"This site requires JavaScript to work correctly"
Header minimieren

Prof. Dr. Michael Heigl

Künstliche Intelligenz für Cybersicherheit

Fakultät Angewandte Informatik

Professorinnen und Professoren

Professor

ITC2+ 1.04

0991/3615-537

Sprechzeiten

nach vorheriger Terminvereinbarung per E-Mail

Sortierung:
Beitrag in Sammelwerk/Tagungsband
  • Michael Heigl
  • Martin Schramm
  • Laurin Dörr
  • Andreas Grzemba

Embedded Plug-In Devices to Secure Industrial Network Communications.

(2016)

Beitrag in Sammelwerk/Tagungsband
  • Michael Heigl
  • Martin Aman
  • A. Fuchs
  • Andreas Grzemba

Industrial Legacy System Communication Through Interconnected Embedded Plug-In Devices.

  • In:
  • J. Mottok
  • R. Stolle
  • M. Reichenberger

(2016)

Vortrag
  • Karl Leidl
  • Martin Aman
  • Michael Heigl
  • Andreas Grzemba

Intrusion Detection Sensoren für industrielle Netzwerke.

Würzburg 22.-23.06.2016.

(2016)

Vortrag
  • Laurin Dörr
  • Michael Heigl
  • Andreas Grzemba
  • Christian Boiger

IT-Security-Architektur für Next-Generation Kommunikationssysteme im Automobil.

Wolfsburg 08.-09.11.2016.

(2016)

Zeitschriftenartikel
  • Nari Arunraj
  • Robert Hable
  • Michael Fernandes
  • Karl Leidl
  • Michael Heigl

Comparison of Supervised, Semi-supervised and Unsupervised Learning Methods in Network Intrusion Detection Systems (NIDS) Application.

In: Anwendungen und Konzepte in der Wirtschaftsinformatik (AKWI) , pg. 10-19

(2017)

Abstract anzeigen

With the emergence of the fourth industrial revolution (Industrie 4.0) of cyber physical systems, intrusion detection systems are highly necessary to detect industrial network attacks. Recently, the increase in application of specialized machine learning techniques is gaining critical attention in the intrusion detection community. A wide variety of learning techniques proposed for different network intrusion detection system (NIDS) problems can be roughly classified into three broad categories: supervised, semi-supervised and unsupervised. In this paper, a comparative study of selected learning methods from each of these three kinds is carried out. In order to assess these learning methods, they are subjected to investigate network traffic datasets from an Airplane Cabin Demonstrator. In addition to this, the imbalanced classes (normal and anomaly classes) that are present in the captured network traffic data is one of the most crucial issues to be taken into consideration. From this investigation, it has been identified that supervised learning methods (logistic and lasso logistic regression methods) perform better than other methodswhen historical data on former attacks are available. The results of this study have also showed that the performance of semi-supervised learning method (One class support vector machine) is comparatively better than unsupervised learning method (Isolation Forest) when historical data on former attacks are not available.
Beitrag in Sammelwerk/Tagungsband
  • Laurin Dörr
  • D. Fiala
  • Michael Heigl
  • Martin Schramm

Assessment simulation model for uncoupled message authentication.

  • In:
  • Institute of Electrical and Electronics Engineers Inc.

DOI: 10.23919/AE.2017.8053580

(2017)

Beitrag in Sammelwerk/Tagungsband
  • Martin Schramm
  • R. Dojen
  • Michael Heigl

Experimental assessment of FIRO- and GARO-based noise sources for digital TRNG designs on FPGAs.

  • In:
  • Institute of Electrical and Electronics Engineers Inc.

pg. 1-6

DOI: 10.23919/AE.2017.8053618

(2017)

Beitrag in Sammelwerk/Tagungsband
  • Michael Heigl
  • Laurin Dörr
  • Amar Almaini
  • D. Fiala
  • Martin Schramm

Incident Reaction Based on Intrusion Detections’ Alert Analysis.

  • In:
  • Institute of Electrical and Electronics Engineers Inc.

pg. 1-6

DOI: 10.23919/AE.2018.8501419

(2018)

Zeitschriftenartikel
  • Martin Schramm
  • R. Dojen
  • Michael Heigl

A Vendor-Neutral Unified Core for Cryptographic Operations in GF(p) and GF( 2m ) Based on Montgomery Arithmetic (Article ID 4983404).

In: Security and Communication Networks , pg. 1-18

(2018)

DOI: 10.1155/2018/4983404

Abstract anzeigen

In the emerging IoT ecosystem in which the internetworking will reach a totally new dimension the crucial role of efficient security solutions for embedded devices will be without controversy. Typically IoT-enabled devices are equipped with integrated circuits, such as ASICs or FPGAs to achieve highly specific tasks. Such devices must have cryptographic layers implemented and must be able to access cryptographic functions for encrypting/decrypting and signing/verifying data using various algorithms and generate true random numbers, random primes, and cryptographic keys. In the context of a limited amount of resources that typical IoT devices will exhibit, due to energy efficiency requirements, efficient hardware structures in terms of time, area, and power consumption must be deployed. In this paper, we describe a scalable word-based multivendor-capable cryptographic core, being able to perform arithmetic operations in prime and binary extension finite fields based on Montgomery Arithmetic. The functional range comprises the calculation of modular additions and subtractions, the determination of the Montgomery Parameters, and the execution of Montgomery Multiplications and Montgomery Exponentiations. A prototype implementation of the adaptable arithmetic core is detailed. Furthermore, the decomposition of cryptographic algorithms to be used together with the proposed core is stated and a performance analysis is given.
Vortrag
  • Michael Heigl

DecADe - Decentralized Anomaly Detection. Posterpräsentation.

  • Technische Hochschule Deggendorf.

Deggendorf 08.03.2018.

(2018)

Zeitschriftenartikel
  • Michael Heigl
  • Laurin Dörr
  • Nicolas Tiefnig
  • D. Fiala
  • Martin Schramm

A Resource-Preserving Self-Regulating Uncoupled MAC Algorithm to be Applied in Incident Detection.

In: Computers & Security (vol. 85) , pg. 270-285

(2019)

DOI: 10.1016/j.cose.2019.05.010

Abstract anzeigen

The connectivity of embedded systems is increasing accompanied with thriving technology such as Internet of Things/Everything (IoT/E), Connected Cars, Smart Cities, Industry 4.0, 5G or Software-Defined Everything. Apart from the benefits of these trends, the continuous networking offers hackers a broad spectrum of attack vectors. The identification of attacks or unknown behavior through Intrusion Detection Systems (IDS) has established itself as a conducive and mandatory mechanism apart from the protection by cryptographic schemes in a holistic security eco-system. In systems where resources are valuable goods and stand in contrast to the ever increasing amount of network traffic, sampling has become a useful utility in order to detect malicious activities on a manageable amount of data. In this work an algorithm – Uncoupled MAC – is presented which secures network communication through a cryptographic scheme by uncoupled Message Authentication Codes (MAC) but as a side effect also provides IDS functionality producing alarms based on the violation of Uncoupled MAC values. Through a novel self-regulation extension, the algorithm adapts it’s sampling parameters based on the detection of malicious actions. The evaluation in a virtualized environment clearly shows that the detection rate increases over runtime for different attack scenarios. Those even cover scenarios in which intelligent attackers try to exploit the downsides of sampling.
Beitrag in Sammelwerk/Tagungsband
  • Laurin Dörr
  • Michael Heigl
  • D. Fiala
  • Martin Schramm

Comparison of Energy-Efficient Key Management Protocols for Wireless Sensor Networks.

pg. 21-26

DOI: 10.1145/3343147.3343156

(2019)

Beitrag in Sammelwerk/Tagungsband
  • Michael Heigl
  • Martin Schramm
  • D. Fiala

A Lightweight Quantum-Safe Security Concept for Wireless Sensor Network Communication.

pg. 906-911

DOI: 10.1109/PERCOMW.2019.8730749

(2019)

Beitrag in Sammelwerk/Tagungsband
  • Michael Heigl
  • Laurin Dörr
  • Martin Schramm
  • D. Fiala

On the Energy Consumption of Quantum-resistant Cryptographic Software Implementations Suitable for Wireless Sensor Networks.

pg. 72-83

DOI: 10.5220/0007835600720083

(2019)

Zeitschriftenartikel
  • Michael Heigl
  • Kumar Anand
  • Andreas Urmann
  • D. Fiala
  • Martin Schramm
  • Robert Hable

On the Improvement of the Isolation Forest Algorithm for Outlier Detection with Streaming Data.

In: Electronics (vol. 10) , pg. 1534

(2021)

DOI: 10.3390/electronics10131534

Abstract anzeigen

In recent years, detecting anomalies in real-world computer networks has become a more and more challenging task due to the steady increase of high-volume, high-speed and high-dimensional streaming data, for which ground truth information is not available. Efficient detection schemes applied on networked embedded devices need to be fast and memory-constrained, and must be capable of dealing with concept drifts when they occur. Different approaches for unsupervised online outlier detection have been designed to deal with these circumstances in order to reliably detect malicious activity. In this paper, we introduce a novel framework called PCB-iForest, which generalized, is able to incorporate any ensemble-based online OD method to function on streaming data. Carefully engineered requirements are compared to the most popular state-of-the-art online methods with an in-depth focus on variants based on the widely accepted isolation forest algorithm, thereby highlighting the lack of a flexible and efficient solution which is satisfied by PCB-iForest. Therefore, we integrate two variants into PCB-iForest—an isolation forest improvement called extended isolation forest and a classic isolation forest variant equipped with the functionality to score features according to their contributions to a sample’s anomalousness. Extensive experiments were performed on 23 different multi-disciplinary and security-related real-world datasets in order to comprehensively evaluate the performance of our implementation compared with off-the-shelf methods. The discussion of results, including AUC, F1 score and averaged execution time metric, shows that PCB-iForest clearly outperformed the state-of-the-art competitors in 61% of cases and even achieved more promising results in terms of the tradeoff between classification and computational costs.
Zeitschriftenartikel
  • Michael Heigl
  • Enrico Weigelt
  • Andreas Urmann
  • D. Fiala
  • Martin Schramm

Exploiting the Outcome of Outlier Detection for Novel Attack Pattern Recognition on Streaming Data.

In: Electronics (vol. 10) , pg. 2160

(2021)

DOI: 10.3390/electronics10172160

Abstract anzeigen

Future-oriented networking infrastructures are characterized by highly dynamic Streaming Data (SD) whose volume, speed and number of dimensions increased significantly over the past couple of years, energized by trends such as Software-Defined Networking or Artificial Intelligence. As an essential core component of network security, Intrusion Detection Systems (IDS) help to uncover malicious activity. In particular, consecutively applied alert correlation methods can aid in mining attack patterns based on the alerts generated by IDS. However, most of the existing methods lack the functionality to deal with SD data affected by the phenomenon called concept drift and are mainly designed to operate on the output from signature-based IDS. Although unsupervised Outlier Detection (OD) methods have the ability to detect yet unknown attacks, most of the alert correlation methods cannot handle the outcome of such anomaly-based IDS. In this paper, we introduce a novel framework called Streaming Outlier Analysis and Attack Pattern Recognition, denoted as SOAAPR, which is able to process the output of various online unsupervised OD methods in a streaming fashion to extract information about novel attack patterns. Three different privacy-preserving, fingerprint-like signatures are computed from the clustered set of correlated alerts by SOAAPR, which characterizes and represents the potential attack scenarios with respect to their communication relations, their manifestation in the data’s features and their temporal behavior. Beyond the recognition of known attacks, comparing derived signatures, they can be leveraged to find similarities between yet unknown and novel attack patterns. The evaluation, which is split into two parts, takes advantage of attack scenarios from the widely-used and popular CICIDS2017 and CSE-CIC-IDS2018 datasets. Firstly, the streaming alert correlation capability is evaluated on CICIDS2017 and compared to a state-of-the-art offline algorithm, called Graph-based Alert Correlation (GAC), which has the potential to deal with the outcome of anomaly-based IDS. Secondly, the three types of signatures are computed from attack scenarios in the datasets and compared to each other. The discussion of results, on the one hand, shows that SOAAPR can compete with GAC in terms of alert correlation capability leveraging four different metrics and outperforms it significantly in terms of processing time by an average factor of 70 in 11 attack scenarios. On the other hand, in most cases, all three types of signatures seem to reliably characterize attack scenarios such that similar ones are grouped together, with up to 99.05% similarity between the FTP and SSH Patator attack.
Zeitschriftenartikel
  • Michael Heigl
  • Enrico Weigelt
  • D. Fiala
  • Martin Schramm

Unsupervised Feature Selection for Outlier Detection on Streaming Data to Enhance Network Security.

In: Applied Sciences (vol. 11) , pg. 12073

(2021)

DOI: 10.3390/app112412073

Abstract anzeigen

Over the past couple of years, machine learning methods—especially the outlier detection ones—have anchored in the cybersecurity field to detect network-based anomalies rooted in novel attack patterns. However, the ubiquity of massive continuously generated data streams poses an enormous challenge to efficient detection schemes and demands fast, memory-constrained online algorithms that are capable to deal with concept drifts. Feature selection plays an important role when it comes to improve outlier detection in terms of identifying noisy data that contain irrelevant or redundant features. State-of-the-art work either focuses on unsupervised feature selection for data streams or (offline) outlier detection. Substantial requirements to combine both fields are derived and compared with existing approaches. The comprehensive review reveals a research gap in unsupervised feature selection for the improvement of outlier detection methods in data streams. Thus, a novel algorithm for Unsupervised Feature Selection for Streaming Outlier Detection, denoted as UFSSOD, will be proposed, which is able to perform unsupervised feature selection for the purpose of outlier detection on streaming data. Furthermore, it is able to determine the amount of top-performing features by clustering their score values. A generic concept that shows two application scenarios of UFSSOD in conjunction with off-the-shell online outlier detection algorithms has been derived. Extensive experiments have shown that a promising feature selection mechanism for streaming data is not applicable in the field of outlier detection. Moreover, UFSSOD, as an online capable algorithm, yields comparable results to a state-of-the-art offline method trimmed for outlier detection. V
Beitrag in Sammelwerk/Tagungsband
  • Amar Almaini
  • Jakob Folz
  • D. Wölfl
  • A. Al Dubai
  • Martin Schramm
  • Michael Heigl

A New Scalable Distributed Homomorphic Encryption Scheme for High Computational Complexity Models.

DOI: 10.1109/IWCMC58020.2023.10183131

(2023)

Zeitschriftenartikel
  • Robert Aufschläger
  • Jakob Folz
  • E. März
  • J. Guggumos
  • Michael Heigl
  • B. Buchner
  • Martin Schramm

Anonymization Procedures for Tabular Data: An Explanatory Technical and Legal Synthesis.

In: Information (vol. 14) , pg. 487

(2023)

DOI: 10.3390/info14090487

Abstract anzeigen

In the European Union, Data Controllers and Data Processors, who work with personal data, have to comply with the General Data Protection Regulation and other applicable laws. This affects the storing and processing of personal data. But some data processing in data mining or statistical analyses does not require any personal reference to the data. Thus, personal context can be removed. For these use cases, to comply with applicable laws, any existing personal information has to be removed by applying the so-called anonymization. However, anonymization should maintain data utility. Therefore, the concept of anonymization is a double-edged sword with an intrinsic trade-off: privacy enforcement vs. utility preservation. The former might not be entirely guaranteed when anonymized data are published as Open Data. In theory and practice, there exist diverse approaches to conduct and score anonymization. This explanatory synthesis discusses the technical perspectives on the anonymization of tabular data with a special emphasis on the European Union’s legal base. The studied methods for conducting anonymization, and scoring the anonymization procedure and the resulting anonymity are explained in unifying terminology. The examined methods and scores cover both categorical and numerical data. The examined scores involve data utility, information preservation, and privacy models. In practice-relevant examples, methods and scores are experimentally tested on records from the UCI Machine Learning Repository’s “Census Income (Adult)” dataset.
Vortrag
  • Jakob Folz
  • Robert Aufschläger
  • Michael Heigl

PRIVATE OPEN DATA?! - EAsyAnon TRUSTSERVICE. Posterpräsentation.

  • Bundesministerium für Bildung und Forschung.

Berlin 13.-15.03.2023.

(2023)

Vortrag
  • Michael Heigl

Cybersicherheit – Mehr als nur ein Kostenfaktor?!.

  • Pro Vilshofen Stadtmarketing e.V..

Vilshofen 13.03.2023.

(2023)

Beitrag in Sammelwerk/Tagungsband
  • Amar Almaini
  • Tobias Koßmann
  • Jakob Folz
  • Martin Schramm
  • Michael Heigl
  • A. Al Dubai

Integrating Reality: A Hybrid SDN Testbed for Enhanced Realism in Edge Computing Simulations.

(2024)

Vortrag
  • Ludwig Bellstedt
  • Michael Heigl

Survey on Automated Threat Modeling Methods. Posterpräsentation.

Nürnberg 03.07.2024.

(2024)

Beitrag in Sammelwerk/Tagungsband
  • Robert Aufschläger
  • Sebastian Wilhelm
  • Michael Heigl
  • Martin Schramm

ClustEm4Ano: Clustering Text Embeddings of Nominal Textual Attributes for Microdata Anonymization.

  • In:
  • R. Chbeir
  • P. Revesz
  • Y. Manolopoulos
  • C. Leung
  • J. Bernardino
  • S. Ilarri

Cham: Springer Nature Switzerland pg. 122-137

DOI: 10.1007/978-3-031-83472-1_9

(2025)