Survey: Cybersecurity Vulnerabilities, Attacks and Solutions in the Medical Domain <s> 2) SOLUTIONS FOR INFORMATION COLLECTION ATTACKS <s> Virtual Private Networks (VPNs) provide a secure encrypted communication between remote networks worldwide by using Internet Protocol(IP) tunnels and a shared medium like the Internet. End-to-end connectivity is established by tunneling. OpenVPN and OpenSSH are cross-platform, secure, highly configurable VPN solutions. The performance comparison however between OpenVPN and OpenSSH VPN has not yet been undertaken. This paper focuses on such comparison and evaluates the efficiency of these VPNs over Wide Area Network (WAN) connections. The same conditions are maintained for a fair comparison. To the best knowledge of the authors, this is the first reported test results of these two commonly used VPN technologies. Three parameters, namely speed, latency and jitter are evaluated. Using a real life scenario with deployment over the Linux Operating System, a comprehensive in-depth comparative analysis of the VPN mechanisms is provided. Results of the analysis between OpenSSH and OpenVPN show that OpenSSH utilizes better the link and significantly improves transfer times. <s> BIB001 </s> Survey: Cybersecurity Vulnerabilities, Attacks and Solutions in the Medical Domain <s> 2) SOLUTIONS FOR INFORMATION COLLECTION ATTACKS <s> In this paper, an architectural framework for Web Service Security System that secures Web services effectively from message alteration attacks, Man-in-the Middle (MIM) attacks and Denial of Service (DoS) attacks has been proposed and implemented. This proposed system provides intelligent mechanisms for effective detection and preventions of message alteration attacks at message level, man-in-the middle attacks at transport level and denial of service attacks at application level. For this purpose, new approaches have been proposed for intelligent identification of the services requested by the user to the service provider. Moreover, new agents called requester agent and provider agent have been deployed for effective communication between the service requester and the service provider. An encryption mechanism and digital signature generation is incorporated to secure the Simple Object Access Protocol (SOAP) message over communication between the client and the server. The new approach proposed in this research work called Web Service Registration and Routing System and Inter Proxy Web Service that effectively prevents the message alteration attacks, Man-in-the Middle attacks and other types of attacks in order to secure Web service at message level. Also, new agents are such as requester agent and provider agent have been deployed at the client and server side respectively. These two agents are responsible for effective monitoring and controlling of various messages and attacks at the message level. In addition to this, a security token is created for each user request to verify the validity of the service provider and service requester for effective and secured communication. This system also provides a new approach for the intelligent prevention of Man-in-the Middle attack and Denial of Service attack in Web services. <s> BIB002 </s> Survey: Cybersecurity Vulnerabilities, Attacks and Solutions in the Medical Domain <s> 2) SOLUTIONS FOR INFORMATION COLLECTION ATTACKS <s> Healthcare sectors are increasingly facing cyber security challenges and threats from adversaries due to numerous security flaws and the lack of security safeguards in medical devices. Among these medical devices and systems, security issues that concern implantable medical devices (IMDs) have attracted attention from both academia and the industry. In this paper, we discuss security vulnerabilities in current IMD products by presenting security tests and demonstrations performed by researchers. Based on this, three critical trade-offs in the IMD security design are analyzed, namely security vs. accessibility in medical emergencies, emergency access vs. checkup access and strong security requirements vs. limited IMD resources. Biometrics based security solutions can provide support for emergency access and thus are surveyed, including those using electrocardiogram signals, iris and fingerprints. During the design, we propose to adopt the concept of decoupled design and usable security in order to develop a viable security solution for the IMDs. <s> BIB003 </s> Survey: Cybersecurity Vulnerabilities, Attacks and Solutions in the Medical Domain <s> 2) SOLUTIONS FOR INFORMATION COLLECTION ATTACKS <s> Ransomware, a class of self-propagating malware that uses encryption to hold the victims' data ransom, has emerged in recent years as one of the most dangerous cyber threats, with widespread damage; e.g., zero-day ransomware WannaCry has caused world-wide catastrophe, from knocking U.K. National Health Service hospitals offline to shutting down a Honda Motor Company in Japan[1]. Our close collaboration with security operations of large enterprises reveals that defense against ransomware relies on tedious analysis from high-volume systems logs of the first few infections. Sandbox analysis of freshly captured malware is also commonplace in operation. ::: We introduce a method to identify and rank the most discriminating ransomware features from a set of ambient (non-attack) system logs and at least one log stream containing both ambient and ransomware behavior. These ranked features reveal a set of malware actions that are produced automatically from system logs, and can help automate tedious manual analysis. We test our approach using WannaCry and two polymorphic samples by producing logs with Cuckoo Sandbox during both ambient, and ambient plus ransomware executions. Our goal is to extract the features of the malware from the logs with only knowledge that malware was present. We compare outputs with a detailed analysis of WannaCry allowing validation of the algorithm's feature extraction and provide analysis of the method's robustness to variations of input data\textemdash changing quality/quantity of ambient data and testing polymorphic ransomware. Most notably, our patterns are accurate and unwavering when generated from polymorphic WannaCry copies, on which 63 (of 63 tested) anti-virus (AV) products fail. <s> BIB004 </s> Survey: Cybersecurity Vulnerabilities, Attacks and Solutions in the Medical Domain <s> 2) SOLUTIONS FOR INFORMATION COLLECTION ATTACKS <s> This research presents a penetration testing approach to help secure OpenSSH service on Raspberry Pi 2. The study discusses a technique for penetrating Debian v7.1p2, installed on Raspberry Pi 2, using Kali Linux. We exploit the vulnerability found in SSH protocol exchange keys, which causes multiple CRLF injections in Raspberry Pi 2 Model B, allowing remote authenticated users to bypass intended shell-command restrictions via well crafted X11 data forwarding. We propose an innovative security model to solve the issues of allowing remote authentication access using SSH protocol exchange keys without affecting the encrypted protocols transmissions. We conclude with recommendations on how to securely mitigate MITM attacks using our secure proposed model. <s> BIB005
To safeguard OpenSSH server keys, Ylonen  proposed ensuring that the cryptographic key is presented a minimum number of times in the allocated memory. The SSH protocol is expected to handle the authentication process efficiently. OpenSSH vulnerabilities are famous for the Man-in-the-Middle (MITM) attack presented by Chakaravarthi et al. BIB002 . Coonjah et al. BIB001 propose the solution to handle the information collection attack. In this approach, the end-to-end connection is established using a tunneling process based on an OpenSSH and OpenVPN cross-platform. The results demonstrate that OpenSSH utilizes a better link and provides improved transfer speed and time. It is concluded that OpenSSH is a cost-effective solution. For the problem of an MS17-010 security breach, Qi et al.  proposed a homologous analysis approach based on the API sequence of ransomware. The idea involves using Clustalw algorithms to identify unknown software. The experiments in the paper show that this method, when applied for detecting the homology effect, works well, and end-users can distinguish ransomware clearly. However, the problem with this method is that, when using a sequence alignment algorithm, considerable computation time is needed and there is high time complexity. When the medical system is attacked by WannaCry due to the Windows OS vulnerability, a novel method proposed by Guo and Cheng  based on API hooking can be used to decrypt and free the damaged data. Thus, when WannaCry infects the host computer through Windows OS, the prototype system records the key information and then decrypts the files. The result in the article shows that the system can decrypt encrypted files. However, the system affects the performance of the operating system and process, which could affect medical system performance. Zheng et al. BIB003 proposed adopting usable security and a decoupled design to develop a sustainable security solution for implantable medical devices to avoid MS17-010 security update vulnerabilities. The advantage of this design is that three critical trade-offs are presented and analyzed in the security design. However, this design is limited by insufficient experiments, and it has not been applied to real applications. For OpenSSH vulnerabilities, Alsaadi et al. BIB005 introduced a penetration testing approach to protect the OpenSSH on Raspberry Pi 2. There are particular restrictions that require additional investigation. First, additional work is required to handle the production environment attack. Second, methods of handling the MITM attack on Raspberry Pi with RaspbianJessie using the pixel OS and NOOBS OS and NOOBS OS need to be investigated. A method of identifying and ranking optimal judgement was introduced by Qian & Bridges BIB004 . In the proposed method, features of malware are automatically extracted from the host logs. The study further demonstrates that the recognition information can be extracted effectively by this method. Future research will be considered in conjunction with other tests. However, this contribution has not led to functioning implementations that accelerate the manual analysis of a log and malware evaluation and provide precise pattern generation from host logs and dynamic analysis tools. Table 2 shows the possible solutions for information collection attacks. 