Computer Sciences Commons^™

Forensic Analysis Of Immersive Virtual Reality Social Applications: A Primary Account, Ananya Yarramreddy, Peter Gromkowski, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

Our work presents the primary account for exploring the forensics of immersive Virtual Reality (VR) systems and their social applications. The Social VR applications studied in this work include Bigscreen, Altspace VR, Rec Room and Facebook Spaces. We explored the two most widely adopted consumer VR systems: the HTC Vive and the Oculus Rift. Our tests examined the efficacy of reconstructing evidence from network traffic as well as the systems themselves. The results showed that a significant amount of forensically relevant data such as user names, user profile pictures, events, and system details may be recovered. We anticipate that this …

Exploring Confidentiality Issues In Hyperledger Fabric Business Applications, Shivam Bajpayi, Pedro Moreno-Sanchez, Donghang Lu, Sihao Yin

The Summer Undergraduate Research Fellowship (SURF) Symposium

The rise of Bitcoin and cryptocurrencies over the last decade have made its underlying technology (blockchain) come into the spotlight. Blockchain is a secure ledger of linked records called blocks. These records are cryptographically immutable and any tampering with the block is evident through a change in the cryptographic signature of the block. Among the blockchains deployed in practice today, Hyperledger Fabric is a platform that allows businesses to make use of blockchains in their applications. However, confidentiality issues arise with respects to the blocks in this blockchain network due to the fact that blocks might contain sensitive information accessible …

Regular Lossy Functions And Their Applications In Leakage-Resilient Cryptography, Yu Chen, Baodong Qin, Haiyang Xue

Research Collection School Of Computing and Information Systems

In STOC 2008, Peikert and Waters introduced a powerful primitive called lossy trapdoor functions (LTFs). In a nutshell, LTFs are functions that behave in one of two modes. In the normal mode, functions are injective and invertible with a trapdoor. In the lossy mode, functions statistically lose information about their inputs. Moreover, the two modes are computationally indistinguishable. In this work, we put forward a relaxation of LTFs, namely, regular lossy functions (RLFs). Compared to LTFs, the functions in the normal mode are not required to be efficiently invertible or even unnecessary to be injective. Instead, they could also be …

Server-Aided Attribute-Based Signature With Revocation For Resource-Constrained Industrial-Internet-Of-Things Devices, Hui Cui, Robert H. Deng, Joseph K. Liu, Xun Yi, Yingjiu Li

Research Collection School Of Computing and Information Systems

The industrial Internet-of-things (IIoT) can be seen as the usage of Internet-of-things technologies in industries, which provides a way to improve the operational efficiency. An attribute-based signature (ABS) has been a very useful technique for services requiring anonymous authentication in practice, where a signer can sign a message over a set of attributes without disclosing any information about his/her identity, and a signature only attests to the fact that it is created by a signer with several attributes satisfying some claim predicate. However, an ABS scheme requires exponentiation and/or pairing operations in the signature generation and verification algorithms, and hence, …

Anonymous Privacy-Preserving Task Matching In Crowdsourcing, Jiangang Shu, Ximeng Liu, Xiaohua Jia, Kan Yang, Robert H. Deng

Research Collection School Of Computing and Information Systems

With the development of sharing economy, crowdsourcing as a distributed computing paradigm has become increasingly pervasive. As one of indispensable services for most crowdsourcing applications, task matching has also been extensively explored. However, privacy issues are usually ignored during the task matching and few existing privacy-preserving crowdsourcing mechanisms can simultaneously protect both task privacy and worker privacy. This paper systematically analyzes the privacy leaks and potential threats in the task matching and proposes a single-keyword task matching scheme for the multirequester/multiworker crowdsourcing with efficient worker revocation. The proposed scheme not only protects data confidentiality and identity anonymity against the crowd-server, …

Lightweight Break-Glass Access Control System For Healthcare Internet-Of-Things, Yang Yang, Ximeng Liu, Robert H. Deng

Research Collection School Of Computing and Information Systems

Healthcare Internet-of-things (IoT) has been proposed as a promising means to greatly improve the efficiency and quality of patient care. Medical devices in healthcare IoT measure patients' vital signs and aggregate these data into medical files which are uploaded to the cloud for storage and accessed by healthcare workers. To protect patients' privacy, encryption is normally used to enforce access control of medical files by authorized parties while preventing unauthorized access. In healthcare, it is crucial to enable timely access of patient files in emergency situations. In this paper, we propose a lightweight break-glass access control (LiBAC) system that supports …

Pusc: Privacy-Preserving User-Centric Skyline Computation Over Multiple Encrypted Domains, Ximeng Liu, Kim-Kwang Raymond Choo, Robert H. Deng, Yang Yang

Research Collection School Of Computing and Information Systems

In this paper, we present a new privacy-preserving user-centric skyline computation framework over different encrypted domains, which we referred to as PUSC. With PUSC, a user can flexibly obtain the skyline set from different service providers without disclosing user preferences to third parties in the system. Specifically, we introduce a secure user-defined vector dominance protocol to compare the vector dominance relationship between two encrypted vectors, according to user's preference. This serves as the core protocol in PUSC. Detailed security analysis shows that the proposed PUSC achieves the goal of selecting skyline set according to authorized users' preferences without leaking their …

Privacy-Preserving Biometric-Based Remote User Authentication With Leakage Resilience, Yangguang Tian, Yingjiu Li, Rongmao Chen, Ximeng Liu, Bing Chang, Xingjie Yu

Research Collection School Of Computing and Information Systems

Biometric-based remote user authentication is a useful primitive that allows an authorized user to authenticate to a remote server using his biometrics. Leakage attacks, such as side-channel attacks, allow an attacker to learn partial knowledge of secrets (e.g., biometrics) stored on any physical medium. Leakage attacks can be potentially launched to any existing biometric-based remote user authentication systems. Furthermore, applying plain biometrics is an efficient and straightforward approach when designing remote user authentication schemes. However, this approach jeopardises user’s biometrics privacy. To address these issues, we propose a novel leakage-resilient and privacy-preserving biometric-based remote user authentication framework, such that registered …

State Measurement Spoofing Prevention Through Model Predictive Control Design, Helen Durand

Chemical Engineering and Materials Science Faculty Research Publications

Security of chemical process control systems against cyberattacks is critical due to the potential for injuries and loss of life when chemical process systems fail. A potential means by which process control systems may be attacked is through the manipulation of the measurements received by the controller. One approach for addressing this is to design controllers that make manipulating the measurements received by the controller in any meaningful fashion very difficult, making the controllers a less attractive target for a cyberattack of this type. In this work, we develop a model predictive control (MPC) implementation strategy that incorporates Lyapunov-based stability …

Formal Verification Of A Modern Boot Loader, Scott D. Constable, Rob Sutton, Arash Sahebolamri, Steve Chapin

Electrical Engineering and Computer Science - Technical Reports

We introduce the Syracuse Assured Boot Loader Executive (SABLE), a trustworthy secure loader. A trusted boot loader performs a cryptographic measurement (hash) of program code and executes it unconditionally, allowing later-stage software to verify the integrity of the system through local or remote attestation. A secure loader differs from a trusted loader in that it executes subsequent code only if measurements of that code match known-good values. We have applied a rigorous formal verification technique recently demonstrated in practice by NICTA in their verification of the seL4 microkernel. We summarize our design philosophy from a high level and present our …

Welcoming Remarks From The Ijcic Honorary Editor, Peter Grabosky

International Journal of Cybersecurity Intelligence & Cybercrime

No abstract provided.

The Present And Future Of Cybercrime, Cyberterrorism, And Cybersecurity, Kyung-Shick Choi, Claire Seungeun Lee

International Journal of Cybersecurity Intelligence & Cybercrime

Cybercriminology combines knowledge from criminology, psychology, sociology, computer science, and cybersecurity to provide an in-depth understanding of cybercrime. Cybercrime and cybersecurity are interconnected across many places, platforms, and actors. Cybercrime issues are continuously and expeditiously changing and developing, especially with the advent of new technologies. The International Journal of Cybersecurity Intelligence and Cybercrime (IJCIC) aims to contribute to the growing field of cybercriminology and cybersecurity. The IJCIC is eager to work with scholars, policy analysts, practitioners, and others to enhance theory, methods, and practice within cybercrime and cybersecurity at the regional, national, and international levels.

Juvenile Hackers: An Empirical Test Of Self-Control Theory And Social Bonding Theory, Sinchul Back, Sadhika Soor, Jennifer Laprade

International Journal of Cybersecurity Intelligence & Cybercrime

In accordance with a similar growth in information technology, computer hacking has become a pervasive issue as a form of crime worldwide in recent years. Self-control theory and social bonding theory have frequently been employed to explain various types of crimes, but rarely to explore computer hacking. Drawing from Gottfredson and Hirschi’s (1990) self-control theory and Hirschi’s (1969) social bonding theory, the purpose of this study is to empirically examine the suitability of these two theories in explaining juvenile computer hacking offenses. The self-report survey data utilized for the present study was derived from middle school and high school students …

Architecture Of Aggression In Cyberspace. Testing Cyber Aggression In Young Adults In Hungary, Katalin Parti, Tibor Kiss, Gergely Koplányi

International Journal of Cybersecurity Intelligence & Cybercrime

In order to test whether and how violence is exacerbated in online social networking sites, we utilized the BryantSmith Aggression Scale (Bryant & Smith, 2001), and included examples in the questionnaire offering solutions for 7 different hypothetical cases occurring online (Kiss, 2017). The questionnaire was sent to social work and law school students in Hungary. Prevalence and levels of aggression and its manifestation as violence online proved to be not more severe than in offline social relations. Law students were more aware than students of social work that online hostile acts are discrediting. Students of social work were significantly more …

An Argument For Interdisciplinary Programs In Cybersecurity, Dennis Giever

International Journal of Cybersecurity Intelligence & Cybercrime

In this commentary Dr. Giever presents a compelling argument for interdisciplinary programs in cybersecurity at the university level. He argues that we no longer have the luxury of allowing barriers to exist between those tasked with IT security and those who provide physical security. He recommends that any security program take an “all possible paths” or “balanced approach” to the protection of assets within an organization. Students in computer science, criminal justice, business, human resources, and others should work collaboratively within education programs learning these necessary skills. A team effort is needed to accomplish the myriad of tasks necessary to …

Privacy-Preserving Photo Taking And Accessing For Mobile Phones, Ang Li

Graduate Theses and Dissertations

Today, we are living in environments that are full of cameras embedded in devices such as smart phones and wearables. These mobile devices and as well as apps installed on them are designed to be extremely convenient for users to take, store and share photos. In spite of the convenience brought by ubiquitous cameras, users' privacy may be breached through photos that are taken and stored with mobile devices. For example, when users take a photo of a scenery, a building or a target person, a stranger may also be unintentionally captured in the photo. Such photos expose the location …

Spreading Propaganda In Cyberspace: Comparing Cyber-Resource Usage Of Al Qaeda And Isis, Kyung-Shick Choi, Claire Seungeun Lee, Robert Cadigan

International Journal of Cybersecurity Intelligence & Cybercrime

Terrorists in cyberspace are increasingly utilizing social media to promote their ideologies, recruit new members, and justify terrorist attacks and actions. This study explores the ways in which types of social media, message contents, and motives for spreading propaganda take shape in cyberspace. In order to empirically test these relations, we created a dataset with annual terrorism reports from 2011 to 2016. In our global cyberterrorism dataset, we used and connected cyber-resources (Facebook, online forum, Twitter mentions, websites, and YouTube videos) and legal documents of individual cases that were mentioned in the reports. The results show that YouTube videos were …

Building Test Anonymity Networks In A Cybersecurity Lab Environment, John Schriner

Student Theses

This paper explores current methods for creating test anonymity networks in a laboratory environment for the purpose of improving these networks while protecting user privacy. We first consider how each of these networks is research-driven and interested in helping researchers to conduct their research ethically. We then look to the software currently available for researchers to set up in their labs. Lastly we explore ways in which digital forensics and cybersecurity students could get involved with these projects and look at several class exercises that help students to understand particular attacks on these networks and ways they can help to …

Practical Attribute-Based Multi-Keyword Search Scheme In Mobile Crowdsourcing, Yinbin Miao, Jianfeng Ma, Ximeng Liu, Xinghua Li, Zhiquan Liu, Hui Li

Research Collection School Of Computing and Information Systems

Cloud-based mobile crowd-sourcing has been an attractive solution to provide data storage and share services for resource-limited mobile devices in a privacy-preserving manner, but how to enable mobile users to issue search queries and achieve fine-grained access control over ciphertexts simultaneously is still a big challenge for various circumstances. Although the ciphertext-policy attribute-based keyword search technology combining attribute-based encryption with searchable encryption has become a hot research topic, it just deals with equivalent attributes rather than more practical attribute comparisons, like “greater than” or “less than.” In this paper, we devise a practical cryptographic primitive called attribute-based multi-keyword search scheme …

Secure And Efficient Outsourcing Of Large-Scale Overdetermined Systems Of Linear Equations, Shiran Pan, Wen-Tao Zhu, Qiongxiao Wang, Bing Chang

Research Collection School Of Computing and Information Systems

We address overdetermined systems of linear equations, where the number of unknowns is smaller than the number of equations so that only approximate solutions exist instead of exact solutions. Such systems are prevalent in many areas of science and engineering, and finding the optimal solutions is mathematically known as the linear least squares (LLS) problem. Real-world overdetermined systems are often large-scale and computationally expensive to solve. Consequently, we are interested in connecting the LLS problem with cloud computing, where a resource-constrained client outsources the problem to a powerful but untrusted cloud. Among several security considerations is that the input of …

An Exploratory Study Of Organizational Security Risk Management For Improved Effectiveness, Angela Jackson-Summers

Doctor of Business Administration Dissertations

Information technology executives continue to have concerns about information security (Kappelman, McLean, Johnson, & Torres, 2016) and the increasing rate of information security threats facing organizations (Ponemon Institute, 2017). This exploratory study aimed to take a closer look at the organizational security risk management process for improved effectiveness, and its integral role among other organizational processes. Two research questions were addressed by identifying organizational drivers to security risk management effectiveness, and by determining challenges to achieving organizational security risk management effectiveness. Using the resource-based view theory (RBV), and Carnegie Mellon University’s Software Engineering Institute Capability Maturity Model Integration …

Data Center Application Security: Lateral Movement Detection Of Malware Using Behavioral Models, Harinder Pal Singh Bhasin, Elizabeth Ramsdell, Albert Alva, Rajiv Sreedhar, Medha Bhadkamkar

SMU Data Science Review

Data center security traditionally is implemented at the external network access points, i.e., the perimeter of the data center network, and focuses on preventing malicious software from entering the data center. However, these defenses do not cover all possible entry points for malicious software, and they are not 100% effective at preventing infiltration through the connection points. Therefore, security is required within the data center to detect malicious software activity including its lateral movement within the data center. In this paper, we present a machine learning-based network traffic analysis approach to detect the lateral movement of malicious software within the …

Social Engineering In Non-Linear Warfare, Bill Gardner

Journal of Applied Digital Evidence

This paper explores the use of hacking, leaking, and trolling by Russia to influence the 2016 United States Presidential Elections. These tactics have been called “the weapons of the geek” by some researchers. By using proxy hackers and Russian malware to break into the email of the Democratic National Committee and then giving that email to Wikileaks to publish on the Internet, the Russian government attempted to swing the election in the favor of their preferred candidate.

The source of the malware used in the DNC hack was determined to be of Russian in nature and has been used on …

Experiential Learning Builds Cybersecurity Self-Efficacy In K-12 Students, Abdullah Konak

Journal of Cybersecurity Education, Research and Practice

In recent years, there have been increased efforts to recruit talented K-12 students into cybersecurity fields. These efforts led to many K-12 extracurricular programs organized by higher education institutions. In this paper, we first introduce a weeklong K-12 program focusing on critical thinking, problem-solving, and igniting interest in information security through hands-on activities performed in a state-of-the-art virtual computer laboratory. Then, we present an inquiry-based approach to design hands-on activities to achieve these goals. We claim that hands-on activities designed based on this inquiry-based framework improve K-12 students’ self-efficacy in cybersecurity as well as their problem-solving skills. The evaluation of …

Student Misconceptions About Cybersecurity Concepts: Analysis Of Think-Aloud Interviews, Julia D. Thompson, Geoffrey L. Herman, Travis Scheponik, Linda Oliva, Alan Sherman, Ennis Golaszewski, Dhananjay Phatak, Kostantinos Patsourakos

Journal of Cybersecurity Education, Research and Practice

We conducted an observational study to document student misconceptions about cybersecurity using thematic analysis of 25 think-aloud interviews. By understanding patterns in student misconceptions, we provide a basis for developing rigorous evidence-based recommendations for improving teaching and assessment methods in cybersecurity and inform future research. This study is the first to explore student cognition and reasoning about cybersecurity. We interviewed students from three diverse institutions. During these interviews, students grappled with security scenarios designed to probe their understanding of cybersecurity, especially adversarial thinking. We analyzed student statements using a structured qualitative method, novice-led paired thematic analysis, to document patterns in …

"Think Before You Click. Post. Type." Lessons Learned From Our University Cyber Security Awareness Campaign, Rachael L. Innocenzi, Kaylee Brown, Peggy Liggit, Samir Tout, Andrea Tanner, Theodore Coutilish, Rocky J. Jenkins

Journal of Cybersecurity Education, Research and Practice

This article discusses the lessons learned after implementing a successful university-wide cyber security campaign. The Cyber Security Awareness Committee (CyberSAC), a group comprised of diverse units across campus, collaborated together on resources, talent, people, equipment, technology, and assessment practices to meet strategic goals for cyber safety and education. The project involves assessing student learning and behavior changes after participating in a Cyber Security Password Awareness event that was run as a year-long campaign targeting undergraduate students. The results have implications for planning and implementing university-wide initiatives in the field of cyber security, and more broadly, higher education at large.

Voice Hacking: Using Smartphones To Spread Ransomware To Traditional Pcs, Bryson R. Payne, Leonardo I. Mazuran, Tamirat Abegaz

Journal of Cybersecurity Education, Research and Practice

This paper presents a voice hacking proof of concept that demonstrates the ability to deploy a sequence of hacks, triggered by speaking a smartphone command, to launch ransomware and other destructive attacks against vulnerable Windows computers on any wireless network the phone connects to after the voice command is issued. Specifically, a spoken, broadcast, or pre-recorded voice command directs vulnerable Android smartphones or tablets to a malicious download page that compromises the Android device and uses it as a proxy to run software designed to scan the Android device’s local area network for Windows computers vulnerable to the EternalBlue exploit, …

A Case Study In The Implementation Of A Human-Centric Higher Education Cybersecurity Program, John W. Coffey, Melanie Haveard, Geissler Golding

Journal of Cybersecurity Education, Research and Practice

This article contains a description of the implementation of a comprehensive cyber security program at a regional comprehensive university. The program was designed to create an effective cyber security management infrastructure and to train end users and other categories of security management personnel in data protection and cyber security. This work addresses the impetus for the program, the rather extensive planning and development that went into the program, its implementation, and insights gleaned from the experience. The paper concludes with a summary of the strengths and weaknesses of the initiative.

From The Editors, Michael E. Whitman, Herbert J. Mattord, Carole L. Hollingsworth

Journal of Cybersecurity Education, Research and Practice

Welcome to the Spring 2018 issue of the Journal of Cybersecurity Education, Research, and Practice (JCERP). On behalf of the editorial team, we thank you for taking the time to read this issue and strongly encourage you to submit an article for consideration in an upcoming edition.

Compact Hardware Implementation Of A Sha-3 Core For Wireless Body Sensor Networks, Yi Yang, Debiao He, Neeraj Kumar, Sherali Zeadally

Information Science Faculty Publications

One of the most important Internet of Things applications is the wireless body sensor network (WBSN), which can provide universal health care, disease prevention, and control. Due to large deployments of small scale smart sensors in WBSNs, security, and privacy guarantees (e.g., security and safety-critical data, sensitive private information) are becoming a challenging issue because these sensor nodes communicate using an open channel, i.e., Internet. We implement data integrity (to resist against malicious tampering) using the secure hash algorithm 3 (SHA-3) when smart sensors in WBSNs communicate with each other using the Internet. Due to the limited resources (i.e., storage, …