APRÈN. Portal de la producció docent del professorat de la UPC

El continuo aumento de la popularidad de los dispositivos IoT pueden aportar grandes ventajas ya sea en la automatización, en la eficiencia, en la obtención de información, etc. Pero como consecuencia, tanto la falta de seguridad en los dispositivos como la información sensible que puede almacenar de los usuarios, los convierten en uno de los principales objetivos de los atacantes, ya sea para obtener información o para utilizarlos de manera maliciosa. Para poder detectar estos ataques, en un primer momento, se plantea utilizar la herramienta más popular en la actualidad, Machine Learning. Pero como para su funcionamiento se necesita de datos aportados por cada dispositivo, puede llegar a aumentar el tráfico de la red hasta saturarla. Además, de que enviar datos sensibles por la red puede llegar a provocar una fuga de información no deseada. Entonces, como alternativa, apareció la técnica Federated Learning, con las cuales cada dispositivo aplicará un algoritmo de Machine Learning localmente, permitiendo a los dispositivos únicamente enviar información sobre el aprendizaje del algoritmo. Los objetivos principales del proyecto, se centran en la preparación de los datasets, extraídos del dataset CICIOT2023 donde incluyen muestras de tráfico de red normal en una red IoT y un conjunto de muestras de 33 diferentes ataques que se realizaron sobre los distintos dispositivos IoT. Estos datasets, se utilizarán tanto el Machine Learning como Federated Learning. También se centrarán en los resultados que proporcionarán los algoritmos de Machine Learning como los de Federated Learning sobre la detección de amenazas en las redes IoT, determinar qué algoritmo pueda conseguir una mayor detección y hacer una comparación entre las precisiones de Machine Learning y Federated Learning.

Este proyecto se centra en la investigación, planificación e implementación de un SIEM (Security Information and Event Management) de código abierto para mejorar la visibilidad y protección de una empresa. La ciberseguridad es uno de los elementos más importantes y necesarios hoy en día, por lo que se necesitan herramientas que ayuden en este ámbito. Se inicia el proyecto realizando una breve introducción tanto al mundo de la ciberseguridad como a los objetivos que se desean conseguir. Se continúa repasando diversos conceptos necesarios y se estudian las diferentes soluciones comerciales de los SIEM, finalizando con la elección del SIEM para el proyecto. Con la elección de Wazuh como SIEM de código abierto se inicia el trabajo técnico. Este se divide principalmente en la implementación del SIEM en el entorno de producción y, posteriormente, la creación de casos de uso que permitan aprovechar todas las capacidades explicadas. A su vez, se ha estudiado la viabilidad del proyecto, concluyendo que se puede mejorar la seguridad de una empresa con una herramienta de código abierto pese a las limitaciones que presenta frente a otras opciones.

Wi-Fi has been widely deployed around the world for more than 2 decades, and across that amount of time, the standard continues to improve in terms of bandwidth, security, etc. In 2016, the 802.11mc standard, also known as Fine Timing Measurement (FTM), was released, which proposes an improved method for indoor positioning using Wi-Fi. FTM uses RTT (Round Trip-Time) measurements, as the basis to calculate the distances between an initiator device and a responder one; these measurements can be performed several times and with different responders, so that multilateration can be applied to determine the initiator's location. FTM was designed to allow the frames to be transmitted without associating to the Wi-Fi network; in other words, the frames are transmitted over the wireless network, without the need for the initiator to authenticate to the AP and without any encryption. This fact is key for FTM to work, because it focuses only on transporting the timing measurements and not heavy data transfers like internet navigation. To compute the user's position using the captured data, the attacker applies the Passive TDOA technique, which was first proposed to passively calculate a device's own location without starting a new FTM session, just listening to the FTM exchanges of another user. The purpose of this work is to demonstrate how accurate an attacker can be when estimating the victim's position under different scenarios and conditions while the victim is using FTM protocol, and to expose the time that it takes to do it. Also, this master thesis aims to quantify the impact of an FTM attack and to contribute to improving the FTM protocol's security. To accomplish the goals mentioned on the paragraph below, this master thesis will simulate a Wi-Fi environment using a Python interpreter. In this simulation, the devices involved are the APs, the attacker device, and the victim device. For better understanding this thesis proposes splitting the layout into two models: the first, called model 1, is a small 6x6 test area, no error measurements involved. The APs are permanently set on each corner, the attacker device is set on one of the grid points and the victim device sweeps every point of the grid. Then, the model 2 is proposed, which is a 30x30 test area where the APs are set randomly on the grid, following the recommendations for Wi-Fi deployments. The attacker is placed randomly in the area and the victim performs sweeping at all the grid points. After all calculations are completed, the results of model 1 and model 2 are analyzed using metrics like RMSE, mean error and standard deviation; time metrics are also included in this analysis. This thesis is structured as follows. In Chapter 1, Fundamental Concepts, this thesis explores first the basics of the FTM procedure, how it works using RTT and how it's been used to estimate a user device location. Then, it describes Time Difference of Arrival (TDOA) principles and the Passive TDOA technique, which shows an interesting way to deal with many devices trying to send their timing measurements to the AP, affecting the total bandwidth of the wireless network. Chapter 2, Methodology, covers the entire work environment simulation, using Python interpreter, and explains how many layout models and study cases will be done. Chapter 3, Result and Analysis, exposes the results from both models and analyzes the model behavior under certain circumstances; model 1's results, show how the geometry of the test area and the positioning of the devices can make an impact on the results, and model 2 explores how the results change, when the devices are set randomly on a bigger test area, with ideal or realistic conditions. Finally, Chapter 4, Conclusions, lists the analysis's conclusions and recommendations are proposed to help future studies for FTM security improvements.

This thesis consists in the development and analysis of Federated Learning to detect malicious network traffic in IoT environments. The motivation of the project is based on two main aspects, the poor security measures in the actual IoT devices and the necessity of preserving data privacy in Machine Learning processes. First, this project goes through an overview of Machine Learning concepts, followed by explanations of the most common attacks to IoT devices. We will also find information about Federated Learning and its main characteristics. Second, we can find two practical parts. The first one consists in applying Centralised Learning to the chosen dataset and with 3 different algorithms. After that, the entire dataset has been divided into several smaller ones representing different IoT devices in a network, and the same three algorithms have been applied following two different Federated Learning strategies.

This project is based on the viable and secure integration of a set of IoT devices into the network of an insurance company. Being a double degree work in Telecommunication Systems Engineering and Telematics Engineering, it has been divided into two main parts: The first part, which corresponds to the degree in Telecommunication Systems, aims to incorporate a set of IoT devices into the company's infrastructure. It has been chosen to implement devices with different characteristics, among which there are video surveillance cameras, a new locking system for lockers, screens to facilitate the reservation of meeting rooms. Taking advantage of the project, the aim is to replace traditional temperature and humidity sensors with ones with IoT capabilities. To address this challenge, an analysis of the requirements of the devices to be incorporated, along with the characteristics of the company's infrastructure, is carried out. To assess the viability of the new links, a set of power estimation calculations is carried out. The second part, which corresponds to the Telematics Engineering degree, focuses on the field of cyber security in the context of IoT devices. Based on the analysis of the entity's virtual infrastructure, the existing security risks are extracted. Throughout the practical part, the different risks are evaluated and classified, using the tool of a risk matrix and the methodology followed to design the control framework is shown, with the aim of mitigating the security risks detected at the start. Among the main conclusions, it is extracted that this case cannot be extrapolated to other cases, since, as reflected throughout the work, the analysis of the initial scenario is key. In such a way that, the type of devices that you want to incorporate, the physical characteristics of the infrastructure or the resources of the entity, delimit the strategy to follow. On the cybersecurity side, there are endless measures to mitigate the risks. But, keeping in mind that the company's resources are not infinite, a strategy has been drawn up to prioritize the risks presented, with the help of tools such as the risk matrix and the control framework. Finally, there are common solutions that can be addressed by all entities, no matter how small, that make a significant contribution to following a robust and reliable security strategy.

The exponential growth of Internet of Things (IoT) infrastructure has introduced significant security challenges due to the large-scale deployment of interconnected devices. IoT devices are present in every aspect of our modern life; they are essential components of Industry 4.0, smart cities, and critical infrastructures. Therefore, the detection of attacks on this platform becomes necessary through an Intrusion Detection Systems (IDS). These tools are dedicated hardware devices or software that monitors a network to detect and automatically alert the presence of malicious activity. This study aimed to assess the viability of Machine Learning Models for IDS within IoT infrastructures. Five classifiers, encompassing a spectrum from linear models like Logistic Regression, Decision Trees from Trees Algorithms, Gaussian Naïve Bayes from Probabilistic models, Random Forest from ensemble family and Multi-Layer Perceptron from Artificial Neural Networks, were analysed. These models were trained using supervised methods on a public IoT attacks dataset, with three tasks ranging from binary classification (determining if a sample was part of an attack) to multiclassification of 8 groups of attack categories and the multiclassification of 33 individual attacks. Various metrics were considered, from performance to execution times and all models were trained and tuned using cross-validation of 10 k-folds. On the three classification tasks, Random Forest was found to be the model with best performance, at expenses of time consumption. Gaussian Naïve Bayes was the fastest algorithm in all classification¿s tasks, but with a lower performance detecting attacks. Whereas Decision Trees shows a good balance between performance and processing speed. Classifying among 8 attack categories, most models showed vulnerabilities to specific attack types, especially those in minority classes due to dataset imbalances. In more granular 33 attack type classifications, all models generally faced challenges, but Random Forest remained the most reliable, despite vulnerabilities. In conclusion, Machine Learning algorithms proves to be effective for IDS in IoT infrastructure, with Random Forest model being the most robust, but with Decision Trees offering a good balance between speed and performance.

Malware is any intrusive program that exploits system vulnerabilities on a computing system. A malware infection can be disastrous for any organization. It can cripple networks and systems, as well as destroy, delete, corrupt, or exfiltrate sensitive data. In this thesis we explore how machine learning can detect and classify malware threats to prevent further damage in a network. Specifically, we use Naive Bayes, K-Nearest Neighbours, Decision Tree, Random Forest and Support Vector Machine algorithms, determining the precision, accuracy and recall averages for 100 different random states, as well as the variance of each one of these averages. We will use two datasets: the CIC-Evasive-PDFMal2022 dataset (which consists of 10025 records and 28 numerical features) and the CIC-MalMem-2022 dataset (which consists of 58596 records and 55 numerical features). For malware classification, we will only use the second one because the first one is not labeled with the malware type.

This work aims to present the design and development of an artificial intelligence in the form of a chatbot that can provide support to a company's cybersecurity team and carry out threat management tasks. To achieve this objective, an exhaustive study of the different artificial intelligence tools that work with the interpretation of natural language was carried out, evaluating in detail each of the functionalities they offer. After a rigorous evaluation, a specific tool was selected and trained so that it could understand human language and perform cybersecurity tasks once it has understood what the user needs. In addition to performing threat management tasks, the chatbot also provides information on cybersecurity incident prevention and resolution, making it a valuable resource for non-technical users to resolve and prevent security incidents on their devices. The development of the chatbot was done in a test environment that simulated the possible environment of a company's cybersecurity teams. This made it possible to evaluate the performance of the chatbot and correct possible problems before taking it to production. In addition, how to bring the chatbot to production in commercial environments was studied, considering technical and implementation aspects. The results of the project are highly satisfactory, since the chatbot has been able to correctly interpret and perform the interactions that were proposed at the beginning of the project. In addition, the information provided by the chatbot on prevention and resolution of cybersecurity incidents has proven valuable for cybersecurity teams. In general, it can be concluded that the chatbot designed in this project has great potential to improve the cybersecurity of companies and provide support to cybersecurity teams.

Bitcoin was the origin of the cryptocurrency market in 2008, when a technical document was presented under the pseudonym Satoshi Nakamoto, in which the concept, characteristics and vision of this cryptocurrency were set out. Bitcoin is currently the leading and most popular cryptocurrency in terms of market capitalisation. For this reason, since 2020, society has become very interested in understanding how it works and being able to benefit economically from investment. To do this, two methodologies are mainly used: technical or manual market analysis and Machine Learning algorithms. Technical analysis allows a human being to analyse a graph of a specific asset, based on the use of a set of tools that allow the prediction of the next movement and produce economic benefits. Even so, it is a methodology that involves a considerable amount of time as it requires a lot of training and time to acquire the necessary experience and obtain economic returns from it. The use of Machine Learning allows the creation of models that make predictions of the price of an asset in an automated way. This methodology complements and improves the predictions made by a person who uses technical or manual analysis to determine the next movement of any asset, as Machine Learning can process and treat amounts of information that a human being is not capable of retaining. Therefore, the main objective of this final degree work is to create models that allow predicting the price of Bitcoin by using automatic Machine Learning algorithms from a data file containing attributes related to the price of the cryptocurrency, a Data Set. With that purpose, the set of algorithms that have been chosen are Random Forest, Linear Regression and Time Series (Forecasting). The prediction models obtained by means of the previously mentioned algorithms have been evaluated in terms of regression errors and techniques such as Out of Bag, Cross Validation and Grid Search techniques have been applied in order to optimise the models. Finally, Bitcoin price prediction has been carried out with each of the models, among which the Linear Regression model stands out, as it obtained the best prediction results compared to the real price.

This final degree project deals with the use of tools in order to find security vulnerabilities and performance limitations in order to make applications more robust and solid against attacks. In addition, it also explains how to integrate these tools in continuous integration and continuous delivery environments. The tools selected for the job are Zap (security vulnerabilities), Gatling (performance limitations) and Jenkins (CI/CD environment integration). This project consists of a guide of the configuration and use of all the tools, a sample of results and an in-depth analysis of a simulated environment. There is also a mention about how the work has been organized and it ends with a critical conclusion about the tools used and how the project has been done.

This thesis is part of a project consisting on the network replacement of all supermarket chain's stores. The motivation of this renewal is that the store's network has become outdated, obsolete and unsecure. In this thesis, the weak points of the old network are analysed and a proposal for its settlement and improvement is shown step by step, starting from scratch. In addition, the infrastructure of both networks is also reviewed, analysing what are the characteristics of nowadays network devices available on the market and its manufacturers. The proposed final design incorporates Layer 3 and Layer 2 diagrams, including the planning of firewalls provision, routing, switching and redundancy of the network devices. An insight on the protocols that are currently used to overcome arising issues are also discussed.

According to Europol in its latest report of 2020 we are in a situation where cybercrime is steadily evolving, the resilience and creativity of attackers is constantly increasing, and they are often one step ahead of any organization trying to fight them. The pandemic has made our lives virtual, and criminals have not hesitated to take advantage of the situation. The attacks during this year have been extremely varied, from DDoS to Ransomware for the distribution of pornography. In general, an attacker has an opportunistic profile and this time they have taken advantage of two things; the lack of skilled personnel to cover cybersecurity positions and how unprepared we were for massive remote work. The increase in cloud applications means that companies are constantly connected to the Internet, and although according to the annual Accenture report, most organizations better anticipate cyberattacks, a door has been opened to indirect targets such as suppliers in the supply chain. These attacks can have an unsustainable price for this type of companies. We must keep in mind that the profitability of outsourcing is 55% so it is understandable that many companies hire third parties to meet their needs of cost reduction. Not to mention the human and economic effort that can involve doing various tasks internally. But it should be noted that when a company goes to a third party to hire a service, this third party is probably associated with a large company such as Microsoft or Google. These big players however have the most CVE associated in 2020 and therefore we end up talking about different ways to get to the same place, preventing small- and large-scale vulnerabilities

Due to the large number of checked pieces of baggage that are mishandled from check-in until its final destination, measures such as IATA (International Air Transport Association) Resolution 753/30.53 have been created in order to require a minimum set of tracking points along a baggage journey. Blockchain technology, which stands out for its potential in cybersecurity, is proposed in this project to be used as a database to record the tracking data of a luggage through the use of smart contracts of the Ethereum blockchain. For this reason, a smart contract has been developed in Remix IDE to be firstly deployed in the JavaScript VM environment and thus, to check its proper operation and to compute its price based on the gas used to record the data of each tracking point during a possible journey. Finally, the smart contract is deployed on a private blockchain created with Go Ethereum at five different scenarios, where each one has a distinct number of nodes (from 1 to 5 nodes), as means to see if its use is really optimal in this field.

Airports are critical facilities mostly controlled by SCADA systems, which can be vulnerable to cyberattacks if not properly protected. In this document, we present an analysis of such systems from the security point of view, by analysing the potential attack points and providing a set of countermeasures. SCADA systems are used to control, monitor and interact with the facilities remotely by means of devices such as the MTU, which is the main computer that is responsible for monitoring and collecting information from the RTUs, the RTUs that control the substations and receive signals from the field devices, the communications network responsible for managing the information that is sent between the devices, and the field devices that allow the automation of the system. Communication between devices is guaranteed by means of several protcols such as OPC, BACnet, Profibus, Profinet, MQTT and Modbus protocols. In terms of vulnerabilities, there are three major areas: the control center, the communications network, and the technical processes where DoS attacks, simple integrity attacks, or stealth integrity attacks can take place. In order to detect attacks, we can follow different approaches focused either on information security, data or models. It is also desirable to follow cybersecurity standards in order to ensure the security of systems where the best known are the IEC6443, the NERC-CIP, or the NIST 800-2. On the other hand, Machine Learning algorithms might be a good ally in order to protect the system since it can allow us to create a model from a data-set and be able to classify network traffic as normal or malicious, and in the latter, take the appropiate action to protect the system. In this document we present some of these algorithms and provide simulation results of their application to a SCADA system.

Cyberattacks are sets of actions directed against information systems that operate on the network, canceling their services. With the increasing complexity of websites and the rapid development of applications today, the possibility of being attacked increases exponentially. The digital transformation has achieved a great number of benefits, but at the same time, life in an interconnected society has brought a series of disadvantages, thus being more exposed to cyberattacks. In addition, current technological development has also benefited Cybercriminals, which are able to carry out sophisticated computer attacks. This panorama is an invitation to reflect on the importance of protecting networks and systems, as well as the privacy and digital rights of citizens. Having a good cybersecurity system will help to detect and protect systems against various threats. The use of Machine Learning algorithms has been the proposal of this project for the detection of cyberattacks in a network. This work presents an overview of the main threats to computer networks. Besides, a dataset containing samples from network connections, both normal and malicious, and a set of Machine Learning algorithms implemented in Python have been applied to it. The algorithms used are K-Nearest Neighbor (KNN), Random Forest (RF) and Principal Component Analysis (PCA). The performance for each algorithm has been calculated by modifying different parameters against the input data set and after having analyzed the behavior of each one, a comparison has been made between them.

The recent development of ICT (Information and Communications Technologies) has radically altered the concept of identity, which today embodies the different social levels of an individual, such as: family, work and friends. Digital identity is built not only upon what we are, but also from what we do online and how we interact to others, that is why it has become so relevant. Moreover, with more than three billion users on the Internet, each of them with multiple digital identities, managing these identities is very important. People often have the feeling that we do not have control of our information, due to the large number of private companies that daily commercialize with our data without our explicit consent. This is how the concept of sovereign digital identity arises, it is an expression of digital identity in which the user has full control of their data, apart from being able to manage who can access them and on which terms. In this project, the main objective is to promote uPort, a powerful technology that will be soon part of our daily lives. To achieve this goal, a depth analysis of this new identity paradigm has been carried out, outlining the main differences and advantages with respect to a centralized identity system. On the other hand, a search for possible use cases has been executed and an application called Cibertickets has been implemented. It shows how using uPort as a management system of sovereign digital identity, multiple problems in the process of buying tickets for events are solved. For example, prevent the use of bots to buy tickets massively and be able to resell them, the frequent dependence on third-party intermediary companies such as Facebook or Google to register or even the difficulty of certain companies to accomplish the GDPR (General Data Protection Regulation).

La tecnologia Blockchain és una tecnologia emergent i innovadora que va sortir fa més de 10 anys amb l?aparició de Bitcoin. Blockchain permet obtenir un import monetari distribuït en el qual no existeix cap entitat central i on els membres del sistema utilitzin protocols de consens per validar les transaccions. El mètode de consens més conegut és Proof of Work (PoW), que es basa en la resolució d?un problema matemàtic complicat i s?utilitza a Bitcoin, entre altres blockchains. Tanmateix, hi ha molts altres enfocaments com els basats en Prova d?Estaca (PoS) o basats en la tolerància bizantina (BFT). Les cadenes de blocs poden ser públiques, el que significa que qualsevol usuari pot unir-se lliurement a elles, com és el cas de Bitcoin, o es pot autoritzar els usuaris que necessiten accedir al sistema. En aquest treball estudiarem i analitzarem dos blockchains autoritzades: Exonum i Neo, que es basen en l?algorisme de consens PBFT i proporcionen seguretat contra els atacs bizantins. Amb aquesta finalitat, s?han utilitzat blockchains de prova i es compara el rendiment d?ambdues blockchains en termes de rendibilitat (transaccions per segon) i temps de compromís (temps necessari per afegir un nou bloc a la blockchain amb noves transaccions). Las cadenas de bloques pueden ser públicas, lo que significa que cualquier usuario puede unirse libremente a ellas, como es el caso de Bitcoin, o se puede autorizar cuando los usuarios necesitan acceso para unirse al sistema. En este trabajo estudiaremos y analizaremos dos cadenas de bloques autorizadas: Exonum y Neo, que se basan en el algoritmo de consenso PBFT y proporcionan seguridad contra ataques bizantinos. Para este fin, se han utilizado blockchains de prueba y el rendimiento de ambas blockchains se compara en términos de rendimiento (transacciones por segundo) y tiempo de compromiso (tiempo necesario para agregar un nuevo bloque a la cadena de bloques con nuevas transacciones).

Blockchain is a decentralized database that records blocks of information and links one block to the previous ones by means of cryptographic functions. In this way, information integrity is guaranteed. So far, the main application of blockchains have been monetary transactions, and usually each blockchain uses its own currency. The first and best-known of these currencies, better known as cryptocurrencies, was Bitcoin. One of the advantages of using Bitcoin against traditional monetary systems is that it does not require the presence of a central entity, such a bank, in charge of verifying data and validating transactions. In a blockchain, its own users are responsible for that and make use of a consensus protocol to approve or reject transactions. Despite it, this cryptocurrency exhibits many problems such as the lack of anonymity in the transactions. For this reason, the scientific community has developed other approaches in order to overcome Bitcoin limitations. Monero is a blockchain created in 2014, which uses advanced cryptography in order to provide a high degree of anonymity to its users. Its main goal is to prevent third parties from linking a transaction with its sender and its receiver. With this purpose, it makes use of several security mechanisms such as ring signature, the division of the expense and two pairs of public-private keys or RingCT, a feature that allows you to hide the amount of money sent in transactions. A recent study analyzed the likelihood of cancelling anonymity provided by the ring signature. As a consequence, a new feature named RingCT was added to Monero, which allows the hiding of the amount of cryptocurrency sent in a specific transaction. The goals of this work are twofold. On the one hand, to analyze the performance of Monero in a theoretical and practical way, by running a test blockchain. On the other hand, we aim at analyzing by means of Machine Learning algorithms under which circumstances an attacker can overcome security mechanisms such as RingCT and break Monero’s anonymity.

At a present time, it has been proven that blockchain technology has influenced to a great extent the way of human interaction in a digital world. The operation of the blockchain systems allows the peers to implement digital transactions in a Peer to Peer (P2P) network in a direct way without the need of third parties. Each blockchain determines different rules for the record of the transactions in the ledger. The transactions are inserted in blocks and each one, in turn, is appended to the chain (ledger) based on different consensus algorithms. Once blocks have been inserted in the chain, the consensus has been reached and the blocks with corresponding transactions are considered immutable. This thesis analyses the main features of the blockchain and how the consensus can be achieved through the different kinds of consensus algorithms. In addition, a detailed reference for Stellar and Federated Byzantine Agreement (FBA) consensus protocols is made in order to explain these algorithms, their limitations as well as their improvement. The development of a reputation mechanism is necessary to the improvement of above algorithms.