Search for Articles:
Title / Keyword
Author / Affiliation / Email
Journal
Article Type
 
 
Advanced Search
 
Section
Special Issue
Volume
Issue
Number
Page
 
Journals
JCP
Special Issues
Cloud Security and Privacy
share announcement

Special Issue "Cloud Security and Privacy"

A special issue of Journal of Cybersecurity and Privacy (ISSN 2624-800X). This special issue belongs to the section "Privacy".

Deadline for manuscript submissions: 31 January 2024 | Viewed by 3384

Special Issue Editors

Prof. Dr. Martin Gilje Jaatun

E-Mail Website
Guest Editor
IDE, University of Stavanger, 4021 Stavanger, Norway
Interests: software security; cloud security; critical infrastructure security
Special Issues, Collections and Topics in MDPI journals
Dr. Massimiliano Rak

E-Mail Website
Guest Editor
Department of Engineering, University of Campania Luigi Vanvitelli, Via Roma 29, 81031 Aversa, Italy
Interests: cloud; system security; security assessment; cloud security; HPC; security SLA
Dr. Ferhat Ozgur Catak

E-Mail Website
Guest Editor
IDE, University of Stavanger, 4021 Stavanger, Norway
Interests: cyber security; 5G/6G and beyond wireless systems; data privacy; machine/deep learning covering the theoretical, applicative, and computational aspects; deep learning

Special Issue Information

Dear Colleagues,

Cloud computing is a cost-effective way of provisioning infrastructure and software, but challenges related to privacy and security still trouble many potential users and keep cloud computing from reaching its true potential. This Special Issue aims to publish novel approaches to security and privacy in the cloud.

Suggested topics include, but are not limited to:

  • Securing Machine Learning in the cloud;
  • Trusted execution and confidential computing;
  • Virtual machine and container security;
  • Cloud accountability and auditing;
  • Cloud authentication and authorization;
  • Blockchain cloud services;
  • Cryptography in the cloud;
  • Hypervisor security;
  • Cloud identity management and security as a service;
  • The prevention of data loss or leakage;
  • Secure, interoperable identity management;
  • Cloud trust and credential management;
  • Trust models for cloud services;
  • Usable security risk management in the cloud.

Prof. Dr. Martin Gilje Jaatun
Dr. Massimiliano Rak
Dr. Ferhat Ozgur Catak
Guest Editors

Manuscript Submission Information

Manuscripts should be submitted online at www.mdpi.com by registering and logging in to this website. Once you are registered, click here to go to the submission form. Manuscripts can be submitted until the deadline. All submissions that pass pre-check are peer-reviewed. Accepted papers will be published continuously in the journal (as soon as accepted) and will be listed together on the special issue website. Research articles, review articles as well as short communications are invited. For planned papers, a title and short abstract (about 100 words) can be sent to the Editorial Office for announcement on this website.

Submitted manuscripts should not have been published previously, nor be under consideration for publication elsewhere (except conference proceedings papers). All manuscripts are thoroughly refereed through a single-blind peer-review process. A guide for authors and other relevant information for submission of manuscripts is available on the Instructions for Authors page. Journal of Cybersecurity and Privacy is an international peer-reviewed open access quarterly journal published by MDPI.

Please visit the Instructions for Authors page before submitting a manuscript. The Article Processing Charge (APC) for publication in this open access journal is 1000 CHF (Swiss Francs). Submitted papers should be well formatted and use good English. Authors may use MDPI's English editing service prior to publication or during author revisions.

Published Papers (3 papers)

Download All Papers
Order results
Result details
Show export options expand_more Show export options expand_less
Select all
Export citation of selected articles as:

Research

Jump to: Review, Other

24 pages, 5484 KiB  
Article
Machine Learning Detection of Cloud Services Abuse as C&C Infrastructure
by
Turki Al lelah
,
George Theodorakopoulos
,
Amir Javed
and
Eirini Anthi
J. Cybersecur. Priv. 2023, 3(4), 858-881; https://doi.org/10.3390/jcp3040039 - 01 Dec 2023
Viewed by 269
Abstract
The proliferation of cloud and public legitimate services (CLS) on a global scale has resulted in increasingly sophisticated malware attacks that abuse these services as command-and-control (C&C) communication channels. Conventional security solutions are inadequate for detecting malicious C&C traffic because it blends with [...] Read more.
The proliferation of cloud and public legitimate services (CLS) on a global scale has resulted in increasingly sophisticated malware attacks that abuse these services as command-and-control (C&C) communication channels. Conventional security solutions are inadequate for detecting malicious C&C traffic because it blends with legitimate traffic. This motivates the development of advanced detection techniques. We make the following contributions: First, we introduce a novel labeled dataset. This dataset serves as a valuable resource for training and evaluating detection techniques aimed at identifying malicious bots that abuse CLS as C&C channels. Second, we tailor our feature engineering to behaviors indicative of CLS abuse, such as connections to known CLS domains and potential C&C API calls. Third, to identify the most relevant features, we introduced a custom feature elimination (CFE) method designed to determine the exact number of features needed for filter selection approaches. Fourth, our approach focuses on both static and derivative features of Portable Executable (PE) files. After evaluating various machine learning (ML) classifiers, the random forest emerges as the most effective classifier, achieving a 98.26% detection rate. Fifth, we introduce the “Replace Misclassified Parameter (RMCP)” adversarial attack. This white-box strategy is designed to evaluate our system’s detection robustness. The RMCP attack modifies feature values in malicious samples to make them appear as benign samples, thereby bypassing the ML model’s classification while maintaining the malware’s malicious capabilities. The results of the robustness evaluation demonstrate that our proposed method successfully maintains a high accuracy level of 84%. In sum, our comprehensive approach offers a robust solution to the growing threat of malware abusing CLS as C&C infrastructure. Full article
(This article belongs to the Special Issue Cloud Security and Privacy)
►▼ Show Figures

Figure 1

Review

Jump to: Research, Other

36 pages, 1830 KiB  
Review
Security in Cloud-Native Services: A Survey
by
Theodoros Theodoropoulos
,
Luis Rosa
,
Chafika Benzaid
,
Peter Gray
,
Eduard Marin
,
Antonios Makris
,
Luis Cordeiro
,
Ferran Diego
,
Pavel Sorokin
,
Marco Di Girolamo
,
Paolo Barone
,
Tarik Taleb
and
Konstantinos Tserpes
J. Cybersecur. Priv. 2023, 3(4), 758-793; https://doi.org/10.3390/jcp3040034 - 26 Oct 2023
Viewed by 1271
Abstract
Cloud-native services face unique cybersecurity challenges due to their distributed infrastructure. They are susceptible to various threats like malware, DDoS attacks, and Man-in-the-Middle (MITM) attacks. Additionally, these services often process sensitive data that must be protected from unauthorized access. On top of that, [...] Read more.
Cloud-native services face unique cybersecurity challenges due to their distributed infrastructure. They are susceptible to various threats like malware, DDoS attacks, and Man-in-the-Middle (MITM) attacks. Additionally, these services often process sensitive data that must be protected from unauthorized access. On top of that, the dynamic and scalable nature of cloud-native services makes it difficult to maintain consistent security, as deploying new instances and infrastructure introduces new vulnerabilities. To address these challenges, efficient security solutions are needed to mitigate potential threats while aligning with the characteristics of cloud-native services. Despite the abundance of works focusing on security aspects in the cloud, there has been a notable lack of research that is focused on the security of cloud-native services. To address this gap, this work is the first survey that is dedicated to exploring security in cloud-native services. This work aims to provide a comprehensive investigation of the aspects, features, and solutions that are associated with security in cloud-native services. It serves as a uniquely structured mapping study that maps the key aspects to the corresponding features, and these features to numerous contemporary solutions. Furthermore, it includes the identification of various candidate open-source technologies that are capable of supporting the realization of each explored solution. Finally, it showcases how these solutions can work together in order to establish each corresponding feature. The insights and findings of this work can be used by cybersecurity professionals, such as developers and researchers, to enhance the security of cloud-native services. Full article
(This article belongs to the Special Issue Cloud Security and Privacy)
►▼ Show Figures

Figure 1

Other

Jump to: Research, Review

33 pages, 5059 KiB  
Systematic Review
Abuse of Cloud-Based and Public Legitimate Services as Command-and-Control (C&C) Infrastructure: A Systematic Literature Review
by
Turki Al lelah
,
George Theodorakopoulos
,
Philipp Reinecke
,
Amir Javed
and
Eirini Anthi
J. Cybersecur. Priv. 2023, 3(3), 558-590; https://doi.org/10.3390/jcp3030027 - 01 Sep 2023
Cited by 1 | Viewed by 1416
Abstract
The widespread adoption of cloud-based and public legitimate services (CPLS) has inadvertently opened up new avenues for cyber attackers to establish covert and resilient command-and-control (C&C) communication channels. This abuse poses a significant cybersecurity threat, as it allows malicious traffic to blend seamlessly [...] Read more.
The widespread adoption of cloud-based and public legitimate services (CPLS) has inadvertently opened up new avenues for cyber attackers to establish covert and resilient command-and-control (C&C) communication channels. This abuse poses a significant cybersecurity threat, as it allows malicious traffic to blend seamlessly with legitimate network activities. Traditional detection systems are proving inadequate in accurately identifying such abuses, emphasizing the urgent need for more advanced detection techniques. In our study, we conducted an extensive systematic literature review (SLR) encompassing the academic and industrial literature from 2008 to July 2023. Our review provides a comprehensive categorization of the attack techniques employed in CPLS abuses and offers a detailed overview of the currently developed detection strategies. Our findings indicate a substantial increase in cloud-based abuses, facilitated by various attack techniques. Despite this alarming trend, the focus on developing detection strategies remains limited, with only 7 out of 91 studies addressing this concern. Our research serves as a comprehensive review of CPLS abuse for the C&C infrastructure. By examining the emerging techniques used in these attacks, we aim to make a significant contribution to the development of effective botnet defense strategies. Full article
(This article belongs to the Special Issue Cloud Security and Privacy)
►▼ Show Figures

Figure 1

Show export options expand_more Show export options expand_less
Select all
Export citation of selected articles as:
 
Displaying articles 1-3
Back to TopTop