APRÈN. Portal de la producció docent del professorat de la UPC

This thesis is a contribution to the attacker taxonomy project developed at Aalborg University as it expands its scope. The objective is to provide a framework that describes the future state of cybersecurity through a structured categorization of reliable sources. The PREACT taxonomy is designed to raise awareness and inform society, businesses and individuals about emerging cyber threats, helping them to take security measures beforehand. By integrating recent research and existing attacker profiles, this work offers a global view of the cybersecurity landscape. The taxonomy is formalized in a tree diagram to improve understanding and accessibility, as its purpose is educational and reflective. This project is builded on previous advancements and aims to be a foundation for future research to understand and mitigate cybersecurity risks.

This thesis proposes an end-to-end framework for malware detection that models endpoint memory as a dynamically evolving mathematical object. The system acquires memory snapshots via a PowerShell-based VirtualBox control script, compresses them into complex-valued representations capturing magnitude and orientation changes (implemented in Rust), and analyzes these representations as two-dimensional time series in Python. This approach simulates a “MEMORY ECG,” where the delta of page content across consecutive snapshots reveals anomalous behavior without requiring process specific knowledge. At the core of this framework is an autoencoder (AE) that captures the latent structure of normal memory blocks across multiple snapshots. By modeling how blocks evolve over time, the AE identifies deviations from these learned distributions, signaling potential malware. Feature extraction, essential for AE input, is performed using Wavelet Scattering Transform (WST) or alternative techniques such as Fourier Transform, Cepstrum and wavelets analysis. Unlike WST, which generates invariant features directly, these other methods involve an additional layer of preprocessing to extract features from raw memory deltas, enabling the AE to detect anomalies effectively. Developed in Python, the solution offers extensive configurability and automation for both signal processing and machine learning through a Keras-based pipeline. Users can finetune parameters such as block size, transform type, scaling, and PCA, as well as define operational modes (training, incremental training, or testing). By integrating memory acquisition, compression, and feature extraction into a continuous workflow, this scalable framework lays the foundation for real-time behavioral malware detection, enabling live anomaly monitoring through endpoint memory analysis as a time-varying signal.

Quantum Key Distribution (QKD) provides a method for securely sharing a secret key between two distant parties, Alice and Bob, by leveraging the principles of quantum mechanics. This thesis focuses on Continuous-Variable (CV) QKD, a variant of QKD where information is encoded in the quadrature components of coherent light states, allowing for efficient and cost-effective detection using homodyne or heterodyne receivers. The thesis is divided into three main parts: an introduction to quantum cryptography concepts, the presentation of a CV-QKD protocol, and a detailed security proof of the protocol against different types of attacks. The security proof considers both finite and infinite symbol transmission and tackles various eavesdropping attacks, including individual, collective, and coherent attacks. The use of Gaussian states and operations provides a promising approach to enhance QKD security, particularly in the context of practical quantum cryptography. The final sections provide a mathematical framework for the optimization of secure key rates and strategies for addressing the photon-number cutoff assumption in practical implementations.

Es generen grans conjunts de dades genòmiques a partir de diverses activitats, inclosa la recerca genealògica, estudis biomèdics, i aplicacions clíniques, que aporten un valor significatiu però sovint restringit per preocupacions de privacitat. Els serveis Beacon han sorgit per ampliar l'accessibilitat a aquestes dades, permetent consultes d'al·lels específics per informar de decisions clíniques. No obstant això, aquests serveis poden inadvertidament revelar la participació individual en conjunts de dades. Per abordar aquests reptes, la interfície Beacon v2 per a l'accés a la informació genòmica, desenvolupat per l'Aliança Global per a la Genòmica i Salut (GA4GH), té com a objectiu crear una solució segura i fàcil d'usar per consultar a nivell de població dades genòmiques, emfatitzant la privacitat i la seguretat. Aquest projecte, construït sobre l'obra de Daniel Naro per a el Projecte GenClinLab [92], incorpora una interfície proxy per millorar la seguretat, la privacitat, i granularitat de la gestió genòmica de dades. Utilitzant tècniques de privacitat diferencial (DP), la interfície garanteix l'anonimat de les dades individuals, que és vital per a la recerca en malalties rares Genètica i càncer. L'innovador marc algorítmic introduït en aquest projecte garantirà privacitat amb un impacte mínim en la utilitat de dades, abordant tant la configuració per lots com la consulta en línia. En última instància, aquesta interfície pretén ser una pedra angular en l'ecosistema genòmic de compartició de dades, avançant recerca científica i clínica, alhora que es mantenen els estàndards més alts de privacitat i seguretat.

En l'era digital, la protecció de dades és crucial per a les grans empreses, especialment davant l'augment de les amenaces cibernètiques i les estrictes regulacions com el RGPD. Aquesta tesi se centra en la identificació, classificació i protecció de dades delicades a Damm mitjançant la implementació de mesures avançades de protecció de dades amb Microsoft Purview. El projecte va implicar una avaluació exhaustiva dels riscos de filtració de dades, seguida del desenvolupament i desplegament de polítiques de Prevenció de Pèrdua de Dades personalitzades i etiquetes de sensibilitat. Aquestes etiquetes es van aplicar per garantir una classificació adequada de les dades i la seva protecció a tota l'organització. Els resultats van demostrar una millora significativa en la protecció de la informació delicada i comentaris positius dels usuaris respecte a la facilitat d'ús i l'eficàcia de les noves eines. Aquest treball no només garanteix el compliment dels requisits normatius, sinó que també millora la seguretat de les dades i l'eficiència operativa global de Damm.

Aquesta tesi aborda la necessitat crítica de mesures de seguretat en els sistemes de gestió de dades mèdiques, centrant-se en la plataforma Genomic Information Protection And Management System (GIPAMS). A mesura que els ciberatacs als sistemes de salut esdevenen cada cop més sofisticats, protegir la confidencialitat, integritat i disponibilitat de la informació dels pacients és primordial. A través d?una auditoria de seguretat integral, aquesta investigació identifica vulnerabilitats dins de GIPAMS i implementa solucions personalitzades, tant per mitigar els efectes potencials dels atacs maliciosos contra la plataforma com per monitorar l?estat de la infraestructura en tot moment. L?objectiu és enfortir GIPAMS contra l?accés no autoritzat i les violacions de dades, assegurant en última instància una plataforma més segura i fiable per als usuaris, alhora que ofereix idees i millors pràctiques per a futurs projectes.

El protocol MQTT (Message Queuing Telemetry Transport) ha guanyat popularitat en aplicacions de l'Internet de les Coses (IoT) a causa de la seva eficiència i baix consum de recursos, cosa que el fa ideal per a entorns amb ample de banda limitat i connexions inestables. Tanmateix, la seva simplicitat també presenta desafiaments significatius en termes de seguretat. Aquesta tesi té com a objectiu avaluar les vulnerabilitats de seguretat i el rendiment de tres brokers MQTT àmpliament utilitzats: Mosquitto, VerneMQ i EMQ X. El treball se centra en identificar vulnerabilitats inherents en cada broker, implementar i verificar configuracions de seguretat basades en TLS, i realitzar proves de càrrega i estrès per avaluar la capacitat dels brokers per gestionar grans volums de connexions i dades. A més, es proposen recomanacions per millorar la seguretat de les implementacions de MQTT basant-se en els resultats obtinguts. Els resultats de l'anàlisi indiquen que, encara que tots els brokers analitzats són capaços de gestionar un nombre considerable de connexions simultànies, hi ha diferències en la seva capacitat per mitigar atacs de denegació de servei (DoS) i en la robustesa dels seus mecanismes d'autenticació i xifratge. Basat en aquests resultats, es suggereixen millores en la configuració de seguretat i la gestió de recursos per enfortir les implementacions de MQTT en entorns IoT.

A Zero-Knowledge Proof basically is a protocol between two parties, the Prover and the Verifier, that allows the Prover to convince the Verifier about the truthness of a non trivial statement without revealing any additional information. Zero Knowledge Proofs have found a lot of practical applications covering most of the protocols concerning about data privacy and protocol verification. Examples of that are anonymous cash or electronic voting. The possibility to have real quantum computers with a reasonable size in a near future is forcing the cryptographic community to devise new methods to provide security that resist quantum attacks. Most of the zero-knowledge protocols used nowadays are based on computational problems like the discrete logarithm problem that can no longer be considered hard, since there are known efficient ways to solve them with quantum algorithms. Cryptographic research about the quantum security of zero knowledge proofs started nearly 20 years ago in a very theoretical approach, but not many papers on that topic appeared since then. The goal of this thesis is writing a survey including the main concepts about quantum secure zero-knowledge protocols, the state-of-the-art both from the theoretical and practical approaches, and an exploration of their potential application areas. The survey will be a good starting document for further students willing to do research in this topic.

This thesis aims to explain how the Payment Services Directive 2 (PSD2) works, its types and how it evolved from the Payment Services Directive (PSD). It will also be highlighted the impact this normative has in the financial industry and its requirements. The focus will not be only in the regulatory requirements but also in the security ones, like how to detect fraud and what measures needs to be applied to get a high security level. In order to grant the level of security needed, it must use OAuth2, that will be explained, and the different ISOs standards that need to be followed. Lastly, a comparison of this European Union directive against different ones in the world will be done. At the very end of the thesis, a glossary with all the acronyms used can be found.

This thesis explores the development and improvement of the HuntDown project, a tool used for penetration testing and cybersecurity audits. The focus is on making the tool easier to use by integrating various command-line interface (CLI) tools into a simple graphical interface. A new JSON-based format was created to store tool options, which helps handle different command formats and improves how data is processed and checked. Key achievements include setting up a strong backend verification system and expanding HuntDown's features to support more tools. These improvements aim to make the user experience smoother and ensure that automated attack setups are secure and effective.

With the development of society, informatics is gaining more relevance every day. All businesses need databases and programs to track everything that happens. Everyone uses their cellphones every day at all times, and they also have computers at home for personal use. Airplanes and cars have a lot of technology nowadays to make everything safer. However, while technology allows us to do things faster and safer, using so much technology has its problems, and one of them is the importance of making these systems and programs secure. To overcome these problems, there are different ways to do it, but one of them is pentesting, which consists of trying to attack, as if it were a real attack, the different systems that make up the whole business or whatever we are trying to attack. Huntdown is a program that lets you carry out different attacks on specific servers and gives you feedback on what the attack did. This can be useful to know if something in the system we are testing is not as secure as it should be or if something can be improved. In this project, we have improved the feedback it gives by taking every part of the command output and putting it into a JSON that is readable and useful to understand what is going on. The solution we used is based on regex, trying to take every part of the command output and organize it to be able to study if the security of the system is enough or if it should be improved.

This thesis presents the development of a Telegram bot designed to analysen .eml email files for potential phishing attempts. The bot integrates multiple APIs, including VirusTotal, AbuseIPDB, URLScan, and OpenAI's ChatGPT, to provide automated and detailed analysis reports. The project aims to create a user-friendly tool accessible to individuals regardless of technical expertise, incorporating educational elements to inform users about phishing threats and preventive measures. The system offers practical tips and real-world examples to enhance user awareness and ability to identify phishing emails.

The present study explores the field of decentralized oracles, paying specific attention to the Chainlink network. Additionally, the study includes the creation of a decentralized finance (DeFi) trader smart contract that integrates Chainlink's oracles and price feeds. Moreover, it is discussed how decentralized oracles play a crucial role in facilitating connectivity between blockchain systems and external data sources, thereby bolstering operational capabilities and broadening the scope of functionalities available to blockchain applications. The principal aim of this research is to illustrate the incorporation and application of decentralized oracles in practical settings, particularly by means of the construction of a DeFi trader smart contract. The purpose of this contract is to utilize Chainlink's dependable and secure price feeds for the implementation of essential trading operations, including the initiation and processing of purchase and sale transactions, as well as the management of limit orders. The utilization of reliable and promptly available market data from Chainlink's decentralized oracle network enables the smart contract to facilitate efficient and transparent trading activities. The primary elements of this study entail a comprehensive examination of Chainlink's complex architectural framework, consisting of decentralized oracle networks (DONs) that collate and authenticate data from various origins to safeguard the accuracy and integrity of the data. The research also examines pertinent security issues such as Sybil attacks, data manipulation, and node collusion, and delves into different strategies to mitigate these risks, including cryptographic proofs, multi-source data aggregation, and robust consensus mechanisms. In summary, this investigation highlights the importance of decentralized oracles in enhancing the functionalities of blockchain technology and DeFi applications. The results emphasize the need for extensive implementation and incorporation of decentralized oracles in order to guarantee the sustained progress and prosperity of blockchain ecosystems. This study offers a thorough and technical analysis of the architecture, security, and practical uses of Chainlink decentralized oracles, providing valuable perspectives for the advancement of financial innovations based on blockchain technology.

Este proyecto se ha basado en el estudio de una solución de Gestión de Acceso Privilegiado, como parte del trabajo realizado en las prácticas en Accenture. La solución empleada por la empresa es CyberArk. Este proyecto se puede resumir en 3 partes: formación en CyberArk y laboratorios, una segunda parte que ha consistido en la gestión de cuentas privilegiadas y, por último, la segunda tarea que ha consistido en balancear las cuentas en los Central Policy Managers (CPMs). La primera parte ha consistido en una formación extensa sobre CyberArk en la cual se han completado dos cursos que dan acceso a la certificación 'Defender-PAM'. La segunda y la tercera parte del proyecto fueron diferentes tareas asignadas a un proyecto de migración para utilizar CyberArk. Estas tareas implicaron gestionar grandes cantidades de cuentas y entender la arquitectura y el estado actual del proyecto. La segunda parte consistió en reorganizar la distribución de las cuentas en los diferentes CPM para equilibrar la carga en cada uno.

Quantum Key Distribution (QKD) represents a groundbreaking advancement in the field of cryptography, leveraging the principles of quantum mechanics to establish secure communication channels. Unlike classical cryptographic methods, QKD promises theoretically unbreakable security by ensuring that any attempt at eavesdropping can be detected. This thesis explores the practical implementation, challenges, and comparative security of various QKD scenarios within modern network infrastructures. We specifically analyze the security implications of integrating QKD with Software-Defined Networking (SDN) and compare it against Quantum Random Number Generators (QRNG), Post-Quantum Cryptography (PQC), and Physical Unclonable Functions under different conditions, with the aim of providing a comprehensive evaluation of the strengths and vulnerabilities of each approach, guiding future developments in secure communication systems. After the analysis performed in this Master Thesis, we can safely conclude that the Quantum Key Distribution scenario is the ideal use case, having the highest overall security score. Meanwhile, the scenarios of QRNG and PQC are the closest to the ideal security when compared to QKD. Finally, while the PUF scenario has the lowest overall security score, it still presents better authentication features that can prove beneficial if combined with other scenarios.

Business Email Compromise (BEC) attacks pose a significant and evolving threat to organizations worldwide, causing substantial financial losses and operational disruptions. This research aims to enhance the understanding of BEC threat actors by profiling their tactics, techniques, and procedures (TTPs) using the MITRE ATT\&CK framework as a foundation. Through the analysis of cyber threat intelligence reports and incident response data, this study identifies and characterizes twenty distinct BEC groups, examining their preferred targets, tools, and techniques to uncover patterns in their evolution and methodologies.

En l'evolució del panorama de la seguretat digital, la implementació d?Infraestructures de Clau Pública robustes s?ha convertit en una pedra angular per garantir la integritat i la confidencialitat de les comunicacions. Aquesta tesi presenta un estudi de cas complet sobre la implementació d?una PKI basada en EJBCA dins de l?entorn del Campus Nord de la UPC. L?estudi s?endinsa en la planificació estratègica, els reptes i les metodologies implicades en l?establiment d?un sistema PKI segur. Destaca el paper crític d?EJBCA en facilitar identitats digitals segures i la gestió sense fissures de certificats digitals. A través d?aquesta implementació, la tesi demostra les aplicacions pràctiques i els beneficis de la PKI en la protecció de transaccions i comunicacions digitals dins d?una institució acadèmica, contribuint així al discurs més ampli sobre les mesures de ciberseguretat en entorns educatius.

L'Internet de les Coses Mèdiques (IoMT, per les seves sigles en anglès) ha revolucionat el món sanitari en permetre la integració i comunicació de dispositius i aplicacions mèdiques utilitzant la infraestructura de xarxa. No obstant això, l'augment de la connectivitat també introdueix vulnerabilitats de seguretat, cosa que fa que els sistemes IoMT siguin objectius atractius per als ciberatacs. Aquests atacs suposen una greu amenaça per a la integritat física dels pacients. Aquesta tesi explora l'aplicació de tècniques d'aprenentatge automàtic (ML, per les seves sigles en anglès) per detectar aquests atacs, proporcionant una revisió exhaustiva de les metodologies d'aprenentatge automàtic, tipus d'entrenament, algoritmes i mètodes d'anàlisi de xarxes rellevants per a la seguretat de les xarxes IoMT. La revisió de la literatura cobreix els aspectes fonamentals de l'aprenentatge automàtic, incloent-hi l'aprenentatge supervisat i no supervisat, i examina algoritmes específics com arbres de decisió, màquines de vectors de suport, xarxes neuronals i tècniques d'agrupament. Per avaluar l'efectivitat d'aquests mètodes, es van entrenar diversos models de ML utilitzant conjunts de dades d'IoMT disponibles públicament, com IoMT 2024 de l'Institut Canadenc de Ciberseguretat i la Universitat de New Brunswick. El conjunt de dades va ser preprocessat per assegurar la qualitat i rellevància de les dades, i es va processar de diferents maneres per provar els diferents mètodes d'anàlisi de trànsit. Els models entrenats inclouen mètodes basats en arbres de decisió com Random Forests (RF), i màquines d'augment de gradient (GBM), juntament amb altres mètodes com regressions logístiques i xarxes neuronals. Aquests mètodes van ser entrenats utilitzant mètodes d'anàlisi de flux i característiques de paquets individuals. Els resultats indiquen que els mètodes basats en arbres demostren una alta eficàcia en la identificació i classificació d'atacs en xarxes IoMT, assolint mètriques d'avaluació del 99%. Aquests resultats mostren el potencial dels enfocaments basats en ML per millorar la seguretat dels sistemes IoMT. Els resultats també mostren que incloure informació temporal és crucial per als Sistemes de Detecció d'Intrusos (IDS) basats en aprenentatge automàtic. The literature review covers the foundational aspects of machine learning, including supervised and unsupervised learning, and examines specific algorithms such as decision trees, support vector machines, neural networks, and clustering techniques. To evaluate the effectiveness of these methods, several ML models were trained using publicly available IoMT datasets like IoMT 2024 from the Canadian Institute of Cibersecurity and University of New Brunswick. The dataset was preprocessed to ensure data quality and relevance, and processed in different ways to test the different traffic analysis methods. The models trained include Decision Tree base methods like Random Forests, single Decision Trees and Gradient Boosting Machines, with other methods like Logistic Regressions and Neural Networks. These methods were trained using flow analysis methods and single packet features. The results indicate that tree-based methods demonstrate high efficacy in identifying and classifying attacks on IoMT networks, reaching evaluation metrics of 99%. These findings show the potential of ML-based approaches to enhance the security of IoMT systems. The results also show that including time information is crucial for Machine Learning based IDS.

In todays era of big data and machine learning, the amount of sensitive data and thus the need for protection of individuals privacy has become critical. One of the methods to safeguard discrete information is the statistical disclosure method of microaggregation. When dealing with datasets containing both numerical and categorical information, a lot of algorithms show lack in performance, because they are often optimized for only one type of data. This work explores the implementation and evaluation of various microag- gregation algorithms specifically designed for hybrid datasets, with the aim of achieving effective k-anonymity, a metric to evaluate the privacy level of data, while minimizing in- formation loss. The study focuses on the Maximum Distance to Average Vector (MDAV), Semantic Adaptive MDAV, Transformation-Based Microaggregation (TBM), and MAGE algorithms, implementing them within a Python-based framework. The algorithms were tested on the Adult Census dataset, a standard benchmark in data privacy research, to assess their performance in terms of information loss and computational efficiency. The results demonstrate that each algorithm has distinct advantages depending on the specific characteristics of the dataset and the desired balance between privacy and data utility. This work provides valuable insights into the practical application of microaggregation techniques for hybrid data and suggests directions for future research and improvement.