@conference{10.1145/3538969.3544479b,

title = {Fault-Tolerant SDN Solution for Cybersecurity Applications},

author = {Athanasios Liatifis and Christos Dalamagkas and Panagiotis Radoglou-Grammatikis and Thomas Lagkas and Evangelos Markakis and Valeri Mladenov and Panagiotis Sarigiannidis},

url = {https://doi.org/10.1145/3538969.3544479

},

doi = {10.1145/3538969.3544479},

isbn = {9781450396707},

year  = {2022},

date = {2022-08-23},

booktitle = {Proceedings of the 17th International Conference on Availability, Reliability and Security},

publisher = {Association for Computing Machinery},

address = {Vienna, Austria},

series = {ARES '22},

abstract = {The rapid growth of computer networks in various sectors has led to new services previously hard or impossible to implement. Internet of Things has also assisted in this evolution offering easy access to data but at the same time imposing constraints on both security and quality of service. In this paper, an SDN fault tolerant and resilient SDN controller design approach is presented. The proposed solution is suitable for a wide range of environments. Benefits stemming from actual scenarios are presented and discussed among other solutions.},

keywords = {Cybersecurity, Smart Grid, Software Defined Networking},

pubstate = {published},

tppubtype = {conference}

}

@conference{9850291,

title = {Risk Analysis of DNP3 Attacks},

author = {Vasiliki Kelli and Panagiotis Radoglou-Grammatikis and Thomas Lagkas and Evangelos K Markakis and Panagiotis Sarigiannidis},

url = {https://www.researchgate.net/publication/362741509_Risk_Analysis_of_DNP3_Attacks},

doi = {10.1109/CSR54599.2022.9850291},

isbn = {978-1-6654-9952-1},

year  = {2022},

date = {2022-07-27},

booktitle = {2022 IEEE International Conference on Cyber Security and Resilience (CSR)},

pages = {351-356},

abstract = {The integration of intelligent devices in the industry allows the automation and control of industrial processes, in an efficient and effective manner. Such systems have contributed to the rapid evolution of production infrastructures, increasing the reliability, reducing production costs, and automating the entire manufacturing operations. However, the utilization of intelligent devices has led to an increased attack surface in critical infrastructures, threatening to compromise regular operations. Attacks against such environments can have disastrous consequences in case their goal is achieved, due to the critical nature of such infrastructures. Thus, the timely identification of vulnerable spots through high-quality risk assessment, is considered highly important for avoiding or mitigating potential risks. In this paper, we focus on Distributed Network Protocol 3 (DNP3), a protocol with high utility in smart grids. Specifically, we investigate, identify and describe the vulnerabilities-by-design of DNP3 through 8 DNP3-centered cyberattacks. In addition, we present a novel method for conducting risk assessment, stemming from the combination of two techniques, namely, Attack Defence Trees (ADTs) and Common Vulnerability Scoring System v3.1 (CVSS). Through our proposed technique, the risk of a cyberattack occurring is calculated, thus contributing in securing the critical infrastructure.},

keywords = {cyberattacks, Cybersecurity, DNP3, SCADA},

pubstate = {published},

tppubtype = {conference}

}

@conference{9850329,

title = {Protecting IEC 60870-5-104 ICS/SCADA Systems with Honeypots},

author = {Elisavet Grigoriou and Athanasios Liatifis and Panagiotis Radoglou Grammatikis and Thomas Lagkas and Ioannis Moscholios and Evangelos Markakis and Panagiotis Sarigiannidis},

url = {https://www.researchgate.net/publication/362744045_Protecting_IEC_60870-5-104_ICSSCADA_Systems_with_Honeypots},

doi = {10.1109/CSR54599.2022.9850329},

isbn = {978-1-6654-9952-1},

year  = {2022},

date = {2022-07-27},

booktitle = {2022 IEEE International Conference on Cyber Security and Resilience (CSR)},

pages = {345-350},

abstract = {Both signature-based and anomaly-based Intrusion Detection and Prevention System (IDPS) have already demonstrated their efficiency towards recognising and mitigating various intrusions. However, the first category cannot detect zero-day attacks, while the second one lacks the presence of appropriate datasets. Therefore, the presence of additional cybersecurity mechanisms is necessary, especially in the area of the Industrial Internet of Things (IIoT), including critical infrastructures, such as the smart electrical grid. Thus, honeypots are used to hide and protect critical assets. IEC 60870-5-104 (IEC104) is a widely used telemetry protocol in Industrial Control Systems (ICS)/Supervisory Control and Data Acquisition (SCADA). However, IEC104 lacks critical security features, such as encryption, integrity protection and authentication. This work presents the IEC104 honeypot, which is capable of hiding the actual IEC104 assets and detecting potential intrusions and anomalies. The experimental results demonstrate the effectiveness of our work.},

keywords = {Cybersecurity, Honeypots, ICS, SCADA},

pubstate = {published},

tppubtype = {conference}

}

@conference{9844034,

title = {Dynamic Risk Assessment and Certification in the Power Grid: A Collaborative Approach},

author = {Athanasios Liatifis and Pedro Ruzafa Alcazar and Panagiotis Radoglou Grammatikis and Dimitris Papamartzivanos and Sofianna Menesidou and Thomas Krousarlis and Molinuevo Martin Alberto and Iñaki Angulo and Antonios Sarigiannidis and Thomas Lagkas and Vasileios Argyriou and Antonio Skarmeta and Panagiotis Sarigiannidis},

url = {https://www.researchgate.net/publication/362464616_Dynamic_Risk_Assessment_and_Certification_in_the_Power_Grid_A_Collaborative_Approach},

doi = {10.1109/NetSoft54395.2022.9844034},

isbn = {978-1-6654-0694-9},

year  = {2022},

date = {2022-06-27},

booktitle = {2022 IEEE 8th International Conference on Network Softwarization (NetSoft)},

pages = {462-467},

abstract = {The digitisation of the typical electrical grid introduces valuable services, such as pervasive control, remote monitoring and self-healing. However, despite the benefits, cybersecurity and privacy issues can result in devastating effects or even fatal accidents, given the interdependence between the energy sector and other critical infrastructures. Large-scale cyber attacks, such as Indostroyer and DragonFly have already demonstrated the weaknesses of the current electrical grid with disastrous consequences. Based on the aforementioned remarks, both academia and industry have already designed various cybersecurity standards, such as IEC 62351. However, dynamic risk assessment and certification remain crucial aspects, given the sensitive nature of the electrical grid. On the one hand, dynamic risk assessment intends to re-compute the risk value of the affected assets and their relationships in a dynamic manner based on the relevant security events and alarms. On the other hand, based on the certification process, new approach for the dynamic management of the security need to be defined in order to provide adaptive reaction to new threats. This paper presents a combined approach, showing how both aspects can be applied in a collaborative manner in the smart electrical grid.},

keywords = {certification, Cybersecurity, energy, Honeypot, Power Grid, Risk Assessment, Software Defined Networking},

pubstate = {published},

tppubtype = {conference}

}

@conference{Radoglou_icc2021,

title = {A Self-Learning Approach for Detecting Intrusions in Healthcare Systems},

author = { P. Radoglou and P. Sarigiannidis and G. Efstathopoulos and T. Lagkas and G. Fragulis and A. Sarigiannidis},

url = {https://www.researchgate.net/publication/349158703_A_Self-Learning_Approach_for_Detecting_Intrusions_in_Healthcare_Systems},

doi = {10.1109/ICC42927.2021.9500354},

year  = {2021},

date = {2021-06-14},

booktitle = {2021 IEEE International Conference on Communications (ICC)},

journal = {IEEE International Conference on Communications},

abstract = {The rapid evolution of the Internet of Medical Things (IoMT) introduces the healthcare ecosystem into a new reality consisting of smart medical devices and applications that provide multiple benefits, such as remote medical assistance, timely administration of medication, real-time monitoring, preventive care and health education. However, despite the valuable advantages, this new reality increases the cybersecurity and privacy concerns since vulnerable IoMT devices can access and handle autonomously patients’ data. Furthermore, the continuous evolution of cyberattacks, malware and zero-day vulnerabilities require the development of the appropriate countermeasures. In the light of the aforementioned remarks, in this paper, we present an Intrusion Detection and Prevention System (IDPS), which can protect the healthcare communications that rely on the Hypertext Transfer Protocol (HTTP) and the Modbus/Transmission Control Protocol (TCP). HTTP is commonly adopted by conventional ICT healthcare-related services, such as web-based Electronic Health Record (EHR) applications, while Modbus/TCP is an industrial protocol adopted by IoMT. Although the Machine Learning (ML) and Deep Learning (DL) methods have already demonstrated their efficacy in detecting intrusions, the rarely available intrusion detection datasets (especially in the healthcare sector) complicate their global application. The main contribution of this work lies in the fact that an active learning approach is modelled and adopted in order to re-train dynamically the supervised classifiers behind the proposed IDPS. The evaluation analysis demonstrates the efficiency of this work against HTTP and Modbus/TCP cyberattacks, showing also how the entire accuracy is increased in the various re-training phases. © 2021 IEEE.},

keywords = {Active  Learning, Cybersecurity, Healthcare, Intrusion  De-tection},

pubstate = {published},

tppubtype = {conference}

}