Vulnerability patch management is one of IT organizations' most complex issues due to the increasing number of publicly known vulnerabilities and explicit patch deadlines for compliance. Patch management requires human involvement in testing, deploying, and verifying the patch and its potential side effects. Hence, there is a need to automate the patch management procedure to keep the patch deadline with a limited number of available experts. This study proposed and implemented an automated patch management procedure to address mentioned challenges. The method also includes logic to automatically handle errors that might occur in patch deployment and verification. Moreover, the authors added an automated review step before patch management to adjust the patch prioritization list if multiple cumulative patches or dependencies are detected. The result indicated that our method reduced the need for human intervention, increased the ratio of successfully patched vulnerabilities, and decreased the execution time of vulnerability risk management.

During the last decade, we have witnessed a rapiddevelopment of extended reality (XR) technologies such asaugmented reality (AR) and virtual reality (VR). Further, therehave been tremendous advancements in artificial intelligence(AI) and machine learning (ML). These two trends will havea significant impact on future digital societies. The vision ofan immersive, ubiquitous, and intelligent virtual space opensup new opportunities for creating an enhanced digital world inwhich the users are at the center of the development process,so-calledintelligent realities(IRs).The “Human-Centered Intelligent Realities” (HINTS) profileproject will develop concepts, principles, methods, algorithms,and tools for human-centered IRs, thus leading the wayfor future immersive, user-aware, and intelligent interactivedigital environments. The HINTS project is centered aroundan ecosystem combining XR and communication paradigms toform novel intelligent digital systems.HINTS will provide users with new ways to understand,collaborate with, and control digital systems. These novelways will be based on visual and data-driven platforms whichenable tangible, immersive cognitive interactions within realand virtual realities. Thus, exploiting digital systems in a moreefficient, effective, engaging, and resource-aware condition.Moreover, the systems will be equipped with cognitive featuresbased on AI and ML, which allow users to engage with digitalrealities and data in novel forms. This paper describes theHINTS profile project and its initial results. ©2023, Copyright held by the authors   

The information-security landscape continuously evolves by discovering new vulnerabilities daily and sophisticated exploit tools. Vulnerability risk management (VRM) is the most crucial cyber defense to eliminate attack surfaces in IT environments. VRM is a cyclical practice of identifying, classifying, evaluating, and remediating vulnerabilities. The evaluation stage of VRM is neither automated nor cost-effective, as it demands great manual administrative efforts to prioritize the patch. Therefore, there is an urgent need to improve the VRM procedure by automating the entire VRM cycle in the context of a given organization. The authors propose automated context-aware VRM (ACVRM), to address the above challenges. This study defines the criteria to consider in the evaluation stage of ACVRM to prioritize the patching. Moreover, patch prioritization is customized in an organization’s context by allowing the organization to select the vulnerability management mode and weigh the selected criteria. Specifically, this study considers four vulnerability evaluation cases: (i) evaluation criteria are weighted homogeneously; (ii) attack complexity and availability are not considered important criteria; (iii) the security score is the only important criteria considered; and (iv) criteria are weighted based on the organization’s risk appetite. The result verifies the proposed solution’s efficiency compared with the Rudder vulnerability management tool (CVE-plugin). While Rudder produces a ranking independent from the scenario, ACVRM can sort vulnerabilities according to the organization’s criteria and context. Moreover, while Rudder randomly sorts vulnerabilities with the same patch score, ACVRM sorts them according to their age, giving a higher security score to older publicly known vulnerabilities. © 2022 by the authors.

Vulnerability Risk Management (VRM) is a critical element in cloud security that directly impacts cloud providers’ security assurance levels. Today, VRM is a challenging process because of the dramatic increase of known vulnerabilities (+26% in the last five years), and because it is even more dependent on the organization’s context. Moreover, the vulnerability’s severity score depends on the Vulnerability Database (VD) selected as a reference in VRM. All these factors introduce a new challenge for security specialists in evaluating and patching the vulnerabilities. This study provides a framework to improve the classification and evaluation phases in vulnerability risk management while using multiple vulnerability databases as a reference. Our solution normalizes the severity score of each vulnerability based on the selected security assurance level. The results of our study highlighted the role of the vulnerability databases in patch prioritization, showing the advantage of using multiple VDs.

In the last three years, the unprecedented increase in discovered vulnerabilities ranked with critical and high severity raise new challenges in Vulnerability Risk Management (VRM). Indeed, identifying, analyzing and remediating this high rate of vulnerabilities is labour intensive, especially for enterprises dealing with complex computing infrastructures such as Infrastructure-as-a-Service providers. Hence there is a demand for new criteria to prioritize vulnerabilities remediation and new automated/autonomic approaches to VRM.

In this paper, we address the above challenge proposing an Automated Context-aware Vulnerability Risk Management (AC- VRM) methodology that aims: to reduce the labour intensive tasks of security experts; to prioritize vulnerability remediation on the basis of the organization context rather than risk severity only. The proposed solution considers multiple vulnerabilities databases to have a great coverage on known vulnerabilities and to determine the vulnerability rank. After the description of the new VRM methodology, we focus on the problem of obtaining a single vulnerability score by normalization and fusion of ranks obtained from multiple vulnerabilities databases. Our solution is a parametric normalization that accounts for organization needs/specifications.

OpenFlow flow tables in Open vSwitch contain valuable information about installed flows, priorities, packet actions and routing policies. Their importance is emphasized when collocated tenants compete for the limited entries available to install flow rules. OpenFlow flow tables are a security asset that requires confidentiality and integrity guarantees. However, commodity software switch implementations - such as Open vSwitch - do not implement protection mechanisms capable to prevent attackers from obtaining information about the installed flows or modifying flow tables. We adopt a novel approach to enabling OpenFlow flow table protection through decomposition. We identify core assets requiring security guarantees, isolate OpenFlow flow tables through decomposition and implement a prototype using Open vSwitch and Software Guard Extensions enclaves. An evaluation of the prototype on a distributed testbed both demonstrates that the approach is practical and indicates directions for further improvements. © 2019 IEEE.

In this paper, we consider the application of partial buffer sharing to an M/G/1/K queueing system for cognitive radio networks (CRNs). It is assumed that the CRN is subject to Nakagami-m. fading. Secondary users are allowed to utilize the licensed radio spectrum of the primary users through underlay spectrum access. A finite buffer at the secondary transmitter is partitioned into two regions, the first region serves both classes of packets while the second region serves only packets of the highest priority class. Therefore, the examined CRN can be modeled as an M/G/1/K queueing system using partial buffer sharing. An embedded Markov chain is applied to analyze the queueing behavior of the system. Utilizing the balance equations and the normalized equation, the equilibrium state distribution of the system at an arbitrary time instant can be found. This outcome is utilized to investigate the impact of queue length, arrival rates, and fading parameters on queueing performance measures such as blocking probability, throughput, mean packet transmission time, channel utilization, mean number of packets in the system, and mean packet waiting time for each class of packets.

The usage of network-demanding applications is growing rapidly such as video streaming on mobile terminals. However, network and/or service providers might not guarantee the perceived quality for video streaming that demands high packet transmission rate. In order to satisfy the user expectations and to minimize user churn, it is important for network operators to infer the end-user perceived quality in video streaming. Today, the most reliable method to obtain end-user perceived quality is through subjective tests, and the preferred location is the user interface as it is the closest point of application to the end-user. The end-user perceived quality on video streaming is highly influenced by occasional freezes; technically the extraordinary time gaps between two consecutive pictures that are displayed to the user, i.e., high inter-picture time. In this paper, we present a QoE instrumentation for video streaming, VLQoE. We added functionality to the VLC player to record a set of metrics from the user interface, application-level, network-level, and from the available sensors of the device. To the best of our knowledge, VLQoE is the first tool of its kind that can be used in user experiments for video streaming. By using the tool, we present a two state model based on the inter-picture time, for the HTTP- and RTSP-based video streaming via 3.5G. Next, we studied the influence of inter-picture time on the user perceived quality through out a user study. We investigated the minimum user perceived inter-picture time, and the user response time.

In this paper, we develop a queueing analysis for opportunistic decode-and-forward (DF) relay networks. It is assumed that the networks undergo Nakagami-m fading and that the external arrival process follows a Poisson distribution. By selecting the best relay according to the opportunistic relaying scheme, the source first transmits its signal to the best relay which then attempts to decode the reception and forwards the output to the destination. It is assumed that each relay operates in full-duplex mode, i.e., it can receive and transmit signals simultaneously. The communication process throughout the network can be modeled as a queueing network which is structured from sub-systems of M/G/1 and G/G/1 queueing stations. We invoke the approximate analysis, so-called method of decomposition, to analyze the performance behavior of the considered relay network. The whole queueing network is broken into separate queues which are then investigated individually. Based on this approach, the end-to-end packet transmission time and throughput of the considered relay network are quantified in comparison with the networks with partial relay selection (PRS).