Jason Jaskolka

Carleton University · Department of Systems and Computer Engineering

The existence and usage of covert channels in systems of communicating agents poses a significant threat to the confidentiality of information. It is difficult to fully prevent the possibility of covert channels in a system without limiting the communication between its components or negatively affecting its behaviour. However, by developing an und...

Safety-critical system domains such as critical infrastructures, aerospace, automotive, and industrial manufacturing and control are becoming increasingly dependent on the use of distributed systems to achieve their functionality. These distributed systems can contain many complex interactions among their constituent components. Despite extensive t...

Assuring the security of software-dependent systems in the face of cyber-attacks and failures is now among the top priorities for governments and providers of electric, financial, communication, and other essential services. Practical and foundational solutions for systematic, secure, and trustworthy system development are needed to support develop...

The existence of security threats in software designs can significantly impact the safe and reliable operation of systems. Threats need to be precisely specified before a tool can manipulate them, and though several approaches for threat specification have been proposed, they do not provide the scalability and flexibility required in practice. We t...

Assuring that security requirements have been met in design phases is less expensive compared with changes after system development. Security-critical systems deployment requires providing security cases demonstrating whether the design adequately incorporates the security requirements. Building arguments and generating evidence to support the clai...

Context and motivation: Many requirements engineering (RE) activities depend not only on the nature of the system itself, but also on human-centric characteristics of the RE teams.Question/problem: What role do human-related factors of RE teams play in eliciting high-quality security requirements?Principal ideas/results: This research preview prese...

Industrial control systems (ICS) have become a focal point for cyberattacks due to the shift from trusted proprietary environments. The now exposed attack surface mandates that ICS be equipped with defenses to prevent or mitigate the impact of potential attacks. Consequently, along with exploring the impact on system mission objectives, impact anal...

The growth in the deployment of Internet of Things (IoT) devices in various industries required the use of IoT platforms to manage, automate and control devices. This introduced different commercial and open source IoT platforms for developers and researchers to deploy. As a result, selecting one of these platforms for a specific application and us...

Complex software systems have become increasingly entwined in a wide variety of systems, such as critical infrastructure, industrial control systems, medical devices, automobiles, airplanes, and spacecraft. Assuring the security and safety, as well as other dependability concerns, such as availability, robustness, and reliability, of software-inten...

Intelligent transportation systems, such as connected vehicles, are able to establish real-time, optimized and collision-free communication with the surrounding ecosystem. Introducing the internet of things (IoT) in connected vehicles relies on deployment of massive scale sensors, actuators, electronic control units (ECUs) and antennas with embedde...

The Mirai botnet revolutionized the idea of IoT botnets by infecting numerous vulnerable IoT devices in 2016, leading to the rise of many Mirai variants and imitators that plague the current IoT ecosystem. Studying the botnet infection process can greatly aid us in understanding IoT botnet capabilities and the efficacy of currently available counte...

Modern smart systems such as those needed for Industry 4.0 integrate data from various sources and increasingly require that data be contextualized with domain knowledge. The integration and contextualization of data allows for the advanced reasoning needed to generate knowledge grounded in the data under consideration. In this paper, we propose an...

Internet of Things (IoT) security is an ongoing and challenging issue. Manufacturers and developers are usually seen as the ones responsible for providing security features for IoT devices. Yet, after the release of the devices and services, their security starts to depend on end users as well. End users have the ability to use various privacy and...

Critical infrastructures consist of numerous components, and even more interactions, many of which may not be expected or foreseen by the system designers. The existence of these so-called implicit interactions indicates design flaws that, if not mitigated, could result in losses of system stability, safety, and security. In this paper, we apply a...

One of the main challenges in engineering secure software systems is the formalization of threats for the automation of security architecture threat detection, analysis, and mitigation. On top of that, there is a growing need for the development of reusable security solutions to support secure systems engineering at early stages of development. We...

Over the years, a number of vulnerability scoring frameworks have been proposed to characterize the severity of known vulnerabilities in software-dependent systems. These frameworks provide security metrics to support decision-making in system development and security evaluation and assurance activities. When used in this context, it is imperative...

Individuals and organizations are more aware than ever of the importance and value of preserving the confidentiality and privacy of sensitive information. However, detecting the leakage of sensitive information in networked systems is still a challenging problem, especially when adversaries use covert channels to exfiltrate sensitive information to...

Implicit interactions refer to those interactions among the components of a system that may be unintended and/or unforeseen by the system designers. As such, they represent cybersecurity vulnerabilities that can be exploited to mount cyber-attacks causing serious and destabilizing system effects. In this paper, we study implicit interactions in dis...

The development of distributed computing systems involves complex concerns related to integrating numerous communication styles, technologies (Internet of Things, cloud, big data, etc.), stakeholders (architects, developers, integrators, etc.) and addressing a multitude of application domains (smart cities, health, mobility, etc.). Existing archite...

Communicating Concurrent Kleene Algebra (C²KA) is a mathematical framework for capturing the communicating and concurrent behaviour of agents in distributed systems. It extends Hoare et al.'s Concurrent Kleene Algebra (CKA) with communication actions through the notions of stimuli and shared environments. C²KA has applications in studying system-le...

Building distributed computing systems involves complex concerns integrating a multitude of communication styles, technologies (IoT, cloud, big data, etc.), stake- holders (architects, developers, integrators, etc.) and addressing a multitude of application domains (smart cities, health, mobility, etc.). Existing architectural description languages...

The modern energy sector depends on advanced metering infrastructure (AMI) systems responsible for gathering, measuring, and analyzing enormous amounts of energy consumption information to make important decisions related to energy services including billing, monitoring, distribution, load balancing, and more. However, the introduction and integrat...

Modern distributed systems and networks, like those found in cyber-physical system domains such as critical infrastructures, contain many complex interactions among their constituent software and/or hardware components. Despite extensive testing of individual components, security vulnerabilities resulting from unintended and unforeseen component in...

Model-Based Development (MBD) has been gaining traction in the development of embedded software in many industries, especially in safety-critical domains. The models are typically described using domain-specific languages and tools that are readily accessible to the domain experts. Consequently, domain experts, despite not having formal software en...

As the world enters the age of "big data", new ways to represent and reason on enormous amounts of data are demanded and expected. Work in developing ontologies and reasoning approaches have taken steps towards addressing these needs. However, ontology development is not usually perceived as an engineering activity. Developers often overlook fundam...

Over the last decade, the world has entered into the age of “big data” and new ways to represent and reason on enormous amounts of data are required. Work in developing ontologies and sophisticated reasoning approaches partly addresses these needs. However, ontology development is currently more of an art than an engineering activity. Fundamental q...

With the ubiquity and pervasiveness of computers in daily activities and with the ever-growing complexity of communication networks and protocols, covert channels are becoming an eminent threat to the confidentiality of information. In light of this threat, we propose a technique to detect confidential information leakage via protocol-based covert...

The rapid transition to cloud-based infrastructures has introduced a number of uncharted risks, threats, and challenges that are faced by security experts. In particular, concerns surrounding the confidentiality of information in cloud-based systems and the existence of covert communication channels ought to be addressed. In this paper, we outline...

Covert channels are means of communication that allow agents in a system to transfer information in a manner that violates the system's security policy. Covert channels have been well studied in the constrained and old sense of the term where two agents are communicating through a channel while an intruder interferes to hide the transmission of a m...

An integral part of safeguarding systems of communicating agents from covert channel communication is having the ability to identify when a covert channel may exist in a given system and which agents are more prone to covert channels than others. In this paper, we propose a formulation of one of the necessary conditions for the existence of covert...

This is Part II in a two-part series discussing the development of investigative support for information confidentiality. In Part I, we proposed a technique based on relation algebra to detect confidential information leakage via protocol-based covert channels. In this paper, we continue developing investigative support for information confidential...

This is Part I in a two-part series discussing the development of investigative support for information confidentiality. In this paper, we propose a technique to detect confidential information leakage via protocol-based covert channels based on relation algebra. It provides tests to verify the existence of an information leakage via a monitored co...

Communication is integral to the understanding of agent interactions in concurrent systems. In this paper, we propose a mathematical framework for communication and concurrency called Communicating Concurrent Kleene Algebra (C2KA). C2KA supports the ability to work in either a state-based or event-based model for the specification of concurrent and...

When modeling families of ambient systems, we experience a number of special challenges due to unpredictable variability in the environments of the systems. One solution to deal with these challenges is to adapt aspect-oriented technology to product family modeling. In this paper, we propose a new language AO-PFA, which adapts the aspect-oriented p...

Communication is integral to the understanding of agent interactions in concurrent systems. In this paper, we propose a mathematical framework for communication and concurrency called Communicating Concurrent Kleene Algebra (C2KA). C2KA supports the ability to work in either a state-based or event-based model for the specification of concurrent and...

Crosscutting concerns are pervasive in embedded software and ambient systems due to the stringent non-functional requirements imposed on them. Maintaining families of these systems to address issues with the crosscutting concerns, such as security concerns, is recognised to be tedious and costly. To tackle the above problem, we adapt the aspect-ori...

Aspect-orientation is a paradigm for managing the separation of crosscutting concerns and decomposing a system using more than one criterion. This paper proposes an aspect-oriented approach at the feature-modeling level to better handle crosscutting concerns in the modeling of product families of ambient systems.Based on the specification language o...

With the ability to leak confidential information in a secret manner, covert channels pose a significant threat to the confidentiality of a system. Due to this threat, the identification of covert channel existence has become an important part of the evaluation of secure systems. In this paper, we present a state-of-the-art survey discussing the condit...

Aspect-orientation is a promising paradigm for managing the separation of crosscutting concerns and decomposing a system using more than one criterion. This paper proposes an aspect-oriented approach at the feature-modeling level to better handle crosscutting concerns in product families. The implementation of some features of a product family can...

With the emergence of computers in every day activities and with the ever-growing complexity of networks and network communication protocols, covert channels are becoming an eminent threat to the confidentiality of information. We propose a technique to detect confidential information leakage via covert channels. The proposed technique is based on...

With the emergence of computers in every day activities and with the ever-growing complexity of networks and network communication protocols, covert channels are becoming an eminent threat to the confidentiality of information. In light of this threat, we propose a technique to detect confidential information leakage via covert channels. Although s...

Covert channels pose a threat to system security for many reasons. One of the most significant security concerns surrounding the use of covert channels in computer and information systems involves confidentiality and the ability to leak confidential information from a high level security user to a low level one covertly. There are many differing vi...

With the emergence of computers in every day activities and with the ever-growing complexity of networks and network protocols, covert channels are becoming an eminent threat to confidentiality of information. With increasing sensitivity of data in many computer application domains, the leakage of confidential information can have severe repercussi...

In this chapter, we present a structure to specify agent explicit knowledge based on information algebra. We define in the context of agent knowledge the combining, marginalizing, and labelling operators. Also, we define remove and frame substitution operator. These operators are all what is needed to express operations on agent explicit knowledge....

Analyzing information flow is beneficial for ensuring the satisfiability of security policies during the exchange of information between the agents of a system. In the literature, models such as Bell-LaPadula model and the Chinese Wall model are proposed to capture and govern the exchange of information among agents. Also, we find several verificat...

Analyzing information flow is beneficial on ensuring the satisfiability of secu- rity policies during the exchange of information between the agents of a system. In the literature, models such as Bell-LaPadula model and the Chinese Wall model are proposed to capture and govern the exchange of information among agents. Also, we find several verifica...

Cryptographic protocols are widely used in various applications to provide secure communications. They are usually represented as communicating agents that send and receive messages. These agents use their knowledge to exchange information and communicate with other agents involved in the protocol. An agent knowledge can be partitioned into explici...