Vulnerability Analysis in Network Infrastructure: A Systematic Literature Review
Article Sidebar
Main Article Content
Abstract
With the advancement of the digital era, organizations have experienced an increasing dependence on information and communication technologies. This increase in connectivity has led to an increase in cyber attacks on network infrastructures, putting critical assets and data at risk. This article develops a systematic literature review on the analysis of network infrastructure vulnerabilities in the last 10 years, using the IEEE, SCOPUS and Redalyc databases for the review process. It was determined that the most widely used method was traffic analysis, and the most widely used technique was network protocol fuzzing. The analysis of vulnerabilities on network protocols predominated and, therefore, the analysis of the service component. The analysis of vulnerabilities in network infrastructures is a research area that has little scientific documentation published in the last 10 years, requiring special attention in the industrial field, as well as further research in emerging areas such as the Internet of Things, artificial intelligence and cloud computing.
Downloads
Article Details
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
1. Derechos de autor
Las obras que se publican en 593 Digital Publisher CEIT están sujetas a los siguientes términos:
1.1. 593 Digital Publisher CEIT, conserva los derechos patrimoniales (copyright) de las obras publicadas, favorece y permite la reutilización de las mismas bajo la licencia Licencia Creative Commons 4.0 de Reconocimiento-NoComercial-CompartirIgual 4.0, por lo cual se pueden copiar, usar, difundir, transmitir y exponer públicamente, siempre que:
1.1.a. Se cite la autoría y fuente original de su publicación (revista, editorial, URL).
1.1.b. No se usen para fines comerciales u onerosos.
1.1.c. Se mencione la existencia y especificaciones de esta licencia de uso.
Edison Mauricio Cornejo-Jiménez , Pontificia Universidad Católica del Ecuador Sede Ambato - Ecuador
https://orcid.org/0009-0000-8735-3420
Computer Systems and Informatics Engineer and Master's student in Cybersecurity at Pontifical Catholic University of Ambato. Software Developer since 2023 for a frozen vegetable exporting company. Trained in networking, with two levels of CCNA completed.
David Omar Guevara-Aulestia , Pontificia Universidad Católica del Ecuador Sede Ambato - Ecuador
https://orcid.org/0000-0002-0410-4398
Systems engineer
Master in Networks and Telecommunications
References
Akpinar, K. O., & Ozcelik, I. (2019). Analysis of Machine Learning Methods in EtherCAT-Based Anomaly Detection. IEEE Access, 7, 184365-184374. Scopus. https://doi.org/10.1109/ACCESS.2019.2960497
Alabady, S. A., Al-Turjman, F., & Din, S. (2020). A Novel Security Model for Cooperative Virtual Networks in the IoT Era. International Journal of Parallel Programming, 48(2), 280-295. Scopus. https://doi.org/10.1007/s10766-018-0580-z
Alarood, A., Ibrahim, A., & Alsubaei, F. (2023). Attacks Notification of Differentiated Services Code Point (DSCP) Values Modifications. IEEE Access, 11, 126950-126966. https://doi.org/10.1109/ACCESS.2023.3332119
Alhaidary, M., Rahman, S. M. M., Zakariah, M., Shamim Hossain, M., Alamri, A., Haque, M. S. M., & Gupta, B. B. (2018). Vulnerability Analysis for the Authentication Protocols in Trusted Computing Platforms and a Proposed Enhancement of the OffPAD Protocol. IEEE Access, 6, 6071-6081. Scopus. https://doi.org/10.1109/ACCESS.2017.2789301
Álvarez, Y., Leguizamón, M., & Londoño, T. (2021). Risks and security solutions existing in the Internet of things (IoT) in relation to Big Data. Ingeniería y Competitividad, 23, 1-13.
Astudillo, C., Carvajal, F., Carvallo, J., Crespo, E., Orellana, M., & Vintimilla, R. (2018). Acometer contra un ERP con Software Libre. Enfoque UTE, 9, 138-148.
Brereton, P., Kitchenham, B. A., Budgen, D., Turner, M., & Khalil, M. (2007). Lessons from applying the systematic literature review process within the software engineering domain. Journal of Systems and Software, 80(4), 571-583. https://doi.org/10.1016/j.jss.2006.07.009
CISCO. (2023). What Is Network Infrastructure? Cisco. https://www.cisco.com/c/en/us/solutions/enterprise-networks/what-is-network-infrastructure.html
Codina, L. (2019, octubre 30). Scopus: Caracterización y guía de uso avanzado · Preparación, búsqueda y exportación de resultados. Lluís Codina. https://www.lluiscodina.com/scopus-analisis-guia-utilizacion/
Cueva, M., & Alvarado, D. (2017). Análisis de Certificados SSL/TLS gratuitos y su implementación como Mecanismo de seguridad en Servidores de Aplicación. Enfoque UTE, 8, 273-286.
Deola, E. (2023, febrero 4). Ataque Wanna Cry: La importancia de disponer de sistemas de seguridad actualizados. FlashStart. https://flashstart.com/es/el-ataque-wannacry-de-2017/
Fortra. (2022). Qué es el escaneo de vulnerabilidades y cómo funciona | Fortra Blog. https://www.fortra.com/es/blog/escaneo-vulnerabilidades
Gábor, L., & Sándor, R. (2014). Improving the Performance and Security of the TOTD DNS64 Implementation. Journal of Computer Science and Technology, 14, 9-15.
IBM Security. (2023). Cost of a Data Breach Report 2023. https://www.ibm.com/downloads/cas/E3G5JMBP
Ierardi, C., Orihuela, D. L., Jurado, I., Rodríguez, Á., & Tapia, A. (2017). Revisión sistemática de la literatura en ingeniería de sistemas. Caso práctico: Técnicas de estimación distribuida de sistemas ciberfísicos. Actas de las XXXVIII Jornadas de Automática, 2017, ISBN 978-84-16664-74-0, págs. 84-91, 84-91. https://dialnet.unirioja.es/servlet/articulo?codigo=6591559
Jacklin, B. (2024, febrero 21). AI Technology is Invaluable for Cybersecurity. Https://Www.Smartdatacollective.Com/. https://www.smartdatacollective.com/ai-technology-is-invaluable-for-cybersecurity/
Kholidy, H. (2022). Multi‐layer attack graph analysis in the 5g edge network using a dynamic hexagonal fuzzy method. Sensors, 22(1). Scopus. https://doi.org/10.3390/s22010009
Kim, H., Hwang, E., Kim, D., Cho, J., Moore, T. J., Nelson, F. F., & Lim, H. (2023). Time-Based Moving Target Defense Using Bayesian Attack Graph Analysis. IEEE Access, 1-1. Scopus. https://doi.org/10.1109/ACCESS.2023.3269018
Kubecka, M. (2020). Practical Cybersecurity Architecture: A guide to creating and implementing robust designs for cybersecurity architects (Packt Publishing).
Kumar, B. K., Raj, N., Dhivvya, J., & Muralidharan, D. (2019). Fixing Network Security Vulnerabilities in Local Area Network. 2019 3rd International Conference on Trends in Electronics and Informatics (ICOEI), 1349-1354. https://doi.org/10.1109/ICOEI.2019.8862634
Li, J., Zhao, B., & Zhang, C. (2018). Fuzzing: A survey. Cybersecurity, 1(1), 6. https://doi.org/10.1186/s42400-018-0002-y
Limones, E. (2022, septiembre 23). Análisis de vulnerabilidades informáticas [Blog]. OpenWebinars.net. https://openwebinars.net/blog/analisis-de-vulnerabilidades-informaticas/
Luo, J., Shan, C., Cai, J., & Liu, Y. (2018). IoT application-layer protocol vulnerability detection using reverse engineering. Symmetry, 10(11). Scopus. https://doi.org/10.3390/sym10110561
Marcillo, M. P., Marcillo, J. C., Ortiz, M. M., & Mero, E. A. (2021). Análisis de las Herramientas y Técnicas utilizadas en prueba de penetración para la detección de vulnerabilidades en aplicaciones web. UNESUM - Ciencias. Revista Científica Multidisciplinaria, 5(1), Article 1. https://doi.org/10.47230/unesum-ciencias.v5.n3.2021.316
Milani, S., & Chatzigiannakis, I. (2021). Design, analysis, and experimental evaluation of a new secure rejoin mechanism for lorawan using elliptic-curve cryptography. Journal of Sensor and Actuator Networks, 10(2). Scopus. https://doi.org/10.3390/JSAN10020036
Molina, Y., & Orozco, L. G. (2020). Vulnerabilidades de los Sistemas de Información: Una revisión. https://dspace.tdea.edu.co/handle/tdea/1398
Navarro, G. (2011). Introducción a las vulnerabilidades. Universitat Oberta de Catalunya.
Nebbione, G., & Calzarossa, M. (2023). A Methodological Framework for AI-Assisted Security Assessments of Active Directory Environments. IEEE Access, 11, 15119-15130. Scopus. https://doi.org/10.1109/ACCESS.2023.3244490
Pando, F. (2023, junio 22). Haz un análisis de vulnerabilidades para tu empresa; cajas blanca y negra. IT Masters Mag. https://www.itmastersmag.com/noticias-analisis/analisis-de-vulnerabilidades-cual-es-su-importancia/
Pastorino, C. (2017). Aclarando KRACK Attack, la vulnerabilidad descubierta en WPA2. Welivesecurity. https://www.welivesecurity.com/la-es/2017/10/27/aclarando-krack-attack-wpa2/
Peng, Y. (2023). Research on the Technology of Computer Network Security Protection. Journal of Applied Data Sciences, 4(1), Article 1. https://doi.org/10.47738/jads.v4i1.80
Ramírez, G. A. (2023). Seguridad en desarrollo web: Mejores prácticas para proteger aplicaciones y datos. Dominio de las Ciencias, 9(3), Article 3. https://doi.org/10.23857/dc.v9i3.3552
Rouse, M. (2023, octubre 30). Network Infrastructure. Techopedia. https://www.techopedia.com/definition/16955/network-infrastructure
Sánchez, F., Martínez, J. E., & Téllez, A. (2022). La seguridad en el ciberespacio desde una perspectiva sociocultural. methaodos.revista de ciencias sociales, 10(2), Article 2. https://doi.org/10.17502/mrcs.v10i2.577
Shastry, B., Leutner, M., Fiebig, T., Thimmaraju, K., Yamaguchi, F., Rieck, K., Schmid, S., Seifert, J., & Feldmann, A. (2017). Static Program Analysis as a Fuzzing Aid. En M. Polychronakis, M. Antonakakis, M. Dacier, & M. Bailey (Eds.), Lect. Notes Comput. Sci.: Vol. 10453 LNCS (pp. 26-47). Springer Verlag; Scopus. https://doi.org/10.1007/978-3-319-66332-6_2
SolarWinds. (2023). What Is Network Infrastructure? All About Network Infrastructure - IT Glossary. https://www.solarwinds.com/resources/it-glossary/network-infrastructure
Zhang, Z., Zhang, H., Zhao, J., & Yin, Y. (2023). A Survey on the Development of Network Protocol Fuzzing Techniques. Electronics (Switzerland), 12(13). Scopus. https://doi.org/10.3390/electronics12132904
Zolanvari, M., Teixeira, M. A., Gupta, L., Khan, K. M., & Jain, R. (2019). Machine Learning-Based Network Vulnerability Analysis of Industrial Internet of Things. IEEE Internet of Things Journal, 6(4), 6822-6834. Scopus. https://doi.org/10.1109/JIOT.2019.2912022