Computer Sciences Commons^™

Risk Management In Crm Security Management, Mahdi Seify

Research outputs pre 2011

In an increasing competitive world, marketing survival can be depended simply on timely new information on customers and market trend. One of the most important strategies in CRM (Customer Relationship Management) is to capture enough information from customers and using this information carefully [Ryals , Tinsley]. Of course security of this information is very important in CRM data management [Bryan]. Data management is a method for scheduling and controlling data saving, recovering and processing. This activity has been done continually or periodically[Bryan]. Security level of this information depends on the security policy of the organization. CRM security policy is the …

Understanding Transition Towards Information Security Culture Change, Leanne Ngo, Wanlei Zhou, Matthew Warren

Research outputs pre 2011

Transitioning towards an information security culture for organisations has not been adequately explored in the current security and management literature. Many authors have proposed how information security culture can be created, fostered and managed within organisations, but have failed to adequately address the transition process towards information security culture change, particularly for small medium enterprises (SMEs). This paper aims to (1) recapitulate key developments and trends within information security culture literature; (2) explore in detail the transition process towards organisational change; (3) adapt the transition process with respects to the key players involved in transition and propose a transition model …

Smart Card Authentication For Mobile Devices, Wayne Jansen, Serban Gavrila, Clément Séveillac

Research outputs pre 2011

While mobile handheld devices provide productivity benefits, they also pose new risks. User authentication is the best safeguard against the risk of unauthorized use and access to a device’s contents. This paper describes two novel types of smart card with unconventional form factors, designed to take advantage of common interfaces built into many current handheld devices.

Non-Repudiation In Pure Mobile Ad Hoc Network, Yi-Chi Lin, Jill Slay

Research outputs pre 2011

Within the last decade, the use of wireless technologies has become more prevalent. Wireless networks have flexible architectures with data transferred via radio waves and can be divided into two categories; infrastructure-based wireless networks and mobile ad hoc network.

The mobile ad hoc network (MANET) is an autonomous system which can be dynamically built without pre-existing infrastructure or a trusted third party (TTP). Due to these infrastructure-less and self-organized characteristics, MANET encounters different problems from infrastructure-based wired network, such as key management, power shortage, and security issues. This paper will further divide MANETs into pure ad hoc networks which do …

Benchmarking E-Business Security: A Model And Framework, Graeme Pye, Matthew J. Warren

Research outputs pre 2011

The dynamic nature of threats and vulnerabilities within the E-business environment can impede online functionality, compromise organisational or customer information, contravene security implementations and thereby undermine online customer confidence. To negate these problems, E-business security has to become proactive, by reviewing and continuously improving security to strengthen E-business security measures and policies. This can be achieved through benchmarking the security measures and policies utilised within the E-business, against recognised information technology (IT) and information security (IS) security standards.

An Investigation Into The Paradox Of Organisational Flexibility Versus Security: A Research Project, Rosanna Fanciulli

Research outputs pre 2011

The trend towards utilising geographically and temporally dispersed personnel has grown quickly over the past decade; enabled by swift advances in computing, telecommunications, and networking technologies. The impact of these developments on corporate strategies and forms has manifested itself in a move to de-legitimise the rigid structure of a traditional bureaucracy and move towards one that is more flexible. These new technologies and organisational structures, however, also bring with them Information Security threats and risks. It is critical that managers become informed and equipped to deal with these issues. This paper presents an ongoing study designed to determine the major …

Architecture For Self-Estimation Of Security Level In Ad Hoc Network Nodes, Reijo Savola

Research outputs pre 2011

Inherent freedom due to a lack of central authority of self-organised mobile ad hoc networks introduces challenges to security and trust management. In these kinds of scenarios, the nodes themselves are naturally responsible for their own security – or they could trust certain known nodes, called “micro-operators”. We propose an architecture for security management in self-organising mobile ad hoc networks that is based on the nodes’ own responsibility and node-level security monitoring. The aim is to predict, as well as to monitor the security level concentrating on the principal effects contributing to it.

My Problem Or Our Problem? Exploring The Use Of Information Sharing As A Component Of A Holistic Approach To E-Security In Response To The Growth Of ‘Malicious Targeted Attacks’, Aaron Olding, Paul Turner

Research outputs pre 2011

There is now a growing recognition amongst e-security specialists that the e-security environment faced by organisations is changing rapidly. This environment now sees a situation where maliciously targeted attacks are conducted by ‘guns for hire’ (hackers) and/or criminal organisations (Illett 2005; Keiser 2005). As a consequence, conventional organisational approaches to e-security are becoming increasingly problematic and inadequate. There is a need to raise awareness of these issues amongst organisations and to contribute to the generation of effective integrated solutions that address this emerging e-security environment without sacrificing user privacy and/or breaching user trust. This paper considers the potential role of …

Detecting Rogue Access Points That Endanger The Maginot Line Of Wireless Authentication, Zhiqi Tao, A. B. Ruighaver

Research outputs pre 2011

The rapid growth in deployment of wireless networks in recent years may be an indication that many organizations believe that their system will be adequately secured by the implementation of enhanced encryption and authentication. However, in our view, the emphasis on cryptographic solutions in wireless security is repeating the history of the “Maginot Line”. Potential attackers of wireless networks currently will find many ways to get access to wireless networks to compromise the confidentiality of information without the need to crack the encryption. In this paper we analyze how rogue access points threaten the security of an organization’s wireless network …

Security Of An Ill-Posed Operator Based Scheme For Image Authentication, Yongdong Wu, Robert H. Deng

Research Collection School Of Computing and Information Systems

This letter analyzes the security of an image authentication scheme which exploits the instability of an ill-posed operator. Since the ill-posed operator produces only a limited number of authentic images regardless of the number of watermarks, an attacker can impersonate an image owner to generate authentic images at a high probability. Our experiments demonstrate that our attack is both practical and effective.

Technology Competition And Optimal Investment Timing: A Real Options Perspective, Robert J. Kauffman, X. Li

Research Collection School Of Computing and Information Systems

Companies often choose to defer irreversible investments to maintain valuable managerial flexibility in an uncertain world. For some technology-intensive projects, technology uncertainty plays a dominant role in affecting investment timing. This article analyzes the investment timing strategy for a firm that is deciding about whether to adopt one or the other of two incompatible and competing technologies.We develop a continuous-time stochastic model that aids in the determination of optimal timing for managerial adoption within the framework of real options theory. The model captures the elements of the decision-making process in such a way so as to provide managerial guidance in …

Isram: Information Security Risk Analysis Method, Bilge Karabacak, Ibrahim Sogukpinar

All Faculty and Staff Scholarship

Continuously changing nature of technological environment has been enforcing to revise the process of information security risk analysis accordingly. A number of quantitative and qualitative risk analysis methods have been proposed by researchers and vendors. The purpose of these methods is to analyze today's information security risks properly. Some of these methods are supported by a software package. In this study, a survey based quantitative approach is proposed to analyze security risks of information technologies by taking current necessities into consideration. The new method is named as Information Security Risk Analysis Method (ISRAM). Case study has shown that ISRAM yields …

Ontology-Assisted Mining Of Rdf Documents, Tao Jiang, Ah-Hwee Tan

Research Collection School Of Computing and Information Systems

Resource description framework (RDF) is becoming a popular encoding language for describing and interchanging metadata of web resources. In this paper, we propose an Apriori-based algorithm for mining association rules (AR) from RDF documents. We treat relations (RDF statements) as items in traditional AR mining to mine associations among relations. The algorithm further makes use of a domain ontology to provide generalization of relations. To obtain compact rule sets, we present a generalized pruning method for removing uninteresting rules. We illustrate a potential usage of AR mining on RDF documents for detecting patterns of terrorist activities. Experiments conducted based on …

Forensic Analysis Of Digital Image Tampering, Jonathan R. Sturak

Theses and Dissertations

The use of digital photography has increased over the past few years, a trend which opens the door for new and creative ways to forge images. The manipulation of images through forgery influences the perception an observer has of the depicted scene, potentially resulting in ill consequences if created with malicious intentions. This poses a need to verify the authenticity of images originating from unknown sources in absence of any prior digital watermarking or authentication technique. This research explores the holes left by existing research; specifically, the ability to detect image forgeries created using multiple image sources and specialized methods …

Vertical Sensitivity For The Information Security Health Rating Of Enterprises, Arcot Desai Narasimhalu, Nagarajan Dayasindhu, Raghavan Subramanian

Research Collection School Of Computing and Information Systems

INFOSeMM Maturity model was developed jointly by SMU and Infosys. It is recognized that different industry verticals will have different levels of recommended maturity levels. This paper articulates the need for developing the industry vertical benchmarks.

On Security Notions For Steganalysis, Kisik Chang, Robert H. Deng, Feng Bao, Sangjin Lee, Hyungjun Kim, Jongin Lim

Research Collection School Of Computing and Information Systems

There have been some achievements in steganalysis recently. Many people have been making strides in steganalysis. They have approached steganalysis from different angles; from information theory to complexity theory. Anderson gave a possibility that there is a provable secure steganographic system, but there had not been complexity theoretical approaches for years. In 2002, Katzenbeisser and Petitcolas defined the conditional security of steganography and gave a possibility for a practical, provable secure steganography for the first time, and Hopper et al. introduced a provable secure steganographic algorithm in the sense of complexity theory. Chang et al. also tried to define the …

Anonymous Secure Routing In Mobile Ad-Hoc Networks, Bo Zhu, Zhiguo Wan, Mohan S. Kankanhalli, Feng Bao, Robert H. Deng

Research Collection School Of Computing and Information Systems

Although there are a large number of papers on secure routing in mobile ad-hoc networks, only a few consider the anonymity issue. In this paper, we define more strict requirements on the anonymity and security properties of the routing protocol, and notice that previous research works only provide Weak Location Privacy and Route Anonymity, and are vulnerable to specific attacks. Therefore, we propose the Anonymous Secure Routing (ASR) protocol that can provide additional properties on anonymity, i.e. Identity Anonymity and Strong Location Privacy, and at the same time ensure the security of discovered routes against various passive and active attacks. …

Implementation And Comparison Of Denial Of Service Attack Techniques, Khaled M. Elleithy, Drazen Blagovic, Wang K. Cheng, Paul Sideleau

School of Computer Science & Engineering Faculty Publications

A denial of service attack (DOS) is any type of attack on a networking structure to disable a server from servicing its clients. Attacks range from sending millions of requests to a server in an attempt to slow it down, flooding a server with large packets of invalid data, to sending requests with an invalid of spoofed IP address. In this paper we show the implementation and analysis of three main types of attack: Ping of Death, TCP SYN Flood, and Distributed DOS. The Ping of Death attack will be simulated against a Microsoft Windows 95 computer. The TCP SYN …

Flexible Verification Of Mpeg-4 Stream In Peer-To-Peer Cdn, Tieyan Li, Yongdong Wu, Di Ma, Robert H. Deng

Research Collection School Of Computing and Information Systems

The current packet based stream authentication schemes provide effective and efficient authentication over a group of packets transmitted on erasure channels. However, by fixing the packets in transmission, any packet manipulation will cause authentication failure. In p2p content delivery network where a proxy-in-the-middle is able to store, forward, transcode and transform the stream, previous schemes are simply unapplicable. To address the problem, we propose a flexible verification scheme that relies on special stream formats (i.e. Unequal Loss Protection ULP scheme [7]). We apply the so called Unequal Loss Verification ULV scheme into MPEG-4 framework. The encoding, packing, amortizing and verifying …

Comments On "A Practical (T, N) Threshold Proxy Signature Scheme Based On The Rsa Cryptosystem", Guilin Wang, Feng Bao, Jianying Zhou, Robert H. Deng

Research Collection School Of Computing and Information Systems

In a (t, n) threshold proxy signature scheme based on RSA, any t or more proxy signers can cooperatively generate a proxy signature while t-1 or fewer of them can't do it. The threshold proxy signature scheme uses the RSA cryptosystem to generate the private and the public key of the signers. In this article, we discuss the implementation and comparison of some threshold proxy signature schemes that are based on the RSA cryptosystem. Comparison is done on the basis of time complexity, space complexity and communication overhead. We compare the performance of four schemes: Hwang et al., Wen et …

Compliant Encryption Of Jpeg2000 Codestreams, Yongdong Wu, Robert H. Deng

Research Collection School Of Computing and Information Systems

This paper presents a compliant encryption method for JPEG 2000 codestreams such that the encryption process does not introduce superfluous JPEG2000 markers in the protected codestream, i.e., the protected codestream preserves the syntax of the original codestream. The proposed encryption method works with any standard ciphers, incurs no storage overhead, introduces negligible computational cost and maintains all the desirable properties of the original JPEG 2000 codestream such as error resilience and scalability.

Dynamic Access Control For Multi-Privileged Group Communications, Di Ma, Robert H. Deng, Yongdong Wu, Tieyan Li

Research Collection School Of Computing and Information Systems

Recently, there is an increase in the number of group communication applications which support multiple service groups of different access privileges. Traditional access control schemes for group applications assume that all the group members have the same access privilege and mostly focus on how to reduce rekeying messages upon user joining and leaving. Relatively little research effort has been spent to address security issues for group communications supporting multiple access privileges. In this paper, we propose a dynamic access control scheme for group communications which support multiple service groups with different access privileges. Our scheme allows dynamic formation of service …

Trust Establishment In Large Scale Grid Settings, Bo Zhu, Tieyan Li, Huafei Zhu, Mohan S . Kankanhalli, Feng Bao, Robert H. Deng

Research Collection School Of Computing and Information Systems

Trust establishment is hard in grid architecture by the ad hoc nature. To set up trust in large scale of network is more difficult. In this paper, we propose an automatic key management (AKM) model and corresponding key construction schemes. The hierarchical structure is formed automatically and scale seamlessly in arbitrary network sized. Regions are configured differently according to various levels of risks faced. The novel model provides an integrated solution for self-organized trust establishment, upon which rich appliances are securely supported. It is automatic, flexible, and scalable. Furthermore, simulation results show that computation costs due to the variations are …

Recommender Systems Research: A Connection-Centric Survey, Saverio Perugini, Marcos André Gonçalves, Edward A. Fox

Computer Science Faculty Publications

Recommender systems attempt to reduce information overload and retain customers by selecting a subset of items from a universal set based on user preferences. While research in recommender systems grew out of information retrieval and filtering, the topic has steadily advanced into a legitimate and challenging research area of its own. Recommender systems have traditionally been studied from a content-based filtering vs. collaborative design perspective. Recommendations, however, are not delivered within a vacuum, but rather cast within an informal community of users and social context. Therefore, ultimately all recommender systems make connections among people and thus should be surveyed from …

Proxy Signature Scheme With Multiple Original Signers For Wireless E-Commerce Applications, Guilin Wang, Feng Bao, Jianying Zhou, Robert H. Deng

Research Collection School Of Computing and Information Systems

In a proxy signature scheme, a user delegates his/her signing capability to another user in such a way that the latter can sign messages on behalf of the former. We propose an efficient and secure proxy signature scheme with multiple original signers. Our scheme is suitable for wireless electronic commerce applications, since the overheads of computation and communication are low. As an example, we present an electronic air ticket booking scheme for wireless customers.

On The Security Of The Lee-Hwang Group-Oriented Undeniable Signature Schemes, Guilin Wang, Jianying Zhou, Robert H. Deng

Research Collection School Of Computing and Information Systems

Undeniable signature is an intriguing concept introduced by Chaum and van Antwerpen at Crypto89. In 1999, Lee and Hwang presented two group-oriented undeniable signature schemes with a trusted center. Their schemes are natural generalizations of Chaums zero knowledge undeniable signature scheme proposed in 1990. However, we find that the Lee-Hwang schemes are insecure. In this paper, we demonstrate five effective attacks on their schemes: four of them are insider universal forgeries, in which one dishonest member (maybe colluding with a verifier) can get a valid signature on any chosen massage, and another attack allows a dishonest member to prevent honest …

Security Analysis Of Two Signcryption Schemes, Guilin Wang, Robert H. Deng, Dongjin Kwak, Sangjae Moon

Research Collection School Of Computing and Information Systems

Signcryption is a new cryptographic primitive that performs signing and encryption simultaneously, at a cost significantly lower than that required by the traditional signature-then-encryption approach. In this paper, we present a security analysis of two such schemes: the Huang-Chang convertible signcryption scheme, and the Kwak-Moon group signcryption scheme. Our results show that both schemes are insecure. Specifically, the Huang-Chang scheme fails to provide confidentiality, while the Kwak-Moon scheme does not satisfy the properties of unforgeability, coalition-resistance, and traceability.

Rating Information Security Maturity, Arcot Desai Narasimhalu, Nagarajan Dayasindhu

Research Collection School Of Computing and Information Systems

Most CEOs have difficulty relating to the information security investments in their companies. This article presents a summary of a the information security maturity model that the CEOs could use to determine the desired level of investments into information security infrastructure, tools and applications.

Packet-Loss Resilient Coding Scheme With Only Xor Operations, Gui Liang Feng, Robert H. Deng, Feng Bao

Research Collection School Of Computing and Information Systems

Application of forward error correction to recover lost packets in higher layers of communication networks is receiving increasing attention. Most of the previous proposals for packet loss recovery use symbol-oriented Reed-Solomon codes operating in symbol erasure-correction mode. A Reed-Solomon code is optimal in the sense that it is maximal distance separable; however, the decoding speed of a Reed-Solomon code is slow since it involves operations over GF(2m) using lookup tables. A packet-oriented (n, k)/(m, l) packet-loss resilient code based on an (n, k) Reed-Solomon code over GF(2m) is given. The code accepts k-packet information sequences and encodes them into n-packet …

A Novel Distributed Denial-Of-Service Detection Algorithm, Brett Tsudama

Master's Theses

The applicability of implementing Ratio-based SYN Flood Detection (RSD) on a network processor is explored, and initial results are presented.