Identifying and Mitigating Phishing Attack Threats in IoT Use Cases Using a Threat Modelling Approach.

Internet of things (IoT) is a technology that enables our daily life objects to connect on the Internet and to send and receive data for a meaningful purpose. In recent years, IoT has led to many revolutions in almost every sector of our society. Nevertheless, security threats to IoT devices and networks are relentlessly disruptive, because of the proliferation of Internet technologies. Phishing is one of the most prevalent threats to all Internet users, in which attackers aim to fraudulently extract sensitive information of a user or system, using fictitious emails, websites, etc. With the rapid increase in IoT devices, attackers are targeting IoT devices such as security cameras, smart cars, etc., and perpetrating phishing attacks to gain control over such vulnerable devices for malicious purposes. In recent decades, such scams have been spreading, and they have become increasingly advanced over time. By following this trend, in this paper, we propose a threat modelling approach to identify and mitigate the cyber-threats that can cause phishing attacks. We considered two significant IoT use cases, i.e., smart autonomous vehicular system and smart home. The proposed work is carried out by applying the STRIDE threat modelling approach to both use cases, to disclose all the potential threats that may cause a phishing attack. The proposed threat modelling approach can support the IoT researchers, engineers, and IoT cyber-security policymakers in securing and protecting the potential threats in IoT devices and systems in the early design stages, to ensure the secure deployment of IoT devices in critical infrastructures.

A Generative Adversarial Network (GAN) Technique for Internet of Medical Things Data.

The application of machine learning and artificial intelligence techniques in the medical world is growing, with a range of purposes: from the identification and prediction of possible diseases to patient monitoring and clinical decision support systems. Furthermore, the widespread use of remote monitoring medical devices, under the umbrella of the "Internet of Medical Things" (IoMT), has simplified the retrieval of patient information as they allow continuous monitoring and direct access to data by healthcare providers. However, due to possible issues in real-world settings, such as loss of connectivity, irregular use, misuse, or poor adherence to a monitoring program, the data collected might not be sufficient to implement accurate algorithms. For this reason, data augmentation techniques can be used to create synthetic datasets sufficiently large to train machine learning models. In this work, we apply the concept of generative adversarial networks (GANs) to perform a data augmentation from patient data obtained through IoMT sensors for Chronic Obstructive Pulmonary Disease (COPD) monitoring. We also apply an explainable AI algorithm to demonstrate the accuracy of the synthetic data by comparing it to the real data recorded by the sensors. The results obtained demonstrate how synthetic datasets created through a well-structured GAN are comparable with a real dataset, as validated by a novel approach based on machine learning.

High blood flow shear stress values are associated with circulating tumor cells cluster disaggregation in a multi-channel microfluidic device.

Metastasis represents a dynamic succession of events involving tumor cells which disseminate through the organism via the bloodstream. Circulating tumor cells (CTCs) can flow the bloodstream as single cells or as multicellular aggregates (clusters), which present a different potential to metastasize. The effects of the bloodstream-related physical constraints, such as hemodynamic wall shear stress (WSS), on CTC clusters are still unclear. Therefore, we developed, upon theoretical and CFD modeling, a new multichannel microfluidic device able to simultaneously reproduce different WSS characterizing the human circulatory system, where to analyze the correlation between SS and CTC clusters behavior. Three physiological WSS levels (i.e. 2, 5, 20 dyn/cm2) were generated, reproducing values typical of capillaries, veins and arteries. As first validation, triple-negative breast cancer cells (MDA-MB-231) were injected as single CTCs showing that higher values of WSS are correlated with a decreased viability. Next, the SS-mediated disaggregation of CTC clusters was computationally investigated in a vessels-mimicking domain. Finally, CTC clusters were injected within the three different circuits and subjected to the three different WSS, revealing that increasing WSS levels are associated with a raising clusters disaggregation after 6 hours of circulation. These results suggest that our device may represent a valid in vitro tool to carry out systematic studies on the biological significance of blood flow mechanical forces and eventually to promote new strategies for anticancer therapy.

3D fluid-dynamic ovarian cancer model resembling systemic drug administration for efficacy assay.

Recently, 3D in vitro cancer models have become important alternatives to animal tests for establishing the efficacy of anticancer treatments. In this work, 3D SKOV-3 cell-laden alginate hydrogels were established as ovarian tumor models and cultured within a fluid-dynamic bioreactor (MIVO®) device able to mimic the capillary flow dynamics feeding the tumor. Cisplatin efficacy tests were performed within the device over time and compared with (i) the in vitro culture under static conditions and (ii) a xenograft mouse model with SKOV-3 cells, by monitoring and measuring cell proliferation or tumor regression, respectively, over time. After one week of treatment with 10 µM cisplatin, viability of cells within the 3D hydrogels cultured under static conditions remained above 80%. In contrast, the viability of cells within the 3D hydrogels cultured within dynamic MIVO® decreased by up to 50%, and very few proliferating Ki67-positive cells were observed through immunostaining. Analysis of drug diffusion, confirmed by computational analysis, explained that these results are due to different cisplatin diffusion mechanisms in the two culture conditions. Interestingly, the outcome of the drug efficacy test in the xenograft model was about 44% of tumor regression after 5 weeks, as predicted in a shorter time in the fluid-dynamic in vitro tests carried out in the MIVO® device. These results indicate that the in vivo-like dynamic environment provided by the MIVO® device allows to better model the 3D tumor environment and predict in vivo drug efficacy than a static in vitro model.

MQTTset, a New Dataset for Machine Learning Techniques on MQTT.

IoT networks are increasingly popular nowadays to monitor critical environments of different nature, significantly increasing the amount of data exchanged. Due to the huge number of connected IoT devices, security of such networks and devices is therefore a critical issue. Detection systems assume a crucial role in the cyber-security field: based on innovative algorithms such as machine learning, they are able to identify or predict cyber-attacks, hence to protect the underlying system. Nevertheless, specific datasets are required to train detection models. In this work we present MQTTset, a dataset focused on the MQTT protocol, widely adopted in IoT networks. We present the creation of the dataset, also validating it through the definition of a hypothetical detection system, by combining the legitimate dataset with cyber-attacks against the MQTT network. Obtained results demonstrate how MQTTset can be used to train machine learning models to implement detection systems able to protect IoT contexts.

SlowITe, a Novel Denial of Service Attack Affecting MQTT.

Security of the Internet of Things is a crucial topic, due to the criticality of the networks and the sensitivity of exchanged data. In this paper, we target the Message Queue Telemetry Transport (MQTT) protocol used in IoT environments for communication between IoT devices. We exploit a specific weakness of MQTT which was identified during our research, allowing the client to configure the behavior of the server. In order to validate the possibility to exploit such vulnerability, we propose SlowITe, a novel low-rate denial of service attack aimed to target MQTT through low-rate techniques. We validate SlowITe against real MQTT services, considering both plain text and encrypted communications and comparing the effects of the threat when targeting different daemons. Results show that the attack is successful and it is able to exploit the identified vulnerability to lead a DoS on the victim with limited attack resources.