Computer Sciences Commons^™

E-Customer Relationship Management In Insurance Industry In Albania, Evelina Bazini

UBT International Conference

E- Customer relationship management is an issue that every company, large or small must take in some way. Handled well, a CRM strategy can deliver significant benefits for companies and customers. Interaction with customers, in particular, has been enhanced and organizations who wish to remain competitive have started to implement CRM programmes and techniques in order to develop closer relations with their customers and to develop a better understanding of their needs. At the same time, the use of e-commerce techniques in CRM allows insurance organizations to identify customers, monitor their habits and use of information, and deliver them improved …

Security Slicing For Auditing Xml, Xpath, And Sql Injection Vulnerabilities, Julian Thome, Lwin Khin Shar, Lionel Briand

Research Collection School Of Computing and Information Systems

XML, XPath, and SQL injection vulnerabilities are among the most common and serious security issues for Web applications and Web services. Thus, it is important for security auditors to ensure that the implemented code is, to the extent possible, free from these vulnerabilities before deployment. Although existing taint analysis approaches could automatically detect potential vulnerabilities in source code, they tend to generate many false warnings. Furthermore, the produced traces, i.e. dataflow paths from input sources to security-sensitive operations, tend to be incomplete or to contain a great deal of irrelevant information. Therefore, it is difficult to identify real vulnerabilities and …

Stack Layout Randomization With Minimal Rewriting Of Android Binaries, Yu Liang, Xinjie Ma, Daoyuan Wu, Xiaoxiao Tang, Debin Gao, Guojun Peng, Chunfu Jia, Huanguo Zhang

Research Collection School Of Computing and Information Systems

Stack-based attacks typically require that attackers have a good understanding of the stack layout of the victim program. In this paper, we leverage specific features on ARM architecture and propose a practical technique that introduces randomness to the stack layout when an Android application executes. We employ minimal binary rewriting on the Android app that produces randomized executable of the same size which can be executed on an unmodified Android operating system. Our experiments on applying this randomization on the most popular 20 free Android apps on Google Play show that the randomization coverage of functions increases from 65% (by …

Security And Privacy Of Electronic Health Information Systems: Editorial, Elisa Bertino, Robert H. Deng, Xinyi Huang, Jianying Zhou

Research Collection School Of Computing and Information Systems

Digital technologies have dramatically transformed our daily lives by bringing countless conveniences and benefits. As an evolving concept, electronic health information has become the focus of attention in both academia and industry. By leveraging modern digital technologies like the internet and the cloud, electronic health information systems will be a key enabling technology in improving the quality and convenience of patient care, encouraging patient participation in their care, reducing medical errors, improving practice efficiencies, and saving time and cost. The complexity of electronic health information systems, however, raises several new security and privacy issues. It is thus critical to investigate …

Whatsapp Network Forensics: Decrypting And Understanding The Whatsapp Call Signaling Messages, Filip Karpisek, Ibrahim Baggili, Frank Breitinger

Electrical & Computer Engineering and Computer Science Faculty Publications

WhatsApp is a widely adopted mobile messaging application with over 800 million users. Recently, a calling feature was added to the application and no comprehensive digital forensic analysis has been performed with regards to this feature at the time of writing this paper. In this work, we describe how we were able to decrypt the network traffic and obtain forensic artifacts that relate to this new calling feature which included the: a) WhatsApp phone numbers, b) WhatsApp server IPs, c) WhatsApp audio codec (Opus), d) WhatsApp call duration, and e) WhatsApp's call termination. We explain the methods and tools used …

Why Education In The Law And Policy Of Cybersecurity Is A Must, Markus Rauschecker

Homeland Security Publications

No abstract provided.

Steganography, Naresh Emmadi, Varun Kumar Kattekolu, Sudhakar Shamul

All Capstone Projects

Multi Layer Security (MLS) is the art of hiding the fact that communication is taking place, by hiding information in other information. Many different carrier file formats can be used, but digital images are the most popular because of their frequency on the internet. For hiding secret information in images, there exists a large variety of techniques some are more complex than others and all of them have respective strong and weak points. Different applications may require absolute invisibility of the secret information, while others require a large secret message to be hidden. This project report intends to give an …

Android Attack Protection Application, Jahnavi Keerthipati, Vikas Reddy Tammanagari, Harinath Reddy Vangeti

All Capstone Projects

Developed an android attack protection application. It is designed for people who are under attack. They would press a button on their phone and it will gather their current location and start recording a 5 second video with audio. This application will then automatically send the location and video straight to the person selected.

Real-Time Detection System For Suspicious Urls, Krishna Prasad Chouty, Anup Chandra Thogiti, Kranthi Sudha Vudatha

All Capstone Projects

Twitter is prone to malicious tweets containing URLs for spam, phishing, and malware distribution. Conventional Twitter spam detection schemes utilize account features such as the ratio of tweets containing URLs and the account creation date, or relation features in the Twitter graph. These detection schemes are ineffective against feature fabrications or consume much time and resources. Conventional suspicious URL detection schemes utilize several features including lexical features of URLs, URL redirection, HTML content, and dynamic behavior. However, evading techniques such as time-based evasion and crawler evasion exist. In this paper, we propose WARNINGBIRD, a suspicious Real-Time URL detection system for …

Secured Client Portal, Krishnakar Mogili, Rajitha Thippireddy, Shobhan Tula

All Capstone Projects

This project is aimed at developing an online search Portal for the Placement Department of the college. The system is an online application that can be accessed throughout the organization and outside as well with proper login provided. This system can be used as an Online Job Portal for the Placement Department of the college to manage the student information with regards to placement. Students logging should be able to upload their information in the form of a CV. Visitors/Company representatives logging in may also access/search any information put up by Students.

Professor Frank Breitinger's Full Bibliography, Frank Breitinger

Electrical & Computer Engineering and Computer Science Faculty Publications

No abstract provided.

Towards Automatic Generation Of Security-Centric Descriptions For Android Apps, Mu Zhang, Yue Duan, Qian Feng, Heng Yin

Research Collection School Of Computing and Information Systems

To improve the security awareness of end users, Android markets directly present two classes of literal app information: 1) permission requests and 2) textual descriptions. Unfortunately, neither can serve the needs. A permission list is not only hard to understand but also inadequate; textual descriptions provided by developers are not security-centric and are significantly deviated from the permissions. To fill in this gap, we propose a novel technique to automatically generate security-centric app descriptions, based on program analysis. We implement a prototype system, DESCRIBEME, and evaluate our system using both DroidBench and real-world Android apps. Experimental results demonstrate that DESCRIBEME …

A Note On The Security Of Khl Scheme, Jian Weng, Yunlei Zhao, Deng, Robert H., Shengli Liu, Yanjiang Yang, Kouichi Sakurai

Research Collection School Of Computing and Information Systems

A public key trace and revoke scheme combines the functionality of broadcast encryption with the capability of traitor tracing. In Asiacrypt 2003, Kim, Hwang and Lee proposed a public key trace and revoke scheme (referred to as KHL scheme), and gave the security proof to support that their scheme is z-resilient against adaptive chosen-ciphertext attacks, in which the adversary is allowed to adaptively issue decryption queries as well as adaptively corrupt up to z users. In the passed ten years, KHL scheme has been believed as one of the most efficient public key trace and revoke schemes with z-resilience against …

On Robust Image Spam Filtering Via Comprehensive Visual Modeling, Jialie Shen, Deng, Robert H., Zhiyong Cheng, Liqiang Nie, Shuicheng Yan

Research Collection School Of Computing and Information Systems

The Internet has brought about fundamental changes in the way peoples generate and exchange media information. Over the last decade, unsolicited message images (image spams) have become one of the most serious problems for Internet service providers (ISPs), business firms and general end users. In this paper, we report a novel system called RoBoTs (Robust BoosTrap based spam detector) to support accurate and robust image spam filtering. The system is developed based on multiple visual properties extracted from different levels of granularity, aiming to capture more discriminative contents for effective spam image identification. In addition, a resampling based learning framework …

Seeing Your Face Is Not Enough: An Inertial Sensor-Based Liveness Detection For Face Authentication, Yan Li, Yingjiu Li, Qiang Yan, Hancong Kong, Robert H. Deng

Research Collection School Of Computing and Information Systems

Leveraging built-in cameras on smartphones and tablets, face authentication provides an attractive alternative of legacy passwords due to its memory-less authentication process. However, it has an intrinsic vulnerability against the media-based facial forgery (MFF) where adversaries use photos/videos containing victims' faces to circumvent face authentication systems. In this paper, we propose FaceLive, a practical and robust liveness detection mechanism to strengthen the face authentication on mobile devices in fighting the MFF-based attacks. FaceLive detects the MFF-based attacks by measuring the consistency between device movement data from the inertial sensors and the head pose changes from the facial video captured by …

Front Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Masthead

Journal of Digital Forensics, Security and Law

No abstract provided.

Back Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Enhancing Wifi-Based Localization With Visual Clues, Han Xu, Zheng Yang, Zimu Zhou, Longfei Shangguan, Yunhao Liu, Ke Yi

Research Collection School Of Computing and Information Systems

Indoor localization is of great importance to a wide range of applications in the era of mobile computing. Current mainstream solutions rely on Received Signal Strength (RSS) of wireless signals as fingerprints to distinguish and infer locations. However, those methods suffer from fingerprint ambiguity that roots in multipath fading and temporal dynamics of wireless signals. Though pioneer efforts have resorted to motion-assisted or peer-assisted localization, they neither work in real time nor work without the help of peer users, which introduces extra costs and constraints, and thus degrades their practicality. To get over these limitations, we propose Argus, an image-assisted …

Server-Aided Revocable Identity-Based Encryption, Baodong Qin, Deng, Robert H., Yingjiu Li, Shengli Liu

Research Collection School Of Computing and Information Systems

Efficient user revocation in Identity-Based Encryption (IBE) has been a challenging problem and has been the subject of several research efforts in the literature. Among them, the tree-based revocation approach, due to Boldyreva, Goyal and Kumar, is probably the most efficient one. In this approach, a trusted Key Generation Center (KGC) periodically broadcasts a set of key updates to all (non-revoked) users through public channels, where the size of key updates is only O(r log N/r), with N being the number of users and r the number of revoked users, respectively; however, every user needs to keep at least O(logN) …

On Security Of Content-Based Video Stream Authentication, Swee Won Lo, Zhou Wei, Deng, Robert H., Xuhua Ding

Research Collection School Of Computing and Information Systems

Content-based authentication (CBA) schemes are used to authenticate multimedia streams while allowing content-preserving manipulations such as bit-rate transcoding. In this paper, we survey and classify existing transform-domain CBA schemes for videos into two categories, and point out that in contrary to CBA for images, there exists a common design flaw in these schemes. We present the principles (based on video coding concept) on how the flaw can be exploited to mount semantic-changing attacks in the transform domain that cannot be detected by existing CBA schemes. We show attack examples including content removal, modification and insertion attacks. Noting that these CBA …

On Indistinguishability In Remote Data Integrity Checking, Xinyu Fan, Guomin Yang, Yi Mu, Yong Yu

Research Collection School Of Computing and Information Systems

With a rapid growth of data storage in the cloud, data integrity checking in a remote data storage system has become an important issue. A number of protocols, which allow remote integrity checking by a third party, have been proposed. Although those protocols are provably secure, the data privacy issues in those protocols have not been considered. We believe that these issues are equally important since the communication flows of integrity proofs from the cloud server should not reveal any useful information of the stored data. In this paper, we introduce a new definition of data privacy called ‘INDPrivacy’ by …

Attribute Based Broadcast Encryption With Short Ciphertext And Decryption Key, Tran Viet Xuan Phuong, Guomin Yang, Willy Susilo, Xiaofeng Chen

Research Collection School Of Computing and Information Systems

Attribute Based Broadcast Encryption (ABBE) is a combination of Attribute Based Encryption (ABE) and Broadcast Encryption (BE). It allows a broadcaster (or encrypter) to broadcast an encrypted message that can only be decrypted by the receivers who are within a predefined user set and satisfy the access policy specified by the broadcaster. Compared with normal ABE, ABBE allows direct revocation, which is important in many real-time broadcasting applications such as Pay TV. In this paper, we propose two novel ABBE schemes that have distinguishing features: the first scheme is key-policy based and has short ciphertext and constant size decryption key; …

From Physical Security To Cybersecurity, Arunesh Sinha, Thanh H. Nguyen, Debarun Kar, Matthew Brown, Milind Tambe, Albert Xin Jiang

Research Collection School Of Computing and Information Systems

Security is a critical concern around the world. In many domains from cybersecurity to sustainability, limited security resources prevent complete security coverage at all times. Instead, these limited resources must be scheduled (or allocated or deployed), while simultaneously taking into account the importance of different targets, the responses of the adversaries to the security posture, and the potential uncertainties in adversary payoffs and observations, etc. Computational game theory can help generate such security schedules. Indeed, casting the problem as a Stackelberg game, we have developed new algorithms that are now deployed over multiple years in multiple applications for scheduling of …

Api-Based Acquisition Of Evidence From Cloud Storage Providers, Andres E. Barreto

LSU New Orleans Theses and Dissertations

Cloud computing and cloud storage services, in particular, pose a new challenge to digital forensic investigations. Currently, evidence acquisition for such services still follows the traditional approach of collecting artifacts on a client device. In this work, we show that such an approach not only requires upfront substantial investment in reverse engineering each service, but is also inherently incomplete as it misses prior versions of the artifacts, as well as cloud-only artifacts that do not have standard serialized representations on the client.

In this work, we introduce the concept of API-based evidence acquisition for cloud services, which addresses these concerns …

Identity-Based Lossy Encryption From Learning With Errors, Jingnan He, Bao Li, Xianhui Lu, Dingding Jia, Haiyang Xue, Xiaochao Sun

Research Collection School Of Computing and Information Systems

We extend the notion of lossy encryption to the scenario of identity-based encryption (IBE), and propose a new primitive called identity-based lossy encryption (IBLE). Similar as the case of lossy encryption, we show that IBLE can also achieve selective opening security. Finally, we present a construction of IBLE from the assumption of learning with errors.

Novel Cryptographic Primitives And Protocols For Censorship Resistance, Kevin Patrick Dyer

Dissertations and Theses

Internet users rely on the availability of websites and digital services to engage in political discussions, report on newsworthy events in real-time, watch videos, etc. However, sometimes those who control networks, such as governments, censor certain websites, block specific applications or throttle encrypted traffic. Understandably, when users are faced with egregious censorship, where certain websites or applications are banned, they seek reliable and efficient means to circumvent such blocks. This tension is evident in countries such as a Iran and China, where the Internet censorship infrastructure is pervasive and continues to increase in scope and effectiveness.

An arms race is …

Automatic Video Self Modeling For Voice Disorder, Ju Shen, Changpeng Ti, Anusha Raghunathan, Sen-Ching S. Cheung, Rita Patel

Computer Science Faculty Publications

Video self modeling (VSM) is a behavioral intervention technique in which a learner models a target behavior by watching a video of him- or herself. In the field of speech language pathology, the approach of VSM has been successfully used for treatment of language in children with Autism and in individuals with fluency disorder of stuttering. Technical challenges remain in creating VSM contents that depict previously unseen behaviors. In this paper, we propose a novel system that synthesizes new video sequences for VSM treatment of patients with voice disorders. Starting with a video recording of a voice-disorder patient, the proposed …

A New Public Remote Integrity Checking Scheme With User Privacy, Yiteng Feng, Yi Mu, Guomin Yang, Joseph Liu

Research Collection School Of Computing and Information Systems

With a cloud storage, users can store their data files on a remote cloud server with a high quality on-demand cloud service and are able to share their data with other users. Since cloud servers are not usually regarded as fully trusted and the cloud data can be shared amongst users, the integrity checking of the remote files has become an important issue. A number of remote data integrity checking protocols have been proposed in the literature to allow public auditing of cloud data by a third party auditor (TPA). However, user privacy is not taken into account in most …

Attribute-Based Encryption With Efficient Verifiable Outsourced Decryption, Baodong Qin, Robert H. Deng, Shengli Liu, Siqi Ma

Research Collection School Of Computing and Information Systems

Attribute-based encryption (ABE) with outsourced decryption not only enables fine-grained sharing of encrypted data, but also overcomes the efficiency drawback (in terms of ciphertext size and decryption cost) of the standard ABE schemes. In particular, an ABE scheme with outsourced decryption allows a third party (e.g., a cloud server) to transform an ABE ciphertext into a (short) El Gamal-type ciphertext using a public transformation key provided by a user so that the latter can be decrypted much more efficiently than the former by the user. However, a shortcoming of the original outsourced ABE scheme is that the correctness of the …