Project Publications
LOCARD related articles have been published in high-rated journals and presented in top conferences. The following list depicts all articles published and presented from the beginning of the project.


Attackers regularly target Android phones and come up withnew ways to bypass detection mechanisms to achieve long-term stealth on a victim's phone. One way attackers do this is by leveraging critical benign app functionality to carry out specific attacks. In this paper, we present a novel generalised framework, JIT-MF (Just-in-time Memory Forensics), which aims to address the problem of timely collection of short-lived evidence in volatile memory to solve the stealthiest of Android attacks. The main components of this framework are i) Identification of critical data objects in memory linked with critical benign application steps that may be misused by an attacker; and ii) Careful selection of trigger points, which identify when memory dumpsshould be taken during benign app execution.The effectiveness and cost of trigger point selection, a corner stone of this framework, are evaluated in a preliminary qualitative study using Telegram and Pushbullet as the victim apps targeted by stealthy malware.Our study identifies that JIT-MF is successful in dumping critical dataobjects on time, providing evidence that eludes all other forensic sources.Experimentation offers insight into identifying categories of trigger points that can strike a balance between the effort required for selection andthe resulting effectiveness and storage costs. Several optimisation mea-sures for the JIT-MF tools are presented, considering the typical resource constraints of Android devices.

Authors: Jennifer Bellizzi; Mark Vella; Christian Colombo; Mark Vella; Christian Colombo; Julio Hernandez-Castro.

Conference: 25th Nordic Conference on Secure IT Systems

Date of Publication: November 2020.

Publisher: Springer.


Android accessibility features include a robust set of toolsallowing developers to create apps for assisting people with disabilities. Unfortunately, this useful set of tools can also be abused and turned into an attack vector, providing malware with the ability to interact and readcontent from third-party apps. In this work, we are the first to study the impact that the stealthy exploitation of Android accessibility services can have on significantly reducing the forensic footprint of malware attacks, thus hindering both liveand post-incident forensic investigations. We show that through Living off the Land (LotL) tactics, or by offering a malware-only substitute for attacks typically requiring more elaborate schemes, accessibility-based malware can be rendered virtually undetectable. In the LotL approach, we demonstrate accessibility-enabled SMS andcommand and control (C2) capabilities. As for the latter, we show acomplete cryptocurrency wallet theft, whereby the accessibility trojancan hijack the entire withdrawal process of a widely used app, including two-factor authentication (2FA). In both cases, we demonstrate how the attacks result in significantly diminished forensic evidence when compared to similar attacks not employing accessibility tools, even to the extent of maintaining device take-over without requiring malware per-sistence.

Authors: Yonas Leguesse; Mark Vella; Christian Colombo; Julio Hernandez-Castro.

Journal: International Workshop on Security and Trust Management.

Date of Publication: 16 September, 2020.



Traceability has become a critical element in supply chain management, particularly in safety-sensitive sectors like food, pharmaceuticals, etc. Upstream (manufacturers, producers, etc.) and downstream (distributors, wholesalers, etc.) supply chain members need to store and handle traceability-related information for providing proof of regulatory compliance to both state authorities and more demanding customers. Consumers also place high expectations on food supply chains (FSC) with specific emphasis on facets related to safety. However, the complexity of modern FSC networks and their fragmentation act as barriers for the development of sound traceability mechanisms. In this paper a distributed trustless and secure architecture for FSC traceability is developed and tested. For assessing the feasibility of the proposed approach, a food traceability case study from a dairy company is presented. The applicability of the model is further illustrated by the development of fully functional smart contracts and a local private blockchain. Moreover, the various links between the proposed blockchain-based model and its managerial implications are presented. The overall benefits of the proposed model are discussed along with fruitful areas for future research. The results are of significant value to both practitioners and researchers.

Authors: Fran Casino,Venetis Kanakaris,Thomas K. Dasaklis,Socrates Moschuris,Spiros Stachtiaris,Maria Pagoni &Nikolaos P. Rachaniotis

Journal: International Journal of Production Research

Date of Publication: 23 July, 2020.

Publisher: Taylor & Francis

Download this file (trace_block.pdf)trace_block.pdf[ ]2320 kB


Routing Protocol for low power and Lossy networks (RPL) is a standardized routing protocol for low power and lossy networks (LLNs) such as the Internet of Things (IoT). RPL was designed to be a simple (but efficient) and practical networking protocol to perform routing in IoT networks that consists of resource constrained devices. These tiny intercommunicating devices are currently in use in a large array of IoT application services (e.g., eHealth, smart agriculture, smart grids, and home automation). However, the lack of scalability and the low data communication reliability due to faulty links or malicious nodes, still remains significant challenges in the broader adoption of RPL in LLNs. In this paper, we propose RECOUP, a robust multicast communication routing protocol for Low power and Lossy Networks. RECOUP efficiently uses a low-overhead cluster-based multicast routing technique on top of the RPL protocol. RECOUP increases the probability of message delivery to the intended destination(s), irrespective of the network size and faults (such as broken links or non-responsive nodes), and in the presence of misbehaving nodes. An implementation of RECOUP is realized in Contiki. Our results show the effectiveness of RECOUP over state-of-art protocols concerning packet delivery ratio to 25%, end-to-end delay down to 100 ms, and low radio transmissions required for per packet delivery to 6 mJ. Moreover, it minimizes the impact of various topologies (i.e., rank and sybil) and data communication (i.e., blackhole, wormhole, and jamming) attacks that targets an IoT networking infrastructure.

Authors: Mauro Conti; Pallavi Kaliyar; Chhagan Lal.

Journal: Journal of Network and Computer Applications.

Date of Publication: 15 August, 2020.

Publisher:: Elsevier.


The Internet of Things (IoT) is recognized as a disruptive innovation that has been led by industry leaders and researchers. IoT promises to improve our daily life based on smart objects interacting with each other, and that can be connected to the Internet. Building a security framework into this new paradigm is a significant technical challenge today. It is mainly due to the low-cost and resource-constrained nature of IoT devices. In most of the IoT application scenarios, the routing is done by the de-facto standard protocol called routing protocol for low power and lossy networks (RPL). The use of RPL is suitable due to its energy-efficient schemes, availability of secure and multiple communication modes, and adaptivity to work in various IoT network scenarios. Hence, many researchers are now focusing on RPL related security issues. To this end, our work provides a concise description of two major threats to RPL called sybil and wormhole attacks. Moreover, we propose two solutions to detect these attacks in RPL-based IoT networks. Specifically, our proposed techniques exploit the concept of Highest Rank Common Ancestor (HRCA) to find a common ancestor with the highest rank among all the ancestors that a pair of nodes have in the target network tree. Our two detection algorithms not only detect an ongoing attack but also localizes the position of the adversary in the network. Thus, it makes the mitigation process lightweight and fast. We implement the two approaches in Cooja, the Contiki network emulator. The results obtained from our experiments demonstrate the feasibility of the proposals concerning true positive rate, detection time, packet loss ratio, memory consumption, and network overhead. Our techniques show promising to cover more complex scenarios in the future.

AuthorsPallavi KaliyarWafa Ben Jaballah; Mauro Conti; Chhagan Lal.

Journal: Computers and Security.

Date of Publication: July, 2020.

Publisher:: Elsevier.


Over the last few years, the dramatic growth in video demand has inspired the service providers (e.g., Netflix and YouTube) to swing towards HTTP based Dynamic Adaptive Streaming (DASH). However, sustaining the adequate bandwidth claims over this rapid growth in multimedia content becomes a significant challenge for network operators. Considering the effectiveness of the next generation future Internet architecture, i.e., Name Data Networking (NDN), recently DASH over NDN is implemented. The fundamental characteristics of NDN, such as efficient content distribution and low bandwidth requirements, significantly increase the bandwidth utilization, which ensures the smooth delivery of multimedia content. However, we discovered that the above characteristics of NDN also opens the door for new vulnerabilities.

In this paper, first we propose a new attack termed as “Bitrate Oscillation Attack” (BOA), which disrupt the functionality of DASH protocol over NDN by exploiting its two key features called in-network caching and interest aggregation. In particular, BOA forces the DASH streaming system running at the honest client to oscillate in various video resolutions with high frequency and amplitude, within a single video session. Second, to mitigate the BOA, we design and implement a proactive countermeasure called “NC based DAS-NDN”. Our solution efficiently enables the network coding to DAS multimedia content and within NDN architecture. Thus, without any coordination between the network nodes reduces bitrate oscillations in the presence of BOA and NDN’s inherent content source variations. The performance evaluation performed on different target scenarios proves the effectiveness of our proposed attack, and the results also show the correctness of our proposed corresponding countermeasure. In particular, the result analysis shows that BOA increases the annoyance factor in spatial dimension of end-user, and our countermeasure greatly reduces the adverse effects of BOA and also make DAS friendly to NDN’s inherent features.

AuthorsPallavi KaliyarWafa Ben Jaballah; Mauro Conti; Chhagan Lal.

Journal: Computer Networks.

Date of Publication: 19 June, 2020.

Publisher:: Elsevier.

Download this file (NC based DAS-NDN.pdf)NC based DAS-NDN.pdf[ ]2552 kB


Several ongoing research efforts aim to design potential Future Internet Architectures, among which Named-Data Networking (NDN) introduces a shift from the existing host-centric Internet Protocol-based Internet infrastructure towards a content-oriented one. However, researchers have identified some design limitations in NDN, among which some enable to build up a new type of Distributed Denial of Service attack, better known as Interest Flooding Attack (IFA). In IFA, an adversary issues not satisfiable requests in the network to saturate the Pending Interest Table (PIT) of NDN routers and prevent them from properly handling the legitimate traffic. Researchers have been trying to mitigate this problem by proposing several detection and reaction mechanisms, but all the mechanisms proposed so far are not highly effective and, on the contrary, heavily damage the legitimate traffic. In this paper, we propose a novel mechanism for IFA detection and mitigation, aimed at decreasing the memory consumption of the PIT by effectively reducing the malicious traffic that passes through each NDN router. In particular, our protocol exploits an effective management strategy on the PIT, through which the Malicious Interest (MIs) already stored in the PIT are removed and the new incoming MIs are dropped. In addition, the proposed countermeasure provides an additional security wall on the edges of the network to detect and mitigate the attack as early as possible and improve the network health, i.e., routers PIT occupancy during IFA. To evaluate the effectiveness of our work, we implemented the proposed countermeasure on the open-source ndnSIM simulator and compared its effectiveness with the state of the art. The results show that our proposed countermeasure effectively reduces the IFA damages both in terms of preserved legitimate traffic and availability of routers PIT. Considering the legitimate traffic, the amount of Benign Interests preserved by our approach increases from 5% to 40% with respect to the preservation guaranteed by the state-of-the-art solutions. Concerning the routers PIT availability, our approach guarantees that the 97% of the PIT size is left free for handling the legitimate traffic.

Authors: Abdelmadjid Benarfa; Muhammad Hassan; Eleonora Losiouk; Alberto Compagno; Mohamed Bachir Yagoubi; Mauro Conti.

Journal: International Journal of Information Security.

Date of Publication: 8 May, 2020.

Publisher:: Springer.


In this paper, an enhancement of a hybrid simulation technique based on combining collaborative filtering with deterministic 3D ray launching algorithm is proposed. Our approach implements a new methodology of data depuration from low definition simulations to reduce noisy simulation cells. This is achieved by processing the maximum number of permitted reflections, applying memory based collaborative filtering, using a nearest neighbors’ approach. The depuration of the low definition ray launching simulation results consists on discarding the estimated values of the cells reached by a number of rays lower than a set value. Discarded cell values are considered noise due to the high error that they provide comparing them to high definition ray launching simulation results. Thus, applying the collaborative filtering technique both to empty and noisy cells, the overall accuracy of the proposed methodology is improved. Specifically, the size of the data collected from the scenarios was reduced by more than 40% after identifying and extracting noisy/erroneous values. In addition, despite the reduced amount of training samples, the new methodology provides an accuracy gain above 8% when applied to the real-world scenario under test, compared with the original approach. Therefore, the proposed methodology provides more precise results from a low definition dataset, increasing accuracy while exhibiting lower complexity in terms of computation and data storage. The enhanced hybrid method enables the analysis of larger complex scenarios with high transceiver density, providing coverage/capacity estimations in the design of heterogeneous IoT network applications.

Authors: Fran Casino; Peio Lopez-Iturri; Erik Aguirre; Leyre Azpilicueta; Francisco Falcone; Agusti Solanas.

JournalIEEE Access.

Date of Publication: 4 May, 2020.

Publisher: Institute of Electrical and Electronics Engineers (IEEE).


Random number generation is critical to many applications. Gaming, gambling, and particularly cryptography all require random numbers that are uniform and unpredictable. For testing whether supposedly random sources feature particular characteristics commonly found in random sequences, batteries of statistical tests are used. These are fundamental tools in the evaluation of random number generators and form part of the pathway to certification of secure systems implementing them. Although there have been previous studies into this subject becker2013stealthy, RNG manufacturers and vendors continue to use statistical tests known to be of dubious reliability, in their RNG verification processes. Our research shows that FIPS-140-2 cannot identify adversarial biases effectively, even very primitive ones. Concretely, this work illustrates the inability of the FIPS 140 family of tests to detect bias in three obviously flawed PRNGs. Deprecated by official standards, these tests are nevertheless still widely used, for example in hardware-level self-test schemes incorporated into the design of many True RNGs (TRNGs). They are also popular with engineers and cryptographers for quickly assessing the randomness characteristics of security primitives and protocols, and even with manufacturers aiming to market the randomness features of their products to potential customers. In the following, we present three biased-by-design RNGs to show in explicit detail how simple, glaringly obvious biases are not detected by any of the FIPS 140-2 tests. One of these RNGs is backdoored, leaking key material, while others suffer from significantly reduced unpredictability in their output sequences. To make our point even more straightforward, we show how files containing images can also fool the FIPS 140 family of tests. We end with a discussion on the security issues affecting an interesting and active project to create a randomness beacon. Their authors only tested the quality of their randomness with the FIPS 140 family of tests, and we will show how this has led them to produce predictable output that, albeit passing FIPS fails other randomness tests quite catastrophically.

Authors: Darren Hurley-Smith; Constantinos Patsakis; Julio Hernandez-Castro.

JournalIEEE Transactions on Information Forensics and Security.

Date of Publication: 17 April 2020.

PublisherInstitute of Electrical and Electronics Engineers (IEEE).

Download this file (fips.pdf)fips.pdf[ ]985 kB

Page 2 of 5

Slide 1
Join the community
Follow us and stay connected and updated.
EU flag Copyright © 2019 - 2022 LOCARD. All rights reserved. This project has received funding from the European Union’s Horizon 2020 Research and Innovation Programme under Grant Agreement nº 832735. This project reflects only the author’s view and the Commission is not responsible for any use that may be made of the information it contains.