Internet of Things (IoT) is an increasingly popular technology that enables physical devices, vehicles, home appliances, etc. to communicate and even inter-operate with one another. It has been widely used in industrial production and social applications including smart home, healthcare, and industrial automation. While bringing unprecedented convenience, accessibility, and efficiency, IoT has caused acute security and privacy threats in recent years. There are increasing research works to ease these threats, but many problems remain open. To better understand the essential reasons of new IoT threats and the challenges in current research, this survey first proposes the concept of “IoT features”. Then, we discuss the security and privacy effects of eight IoT features including the threats they cause, existing solutions to threats and research challenges yet to be solved. To help researchers follow the up-to-date works in this field, this paper finally illustrates the developing trend of IoT security research and reveals how IoT features affect existing security research by investigating most existing research works related to IoT security from 2013 to 2017.

Enforcing a variety of security measures (such as intrusion detection systems, and so on) can provide a certain level of protection to computer networks. However, such security practices often fall short in face of zero-day attacks. Due to the information asymmetry between attackers and defenders, detecting zero-day attacks remains a challenge. Instead of targeting individual zero-day exploits, revealing them on an attack path is a substantially more feasible strategy. Such attack paths that go through one or more zero-day exploits are called zero-day attack paths. In this paper, we propose a probabilistic approach and implement a prototype system ZePro for zero-day attack path identification. In our approach, a zero-day attack path is essentially a graph. To capture the zero-day attack, a dependency graph named object instance graph is first built as a supergraph by analyzing system calls. To further reveal the zero-day attack paths hidden in the supergraph, our system builds a Bayesian network based upon the instance graph. By taking intrusion evidence as input, the Bayesian network is able to compute the probabilities of object instances being infected. Connecting the high-probability-instances through dependency relations forms a path, which is the zero-day attack path. The experiment results demonstrate the effectiveness of ZePro for zero-day attack path identification.

Capturing the uncertain aspects in cyber security is important for security analysis in enterprise networks. However, there has been insufficient effort in studying what modeling approaches correctly capture such uncertainty, and how to construct the models to make them useful in practice. In this paper, we present our work on justifying uncertainty modeling for cyber security, and initial evidence indicating that it is a useful approach. Our work is centered around near real-time security analysis such as intrusion response. We need to know what is really happening, the scope and severity level, possible consequences, and potential countermeasures. We report our current efforts on identifying the important types of uncertainty and on using Bayesian networks to capture them for enhanced security analysis. We build an example Bayesian network based on a current security graph model, justify our modeling approach through attack semantics and experimental study, and show that the resulting Bayesian network is not sensitive to parameter perturbation.

Anomaly events indicating the unhealthy status of the computer system are recorded in the system log (Syslog). Therefore, Syslog-based anomaly event detection is crucial for diagnosing system issues and problems. However, existing log-based anomaly detection approaches use raw and unstructured log entries independently and incompletely , i.e., without considering the context of each event and event metadata in the logs. They employ incomplete representation of unstructured log data, limiting the deep learning model’s capacity in the early stage, which tends to omit anomaly events and cause false alarms. In this work, we propose DeepSyslog, which represents Syslog with the context of log events and event metadata in the logs. Inspired by the sequence nature of the log stream, we employ unsupervised sentence embedding to extract the semantic and context information hidden in the log stream, rather than word embedding or one-hot embedding, which only capture the similarities between log words. The sentence embedding is further integrated with event metadata to form complete representations of Syslog, which can distinguish the anomaly caused by the correlated log entries and exceptional event metadata in the log. The simulation results on widely used log datasets show that DeepSyslog achieves high performance compared with the existing log-based anomaly event detection approaches.

Urinary tract infections (UTIs) are among the most common acquired bacterial infections in humans. The current gold standard method for identification of uropathogens in clinical laboratories is cultivation. However, culture-based assays have substantial drawbacks, including long turnaround time and limited culturability of many potential pathogens. Nanopore sequencing technology can overcome these limitations and detect pathogens while also providing reliable predictions of drug susceptibility in clinical samples. Here, we optimized a metagenomic nanopore sequencing (mNPS) test for pathogen detection and identification in urine samples of 76 patients with acute uncomplicated UTIs. We first used twenty of these samples to show that library preparation by the PCR Barcoding Kit (PBK) led to the highest agreement of positive results with gold standard clinical culture tests, and enabled antibiotic resistance detection in downstream analyses. We then compared the detection results of mNPS with those of culture-based diagnostics and found that mNPS sensitivity and specificity of detection were 86.7% [95% confidence interval (CI), 73.5–94.1%] and 96.8% (95% CI, 82.4–99.9%), respectively, indicating that the mNPS method is a valid approach for rapid and specific detection of UTI pathogens. The mNPS results also performed well at predicting antibiotic susceptibility phenotypes. These results demonstrate that our workflow can accurately diagnose UTI-causative pathogens and enable successful prediction of drug-resistant phenotypes within 6 h of sample receipt. Rapid mNPS testing is thus a promising clinical diagnostic tool for infectious diseases, based on clinical urine samples from UTI patients, and shows considerable potential for application in other clinical infections.