Computer Sciences Commons^™

Security Vulnerabilities In Android Applications, Crischell Montealegre, Charles Rubia Njuguna, Muhammad Imran Malik, Peter Hannay, Ian Noel Mcateer

Australian Information Security Management Conference

Privacy-related vulnerabilities and risks are often embedded into applications during their development, with this action being either performed out of malice or out of negligence. Moreover, the majority of the mobile applications initiate connections to websites, other apps, or services outside of its scope causing significant compromise to the oblivious user. Therefore, mobile data encryption or related data-protection controls should be taken into account during the application development phase. This paper evaluates some standard apps and their associated threats using publicly available tools and demonstrates how an ignorant user or an organisation can fall prey to such apps.

Xmpp Architecture And Security Challenges In An Iot Ecosystem, Muhammad Imran Malik, Ian Noel Mcateer, Peter Hannay, Syed Naeem Firdous, Zubair Baig

Australian Information Security Management Conference

The elusive quest for technological advancements with the aim to make human life easier has led to the development of the Internet of Things (IoT). IoT technology holds the potential to revolutionise our daily life, but not before overcoming barriers of security and data protection. IoTs’ steered a new era of free information that transformed life in ways that one could not imagine a decade ago. Hence, humans have started considering IoTs as a pervasive technology. This digital transformation does not stop here as the new wave of IoT is not about people, rather it is about intelligent connected devices. …

The Relevance Of A Good Internal Control System In A Computerised Accounting Information System, Raymond Lutui, Tau’Aho ‘Ahokovi

Australian Information Security Management Conference

Advancements in information technology (IT) have enabled companies to use computers to carry out their activities that were previously performed manually. Accounting systems that were previously performed manually can now be performed with the help of computers. With all the advantages of computerized accounting software, business owners need to realize that problems do arise for a variety of reasons. Dependence on computers sometimes leads to bigger problems. This paper, therefore provide a detail information about the concept of internal control to its relevance in a computerised accounting information. This study also considers the trend between manual and computerised accounting system. …

An Investigation Into A Denial Of Service Attack On An Ethereum Network, Richard Greene, Michael N. Johnstone

Australian Information Security Management Conference

Apart from its much-publicised use in crypto-currency, blockchain technology is used in a wide range of application areas, from diamonds to wine. The most common application of this technology is in smart contracts in supply chain management, where assurance of delivery and provenance are important. One problem for an Ethereum consortium is the potential for disruption caused by a Denial-of-Service attack across the consortium nodes. Such an attack can be launched from a single source or multiple sources to amplify the effect. This paper investigates the impact of various Denial-of-Service attacks on an Ethereum Consortium deployed on the Azure Cloud …

Mobile Device Wardriving Tools’ Comparison: Nuku’Alofa As Case Study, Raymond Lutui, ‘Osai Tete’Imoana, George Maeakafa

Australian Information Security Management Conference

This paper describes the justification for a project to assess the security status of wireless networks usage in Nuku’alofa, the CBD of Tonga, By War Driving these suburbs, actual data was gathered to indicate the security status of wireless networks and provide an understanding of the users’ level of awareness and attitudes towards wireless security. This paper also takes the opportunity to compare the performance of the War driving tools that this study employed – GMoN, SWardriving, and Wi-Fi Scan. Wireless network communication remains a challenging and critical issue. This study takes an exploratory approach in which it allows the …

Expanding The Artificial Intelligence-Data Protection Debate, Fred H. Cate, Christopher Kuner, Orla Lynskey, Christopher Millard, Nora Ni Loideain, Dan Jerker B. Svantesson

Articles by Maurer Faculty

No abstract provided.

Secure Smart Metering Based On Lora Technology, Yao Cheng, Hendra Saputra, Leng Meng Goh, Yongdong Wu

Research Collection School Of Computing and Information Systems

Smart metering allows Substation Automation System (SAS) to remotely and timely read smart meters. Despite its advantages, smart metering brings some challenges. a) It introduces cyber attack risks to the metering system, which may lead to user privacy leakage or even the compromise of smart metering systems. b) Although the majority of meters are located within a regional power supply area, some hard-to-reach nodes are geographically far from the clustered area, which account for a big portion of the entire smart metering operation cost. Facing the above challenges, we propose a secure smart metering infrastructure based on LoRa technology which …

Securing Display Path For Security-Sensitive Applications On Mobile Devices, Jinhua Cui, Yuanyuan Zhang, Zhiping Cai, Anfeng Liu, Yangyang Li

Research Collection School Of Computing and Information Systems

While smart devices based on ARM processor bring us a lot of convenience, they also become an attractive target of cyber-attacks. The threat is exaggerated as commodity OSes usually have a large code base and suffer from various software vulnerabilities. Nowadays, adversaries prefer to steal sensitive data by leaking the content of display output by a security-sensitive application. A promising solution is to exploit the hardware visualization extensions provided by modern ARM processors to construct a secure display path between the applications and the display device. In this work, we present a scheme named SecDisplay for trusted display service, it …

Efficient And Privacy-Preserving Outsourced Calculation Of Rational Numbers, Ximeng Liu, Kim-Kwang Raymond Choo, Robert H. Deng, Rongxing Lu, Jian Weng

Research Collection School Of Computing and Information Systems

In this paper, we propose a framework for efficient and privacy-preserving outsourced calculation of rational numbers, which we refer to as POCR. Using POCR, a user can securely outsource the storing and processing of rational numbers to a cloud server without compromising the security of the (original) data and the computed results. We present the system architecture of POCR and the associated toolkits required in the privacy preserving calculation of integers and rational numbers to ensure that commonly used outsourced operations can be handled on-the-fly. We then prove that the proposed POCR achieves the goal of secure integer and rational …

Hybrid Privacy-Preserving Clinical Decision Support System In Fog-Cloud Computing, Ximeng Liu, Robert H. Deng, Yang Yang, Ngoc Hieu Tran, Shangping Zhong

Research Collection School Of Computing and Information Systems

In this paper, we propose a framework for hybrid privacy-preserving clinical decision support system in fog cloud computing, called HPCS. In HPCS, a fog server uses a lightweight data mining method to securely monitor patients' health condition in real-time. The newly detected abnormal symptoms can be further sent to the cloud server for high-accuracy prediction in a privacy-preserving way. Specifically, for the fog servers, we design a new secure outsourced inner-product protocol for achieving secure lightweight single-layer neural network. Also, a privacy-preserving piecewise polynomial calculation protocol allows cloud server to securely perform any activation functions in multiple-layer neural network. Moreover, …

Smartwatch-Based Early Gesture Detection & Trajectory Tracking For Interactive Gesture-Driven Applications, Tran Huy Vu, Archan Misra, Quentin Roy, Kenny Tsu Wei Choo, Youngki Lee

Research Collection School Of Computing and Information Systems

The paper explores the possibility of using wrist-worn devices (specifically, a smartwatch) to accurately track the hand movement and gestures for a new class of immersive, interactive gesture-driven applications. These interactive applications need two special features: (a) the ability to identify gestures from a continuous stream of sensor data early–i.e., even before the gesture is complete, and (b) the ability to precisely track the hand’s trajectory, even though the underlying inertial sensor data is noisy. We develop a new approach that tackles these requirements by first building a HMM-based gesture recognition framework that does not need an explicit segmentation step, …

Online/Offline Traceable Attribute-Based Encryption [In Chinese], Kai Zhang, Jianfeng Ma, Junwei Zhang, Zuobin Ying, Tao Zhang, Ximeng Liu

Research Collection School Of Computing and Information Systems

Attribute-based encryption (ABE), as a public key encryption, can be utilized for fine-grained access control. However, there are two main drawbacks that limit the applications of attribute-based encryption. First, as different users may have the same decryption privileges in ciphertext-policy attribute-based encryption, it is difficult to catch the users who sell their secret keys for financial benefit. Second, the number of resource-consuming exponentiation operations required to encrypt a message in ciphertext-policy attribute-based encryption grows with the complexity of the access policy, which presents a significant challenge for the users who encrypt data on mobile devices. Towards this end, after proposing …

A Lightweight Policy Preserving Ehr Sharing Scheme In The Cloud, Zuobin Ying, Lu Wei, Qi Li, Ximeng Liu, Jie Cui

Research Collection School Of Computing and Information Systems

Electronic Health Record (EHR) is a digital health documentary. It contains not only the health-related records but also the personal sensitive information. Therefore, how to reliably share EHR through the cloud is a challenging issue. Ciphertext-policy attribute-based encryption (CP-ABE) is a promising cryptography prototype, which can achieve fine-grained access control as well as one-to-many encryption. In CP-ABE, access policy is attached to the ciphertext, and however, the access policy is not protected, which will also cause some privacy leakage. In this paper, we propose a policy preserving EHR system on the basis of CP-ABE. Specifically, we designed an algorithm, which …

Consortium Blockchain-Based Sift: Outsourcing Encrypted Feature Extraction In The D2d Network, Xiaoqin Feng, Jianfeng Ma, Tao Feng, Yinbin Miao, Ximeng Liu

Research Collection School Of Computing and Information Systems

Privacy-preserving outsourcing algorithms for feature extraction not only reduce users' storage and computation overhead but also preserve the image privacy. However, the existing schemes still suffer from deficiencies induced by security, applications, efficiency and storage. To solve the problems, we implement a consortium chain-based outsourcing feature extraction scheme over encrypted images by using the smart contract, distributed autonomous corporation (DAC), sharding technique, and device to device (D2D) communication, which is secure, widely applied, highly efficient, and has less storage overhead. First, the effectiveness, security, and performance of our scheme are analyzed. Then, the efficiency and storage overhead of our scheme …

Strong Identity-Based Proxy Signature Schemes, Revisited, Weiwei Liu, Yi Mu, Guomin Yang, Yangguang Tian

Research Collection School Of Computing and Information Systems

Proxy signature is a useful cryptographic primitive that has been widely used in many applications. It has attracted a lot of attention since it was introduced. There have been lots of works in constructing efficient and secure proxy signature schemes. In this paper, we identify a new attack that has been neglected by many existing proven secure proxy signature schemes. We demonstrate this attack by launching it against an identity-based proxy signature scheme which is proven secure. We then propose one method that can effectively prevent this attack. The weakness in some other proxy signature schemes can also be fixed …

User-Friendly Deniable Storage For Mobile Devices, Bing Chang, Yao Cheng, Bo Chen, Fengwei Zhang, Wen-Tao Zhu, Yanju Liu, Zhan Wang

Research Collection School Of Computing and Information Systems

Mobile devices are prevalently used to process sensitive data, but traditional encryption may not work when an adversary is able to coerce the device owners to disclose the encryption keys. Plausibly Deniable Encryption (PDE) is thus designed to protect sensitive data against this powerful adversary. In this paper, we present MobiPluto, a user-friendly PDE scheme for denying the existence of sensitive data stored on mobile devices. A salient difference between MobiPluto and the existing PDE systems is that any block-based file systems can be deployed on top of it. To further improve usability and deniability of MobiPluto, we introduce a …

Tinyvisor: An Extensible Secure Framework On Android Platforms, Dong Shen, Zhoujun Li, Xiaojing Su, Jinxin Ma, Deng, Robert H.

Research Collection School Of Computing and Information Systems

As the utilization of mobile platform keeps growing, the security issue of mobile platform becomes a serious threat to user privacy. The current security measures mainly focus on the application level and the framework level, with little protection on the kernel. Virtualization technologies have been used in x86 platforms to protect the security of the kernel. With a higher privilege than the guest operating system, the hypervisor can effectively detect and defend against the malicious activity inside the guest kernel. In this paper, we build a hypervisor framework called TinyVisor leveraging the ARM virtualization extensions to protect the guest system …

User-Friendly Deniable Storage For Mobile Devices, Bing Chang, Yao Cheng, Bo Chen, Fengwei Zhang, Wen-Tao Zhu, Yingjiu Li, Zhan. Wang

Research Collection School Of Computing and Information Systems

Mobile devices are prevalently used to process sensitive data, but traditional encryption may not work when an adversary is able to coerce the device owners to disclose the encryption keys. Plausibly Deniable Encryption (PDE) is thus designed to protect sensitive data against this powerful adversary. In this paper, we present MobiPluto, a user-friendly PDE scheme for denying the existence of sensitive data stored on mobile devices. A salient difference between MobiPluto and the existing PDE systems is that any block-based file systems can be deployed on top of it. To further improve usability and deniability of MobiPluto, we introduce a …

Software Intrusion Detection Evaluation System: A Cost-Based Evaluation Of Intrusion Detection Capability, Agbotiname L. Imoize, Taiwo Oyedare, Michael E. Otuokere, Sachin Shetty

VMASC Publications

In this paper, we consider a cost-based extension of intrusion detection capability (CID). An objective metric motivated by information theory is presented and based on this formulation; a package for computing the intrusion detection capability of intrusion detection system (IDS), given certain input parameters is developed using Java. In order to determine the expected cost at each IDS operating point, the decision tree method of analysis is employed, and plots of expected cost and intrusion detection capability against false positive rate were generated. The point of intersection between the maximum intrusion detection capability and the expected cost is selected as …

A Reliable Data Provenance And Privacy Preservation Architecture For Business-Driven Cyber-Physical Systems Using Blockchain, Xueping Liang, Sachin Shetty, Deepak K. Tosh, Juan Zhao, Danyi Li, Jihong Liu

VMASC Publications

Cyber-physical systems (CPS) including power systems, transportation, industrial control systems, etc. support both advanced control and communications among system components. Frequent data operations could introduce random failures and malicious attacks or even bring down the whole system. The dependency on a central authority increases the risk of single point of failure. To establish an immutable data provenance scheme for CPS, the authors adopt blockchain and propose a decentralized architecture to assure data integrity. In business-driven CPS, end users are required to share their personal information with multiple third parties. To prevent data leakage and preserve user privacy, the authors isolate …

Introduction: Metrics, Modeling And Simulation For Cyber Physical Systems, Barry Ezell, Luanne Burns

VMASC Publications

[Introduction] In recent years, there has been a massive increase in cyber crime. Cyber breeches have become ubiquitous. The US government is attempting to adapt through legislation and policy. For instance, business in the defense industrial base must be in compliance of NIST 80-71 by 31 December 2017. Insurance companies as well are beginning to build actuaries on cyber risk. Along with NIST, there are many cyber frameworks that exist, each with their own following. Recently, companies have sought mapping from one framework to another but this is imperfect solution because some frameworks are exclusively technical control measures with very …

New Dimensions For A Challenging Security Environment: Growing Exposure To Critical Space Infrastructure Disruption Risk, Adrian V. Gheorghe, Alexandru Georgescu, Olga Bucovetchi, Marilena Lazăr, Cezar Scarlat

Engineering Management & Systems Engineering Faculty Publications

Space systems have become a key enabler for a wide variety of applications that are vital to the functioning of advanced societies. The trend is one of quantitative and qualitative increase of this dependence, so much so that space systems have been described as a new example of critical infrastructure. This article argues that the existence of critical space infrastructures implies the emergence of a new category of disasters related to disruption risks. We inventory those risks and make policy recommendations for what is, ultimately, a resilience governance issue.

A Value Sensitive Design Approach To Adolescent Mobile Online Safety, Arup Kumar Ghosh

Electronic Theses and Dissertations

With the rise of adolescent smartphone use, concerns about teen online safety are also on the rise. A number of parental control apps are available for mobile devices, but adoption of these apps has been markedly low. To better understand these apps, their users, and design opportunities in the space of mobile online safety for adolescents, we have conducted four studies informed by the principles of Value Sensitive Design (VSD). In Study 1 (Chapter 2), we conducted a web-based survey of 215 parents and their teens (ages 13-17) using two separate logistic regression models (parent and teen) to examine the …

Cybersecurity And The New Era Of Space Activities, David P. Fidler

Articles by Maurer Faculty

No abstract provided.

Software Safety And Security Risk Mitigation In Cyber-Physical Systems, Miklos Biro, Atif Mashkoor, Johannes Sametinger, Remzi Seker

Publications

Cyber-physical systems (CPSs) offer many opportunities but pose many challenges--especially regarding functional safety, cybersecurity, and their interplay, as well as the systems' impact on society. Consequently, new methods and techniques are needed for CPS development and assurance. This article [and issue] aims to address some of these challenges.

Biometrics Based Privacy-Preserving Authentication And Mobile Template Protection, Wencheng Yang, Jiankun Hu, Song Wang, Qianhong Wu

Research outputs 2014 to 2021

Smart mobile devices are playing a more and more important role in our daily life. Cancelable biometrics is a promising mechanism to provide authentication to mobile devices and protect biometric templates by applying a noninvertible transformation to raw biometric data. However, the negative effect of nonlinear distortion will usually degrade the matching performance significantly, which is a nontrivial factor when designing a cancelable template. Moreover, the attacks via record multiplicity (ARM) present a threat to the existing cancelable biometrics, which is still a challenging open issue. To address these problems, in this paper, we propose a new cancelable fingerprint template …

Determinants Of Personal Information Protection Activities In South Korea, Pilku Kang

MPA/MPP/MPFM Capstone Projects

The purpose of this paper is to investigate how people’s awareness and ways to obtain relevant materials of personal information have influenced individual’s information privacy protection activities. This study uses the data of a 2016 survey on information security published by Korea Information and Security Agency.

The dependent variables of this study are preventive measures for the security of a Personal Computer (PC) and preventive measures against personal information breach. I classify independent variables into four types. They are internet users’ perception about information privacy, such as awareness of the importance of protecting one’s personal information, and awareness of information …

A Security Review Of Local Government Using Nist Csf: A Case Study, Ahmed Ibrahim, Craig Valli, Ian Mcateer, Junaid Chaudhry

Research outputs 2014 to 2021

Evaluating cyber security risk is a challenging task regardless of an organisation’s nature of business or size, however, an essential activity. This paper uses the National Institute of Standards and Technology (NIST) cyber security framework (CSF) to assess the cyber security posture of a local government organisation in Western Australia. Our approach enabled the quantification of risks for specific NIST CSF core functions and respective categories and allowed making recommendations to address the gaps discovered to attain the desired level of compliance. This has led the organisation to strategically target areas related to their people, processes, and technologies, thus mitigating …

A Survey Of Distributed Certificate Authorities In Manets, Junaid Chaudhry, Kashif Saleem, Paul Haskell-Dowland Dr, Mahdi H. Miraz

Research outputs 2014 to 2021

A Certificate Authority (CA) provides the critical authentication and security services for Public Key Infrastructure (PKI) which are used for the Internet and wired networks. In MANETs (wireless and ad hoc) there is an inability to offer a centralized CA to provide these security services. Recent research has looked to facilitate the use of CAs within MANETs through the use of a Distributed Certificate Authority (DCA) for wireless and ad hoc networks. This paper presents a number of different types of DCA protocols and categorizes them into groups based on their factors and specifications. The paper concludes by proposing the …

The Design And Evaluation Of A User-Centric Information Security Risk Assessment And Response Framework, Manal Alohali, Nathan Clarke, Steven Furnell

Research outputs 2014 to 2021

Abstract: The risk of sensitive information disclosure and modification through the use of online services has increased considerably and may result in significant damage. As the management and assessment of such risks is a well-known discipline for organizations, it is a challenge for users from the general public. Users have difficulties in using, understanding and reacting to security-related threats. Moreover, users only try to protect themselves from risks salient to them. Motivated by the lack of risk assessment solutions and limited impact of awareness programs tailored for users of the general public, this paper aims to develop a structured approach …