Abstract

Depression is a disorder that if not treated can hamper the quality of life. EEG has shown great promise in detecting depressed individuals from depression control individuals. It overcomes the limitations of traditional questionnaire-based methods. In this study, a machine learning-based method for detecting depression among young adults using EEG data recorded by the wireless headset is proposed. For this reason, EEG data has been recorded using an Emotiv Epoc+ headset. A total of 32 young adults participated and the PHQ9 screening tool was used to identify depressed participants. Features such as skewness, kurtosis, variance, Hjorth parameters, Shannon entropy, and Log energy entropy from 1 to 5 sec data filtered at different band frequencies were applied to KNN and SVM classifiers with different kernels. At AB band (8–30 Hz) frequency, 98.43 ± 0.15% accuracy was achieved by extracting Hjorth parameters, Shannon entropy, and Log energy entropy from 5 sec samples with a 5-fold CV using a KNN classifier. And with the same features and classifier overall accuracy = 98.10 ± 0.11, NPV = 0.977, precision = 0.984, sensitivity = 0.984, specificity = 0.976, and F1 score = 0.984 was achieved after splitting the data to 70/30 ratio for training and testing with 5-fold CV. From the findings, it can be concluded that EEG data from an Emotiv headset can be used to detect depression with the proposed method.

Introduction

Depressive disorder is a highly prevalent mental illness. Sadness, loss of interest or enjoyment, feelings of guilt or low self-worth, interrupted sleep or food, fatigue, and difficulty concentrating are some characteristics of depression. It may affect a person’s capacity to operate in daily life or at work or school. According to the World Health Organization (WHO) back in 2015, almost 4.4% of the world’s population was suffering from depression [1]. Because of the COVID-19 pandemic, many people suffered from depression due to job loss, study hampering, losing close relatives, staying indoors, etc. A study showed 19.3% increase in depression symptoms among people after COVID-19 in the United States [2]. A study has shown the changes in obsession, depression, and quality of life in schizophrenia patients before and after COVID-19 [3]. When depression is severe it can lead to suicide. Every year around 800 thousand people die because of suicide [1]. In 2017, 13.2% of young adults (aged 18–25) in the U.S. suffered from depression which was 5.1% less in the year 2009 [4]. Of the deaths of young people, around 9.1% are due to suicide [5]. In most suicide cases, people had psychiatric disorders where depression is the most common disorder among others [6]. According to a recent study, insecure attachment styles are linked to greater problems such as depression, social anxiety, and suicidal thoughts [7]. So, depression is a major issue that should be diagnosed and treated at an early age to prevent suicide and for the betterment of the quality of life.

Conclusion

In this work, we have recorded EEG data of young adults (19 depressed and 13 Control) evaluated by the PHQ9 screening tool and proposed a machine learning approach to learn about the EEG properties for depression detection.

We conducted multiple experiments with the reported machine learning (SVM and KNN) classifiers with our recorded data. The first experiment we conducted was on segmentation to find the better sample length suitable for ML. From our experiments, we have identified that 5-second segments are suitable for our work. Then, we have identified a suitable frequency range from various experiments that improve performance using features that are related to depression detection. We have found out that Hjorth parameters along with Shannon entropy and long energy entropy provide better results among other reported features and the beta band (12–30 Hz) gives the highest accuracy of 97.21 ± 0.21% with 25 iterations and 5-fold CV using weighted KNN compared to the other sub-bands. By combining the sub-bands, we have also investigated some other frequency ranges. We have found out that by taking the range from alpha to beta 8–30 Hz (AB), we can improve ML performance and achieve 98.43 ± 0.15% accuracy with 25 iterations and a 5-fold CV with fine KNN classifier. Using AB (8–30 Hz), we can see a significant improvement of 1.22% accuracy and slandered deviation. To further investigate the reliability, we divided the dataset 70/30 for training and testing with 5-fold CV and 10 iterations. In this experiment, we have found out that the ML performance is better by choosing the AB (8–30 Hz) band with fine KNN classifier with an accuracy of 98.10 ± 0.11%, precision of 0.984 ± 0.003, NPV of 0.977 ± 0.002, sensitivity of 0.984 ± 0.002, specificity of 0.976 ± 0.005, and F1 score of 0.984 ± 0.001. Then, we analyzed the ML performance in different regions of the brain and concluded that using the whole brain for depression detection will give the highest accuracy. The proposed method can detect depression among young adults with minimum requirements compared to other related works.

Abstract

     Autonomous ships would require higher cyber-physical interaction in comparison with traditional shipping operations, thus increasing the vulnerabilities associated with cyber security. The increasing complexity surrounding the innate characteristics of the shipping industry makes it challenging to build a resilient framework for ensuring cyber security. This study proposes a multi-criteria decision-making (MCDM) framework for assessing cyber security risk in the autonomous shipping context. The research was validated through surveying subject matter experts, system designers and seafarers. Different types of equipment and systems are ranked based on their perceived vulnerability to cyber threats. Survey data from 28 subject matter experts are collected and analysed through the Bayesian best–worst method (BWM). At system level, the results indicate that navigational systems are the most vulnerable to potential cyber threats, while propulsion systems are the least vulnerable element in the context of future autonomous shipping operations. On a sub-system level, the three most vulnerable parts are Global Navigation Satellite System (GNSS), Electronic Chart Display and Information System (ECDIS) and the communication devices on shore control centres (SCC), while the least vulnerable parts are engine controls, SCC integration platforms and cargo handling at ports.

Introduction

     Merchant ships have been an integral part of international trade, carrying about 90% of the goods transported globally (OECD 2021). Since its inception, eforts have been made by the stakeholders to make this mode of transport safer, more efcient and more cost efective. The introduction of advanced technologies along with the skills development of the workforce over the years has reportedly increased workplace safety in the maritime domain (Chauvin et al. 2013; Allianz 2020).

     Consequently, modern technologies such as Automatic Identifcation Systems (AIS), Global Navigation Satellite Systems (GNSS) and Electronic Chart Display and Information Systems (ECDIS) have contributed to safer navigation. The increased reliability and efciency of these technologies has resulted in their broader adoption in the shipping industry such that large ships are now being efciently operated by fewer crews (Lee and Sanquist 1996). The notion that it is possible to maintain navigational safety in the future even without any crew onboard has led to the discussion towards the adoption of autonomous shipping technology. Wróbel et al. (2017) stated that the introduction of Maritime Autonomous Surface Ships (MASS) could further reduce the likelihood of navigational accidents, such as collisions and groundings, as human error played a role in the majority of navigational accidents. However, the probability and consequences of non-navigational accidents such as fre and structural failure are likely to increase if no crew members are onboard (Wróbel et al. 2017).

Conclusions

     This study has presented an integrated approach to elicit cyber-security vulnerabilities in the context of future autonomous shipping utilizing a MCDM method. Our results suggest that navigational systems are the most vulnerable to cyber-threats, whereas propulsion control systems are the least. This necessitates communication devices and protocols used for the navigation of autonomous ships be redundant and cyber-safe. Other emerging new systems in the context of autonomous ships, such as the shore control centre and associated equipment, although opaque for the time being, are potentially vulnerable to multidimensional cyber-threats as described in this study. The unpredictable nature of cyber-security threats, along with inherent repercussions, calls for a multifaceted approach to safeguard the future of shipping. A pre-emptive approach should include not only technical guidelines but also policy and industrial ones and best practices in risk management, and in the behavioural and cultural aspects of shipping. In addition, experts concur that only compliancebased actions would not be sufcient to safeguard against cyber threats. Rather, an all-out comprehensive approach, considering the above aspects, would ensure a safe and secure adoption of autonomous shipping.

Abstract

     Cyber-security behavior research is scant with even scarce studies carried out in developing countries. We examine the cyber-security and risky Internet behaviors of undergraduate students from Pakistan, taking into account the diversity of these students in terms of demographics, socioeconomic status, and the digital divide. Data were collected using a survey questionnaire. A total of 294 students belonging to six different cities of Pakistan were surveyed employing multistage stratified sampling in face-to-face interaction. The results indicated significant differences of cyber-security posture in terms of gender, age and digital divide variables. The profiles of students based on cyber-security and risky Internet behaviors indicate three groups with a majority of them falling into group that exhibits more risk-averse yet low cyber-security behavior. Moreover, proactive cyber-security awareness behavior has a positive impact on high risk-averse behavior. The implications of the findings are studied in terms of providing customized training and awareness. The future directions are laid out for further explorations in terms of cultural differences within and cross-country contexts.

Introduction

     In the wake of globalization and the complex integration of Information Systems with Information and Communication Technologies (ICTs), cyber-security constitutes an important place. Cyber-security has been defined as “the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance and technologies that can be used to protect the cyber environment and organization and user’s assets” (Alahmari and Duncan 2020). Cyber-security being relatively a nascent area of research (Lowry et al. 2017), complex individual behaviors have caught the attention of researchers only recently (Schneier 2015). Cyber-criminals exploit the weak security behavior of individuals to carry out different cyber-crimes. Literature is replete in prescribing technical hardware-software controls to safeguard assets from security threats and consequent breaches (Schneier 2015). Never-the-less, complete reliance on technical cyber-security solutions has been considered insufficient (Abawajy 2014) and various studies are emphasizing the role of non-technical cyber-security interventions in deterring security breaches (Bulgurcu et al. 2010; Haeussinger and Kranz 2013). According to a study within the field of cyber-security research, only 4% of the literature deals with behavioral studies (Gillam and Foster 2020). Moreover, most of the studies from cyber-security behavioral research are from developed countries.

Conclusion

     The confluence of technical and behavioral solutions establishes the required cyber-security in any organization. With the dearth of behavioral evidence in organizations specifically tertiary institutes, this study explores the cyber-security behavior of students in a developing country context. Our study augments previous studies by using a valid and comparatively smaller instrument and exploring in terms of socio-demographics and digital divide variables and by constructing profiles of students based on their risky and cyber-security behaviors. The study was conducted on undergraduate students and significant differences in cyber-security and risky behavior were reported for gender, age, and frequency of Internet access. The findings from this study are the result of the participant pool derived through a stratified multistage sampling strategy thus supporting external validity. The cyber-security behavior of participants from tertiary institutes paralleled with previous studies. New insights were brought to light in contrast to previous studies regarding the cyber-security posture of undergraduate students. Given the dearth of similar studies, our findings add solution evidence to the inexorably growing cyber-security problem space. The results of our study and the statistical processing lay a solid foundation for those who are looking for further scholarship. The practical application of this study calls for tailored cyber-security trainings keeping gender, age, digital divide variables and participants’ high risky-low cyber-security profiles in mind. Further, establishing the effectiveness of customized training programs before their implementation holds promise for efficient utilization of meager resources kept for cyber-security intervention in developing countries.

Abstract

     Distributed model predictive control (DMPC) schemes have become a popular choice for networked control problems. Under this approach, local controllers use a model to predict its subsystem behavior during a certain horizon so as to find the sequence of inputs that optimizes its evolution according to a given criterion. Some convenient features of this method are the explicit handling of constraints and the exchange of information between controllers to coordinate their actuation and minimize undesired mutual interactions. However, we find that schemes have been developed naively, presenting flaws and vulnerabilities that malicious entities can exploit to gain leverage in cyber-attacks. The goal of this work is to raise awareness about this issue by reviewing the vulnerabilities of DMPC methods and surveying defense mechanisms. Finally, several examples are given to indicate how these defense mechanisms can be implemented in DMPC controllers.

Introduction

     The last years have witnessed a growing interest in distributed control methods due to their superior scalability in large-scale applications such as smart grids (Qi et al., 2011, Yazdanian and Mehrizi-Sani, 2014), water systems (Negenborn, van Overloop, Keviczky, & De Schutter, 2009), and traffic control (De Oliveira & Camponogara, 2010). This approach considers the overall system as an aggregation of smaller pieces, i.e., subsystems, which are locally managed by control units referred to as agents (Kordestani et al., 2021, Scattolini, 2009), whose combined decisions determine the overall performance due to the subsystems’ coupling, e.g., in the control objectives and the system constraints. Moreover, this decomposition may be the only choice regarding the control architecture in applications where the implementation of a centralized controller becomes unfeasible due to the problem size or the existence of multiple independent decision-making entities.

Conclusions

     The evolution of technology is leading towards a world of pervasive connectivity where control systems are expected to play a major role. In this context, DMPC algorithms are likely to become essential because they enhance their capabilities with the progress of technology and they offer a means to coordinate control actions in order to attain optimal performance in a scalable manner. However, an interconnected world will also offer significant opportunities for cyber-attacks, which may have devastating consequences if they affect critical infrastructures. Even nowadays we can find every now and then headlines in major newspapers that show how severe cyber-threats can become, with some notorious attacks disrupting applications such as nuclear plants, power grids, smart buildings and autonomous cars, to make a few examples.

     In this article we have reviewed the most vulnerable spots in the control infrastructure that can be exploited to attack DMPC methods. In addition, we have seen that the algorithms have inherent vulnerabilities because their design is usually based on the assumption that every controller in the network will be compliant with the algorithm employed. To deal with these issues, we have presented detection and mitigation mechanisms that can be used to make these schemes resilient. In particular, we have seen that learning methods can make a difference in defensive tasks because of their superior flexibility to adapt to the nominal operation conditions.

Abstract

     Dedicated cyber-security functions are common in commercial businesses, who are confronted by evolving and pervasive threats of data breaches and other perilous security events. Such businesses are enmeshed with the wider societies in which they operate. Using data gathered from in-depth, semi-structured interviews with 15 Chief Information Security Officers, as well as six senior organisational leaders, we show that the work of political philosopher Thomas Hobbes, particularly Leviathan, offers a useful lens through which to understand the context of these functions and of cyber security in Western society. Our findings indicate that cyber security within these businesses demonstrates a number of Hobbesian features that are further implicated in, and provide significant benefits to, the wider Leviathan-esque state. These include the normalisation of intrusive controls, such as surveillance, and the stimulation of consumption. We conclude by suggesting implications for cyber-security practitioners, in particular, the reflexivity that these perspectives offer, as well as for businesses and other researchers.

Introduction

     Cyber-security practice is increasingly recognised as more than a technological exercise. The application of sociological and political viewpoints to such practice, particularly in organisations, is becoming more and more common, e.g., Burdon and Coles-Kemp (2019); Stevens (2016). In this paper, we build on these foundations by applying a number of lenses based on the work of Thomas Hobbes to a study of 15 Chief Information Security Officers (CISOs) and six senior organisational stakeholders representing 18 UK-based, but predominantly multinational, businesses. This work contributes to and extends cyber security scholarship by considering cyber security within business as a component of wider societal power structures. First, this research indicates that cyber security functions within businesses serve the interests of the state Leviathan. This positions those functions as indirect and possibly unwitting agents of the state, and cyber security itself as beneficial to the state and associated hegemonies. Second, it shows that cyber security functions within businesses operate as a Hobbesian form of control within the micro-societies of businesses, who are themselves mini-Leviathans. Third, it provides a novel sociological lens with which to explore cyber security within businesses and wider societies. We consider the key contribution of this research as being to provide a novel viewpoint on cyber-security practice that enables greater reflexivity and reflection for practitioners, as well as offering a pathway for future research.

Conclusion

     This paper has shown that Hobbes’ work provides a useful lens through which to view the role that cyber security plays in society within and without businesses, particularly given the importance of Hobbesian thinking to Western political thought and the enmeshed nature of states and corporations. Cyber security offers a useful mechanism from which the Leviathan derives benefit. It supports the establishment of fear and discipline, therefore, cementing power through obedience and conformance. Additionally, although less obviously, it also drives accumulation of capital through consumption of products and services, and job creation.

     Businesses play a crucial role for the Leviathan. They employ and educate citizens, inuring them to surveillance and punishing them when they transgress. They maintain narratives of morality. They generate and expand capital. In some cases, they operate critical infrastructure and perform other state functions on the Leviathan’s behalf. Businesses are themselves mini-Leviathans, and are in fear of threats to their existence. Cyber security functions within those businesses provide a means by which they seek to avoid a state of nature. They also, indirectly, provide that function to the state, supporting its attempts to dominate competing state Leviathans. Actions taken by businesses in relation to cyber security involve spending that provides fuel for the continued growth of the Leviathan’s power, and that of the hegemony that the Leviathan supports.

Abstract

     The purpose of this study is to understand public awareness of cybersecurity-related issues and discussions during the COVID-19 pandemic. Employees and confidential organizational data are vulnerable to cyber-attacks as a result of the pandemic, which has raised concerns about cyber security about the new normal of working from home. The public’s main sentiments and aspects related to cyber security concerns have been mined from tweets on the microblogging social media website Twitter. Sentiment Analysis and Topic Modeling techniques have been applied to understand the perspectives, emotions, and themes discussed by people. The analysis reveals people are becoming more aware of cybercrime-related concerns and are more positive than negative in combating the challenge of cybercrime. The paper also highlights the main themes revealed by Topic Modeling.

Introduction

     The Internet has now integrated into human lives, with about 3 billion users all over the world. Billions of dollars are generated globally by this global network [13]. In the current scenario, the majority of the activities and interactions, whether commercial, cultural, governmental, nongovernmental, individual, or organizational, are all performed in cyberspace [1], causing unprecedented growth in cyberspace [2]. The innovations in the field of the internet have made it more accessible, user-friendly, and affordable for most people [34], thus integrating it into human lives profusely. The lives of humans on earth are intertwined in cyberspace and any turbulence or insecurity impacts different facets of human lives [18]. Such a tremendous growth in information sharing provides a platform to those with malevolent intentions and raises cybersecurity issues [15]. Due to COVID-19 pandemic role of technology has escalated in the professional lives with remote working becoming new normal. However organizations are still not able to provide cybercrime safe remote working. In today’s contemporary world social media is a great source of exchanging information, opinions, and discussions by providing a universal platform. Twitter, a microblogging platform has 206 million daily active users enabling users to create and post messages and follow each other [4]. People post their experiences, opinions especially emotions via electronic media. Therefore, microblogging websites like Twitter are a momentous source of data followed by opinion mining and sentiment analysis [17, 29, 30].

Discussion and Conclusion

     The Twitter data analysis explains the awareness and perception of the users on cybersecurity-related issues. Users, in general, discussed the issues like ransomware, malware, and cyber-attacks in different parts of the world. Since the study took place in November and December 2021, the people were well aware and perhaps more trained to combat the cyber-attacks than initially when the COVID-19 outbreak took place as implied by a large number of positive and neutral tones of the polarity of sentiments The Sentiment Analysis further enlightened that people were having ‘trust’ as the major emotion in tweets. This may be the people and their organizations have leveraged better tools and techniques to mitigate the online scams. Also, they were more accustomed to working remotely. Moreover, high anticipation emotion also predicts that people were hopeful that the situation will improve and in future, the cyber security will enhance as companies will take better practical approaches to protect their devices and people. Although, the high value of ‘Fear” in the sentiment analysis depicts that there are issues people are concerned about and the cyber attacks in Russia, ransomware, hacking, and malware show people are still afraid of cybercrimes. The cyber criminals keep on deploying new techniques to scam the devices and people which require a more precautious take on the issues. But the sentiment analysis reveals as people became more accustomed to the new normal and improved vigilant employment of technology the sentiments were more neutral or positive.

Abstract

     This paper presents a cyber-security culture framework for assessing and evaluating the current security readiness of an organization’s workforce. Having conducted a thorough review of the most commonly used security frameworks, we identify core security human-related elements and classify them by constructing a domain agnostic security model. We then proceed by presenting in detail each component of our model and attempt to quantify them in order to achieve a feasible assessment methodology. The paper thereafter presents the application of this methodology for the design and development of a security culture evaluation tool, that offers recommendations and alternative approaches to workforce training programs and techniques. The model has been designed to easily adapt on various application domains while focusing on their unique characteristics. The paper concludes on applications of our instrument on security-critical domains, and its contribution to current research by providing deeper insights regarding the human factor in cybersecurity.

Introduction

     Information Security is a multidisciplinary area of study and professional activity focusing on safeguarding and protecting Information Technology against a variety of dangers and threats.1,2 Initially, information security was characterized by a rather technical approach best left to the technical experts. 3 Even at this early stage, people responsible for implementing information security, identified the need for top management becoming involved. This led to a second phase where information security was incorporated into organizational structures and Information Security Managers were appointed.4 Security policies and procedures were drafted creating the need to understand their effectiveness and assess their results. But most importantly, revealing that there were other elements of information security that had been disregarded up until then. Information security standardization, certification and assessment were introduced along with an effort to understand and address the human element as an important security factor.5

     An organization’s biggest threat to privacy and security, even if not acknowledged, are considered to be their own staff. 6 Employee security awareness is a key link to an organization’s security chain since even the most well-guarded corporation is defenseless with no security culture. 7,8 This term, “security culture,” soon dominated in the era and was attributed various definitions.9 The vast majority of them agree that it “exists when every participant in the information society, appropriately to their role, is aware of the relevant security risks and preventative measures, assumes responsibility and takes steps to improve the security of their information systems and networks

Conclusion and future work 

     Research trend appears to be moving from a technical approach of information security to a socio-cultural approach.53,96,97 Technical simulations and real-time testing of information systems, mathematical models, analytics, and risk assessments make room to behavioral, organizational, and criminological theories as to the basis of the cybersecurity evaluation.

     The security culture framework presented in this paper manages to combine the pros and mitigate the cons of both scientific approaches while underlining the importance of human factor in the security chain.9 Its iterative nature allows closely monitoring and constantly evaluating an organization’s cyber-security culture which, as a living mechanism, adapts and evolves to the continuously demanding technological environment of this century

Abstract

     Sharing threat events and Indicators of Compromise (IoCs) enables quick and crucial decision making relative to effective countermeasures against cyberattacks. However, the current threat information sharing solutions do not allow easy communication and knowledge sharing among threat detection systems (in particular Intrusion Detection Systems (IDS)) exploiting Machine Learning (ML) techniques. Moreover, the interaction with the expert, which represents an important component to gather verified and reliable input data for the ML algorithms, is weakly supported. To address all these issues, ORISHA, a platform for ORchestrated Information SHaring and Awareness enabling the cooperation among threat detection systems and other information awareness components, is proposed here. ORISHA is backed by a distributed Threat Intelligence Platform based on a network of interconnected Malware Information Sharing Platform instances, which enables the communication with several Threat Detection layers belonging to different organizations. Within this ecosystem, Threat Detection Systems mutually benefit by sharing knowledge that allows them to refine the underlying predictive accuracy. Uncertain cases, i.e. examples with low anomaly scores, are proposed to the expert, who acts with the role of oracle in an Active Learning scheme. By interfacing with a honeynet, ORISHA allows for enriching the knowledge base with further positive attack instances and then yielding robust detection models. An experimentation conducted on a well-known Intrusion Detection benchmark demonstrates the validity of the proposed architecture.

Introduction

     Nowadays, organizations and users face an enormous amount of sophisticated, targeted and widespread cyberattacks. Malicious actors were proven able to compromise government computer systems as well user devices causing various types of damages. Phishing, identity theft, information leakage, DDOS and botnet represent some examples of popular threat occurred in 2020 [1]. The outbreak of COVID-19 has further exacerbated this situation. As the virus spread during the early part of the 2020, the number of cyberattacks against organizations grew exponentially, reaching a peak in April [2], [3]. The pandemic unveiled different vulnerabilities of well-known platforms, applications and systems, and simultaneously stimulated the interest for promoting the usage of information sharing technologies to increase the degree of security for enterprises and organizations.

Conclusions

     Security intelligence and data analytics techniques can be used to strengthen the capabilities of cybersecurity applications in various vertical domains and use cases. These techniques can largely benefit from mechanisms to share digital evidence and ensure interoperability. The current Threat Intelligence platforms do not provide native mechanisms to incorporate such mechanisms, especially when data-driven and AI powered threat detection systems are involved. ORISHA is a first attempt to enable a sharing and interoperability protocol among such components, based solely on a data-oriented approach. This simple, flexible strategy and data formats for collaborative threat intelligence can trigger specific advantages: Improving the alert effectiveness by reducing the amount of false positive alerts; better contextualizing threat data with the contribution of multiple actors; boosting trust among producers and consumers of threat intelligence information; and strengthening the robustness of machine learning and deep learning models adopted by security applications. An experimental evaluation, conducted on a well-known IDS benchmark, demonstrates how merging data sharing and active learning strategies can improve the detection capabilities of the MISP network allowing to discover undetected attacks.

Abstract

1. Introduction

2. Overview of blockchain history

3. Blockchain Technology

4. Blockchain Applications

5. Security risks and attacks with blockchain

6. Security measures for blockchain

7. Challenges and research trends

8. Related work

9. Conclusion

Conflict of interest

References

Abstract

     Blockchain is a technology that has desirable features of decentralization, autonomy, integrity, immutability, verification, fault-tolerance, anonymity, auditability, and transparency. In this paper, we first carry out a deeper survey about blockchain technology, especially its history, consensus algorithms’ quantitative comparisons, details of cryptography in terms of public key cryptography, Zero-Knowledge Proofs, and hash functions used in the blockchain, and the comprehensive list of blockchain applications. Further, the security of blockchain itself is a focus in this paper. In particular, we assess the blockchain security from risk analysis to derive comprehensive blockchain security risk categories, analyze the real attacks and bugs against blockchain, and summarize the recently developed security measures on blockchain. Finally, the challenges and research trends are presented to achieve more scalable and securer blockchain systems for the massive deployments.

Introduction

     In blockchain, data are kept in a distributed ledger. It is the blockchain technology to provide integrity and availability that allows participants in the blockchain network to write, read, and verify transactions recorded in a distributed ledger. However, it does not allow the deletion and modification operations on the transactions and other information stored on its ledger. The blockchain system is supported and secured by cryptographic primitives and protocols, e.g., digital signatures, hash functions, etc. These primitives guarantee the transactions that are recorded into the ledger are integrity-protected, authenticity-verified, and non-repudiated. Further, as a distributed network, to allow the entire set of participants to agree on a unified record, the blockchain technology also needs a consensus protocol, which is essentially a set of rules to be followed by every participant, in order to achieve a globally unified view.

     In a trustless environment, blockchain provides users with desirable features of decentralization, autonomy, integrity, immutability, verification, fault-tolerance, attracted great academic and industrial attention in the recent few years, anonymity, auditability, and transparency [[1], [2], [3]]. With these advanced features, blockchain technology has attracted great academic and industrial attention in the recent few years.

Conclusion

     This paper has first conducted a deeper survey on blockchain technology in terms of overview, consensus algorithms, smart contracts, and cryptography for blockchain. It presented the history of blockchain, and compared the five most common consensus algorithms and one most different consensus algorithm in as much detail and quantitative as possible. Public key cryptography, Zero-Knowledge Proof, and hash functions used in blockchain have been described in detail for integrity, authentication, nonrepudiation, and payment address required in blockchain systems. This paper has then listed the comprehensive applications of blockchain. It has further presented the rich information and comparisons of eight cryptocurrencies as the first blockchain application, supply chain as a widely used case, and Smart Dubai Office as the first whole government service application. Further, the security of blockchain itself is a focus in this paper. It has described the comprehensive security risks categories based on the Top 10 Web Application Security Risks, low level risks, and high level risks. It has surveyed many real attacks and bugs on blockchain systems and listed out their root causes. The paper has then presented the security measures in the areas of security analysis, detecting malicious codes & bugs, software codes security, privacy preserving, and so on. Specially, it has presented and compared eleven smart contract bytecode vulnerability analysis tools. Finally, the challenges and research trends have been presented to build more scalable and securer blockchain systems for massive deployments.

Abstract

Introduction

Section snippets

References (103)

Recommended articles (6)

Abstract

Internet of Things or IoT is a rapidly growing network of interconnected ‘things’ embedded with sensors to collect and exchange data over the internet without the need for human intervention. As the applications of IoT continue to skyrocket, it introduces major security, ethical, privacy, and legal challenges that have a substantial impact on our lives. There is a need for a comprehensive overview covering all of these challenges. Therefore, this paper provides a clear overview of the security, ethical, and privacy challenges faced by the common users and examines the current and emerging IoT laws and standards enacted by governments across different countries to combat the vulnerabilities of IoT. Trust and the potential challenges of smart contracts have also been discussed. In addition, the multitude of use cases described in this paper provides an insight into how the threats and vulnerabilities of IoT influence our lives. This study emphasizes a need for globalized IoT laws and that the common user be made aware of the security, ethical, and privacy threats imposed by modern IoT devices. Lastly, this paper identifies the gaps and proposes certain recommendations to direct future researchers.

Introduction

It was in 1967 when Lawrence G. Roberts was appointed as program manager for the ARPANET project, the development of internetworking protocols began piecing together a single network known as the Internet- a shorthand for internetworking [1]. The 21st century has seen a massive advancement in technology, bringing the world closer through high-speed internet available on our computers and mobile devices. Let it be texting, calling, shopping, or just surfing the web, everything is within our grasp. We have adapted to this technology which is now considered a ‘smart’ ecosystem. A terminology called the ‘Internet of Things’ or IoT, in short makes this possible. With IoT growing as a new business and consumer sector, it exhibits us with immense potential of capabilities.

The concept of IoT was first advised in 1999 by Kevin Ashton, the founder of MIT Auto Identification Centre, 1999. He attributed it to an interconnected network of things connected with RFID i.e., Radio-Frequency-Identification Technology. RFID uses Radio waves and their automation to identify or authenticate objects, collect data, and control the objects. RFID comprises transmitters (tags) and receivers (readers). The tag acts as an identifier that transmits or communicates with the reader through radio waves, thus making RFID imperative for the Internet of Things.

1- INTRODUCTION

2- BLOCKCHAIN FOR IOT APPLICATIONS

3- CONSENSUS ALGORITHMS AND EVALUATION PARAMETERS

4- SECURITY ANALYSIS TECHNIQUES

5- PERFORMANCE EVALUATION TECHNIQUES

6- LESSONS LEARNED

7- OPEN CHALLENGES AND FUTURE RESEARCH OPPORTUNITIES

8- CONCLUSION

9- ACKNOWLEDGEMENT

10- REFERENCES

Abstract:

This paper presents research challenges and a tutorial on performance evaluation of blockchain-based security and privacy systems for the internet of things (IoT). We start by summarizing the existing surveys that deal with blockchain security for IoT networks. Then, we review the blockchain-based security and privacy systems for seventeen types of IoT applications, e.g., Industry 4.0, Software Defined Networking, Edge computing, Internet of Drones, Internet of Cloud, Internet of Energy, Internet of Vehicles, etc. We also review various consensus algorithms and provide a comparison with respect to the nine properties such as latency, throughput, computation, storage, and communication costs, scalability, attack model, advantage, and disadvantage…etc. Moreover, we present the security analysis techniques and provide a classification into four categories, including, BAN logic, game theory, theory analysis, and AVISPA tool. In addition, we analyze the performance metrics, blockchain testbeds, and cryptography libraries used in the performance evaluation of blockchain-based security and privacy systems for the IoT networks. Based on the current survey, we discuss the major steps to follow for building and evaluating blockchain-based security and privacy systems. Finally, we discuss and highlight open challenges and future research opportunities.

I. INTRODUCTION

Today, with the emergence of many low-cost and powerful devices such as sensors and RFIDs associated with various communication media, the Internet of Things (IoT) has gained tremendous popularity, which offers a high potential for the development of not only different home automation systems but also various industrial applications, such as connected drones, connected health, smart farming, wearables, among other areas. The IoT market is projected to increase from over 15 billion devices in 2015 to more than 75 billion in 2025. This projection indicates that on average, there will be at least 25 personal IoT devices for every person on earth [1]. The large-scale and transverse nature of IoT systems, with the different elements and components associated with the implementation of such systems, has opened new security and privacy challenges [2], [3].

Abstract

Document Sections

I. Introduction

II. Major Security Risks in IoT

III. Characteristics of Blockchain-Embedded IoT

IV. Classification of Security in IoT

V. Blockchain-Based IoT Attacks

VI. Blockchain-Based Information Sharing Security Mechanism for IoT

VII. IoT Security Scenarios Under Blockchain

VIII. Research Challenges and Future Trends

IX. Conclusion

Abstract:

In recent years, the Internet of Things (IoT) has made great progress. The interconnection between IoT and the Internet enables real-time information processing and transaction implementation through heterogeneous intelligent devices. But the security, the privacy, and the reliability of IoT are key challenges that limit its development. The features of the blockchain, such as decentralization, consensus mechanism, data encryption, and smart contracts, are suitable for building distributed IoT systems to prevent potential attacks and to reduce transaction costs. As a decentralized and transparent database platform, blockchain has the potential to raise the performance of IoT security to a higher level. This article systematically analyzes state of the art of IoT security based on the blockchain, paying special attention to the security features, issues, technologies, approaches, and related scenarios in blockchain-embedded IoT. The integration and interoperation of blockchain and IoT is an important and foreseeable development in the computational communication system.

I. Introduction

At present, the Internet of Things (IoT) is an enormous ecosystem. Its timeliness, convenience, inclusiveness, scalability, integration, and interoperability make IoT an unparalleled prospect for further development. Its applications extend to a wide range of fields, such as agriculture and food traceability, remote medicare and hospitality, location and navigation, logistics and operations, manufacturing and automation, smart city and home use, etc. At the same time, more and more security vulnerabilities have arisen—urgent issues that need to be solved. During the first half of 2017, the number of attacks on IoT devices increased by 280%. By 2021, corporate spending on information security related to IoT is projected to increase from the current 83.5 billion to 119.9 billion. Based on the architecture of IoT itself, many effective paradigms and protocols have been used to prevent or to eliminate potential security risks. But these have not been enough. IoT requires the assistance of appropriate technology and mechanisms to improve its overall security level. With the rapid development of the blockchain, its security functions have been revealed, and they have become potential approaches for IoT security, with a special focus on its decentralized and transparent system, as well as on its consensus mechanisms and privacy protocols, encrypted data and management, and smart contract agreement [1]–[4].

Abstract

Keywords

1. Introduction

2. Literature review

3. Theoretical framework

4. Model of trust calibration for phishing-website detection tools

5. Research methodology

6. Scale development and data collection

7. Analysis and results

8. Discussion

9. Theoretical and practical implications

10. Limitations and future research directions

Acknowledgements

Appendix A. Supplementary data

References

Vitae

Abstract

Phishing websites become a critical cybersecurity threat affecting individuals and organizations. Phishing-website detection tools are designed to protect users against such sites. Nevertheless, detection tools face serious user trust and suboptimal performance issues which require trust calibration to align trust with the tool’s capabilities. We employ the theoretical framework of automation trust and reliance as a kernel theory to develop the trust calibration model for phishing-website detection tools. We test the model using a controlled lab experiment. The results of our analysis show that users’ trust in detection tools can be calibrated by trust calibrators. Moreover, users’ calibrated trust has significant consequences, including users’ tool reliance, use, and performance against phishing websites.

1. Introduction

Phishing websites victimize millions of Internet users, exacting significant monetary losses and social costs for individuals and organizations [[1], [2], [3]]. An FBI announcement showed that phishing rendered $26 billion damage over a three-year period from 2016 to 2019 [4]. About $1.1 million per hour is lost to phishing attacks [5].

Phishing websites come in two forms: spoof and concocted. Spoof sites mimic existing, generally well-known websites to engage in identity theft or malware dissemination [6,7]. Concocted sites are fictional websites designed to conduct social engineering, fraudulent online advertising, or black-hat search engine optimization-based attacks for monetary gains or malware propagations. Both categories of phishing websites have serious implications for Internet users and organizations, such as damaging brand equity and increasing customer churn rates [6]. Concocted websites also frequently appear in top-ranked search results [8] and routinely disseminate malware to unsuspecting site visitors [9]. Phishing-website detection tools protect users against such sites.

These detection tools belong to a subcategory of IT called automated security IT and are defined as a type of security IT that uses certain mechanisms to automatically classify an event/objective as normal or malicious [10] while allowing users to make the final security decision [11]. There are many phishing-website detection tools, but reports indicate that users often ignore or disuse their advice [12,13]. A survey of Internet users found that 60 % of respondents do not use the web browsers’ built-in phishing-website detection tools [14]. Many users rely solely on intuition to judge the credibility of a website despite the fact that spoof rates can be as high as 33 %–45 % when users rely on their own mental model [9,15,16]. While research shows that user accuracy in detecting phishing websites is much lower than the accuracy of the detection tools [1], the rate of ignoring certain types of warnings in some browsers (e.g., SSL warnings) can be as high as 60 % [17]. These results suggest that detection tools face serious trust issues in users. Addressing these issues demands a novel approach to investigate user trust vis-à-vis characteristics of detection tools.