Cybersecurity Challenge

2023 Statements

CS01: Lightweight Security Gateway for IP-based camera and Network Video Recorders (NVR)

Challenge

Lightweight defence to prevent exploitation of IP-based camera and NVR vulnerabilities.

Background

IP-based CCTV cameras and NVR typically use web servers for serving H.264/H.265 video encoders and web-based management interface, which in turn receives HTTP and RTSP requests. Zero-day and unpatched security vulnerabilities in web servers and web applications such as improper authorisation, buffer overflow, and arbitrary code execution, can therefore be exploited (e.g using maliciously crafted HTTP/RTSP requests). Cameras and NVRs are typically deployed at edge networks situated near the physical area under video surveillance, hence not protected by Web Application Firewalls (WAF) in data centres.

Requirements

The solution should contain, but not limited to the following:

1. Develop lightweight defences that can be deployed in edge networks to detect and prevent exploitation of IP-based camera and NVR vulnerabilities (E.g using malicious HTTP and RTSP requests).

Limitations

Expand the usage of Web Application Firewalls (WAF) to edge networks is currently not feasible due to costs and physical space constraints. In addition, WAF does not detect malicious injections like Real Time Streaming Protocol (RTSP) headers and payloads.

Cybersecurity Challenge

2023 Statements

CS03: Bot Traffic Detection

Challenge

To build a machine learning model that can accurately detect online and offline bot traffic in event tracking data while adhering to privacy requirements for the e commerce industry.

Background

Bot usage has given rise to and enabled a variety of automated threats that pose risks to businesses, for instance, payment fraud, voucher abuse, ads fraud, data scraping and credential stuffing attacks. Bot traffic can also lead to misleading event tracking data, as it is mixed with real human behaviour, resulting in poor-quality and inaccurate data that hinders decision-making by businesses.

There are three types of attack scenarios, 1) Credential Stuffing, 2) Mass Collection of Vouchers and 3) Web Scraping. In credential stuffing, the attacker will obtain the account name and password from the dark web and perform a mass login test. Once successful, they can request refund and transfer the money from the customer’s e-wallet to other accounts. They can also utilise customer accounts that have credit card information to place orders and then re-sell the products on other e-commerce platforms. Next, in mass collection of vouchers attacks, attackers will use bots to create multiple new accounts to collect vouchers and make purchases at discounted prices. The attackers can resell the merchandise at a slightly lower price on another e-commerce site to gain financial benefits. In web scraping attacks, attackers will use bots to extract large amount of content and data from a website. Competitors can use this information to understand what the best-selling products are (e.g., from users’ reviews or items sold), or what new products are coming. This will allow competitors to adapt their strategy or even identify the victim’s suppliers, affecting sales.

While the industry currently deploys both real-time and offline measures to detect bot traffic and mitigate threats, there is no industry-wide, standardised solution to detect offline bot traffic in event tracking data. Privacy requirements that limit the available data points pose additional challenges for the development of solutions targeted at bot traffic detection.

Requirements

The solution should contain, but not limited to the following:

1. Be able to leverage browse and click data to detect bot traffic in an offline environment, with real-time detection ability a bonus
2. Provide either a unified or different models applicable to PC, app, and PWA
3. The models should have a high accuracy and coverage rate, and they will be compared with the insights metrics of organizations with similar business strategies.
4. To be accurate, the machine model must be trained in the e-commerce environment utilizing different scenarios and models.
5. Various business matrices will be offered to solution providers to assess the accuracy of the detection.

Limitations

Total data volume is over 1 billion records per day, so efficiency in the model’s ability to process high data volumes is critical.

For the start due to the sensitive of the data extracted from voucher attack. We will start with the data scrapping attack first. This kind of attack is normally conducted via highly skilled ecommerce competitors.