Babak Sadeghiyan

Motahareh Dehghan, Babak Sadeghiyan, Erfan Khosravian et al.

The highest level in the Endsley situation awareness model is called projection when the status of elements in the environment in the near future is predicted. In cybersecurity situation awareness, the projection for an Advanced Persistent Threat (APT) requires predicting the next step of the APT. The threats are constantly changing and becoming more complex. As supervised and unsupervised learning methods require APT datasets for projecting the next step of APTs, they are unable to identify unknown APT threats. In reinforcement learning methods, the agent interacts with the environment, and so it might project the next step of known and unknown APTs. So far, reinforcement learning has not been used to project the next step for APTs. In reinforcement learning, the agent uses the previous states and actions to approximate the best action of the current state. When the number of states and actions is abundant, the agent employs a neural network which is called deep learning to approximate the best action of each state. In this paper, we present a deep reinforcement learning system to project the next step of APTs. As there exists some relation between attack steps, we employ the Long- Short-Term Memory (LSTM) method to approximate the best action of each state. In our proposed system, based on the current situation, we project the next steps of APT threats.

Sara Asgari, Babak Sadeghiyan

Worm origin identification and propagation path reconstruction are essential problems in digital forensics. However, a small number of studies have specifically investigated these problems so far. In this paper, we extend a distributed trace-back algorithm, called Origins, which is only able to identify the origins of fast-spreading worms. We make some modifications to this algorithm so that in addition to identifying the worm origins, it can also reconstruct the propagation path. We also evaluate our extended algorithm. The results show that our algorithm can reconstruct the propagation path of worms with high recall and precision, on average around 0.96. Also, the algorithm identifies the origins correctly in all of our experiments.

Amirahmad Chapnevis, Babak Sadeghiyan

Intersection detection between three-dimensional bodies has various applications in computer graphics, video game development, robotics as well as military industries. In some respects, entities do not want to disclose sensitive information about themselves, including their location. In this paper, we present a secure two-party protocol to determine the existence of an intersection between entities. The protocol presented in this paper allows for intersection detection in three-dimensional spaces in geometry. Our approach is to use an intersecting plane between two spaces to determine their separation or intersection. For this purpose, we introduce a computational geometry protocol to determine the existence of an intersecting plane. In this paper, we first use the Minkowski difference to reduce the two-space problem into one-space. Then, the separating set is obtained and the separation of two shapes is determined based on the inclusion of the center point. We then secure the protocol by modifying the separating set computation method as a privacy-preserver and changing the Minkowski difference method to achieve this goal. The proposed protocol applies to any form of convex three-dimensional shape. The experiments successfully found a secure protocol for intersection detection between two convex hulls in geometrical shapes such as the pyramid and cuboid.

Sara Asgari, Babak Sadeghiyan

Worm origin identification and propagation path reconstruction are among the essential problems in digital forensics. Until now, several methods have been proposed for this purpose. However, evaluating these methods is a big challenge because there are no suitable datasets containing both normal background traffic and worm traffic to evaluate these methods. In this paper, we investigate different methods of generating such datasets and suggest a technique for this purpose. ReaSE is a tool for the creation of realistic simulation environments. However, it needs some modifications to be suitable for generating the datasets. So we make required modifications to it. Then, we generate several datasets for Slammer, Code Red I, Code Red II and modified versions of these worms in different scenarios using our technique and make them publicly available.