International Conference on Cyber Warfare and Security

2020 International Conference on Cyber

Warfare and Security (ICCWS)

20-21 October 2020

Islamabad, Pakistan // Virtual Conference

Conference Booklet

IEEE Catalog Number: CFP20V89-CDR

IEEE ISBN: 978-1-7281-6838-8
 International Conference on Cyber Warfare and Security

Contents

Welcome Notes……………………………………………………………………………….02
Organizing Committee…………………………………………………………………….… 05
Keynotes and Technical Talks………………………………………………………………08
Paper Abstracts……………………………………………………………………………… 14
Conference Program…………………………………………………………………………20
 1 International Conference on Cyber Warfare and Security

Welcome Note by Conference Patron

Javaid Ahmed
Vice Chancellor, Air University

Dear Participants,

I am pleased to welcome you in this 1st Annual International Conference on Cyber Warfare and Security (ICCWS)
organized by National Centre for Cyber Security (NCCS) Pakistan. Cyber Security is a big challenge costing the
world billions of dollars losses annually. There is indeed dearth of professionals as this field is constantly evolving
with new vulnerabilities and attacks emerging every day. The fast growth of this technology domain demands that
we train lot of professionals at a matching pace. Covid-19 pandemic has proved to be another big game changer
as we are adapting to the dynamics of cyber world but at the same time the associated vulnerabilities with digital
space are required to be adequately dealt with.

From academia perspective, quality cyber security education and trainings are crucial for bridging this very
important gap. One of the key challenge is to equip students with practical knowledge and skills to effectively tackle
cyber security threats. To abridge this gap, NCCS is playing a vital role to promote research and development
activities and establishing academia-industry linkages across the country. ICCWS-2020 is a key initiative of NCCS
to provide a scientific platform to the researchers and experts from across the world to share their experiences and
proficiencies related to the cyber security domain.

ICCWS-2020 will include high-quality and focused technical program on cyber security with keynote talks from
prominent industry and academia experts. The research presented in this conference will be good contribution and
value addition in the educational resources and knowledge repositories. The conference will provide networking
opportunities to the researchers, students, developers and cyber security professionals from the industry, academia
and government organizations. I believe that this conference will provide new opportunities for more national and
international collaborations among the stakeholders.

I would like to thank national and international speakers, researchers as well as participants for joining us in this
virtual conference. We are especially pleased with the generous support of international speakers including Mr.
Fred Baker and Prof. Vern Paxson from USA, Mr. Andrey Golov, Mr. Dmitry Zryachikh and Mr. Evgeny Goncharov
from Russia, Dr. Mehmat Akif Nacar, Mr. Murat Husseiyn Candan, and Mr. Abdullah Erten from Turkey, Prof. Dr.
Siraj Shaikh from UK, Prof. Dr. Olaf Maennel from Estonia and Ms. Jean Daka from Belgium. I convey my best
wishes to all the organizers of 1st IEEE ICCWS 2020.
 2 International Conference on Cyber Warfare and Security

Welcome Note by Conference Chair

Prof. Dr. Kashif Kifayat

Director NCCS

Dear Participants,

National Centre for Cyber Security (NCCS) was established in June 2018 by Planning Commission of Pakistan
through Higher Education Commission (HEC). The Centre constitutes Research and Development (R&D) Labs in
11 reputed universities of Pakistan. These partner Labs were established in different specialized areas of cyber
security such as software security, networks security, smart devices and IoT security, Internet security and privacy,
security auditing and testing, critical infrastructure security, Blockchain security, digital forensics and cybercrimes.
The objective of NCCS is to instigate R&D activities, producing skilled human resource as well as the development
of indigenous products and practical applications/toolkits in the specialized domain of Cyber Security to contribute
its part in the protection of national cyberspace. The secretariat of NCCS is housed at Air University Islamabad.

ICCWS-2020 is the first IEEE technical sponsored educational conference in Pakistan that is solely focused on
cyber security. The agenda of this conference covers a wide range of topics related to recent advances in the field
of cyber security and its allied areas. In this two days conference event, researchers and practitioners working in
cyber security and related domains will share their research ideas and experiences related to the state-of-the-art
as well as in the emerging areas of cyber security. In total, 171 papers were submitted from 16 different countries
out of which 23 papers will be presented in ICCWS. These papers were selected through a double blind peer-
review process by the technical program committee comprised of renowned cyber security academicians from
national and international universities. Moreover, keynote speeches and technical talks by leading cyber security
experts from across the world will be part of conference program along with 2 well-focused panel discussions. I
hope that the challenges and opportunities identified by the keynote speakers and panelists will help well in
recognizing cyber security importance, developing better understanding and resilience within the respective
organizations, stakeholders as well in personal life.

We warmly welcome all the national and international participants and encourage them to share their knowledge
and discuss the way forward for creating cyber security awareness and making Pakistan a digitally secure and safe
place to live and work online. We also appreciate our collaborators, sponsors and supporters, without their support
we would not be able to organize this event. We hope you find ICCWS-2020 a valuable experience.
3 International Conference on Cyber Warfare and Security

1st IEEE INTERNATIONAL CONFERENCE ON CYBER WARFARE AND

SECURITY 2020 (ICCWS)

academia experts. The conference will also

CALL FOR
Call for PAPERS
Paper: feature an attractive Lab-to- Market Event
aimed at industry practitioners, vendors and
Cyber Security is a rapidly growing global local start-up companies.
challenge with new sophisticated zero-day
Main topics of interests:
attacks costing economies billions of dollars
annually. Cyber-attacks may particularly affect Following areas and others closely related topics:
the developed world, but developing countries
are also at higher risk due to the lack of
expertise and shortage of security professionals
with adequate skills and experience to
effectively combat the rising threats. There is a
persistent need for initiatives that can produce
skilled resources and carry out Research and
Development (R&D) activities in the specialized
areas of Cyber Security. National Centre for
Cyber Security (NCCS) is an R&D initiative of
Government of Pakistan to promote research
and human resource development in the fields
of Cyber Security. NCCS in technical co-
sponsorship and joint collaboration with IEEE
Islamabad Section (R-10) is organizing a three
days conference event, i.e. ICCWS-2020; to
invite researchers and practitioners around the
World to share their original research ideas and
experiences related to the state-of-the-art as
well as the emerging areas of Cyber Security.
ICCWS-2020 will include high-quality and
focused technical program on Cyber Security
with keynote talks from prominent industry and
 4 International Conference on Cyber Warfare and Security

HINTS FOR ATTENDING ONLINE CONFERENCE

On behalf of the programs committee that helped to set up various sessions for this conference, we invite you to
get ready to learn and network with other researchers and professionals. This conference truly has something for
everyone. The committee has worked diligently to create the best lineup of keynote speakers.

Attending the online session

Program Schedule Be a Good Audience Member

The conference schedule has Presenting your research is

been designed to deliver very important and it requires
comprehensive, timely session. time, effort to prepare, it is not
We expect most of the sessions easy as it seems. Please be
to be complete in time, so vigilant about timing, be
please join the sessions timely. considerate about Q/A option
While joining please identify and Chat Panel available in
yourself and keep your full Zoom Meeting Software to
name as joining Id. Use chat coordinate with organizers.
option to seek any guidance Please be patient and avoid
from organizers or convey your disruption by unmuting your
concerns to session chairs. mic or any other methods.

Your Feedback is Important The Conference Staff

This conference purpose is to

create cyber security
awareness and promote its Conference organizers are
related R&D activities by available to answer any
providing a networking questions or address any
platform. As your presence is concerns you may have about
valued to us we really the conference or facilities.
appreciate you to share your
feedback and suggestions. We
will definitely consider it to
further improve this event.
 5 International Conference on Cyber Warfare and Security

ORGANIZING COMMITTEE
Patron:

Javaid Ahmed, Air University Islamabad, Pakistan

General Chair:
Kashif Kifayat, National Centre for Cyber Security, Air University Islamabad, Pakistan

Program Chair:
Amir Qayyum, Capital University of Science and Technology, Lahore, Pakistan

Technical Program Committee Chair:

Haider Abbas, MCS, National University of Science and Technology, Pakistan

Tracks and Workshops Chairs:

Adil Sultan, Air University Islamabad, Pakistan
Asad Arfeen, NED University of Engineering and Technology, Karachi, Pakistan
Ghalib A. Shah, University of Engineering and Technology Lahore, Pakistan
M. Hanif Durad Pakistan Institute of Engineering and Applied Sciences, Islamabad, Pakistan
Muhammad Imran, Air University, Islamabad, Pakistan
Najam us Siraj, Sir-Syed CASE Institute of Technology, Islamabad, Pakistan
Nazir A. Malik, Bahria University Islamabad, Pakistan
Sadeeq Jan, University of Engineering and Technology Peshawar, Pakistan
Umar Janjua, Information Technology University, Lahore, Pakistan
Zunera Jalil, National Centre for Cyber Security, Air University Islamabad, Pakistan

Publication Committee Chairs:

Chair: Ammar Masood, Air University Islamabad, Pakistan
Co-Chair: Bilal Afzal, National Centre for Cyber Security, Air University Islamabad, Pakistan
Co-Chair: Muhammad Najam ul Islam, Bahria University Islamabad, Pakistan
Co-Chair: Uzair Khan, National University of Computer &Emerging Sciences, Islamabad

Panel Chairs:
Adil Sultan, Air University Islamabad, Pakistan
Shoab A. Khan, National University of Sciences and Technology, Islamabad, Pakistan

Operations and Arrangements Chairs:

Chair: Afzaal Ahmed Khan, Air University Islamabad, Pakistan
Co-Chair: Bilal Afzal, National Centre for Cyber Security, Air University Islamabad, Pakistan
Co-Chair: Farooq Arshad, Air University Islamabad, Pakistan
Co-Chair: Usman Afzal, National Centre for Cyber Security, Air University, Pakistan
Co-Chair: Farhan Babar, National Centre for Cyber Security, Air University, Pakistan
Co-Chair: Naveed Bhatti, National Centre for Cyber Security, Air University, Pakistan
Co-Chair: Qanaita Mehmood, National Centre for Cyber Security, Air University, Pakistan
 6 International Conference on Cyber Warfare and Security

Publicity and Sponsorship Committee:

Chair: Usman Afzal, National Centre for Cyber Security, Air University Islamabad, Pakistan
Co-Chair: Farhan Babar, National Centre for Cyber Security, Air University, Pakistan

Web and Registration Chairs

Chair: Zunera Jalil, National Centre for Cyber Security, Air University, Islamabad, Pakistan
Co-Chair: Asim Ali Fayyaz, Air University, Pakistan
Co-Chair: Noor ul Ain Ashraf, National Centre for Cyber Security, Air University, Pakistan

Finance Committee:
Chair: Tariq Javed Kamboh, Air University Islamabad, Pakistan
Co-Chair: Usman Ghani, National Centre for Cyber Security, Air University, Pakistan

TECHNICAL PROGRAM COMMITTEE

Name Affiliation
1. Vern Paxson (UC Berkeley, USA)
2. Qi Shi (Liverpool John Moores, UK)
3. Olaf Manuel (Tallinn University of Technology, Estonia)
4. Dan DongSeong KIM (University of Queensland, Australia)
5. Hafiz Malik (Dearborn Michigan, USA)
6. Siraj Ahmed Shaikh (Coventry University, UK)
7. Zahri Yunos (CyberSecurity Malaysia, Malaysia)
8. Syed Naqvi (Birmingham City University, UK)
9. Jean Daka (DELOITTE, Belgium)
10. Kashif Kifayat (Air University, Islamabad, Pakistan)
11. Haider Abbas (MCS, NUST, Rawalpindi, Pakistan)
12. Zartash Uzmi (LUMS, Lahore, Pakistan)
13. Mudassar Farooq (Air University, Islamabad, Pakistan)
14. Ejad Ahmed (University of Malaya, Malaysia)
15. Ammar Masood (Air University, Islamabad, Pakistan)
16. Mehdi Hassan (Air University, Islamabad, Pakistan)
17. Zunera Jalil (Air University, Islamabad, Pakistan)
18. Bilal Afzal (NCCS, Air University, Islamabad, Pakistan)
19. Naveed Bhatti (Air University, Islamabad, Pakistan)
20. Jawad Manzoor (Air University, Islamabad, Pakistan)
21. Sidra Siddique (Air University, Islamabad, Pakistan)
22. Fawad Khan (MCS, NUST, Islamabad, Pakistan)
23. Ghalib A. Shah (UET Lahore, Pakistan)
24. M. Waseem Iqbal (MCS, NUST, Islamabad, Pakistan)
25. Khawaja Mansoor (Air University, Islamabad, Pakistan)
26. Ali Hammad Akbar (UET Lahore, Pakistan)
27. Ubaid Ullah Fayyaz (UET Lahore, Pakistan)
28. Amir Mehmood (UET Lahore, Pakistan)
29. Haroon Mahmood (FAST Lahore, Pakistan)
7 International Conference on Cyber Warfare and Security

30. Ashraf Masood (MCS, NUST Rawalpindi, Pakistan)

31. Imran Rashid (MCS, NUST Rawalpindi, Pakistan)
32. Faisal Amjad (MCS, NUST Rawalpindi, Pakistan)
33. Waleed Bin Shahid (MCS, NUST Rawalpindi, Pakistan)
34. Asad Arfeen (NED UET Karachi , Pakistan)
35. M. Mubashir Khan (NED UET Karachi , Pakistan)
36. Iqbal Murtaza (Air University, Islamabad, Pakistan)
37. Muhammad Najam ul Islam (Bahria University, Islamabad, Pakistan)
38. Kashif Naseer Qureshi (Bahria University, Islamabad, Pakistan)
39. Nazir Malik (Bahria University, Islamabad, Pakistan)
40. Faisal Bashir Hussain (Bahria University, Islamabad, Pakistan)
41. Mureed Hussain (PIEAS, Islamabad, Pakistan)
42. M. Hanif Durad (PIEAS, Islamabad, Pakistan)
43. Naeem Iqbal (PIEAS, Islamabad, Pakistan)
44. Ghulam Mustafa (PIEAS, Islamabad, Pakistan)
45. Atif Raza Jafri (Bahria University, Islamabad, Pakistan)
46. Adeel Akram (UET Taxila, Pakistan)
47. Anees Ullah (CASE UET Taxila, Pakistan)
48. Najam-Us-Siraj (CASE, Islamabad, Pakistan)
49. Zain Tariq (Air University, Islamabad, Pakistan)
50. Fahad Tahir (Air University, Islamabad, Pakistan)
51. Mudassar Mushtaq (Air University, Islamabad, Pakistan)
52. Atif Moqurrab (Air University, Islamabad, Pakistan)
53. Hina Shaharyar (Air University, Islamabad, Pakistan)
54. Atiq Ur Rehman (UET Lahore, Pakistan)
55. Suleman Khan (Air University Islamabad, Pakistan)
56. Shehzad Ashraf (Istanbul Gelisim University Istanbul, Turkey)
57. Shahryar Kamal (Air University, Islamabad, Pakistan)
58. Asim Ikram (Air University, Islamabad, Pakistan)
59. Aiza Aqeel Abbasi (Air University, Islamabad, Pakistan)
60. Zaka Ullah (Lahore Garrison University, Lahore, Pakistan)
61. Researchers (National Centre for Cyber Security, Pakistan)
 8 International Conference on Cyber Warfare and Security

KEYNOTE TALKS

Mr. Fred Baker Professor Vern Paxson

ICANN RSSAC Chair / Former IETF Chair, USA University of California, Berkeley / Corelight, Inc.
Berkeley, USA

Talk Title: Management of Security in the Domain Talk Title: Finding Very Damaging Needles in Very
Name System Large Haystacks

Abstract: One fundamental principle in the Internet is Abstract: Many of the most costly security
the End to End Principle. It could be stated in this way: compromises that enterprises suffer manifest as tiny
the one valid thing for any layer of service software trickles of behavior hidden within oceans of other site
(including the Internet Protocol and common activity. This talk will examine the problem of
transports) is to carry out the intent of its user. Almost developing robust detectors for particular forms of
all Internet attacks can be described in terms of a such activity. The themes include research pitfalls, the
violation of that principle - the packet is inspected by crucial need to leverage domain knowledge in an apt
or delivered to an unauthorized party, not delivered at fashion, and why machine learning is difficult to
all, the predictable response is sent to a different effectively apply to such problems
party, the service is overwhelmed, the user is
confused in some way that results in an access to an
unintended service, or any of a long list of similar
schemes. The talk will discuss technologies in use in
the DNS to prevent such attacks in what might seem
the simple posing of a question and it’s a resulting
answer

.
 9 International Conference on Cyber Warfare and Security

Mr. Dmitry Zryachikh Mr. Evgeny Goncharov

Security Code, Russia Kaspersky ICS CERT, Russia

Talk Title: Russian semiconductor / microelectronic Talk Title: Trends and challenges of Industrial Cyber
industry overview Security highlighted by Covid-19 pandemic

Abstract: Standard x86 architecture is far from Abstract: Covid-19 pandemic is definitely the most
enough when it comes to trusted system developing. spoken topic of the year. The pandemic has brought
It doesn’t matter how solid your software is if you struggling and sorrow to millions. Billions had to adjust
cannot be fully sure in hardware level. Dmitry will give their life habits. And it made almost every single
a brief overview about key factors of x86 substitution person on the planet feel insecure. It did not even
for network security appliances and describe key make us more vulnerable. Rather, it highlighted our
challenges we met during this process existing vulnerability. From this perspective the
current pandemics situation is not only a challenge,
but also a huge potential game changer, which may
give us an opportunity to see things different, and to
see some things important that we did not see before.
As the team conducting threat research and
vulnerability analysis to Industrial Control Systems,
we notice it has also highlighted some major
vulnerabilities and cyber security problems of
industrial infrastructures. And many of the problems
highlighted we believe are absolutely important to
solve for the vast majority of modern industrial
enterprises to unlock possibility of the IoT and
Industry 4.0 technological benefits. This talk will cover
the facts discovered during the pandemic period,
major challenges noticed and some trends and
tendencies we may foresee from where we are now.
 10 International Conference on Cyber Warfare and Security

Mr. Andrey Golov Dr. Mehmet Akif NACAR

Security Code, Russia HAVELSAN, Turkey

Bio: Andrey Golov is the Chief Executive Officer at Bio: Mehmet Akif NACAR was born in Sanliurfa,
Trusted Access Technologies. He has more than 15 Turkey in 1972. He received the B.S. degree in
years of executive experience on IT and Security Computer Engineering from Trakya University,
positions in different civil and military organizations. Edirne, Turkey in 1995. Then M.S. degrees in
Andrey also is CEO of Security Code ltd (Russia), one computer education from Gazi University, Ankara,
of the famous leading vendors in Russia related to Turkey in 1998 and computer science in Syracuse
Network, Endpoint and Virtual security. Andrey has University, Syracuse, NY in 2000. He completed his
degree in mathematics/cryptography, financial Ph.D. degree in computer science in Indiana
analysis and MBA degree in IT management. And he University, Bloomington, IN in 2008. From 2001 to
got numerous industry awards and certifications 2008, he was a Graduate Assistant with Indiana
including Certified Information Systems Security University Community Grids Lab. Since 2008, he has
Professional (CISSP), Certified Information Security been an Assistant Professor with the Computer
Auditor (CISA) and Business Continuity Institute Engineering Department, Harran University,
specialist. Andrey has also experience in Cyber Sanliurfa, Turkey. He has involved in many research
Security of International Cyber Space and global projects supported by NSF and DoE. During the work
international cooperation. Andrey has also with Harran University, he was awarded for a few
participated in various international MOU and research projects. He has worked as the vice
intergovernmental missions president in HAVELSAN Training and Simulation
Technologies Department since 2017. He is the
general manager of HAVELSAN since 2020. His
research interests include high-performance systems
within parallel and grid computing, cloud computing
and developing software models for energy efficiency
applications.
 11 International Conference on Cyber Warfare and Security

Professor Dr. Siraj Shaikh Professor Dr. Olaf Maennel

Coventry University, UK Tallinn University of Technology, Estonia

Talk Title: Cyber-Physical Systems Security: Talk Title::Critical Infrastructure Protection: An

Research Challenges and Opportunities Aviation Cybersecurity Perspective

Abstract: The talk would provide a brief overview of Abstract: The aviation industry has embraced a
some of the challenges in defending cyber-physical safety-oriented culture probably more than any other
systems, and then run through some key areas of transport sector. However, from a cybersecurity
development in this domain. It will dive into some perspective it is increasingly vulnerable. Previously
technical areas to reflect on some areas of design, separate systems are now being interconnected in
policy and behavior, and engineering to address order to enhance efficiencies, reduce costs and
systems security. improve the customer experience. However, this
exposes new vulnerabilities that may be exploited by
a variety of threat actors. These range from nation
states to cyber criminals who will see aviation as an
attractive target for financial gain, invading privacy or
just creating chaos. Airport systems running
commercial software are also at risk from
indiscriminate attacks targeting any insecure Internet
connected network that can be remotely accessed.
The unique attributes of the aviation sector serve as a
good example of how cybersecurity research needs
to develop systems able to resist and counter multiple
attack vectors. In our research we demonstrate that
securing the aviation industry requires a holistic and
wide-ranging approach incorporating aspects from
both technical and social science disciplines.
 12 International Conference on Cyber Warfare and Security

Abdullah Erten Ms. Jean Daka

HAVELSAN, Turkey Deloitte’s Enterprise Risk Services, Belgium

Talk Title: Post quantum state of cryptology Talk Title: The challenges of digital forensics

Abstract: His talk will be mainly around the post Abstract: Digital evidence has transformed from a
quantum state of cryptology. The challenges that the single host such as a desktop computer with an
whole cyber world will suffer when the computer attached usb drive to different physical or virtual
power dramatically rises will be assessed. How locations such as the cloud and social networks. This
cryptology will evolve to compensate for the rising makes the challenge of reconstructing the evidence to
computing power will be discussed as well. Post find ‘the smoking gun’ more complex. Digital forensic
quantum changes in terms of battlefield and warfare investigators need to keep the pace with
will be analyzed advancement in technology and the intricacies of
perpetrators by using the right tools that allow them to
do their work in a manner that allows evidence to be
admissible in a court of law whilst maintaining a
forensically sound audit trail. We will look into some
challenges faced and some tools investigators use to
accomplish this.
 13 International Conference on Cyber Warfare and Security

Ahrar Naqvi Mr. Murat Huseyin CANDAN

Ebryx, Pakistan Barikat Cyber Security,Turkey

Talk Title: Zero Day Trust Architecture Talk Title: State of Cyber Security

Bio: Ahrar Naqvi is the CEO of Ebryx, a company he Bio: Mr. Murat H. CANDAN is the CEO of Barikat
founded in 2008 in the US and Pakistan. Ebryx is the Cyber Security. He has been working on various
developer of a Zero Trust Network Access product. Its cyber security roles for the last 20 years and has
R&D services power some of the world’s leading presented among many security events discussing
products in network security, endpoint security and state and improvements for cyber security.
insider threat detection. Ebryx also offers security
assessments, compliance, SOC, incident response
and digital forensics services. Its customers include
local banks, Silicon Valley tech startups and Fortune
500 companies. Before Ebryx, Ahrar was EVP
Engineering at Silicon Valley based Palmchip; Chief
Architect at Veraz Networks and a product architect at
Oracle. Ahrar has an MS in Electrical Engineering
from Stanford University.
 14 International Conference on Cyber Warfare and Security

PAPER PRESENTATIONS: ABSTRACTS

Identifying Mirai-Exploitable Vulnerabilities in IOT encryption algorithm with the provision of protection
Firmware through Static Analysis against the side channel and nonce misuse attack. The
lightweight encryption algorithm utilizes an AES like
Authors: Zafeer Ahmed, Ibrahim Nadir, Haroon rounds architecture with reduced rounds to reduce area
Mahmood, Ali Hammad Akbar, Ghalib Asadullah Shah consumption and high-throughput provision. Its
implementation of software and hardware validates the
Abstract: The prevalent use of IoT has raised numerous lightweight encryption algorithm. The lightweight
security concerns in recent times. One particular encryption algorithm provides similar avalanche effects,
vulnerability in IoT ecosystem is weak authentication as shown by the Advanced Encryption Standard (AES)
credentials. A large number of IoT attacks exploit such algorithm. The lightweight encryption algorithm utilizes
vulnerabilities. Emerged in 2016, the famous Mirai sub-algorithms for the randomization of Initialization
malware conducts attacks that benefits from poorly Vector (IV) and the generation of randomizing keys for
chosen username and passwords. Since its advent, every cipher text. The encryption algorithm is compared
Mirai attacks have only increased with time. Although with the recent implementations for resource
multiple solutions have been suggested in literature comparison and security analysis.
based on dynamic packet analysis but existing solutions
are expensive and are mostly based on reactionary Elixir A 128-bit Stream Cipher Protocol for
measures. In this research work, we propose a scalable Lightweight IOT Devices
solution to audit the security of IoT firmware against the
Mirai attack. Furthermore, we test our system by
statically analyzing more than 1200 recent firmware Authors: Muhammad Umair Tariq, Danial Gohar, Talal
images to inspect their resistance against Mirai botnet. Hassan, Ali Afzal Awan
Our results show that 193 out of 1200+ firmware images
are susceptible to Mirai malware. To get effective
Abstract: Over time, the Internet of Things (IoT) has
results, we tested our solution against a variety of IoT
turned out to be most prevalent in the field of research
devices’ firmware images. We conclude that our solution
and its applications. However, IoT devices are resource
is more scalable, less expensive and proactive as
constraints and thus, require lightweight and secure
compared to other solutions.
ciphering protocols. This paper proposes a new
lightweight stream cipher algorithm named as ‘Elixer’,
Lightweight Encryption Algorithm Implementation based upon classical 128-bit non-linear feedback shift
for Internet of Thing Application register technique. This stream cipher is based on static
and dynamic substitution-boxes with shift operations
Authors: Syed Jahanzeb Hussain Pirzada, Tongge Xu, and results in an output key stream. Confusion and
Liu Jianwei diffusion properties are added with the help of
substitution and transposition techniques respectively.
In the core design of Elixir, there are eight static 6 x 8 s-
Abstract: Internet of Things (IoT) application utilizes
boxes and two dynamic s-boxes. The correctness of the
devices with limited hardware resources such as the
proposed stream cipher is tested according to NIST
wireless sensor network application and devices with
randomness standards and Stream tests. Elixir is
sufficient hardware resources such as satellite
designed to be implemented easily and efficiently for
applications. The main challenge is to design a
both Hardware and Software implementations.
lightweight encryption algorithm to be implementable on
devices with limited hardware resources in IoT
applications. This work proposes a lightweight
 15 International Conference on Cyber Warfare and Security

Nondeterministic Secure LSB Steganography for becoming doubtful thereby losing credibility and
Digital Images truthfulness. Therefore, proving the content realism of an
image is an imperative matter. Commonly used type of
digital image forgery is copy-move that is carried out in
Authors: Khan Farhan Rafat
the same image by pasting specific region to another
semantically similar region. In this study, a technique is
Abstract: The practice of obscuring information on a proposed for detecting image forgery by using discrete
‘need to know’ basis, but still sharing it with others, is wavelet transform (DWT). Compared to Fourier
called ‘secrecy. ’The information that requires transform (FT), DWT is more suitable to analyze image
fortification is known as the secret. However, the pace at contents on edges or abrupt changes in color contrast.
which data gets generated, gathered, disseminated, and The DWT decomposes the image into 4 sub-bands.
Approximation sub-band is employed to implement the
analyzed in today’s Internet of Things (IoT)has inhibited
present method. DWT reduces the size of the image
the individuals from keeping their secrets ‘secret.’ Cloud which in turn minimizes the execution time of the
computing further hardened the situation by providing a algorithm. The experiment results of the proposed
pay-as-you-go method for data processing and technique revealed that this approach is effective in
information retention (persistent storage). Although the detecting and localizing the copy-moved region.
cloud service providers are bound to maintain data Therefore, the presented technique can be used for
integrity, confidentiality, and the privacy of users, yet the CMIF detection and benefits can be obtained in different
fields such as the judiciary, media, and crime
gray areas of proxy points still await a resolution. The
investigation.
judicial endorsement on gaining and having access to
the encrypted data and the pre-shared keys to the law-
Byte-Level Object Identification for Forensic
enforcing authorities by the Australian parliament – the
first amongst the five-eye countries inspecting the global
Authors: Dr. Zunera Jalil, Abdul Rehman
communication has worsened the situation further.
Hence, the current state of affairs not just demand for
Abstract: Lately, digital data has increased a key role in
information hiding but the evolution of ‘secure’
providing and sharing information. Pictures and video
information hiding solutions to maintain secrecy both at
recordings are utilized to pass on convincing messages
the personal and national level. Least Significant Bit
to be utilized under a few unique situations, from
embedding technique for hiding data has brought a stir
propaganda to coercing. The majority of the effort in the
in the information security arena and since its inception
present digital crime investigation network lies in the
has remained a topic of research for the said purpose.
acquisition, retrieval, and investigation of existing data
This research endeavor proposes an enhancement to
from digital machines. It is a time consuming and a
the existing LSB embedding mechanism to deceive
humanly difficult task to collect, process and analyze
attackers from detecting hidden information but without
each media content manually. In this paper, we provide
compromising image perceptibility. The results confer on
a novel approach that solves a real-time problem for an
the effectiveness of the proposed algorithm with regard
investigator while investigating the suspect machine.
to Peak Signal to Noise Ratio and known-cover attack
Our approach acquires all image data at byte level from
scenario.
the suspect machine, perform fast and accurate object
detection resorting to the deep learning-based algorithm
An Efficient Forensic Approach for Copy-move
and present high-level illustration of images containing
Forgery Detection via Discrete Wavelet Transform
suspicious object and unique objects that can be
presented as evidence. Our approach aims to flag
Authors: Rehan Ashraf, Muhammad Sheraz Mehmood,
photos where suspicious objects are detected.
Toqeer Mahmood, Junaid Rashid, Muhammad Wasif
Performance and time consumption wise, this study
Nisar, Mohsin Shah
confirms the importance of automated object detection
Abstract: In this modern era, due to advancements in in digital forensics.
image processing applications; image forgery can be
easily performed and difficult to locate by the bare eye.
Therefore, the digital images and its content are
 16 International Conference on Cyber Warfare and Security

Vulnerabilities and Digital Violations in Software An Enhanced and Secure Multiserver-based User
Products: Logistic Regression Analysis Authentication Protocol

Authors: Shahid Anjum, Effah Wafiyyah Authors: Mehmood Hassan, Aiman Sultan, Ali Afzal
bintiAwangMohd. Hanafi Awan, Shahzaib Tahir, Imran Ihsan

Abstract: The extensive use of the internet and web-

Abstract: Human beings are living in an era where
based applications spot the multi-server authentication
network communication over 5G cellular infrastructure is
as a significant component. The users can get their
gaining in fashion. In an environment of integrated
services after authenticating with the service provider by
technologies along with distributed architectures, there
using similar registration records. Various protocol
are variety of software spaces which need to be
schemes are developed for multi-server authentication,
managed. Software, whether proprietor one or open
but the existing schemes are not secure and often lead
source, may have variety of vulnerabilities which an
towards various vulnerabilities and different security
attacker can exploit and which may compromise the CIA
issues. Recently, Zhao et al. put forward a proposal for
triad of a system. This article performs an analysis of
smart card and user’s password-based authentication
various software vulnerabilities in diverse software
protocol for the multi-server environment and showed
products of major OS software vendors by using the
that their proposed protocol is efficient and secure
logistic regression technique on Common Vulnerabilities
against various security attacks. This paper points out
and Exposures (CVE) details data which is derived from
that Zhao et al.’s authentication scheme is susceptive to
National Vulnerability Database. The logistic
traceability as well as anonymity attacks. Thus, it is not
regressions have been estimated, with the help of
feasible for the multi-server environment. Furthermore,
STATA, for software vulnerability types of various kinds
in their scheme, it is observed that a user while
as dependent binary variables and several independent
authenticating does not send any information with any
variables like vulnerability scores, a continuous variable
mention of specific server identity. Therefore, this paper
and CIA triad, gained access level, access, authenticity
proposes an enhanced, efficient and secure user
and complexity as categorical variables.
authentication scheme for use in any multi-server
environment. The formal security analysis and
Web Server Attack Detection using Machine verification of the protocol is performed using state-of-
Learning the-art tool ”ProVerif” yielding that the proposed scheme
provides higher levels of security.
Authors: Saima Saleem, Muhammad Sheeraz, Dr.
Muhammad Hanif, Dr. Umar Farooq
Improving Discrimination Accuracy Rate of DDoS
Attacks and Flash Events
Abstract: Today, every single organization is utilizing
Authors: Sahareesh Agha, Osama Rehman
web applications for extension of its business as a result
of the high accessibility of web and simple access. With
Abstract: Millions of people across the world are using
the expansion of web use, the danger of attacks has
internet for their day to day activities. People are highly
increased likewise. An efficient monitoring software
dependent on internet as they are using internet
which can detect these attacks timely is required. HTML,
resources for their work in every field. It connects billions
PHP and Java script are used for websites development
of people across the world. Internet Security has
and SQL is used for database management extensively.
become a big issue and with passage of time. Among
Most common web server attacks include SQL injection,
many threats, the Distributed Denial-of-Service (DDoS)
DOS (Denial of Service) and XSS (Cross Site Scripting).
attack is the most frequent threats in the networks.
Rule based intrusion detection systems work on
Consequences of these attacks are more powerful when
keywords and patterns and are unable to detect
launched during flash events which are legitimate traffic
unknown attacks. This paper proposes machine learning
and cause denial of service. This paper focuses on
based model for intrusion detection using web server
improving discrimination accuracy rate of DDoS Attacks
logs. This model detects whether a specific log is normal
and Flash events. Random forest is used for
or an attack log and also specifies the type of attack.
classification. Symmetric uncertainty is used for feature
Web server logs are generated and collected by creating
selection. NSL KDD data set used to evaluate
a private network using an Apache WAMP server.
performance of classifier. Weka is used for implementing
algorithms.
 17 International Conference on Cyber Warfare and Security

Analysis of Fileless Malware and its Evasive An Enhanced SIP Authentication Protocol for
Behavior Preserving User Privacy

Authors: Sarah Naveed, Aiman Sultan, Khwaja

Authors: Asad Afreen, Moosa Aslam, Saad Ahmed Mansoor

Abstract: Malware is any software that causes harm to Abstract: Owing to the advancements in
the user information, computer systems or network. communication media and devices all over the globe,
Modern computing and internet systems are facing there has arisen a dire need for to limit the alarming
number of attacks targeting these and to enhance their
increase in malware threats from the internet. It is
security. Multiple techniques have been incorporated in
observed that different malware follows the same different researches and various protocols and schemes
patterns in their structure with minimal alterations. The have been put forward to cater security issues of session
type of threats has evolved, from file-based malware to initiation protocol (SIP). In 2008, Qiu et al. presented a
fileless malware, such kinds of threats are also known proposal for SIP authentication which while effective
as Advance Volatile Threat (AVT). Fileless malware is than many existing schemes, was still found vulnerable
complex and evasive; exploiting pre-installed trusted to many security attacks. To overcome those issues,
Zhang et al. proposed an authentication protocol. This
programs to infiltrate information with its malicious intent.
paper presents the analysis of Zhang et al.
Fileless malware is designed to run in system memory authentication scheme and concludes that their
with a very small footprint, leaving no artifacts on proposed scheme is susceptible to user traceability. It
physical hard drives. Traditional antivirus signatures and also presents an improved SIP authentication scheme
heuristic analysis are unable to detect this kind of that eliminates the possibility of traceability of user’s
malware due to its sophisticated and evasive nature. activities. The proposed scheme is also verified by
contemporary verification tool, ProVerif and it is found to
This paper provides information relating to detection,
be more secure, efficient and practical than many similar
mitigation and analysis for such kind of threat. SIP authentication scheme.
Automatic YARA Rule Generation
Cluster Analysis and Statistical Modeling: A Unified
Authors: Myra Khalid, Maliha Ismail, Mureed Hussain, Approach for Packet Inspection
Muhammad Hanif Durad
Authors: Sheikh Muhammad Farjad, Asad Arfeeny

Abstract: Since 2010, the numbers of new malware

released daily have become so high, that manual Abstract: A secure network layer capable of
analysis is not an option anymore. The purpose of this distinguishing between malicious and genuine traffic
work is to focus on the increased modern cyber-attacks flows is the need of every transit service provider, edge
network, corporate customer, and a common Internet
and malware campaigns. This work devises a framework user. With the emergence of advanced technologies, the
that automates the process of generating high quality, demand for security has been drastically increased over
effective and efficient malware signatures in the past decade. The analysis of network traffic is
considerably less amount of time and effort. It also essential for various tasks like security, capacity
facilitates in the tedious task of malware analysis. The planning, and visibility at various levels. In this paper, a
proposed framework presents a generic approach to novel architecture is proposed which exploits two
powerful techniques for network traffic inspection that is,
automatic YARA rule-based signature generation. This
cluster analysis and statistical modeling, and unifies
approach is based upon cherry picking the most them in a single framework. The proposed architecture
promising core ideas of the related work. The testing of leverages the clustering technique and statistical
the prototype shows that it is capable of detecting modeling for analyzing and inspecting the network
samples with an average precision of 0.95. traffic. Instead of selecting NetFlow records as the
 18 International Conference on Cyber Warfare and Security

primary format, this research paper presents an and then the attack is launched in the second step. Since
approach that employs Packet Capture (PCAP) data a port is an attack surface as all the information goes into
format for network analysis. The clustering technique and out of a computer through this medium. Therefore in
can be used for classifying benign and malicious traffic
port scanning, available open ports are searched over
but there may arise many uncertainties caused by
various dynamic factors due to emerging application the network to find out the vulnerable machine that can
mixture. Our proposed model uses statistical modeling be exploited. Many slow port scan detection solutions
for supplementing the results obtained from clustering. were proposed in the literature; however, all of these
This unified approach for traffic analysis reduces the approaches use methods to detect the slow port scan
chances of the false alert generation that substantially attacks over the static time period. The approach
deteriorates the security ecosystem. The proposed proposed in this paper can detect the slow port scanning
architecture inspects different parameters of network
attacks not just over the static time interval but also all
traffic to uncover any strong correlation for identifying
malicious network traffic flows. the attacks that are made with a gradual increase or
decrease in the time duration. Moreover, this new
Design and Analysis of Secure RoF Based proposed approach is employed to detect attacks over
Communication in 5G Front haul live data also. Further packet-based analysis is
performed to detect the different types of port scan
Authors: Arsalan Ali, Romana Shahzadi, Nouman attacks. The best of all the accuracy of different scans is
Qamar
implemented. The proposed approach also classifies the
single and parallel port scans based on attempts made.
Abstract: An analytical study is presented in this paper
related to the emerging 5G network based on radio over Therefore the difference between the faster scans and
fiber communication. Security of 5G front haul is ensured the slower ones is achieved.
by using chaos in optical domain. Optical chaos
generated by semiconductor laser is used for this Role of User and Entity Behavior Analytics in
purpose. Optical fiber is chosen to provide high Detecting Insider Attacks
bandwidth and minimum latency whereas chaos
masking technique is used to implement the security Authors: Salman Khaliq, Zain ul Abideen Tariq, Ammar
features. In this work, a Radio over fiber (RoF) Masood
communication system is designed in licensed version
of Opti-system software v.14.0 in which radio frequency Abstract: Traditional cyber security products are neither
signal is modulated on optical signal by using laser and designed nor capable of detecting sophisticated and
Mach-Zehnder modulator (MZM). Chaos generation is carefully crafted insider attacks. The main focus of these
represented by rate equations of laser. Message signal cyber security products is on the red interface, the
is secured by hiding it in the chaotic carrier produced by outside attackers; ignoring the green side, the legitimate
semiconductor laser. After transmission the original users. Moreover traditional cyber security products do
signal is retrieved through perfect synchronization not provide complete vision of user activities within the
between transmitter and receiver, thus maximizing not organization. User and Entity Behavior Analytics (UEBA)
only Q-factor but reduced bit error rate (BER) as well. has become an important aspect in organization’s
System performance is evaluated by using different security because the legitimate users have more rights
lengths of optical fiber and varying laser power. and access over the organization resources as
compared to outsiders. Also, the users are not aware of
Detection of Slow Port Scanning Attacks the security threats that may cause huge damage to
organization’s confidential information and intellectual
property. We discuss the different approaches used in
Authors: Mehrul Nisaa, Kashif Kifayat
User and Entity Behavior Analytics (UEBA) including
user and role-based detection, user and entity activity
Abstract: Cyber Security can be thought of as a set of mapping, user profiling techniques and risk score
techniques used to protect the secrecy, integrity, and calculations of individuals. We present the UEBA
availability of computer data against threats. Scanning approaches proposed in literature and generalized
attack itself is not a technique; In fact, it is a two-step design and feature set of top level commercially
procedure in which scanning is the first step where the available UEBA solutions. We also highlight the fact that
open source community still lags behind in giving a
vulnerability of communication channels are discovered
sophisticated UEBA solution.
 19 International Conference on Cyber Warfare and Security

Hardware-Assisted Isolation Technologies: Security

Architecture and Vulnerability Analysis

Authors: Fatima Khalid, Ammar Masood

Abstract: Hardware-assisted isolation technology

provides a Trusted Execution Environment (TEE) for the
Trusted Computing Base (TCB) of a system. Since there
is no standardization for such systems, many
technologies using different approaches have been
implemented over time. Before selecting or
implementing a TEE, it is essential to understand the
security architecture, features and analyze the
technologies with respect to the new security
vulnerabilities (i.e. Micro-architectural class of
vulnerabilities). These technologies can be divided into
two main types: 1) Isolation by software virtualization
and 2) Isolation by hardware. In this paper, we discuss
technology implementation of each type i.e. Intel SGX
and ARM Trust Zone for type-1; Intel ME and AMD
Secure Processor for type-2. We also cover the
vulnerability analysis against each technology with
respect to the latest discovered attacks. This would
enable a user to precisely appreciate the security
capabilities of each technology.
20 International Conference on Cyber Warfare and Security

CONFERENCE PROGRAM

Day 1 | Tuesday, 20th October 2020 | ICCWS -2020

Day 2 | Tuesday, 21st October 2020 | ICCWS -2020

21 International Conference on Cyber Warfare and Security

Day 2 (Continue)
 22 International Conference on Cyber Warfare and Security

ORGANIZING TEAM EVENT DETAILS

Prof. Dr. Kashif Kifayat, Director NCCS When: October 20th – 21st 2020, 09.00 am- 5.00 pm (GMT+5)
Email: [email protected]

Bilal Afzal, Program Manager, NCCS Where: Online, Live on Zoom / Social Media
Email: [email protected]

Usman Afzal, Business Development Manager, NCCS Inquiry: [email protected]

Email: [email protected] +92 (51) 9153655

www.nccs.pk
Securing Your Cyber Future
 International Conference on Cyber Warfare and Security

Notes
 International Conference on Cyber Warfare and Security

Notes