performance showing that our solution increases performance up to three times. Parallelization and parameter tuning yields another 76% performance boost. Based on these findings, we discuss optimal deployment strategies. • We introduce the idea of attack-aware SSFC reordering and explain its impact in a theoretical scenario. Then, we discuss the required information to perform this process. We validate our claim of the importance of the SSFC order by analyzing the behavior of single security functions and SSFCs. Based on the results, we conclude that there is a massive impact on the performance up to three orders of magnitude, and we find contradicting optimal orders for different workloads. Thus, we demonstrate the need for dynamic reordering. Last, we develop a model for SSFC regarding traffic composition and resource demands. We classify the traffic into multiple classes and model the effect of single security functions on the traffic and their generated resource demands as functions of the incoming network traffic. Based on our model, we propose three approaches to determine optimal orders for reordering. • We implement a framework for attack-aware SSFC reordering based on this knowledge. The framework places all security functions inside an SDN-enabled network and reorders them using SDN flows. Our evaluation shows that the framework can enforce all routes as desired. It correctly adapts to all attacks and returns to the original state after the attacks cease. We find possible security issues at the moment of reordering and present solutions to eliminate them. • Next, we design and implement an approach to load balance servers while taking into account their ability to go into a state of Central Processing Unit (CPU) frequency boost. To this end, the approach collects temperature information from available hosts and places services on the host that can attain the boosted mode the longest. We evaluate this approach and show its effectiveness. For high load scenarios, the approach increases the overall performance and the performance per watt. Even better results show up for low load workloads, where not only all performance metrics improve but also the temperatures and total power consumption decrease. • Last, we design an IDPS protecting against database ransomware attacks that comprise multiple queries to attain their goal. Our solution models these attacks using a Colored Petri Net (CPN). A proof-of-concept implementation shows that our approach is capable of detecting attacks without creating false positives for benign scenarios. Furthermore, our solution creates only a small performance impact. Our contributions can help to improve the performance of security infrastructures. We see multiple application areas from data center operators over software and hardware developers to security and performance researchers. Most of the above-listed contributions found use in several research publications. Regarding future work, we see the need to better integrate SDN-enabled security functions and SSFC reordering in data center networks. Future SSFC should discriminate between different traffic types, and security frameworks should support automatically learning models for security functions. We see the need to consider energy efficiency when regarding SSFCs and take CPU boosting technologies into account when designing performance models as well as placement, scaling, and deployment strategies. Last, for a faster adaptation against recent ransomware attacks, we propose machine-assisted learning for database IDPS signatures.

  @phdthesis{ifflander2021attackaware, abstract = {Over the last decades, cybersecurity has become an increasingly important issue. Between 2019 and 2011 alone, the losses from cyberattacks in the United States grew by 6217%. At the same time, attacks became not only more intensive but also more and more versatile and diverse. Cybersecurity has become everyone’s concern. Today, service providers require sophisticated and extensive security infrastructures comprising many security functions dedicated to various cyberattacks. Still, attacks become more violent to a level where infrastructures can no longer keep up. Simply scaling up is no longer sufficient. To address this challenge, in a whitepaper, the Cloud Security Alliance (CSA) proposed multiple work packages for security infrastructure, leveraging the possibilities of Software-defined Networking (SDN) and Network Function Virtualization (NFV). Security functions require a more sophisticated modeling approach than regular network functions. Notably, the property to drop packets deemed malicious has a significant impact on Security Service Function Chains (SSFCs)—service chains consisting of multiple security functions to protect against multiple at- tack vectors. Under attack, the order of these chains influences the end-to-end system performance depending on the attack type. Unfortunately, it is hard to predict the attack composition at system design time. Thus, we make a case for dynamic attack-aware SSFC reordering. Also, we tackle the issues of the lack of integration between security functions and the surrounding network infrastructure, the insufficient use of short term CPU frequency boosting, and the lack of Intrusion Detection and Prevention Systems (IDPS) against database ransomware attacks. Current works focus on characterizing the performance of security functions and their behavior under overload without considering the surrounding infrastructure. Other works aim at replacing security functions using network infrastructure features but do not consider integrating security functions within the network. Further publications deal with using SDN for security or how to deal with new vulnerabilities introduced through SDN. However, they do not take security function performance into account. NFV is a popular field for research dealing with frameworks, benchmarking methods, the combination with SDN, and implementing security functions as Virtualized Network Functions (VNFs). Research in this area brought forth the concept of Service Function Chains (SFCs) that chain multiple network functions after one another. Nevertheless, they still do not consider the specifics of security functions. The mentioned CSA whitepaper proposes many valuable ideas but leaves their realization open to others. This thesis presents solutions to increase the performance of single security functions using SDN, performance modeling, a framework for attack-aware SSFC reordering, a solution to make better use of CPU frequency boosting, and an IDPS against database ransomware. Specifically, the primary contributions of this work are: • We present approaches to dynamically bypass Intrusion Detection Systems (IDS) in order to increase their performance without reducing the security level. To this end, we develop and implement three SDN-based approaches (two dynamic and one static). We evaluate the proposed approaches regarding security and performance and show that they significantly increase the performance com- pared to an inline IDS without significant security deficits. We show that using software switches can further increase the performance of the dynamic approaches up to a point where they can eliminate any throughput drawbacks when using the IDS. • We design a DDoS Protection System (DPS) against TCP SYN flood at tacks in the form of a VNF that works inside an SDN-enabled network. This solution eliminates known scalability and performance drawbacks of existing solutions for this attack type. Then, we evaluate this solution showing that it correctly handles the connection establishment and present solutions for an observed issue. Next, we evaluate the performance showing that our solution increases performance up to three times. Parallelization and parameter tuning yields another 76% performance boost. Based on these findings, we discuss optimal deployment strategies. • We introduce the idea of attack-aware SSFC reordering and explain its impact in a theoretical scenario. Then, we discuss the required information to perform this process. We validate our claim of the importance of the SSFC order by analyzing the behavior of single security functions and SSFCs. Based on the results, we conclude that there is a massive impact on the performance up to three orders of magnitude, and we find contradicting optimal orders for different workloads. Thus, we demonstrate the need for dynamic reordering. Last, we develop a model for SSFC regarding traffic composition and resource demands. We classify the traffic into multiple classes and model the effect of single security functions on the traffic and their generated resource demands as functions of the incoming network traffic. Based on our model, we propose three approaches to determine optimal orders for reordering. • We implement a framework for attack-aware SSFC reordering based on this knowledge. The framework places all security functions inside an SDN-enabled network and reorders them using SDN flows. Our evaluation shows that the framework can enforce all routes as desired. It correctly adapts to all attacks and returns to the original state after the attacks cease. We find possible security issues at the moment of reordering and present solutions to eliminate them. • Next, we design and implement an approach to load balance servers while taking into account their ability to go into a state of Central Processing Unit (CPU) frequency boost. To this end, the approach collects temperature information from available hosts and places services on the host that can attain the boosted mode the longest. We evaluate this approach and show its effectiveness. For high load scenarios, the approach increases the overall performance and the performance per watt. Even better results show up for low load workloads, where not only all performance metrics improve but also the temperatures and total power consumption decrease. • Last, we design an IDPS protecting against database ransomware attacks that comprise multiple queries to attain their goal. Our solution models these attacks using a Colored Petri Net (CPN). A proof-of-concept implementation shows that our approach is capable of detecting attacks without creating false positives for benign scenarios. Furthermore, our solution creates only a small performance impact. Our contributions can help to improve the performance of security infrastructures. We see multiple application areas from data center operators over software and hardware developers to security and performance researchers. Most of the above-listed contributions found use in several research publications. Regarding future work, we see the need to better integrate SDN-enabled security functions and SSFC reordering in data center networks. Future SSFC should discriminate between different traffic types, and security frameworks should support automatically learning models for security functions. We see the need to consider energy efficiency when regarding SSFCs and take CPU boosting technologies into account when designing performance models as well as placement, scaling, and deployment strategies. Last, for a faster adaptation against recent ransomware attacks, we propose machine-assisted learning for database IDPS signatures.}, author = {Iffl{\"a}nder, Lukas}, keywords = {security}, month = {01}, school = {Universit{\"a}t W{\"u}rzburg}, title = {Attack-aware Security Function Management}, type = {doctoralthesis}, year = 2021 }

  %0 Thesis %1 ifflander2021attackaware %A Iffl{ä}nder, Lukas %D 2021 %T Attack-aware Security Function Management %X Over the last decades, cybersecurity has become an increasingly important issue. Between 2019 and 2011 alone, the losses from cyberattacks in the United States grew by 6217%. At the same time, attacks became not only more intensive but also more and more versatile and diverse. Cybersecurity has become everyone’s concern. Today, service providers require sophisticated and extensive security infrastructures comprising many security functions dedicated to various cyberattacks. Still, attacks become more violent to a level where infrastructures can no longer keep up. Simply scaling up is no longer sufficient. To address this challenge, in a whitepaper, the Cloud Security Alliance (CSA) proposed multiple work packages for security infrastructure, leveraging the possibilities of Software-defined Networking (SDN) and Network Function Virtualization (NFV). Security functions require a more sophisticated modeling approach than regular network functions. Notably, the property to drop packets deemed malicious has a significant impact on Security Service Function Chains (SSFCs)—service chains consisting of multiple security functions to protect against multiple at- tack vectors. Under attack, the order of these chains influences the end-to-end system performance depending on the attack type. Unfortunately, it is hard to predict the attack composition at system design time. Thus, we make a case for dynamic attack-aware SSFC reordering. Also, we tackle the issues of the lack of integration between security functions and the surrounding network infrastructure, the insufficient use of short term CPU frequency boosting, and the lack of Intrusion Detection and Prevention Systems (IDPS) against database ransomware attacks. Current works focus on characterizing the performance of security functions and their behavior under overload without considering the surrounding infrastructure. Other works aim at replacing security functions using network infrastructure features but do not consider integrating security functions within the network. Further publications deal with using SDN for security or how to deal with new vulnerabilities introduced through SDN. However, they do not take security function performance into account. NFV is a popular field for research dealing with frameworks, benchmarking methods, the combination with SDN, and implementing security functions as Virtualized Network Functions (VNFs). Research in this area brought forth the concept of Service Function Chains (SFCs) that chain multiple network functions after one another. Nevertheless, they still do not consider the specifics of security functions. The mentioned CSA whitepaper proposes many valuable ideas but leaves their realization open to others. This thesis presents solutions to increase the performance of single security functions using SDN, performance modeling, a framework for attack-aware SSFC reordering, a solution to make better use of CPU frequency boosting, and an IDPS against database ransomware. Specifically, the primary contributions of this work are: • We present approaches to dynamically bypass Intrusion Detection Systems (IDS) in order to increase their performance without reducing the security level. To this end, we develop and implement three SDN-based approaches (two dynamic and one static). We evaluate the proposed approaches regarding security and performance and show that they significantly increase the performance com- pared to an inline IDS without significant security deficits. We show that using software switches can further increase the performance of the dynamic approaches up to a point where they can eliminate any throughput drawbacks when using the IDS. • We design a DDoS Protection System (DPS) against TCP SYN flood at tacks in the form of a VNF that works inside an SDN-enabled network. This solution eliminates known scalability and performance drawbacks of existing solutions for this attack type. Then, we evaluate this solution showing that it correctly handles the connection establishment and present solutions for an observed issue. Next, we evaluate the performance showing that our solution increases performance up to three times. Parallelization and parameter tuning yields another 76% performance boost. Based on these findings, we discuss optimal deployment strategies. • We introduce the idea of attack-aware SSFC reordering and explain its impact in a theoretical scenario. Then, we discuss the required information to perform this process. We validate our claim of the importance of the SSFC order by analyzing the behavior of single security functions and SSFCs. Based on the results, we conclude that there is a massive impact on the performance up to three orders of magnitude, and we find contradicting optimal orders for different workloads. Thus, we demonstrate the need for dynamic reordering. Last, we develop a model for SSFC regarding traffic composition and resource demands. We classify the traffic into multiple classes and model the effect of single security functions on the traffic and their generated resource demands as functions of the incoming network traffic. Based on our model, we propose three approaches to determine optimal orders for reordering. • We implement a framework for attack-aware SSFC reordering based on this knowledge. The framework places all security functions inside an SDN-enabled network and reorders them using SDN flows. Our evaluation shows that the framework can enforce all routes as desired. It correctly adapts to all attacks and returns to the original state after the attacks cease. We find possible security issues at the moment of reordering and present solutions to eliminate them. • Next, we design and implement an approach to load balance servers while taking into account their ability to go into a state of Central Processing Unit (CPU) frequency boost. To this end, the approach collects temperature information from available hosts and places services on the host that can attain the boosted mode the longest. We evaluate this approach and show its effectiveness. For high load scenarios, the approach increases the overall performance and the performance per watt. Even better results show up for low load workloads, where not only all performance metrics improve but also the temperatures and total power consumption decrease. • Last, we design an IDPS protecting against database ransomware attacks that comprise multiple queries to attain their goal. Our solution models these attacks using a Colored Petri Net (CPN). A proof-of-concept implementation shows that our approach is capable of detecting attacks without creating false positives for benign scenarios. Furthermore, our solution creates only a small performance impact. Our contributions can help to improve the performance of security infrastructures. We see multiple application areas from data center operators over software and hardware developers to security and performance researchers. Most of the above-listed contributions found use in several research publications. Regarding future work, we see the need to better integrate SDN-enabled security functions and SSFC reordering in data center networks. Future SSFC should discriminate between different traffic types, and security frameworks should support automatically learning models for security functions. We see the need to consider energy efficiency when regarding SSFCs and take CPU boosting technologies into account when designing performance models as well as placement, scaling, and deployment strategies. Last, for a faster adaptation against recent ransomware attacks, we propose machine-assisted learning for database IDPS signatures.

• 
  Hands Off my Database: Ransomware Detection in Databases through Dynamic Analysis of Query Sequences Iffländer, Lukas; Dmitrienko, Alexandra; Hagen, Christoph; Jobst, Michael; Kounev, Samuel; (2019).
  • [ BibTeX ]
  • [ EndNote ]
  • [ URL ]
  • [ Download ]
  @techreport{Ifflander_Hands_Off_my_Database, author = {Iffländer, Lukas and Dmitrienko, Alexandra and Hagen, Christoph and Jobst, Michael and Kounev, Samuel}, institution = {Universit{\"a}t W{\"u}rzburg}, journal = {arXiv}, keywords = {t_techreport}, month = {07}, title = {Hands Off my Database: Ransomware Detection in Databases through Dynamic Analysis of Query Sequences}, year = 2019 }

  %0 Report %1 Ifflander_Hands_Off_my_Database %A Iffländer, Lukas %A Dmitrienko, Alexandra %A Hagen, Christoph %A Jobst, Michael %A Kounev, Samuel %D 2019 %J arXiv %T Hands Off my Database: Ransomware Detection in Databases through Dynamic Analysis of Query Sequences %U https://arxiv.org/abs/1907.06775