Computer Sciences Commons^™

Potsdam: Pareto Optimization Targeting Security, Data, And Mediation, J Peter Brady

Dartmouth College Ph.D Dissertations

Given the growing amount and variety of data handled by modern systems, it is crucial to guarantee the accuracy and protection of input data without errors or malicious intentions. The need to improve security in software programs often conflicts with the assurance of maximum performance, making developers and maintainers hesitant to incorporate more testing.

LangSec (Language-Theoretic Security) is a security approach that treats input validation as a formal language recognition problem, ensuring that only well-defined, unambiguous inputs are processed to eliminate exploitable parsing flaws. This dissertation explores integrating LangSec principles with Pareto optimization to enhance safety and robustness in digital …

Llm-Driven Apt Detection For 6g Wireless Networks: A Systematic Review And Taxonomy, Muhammed Golec, Yaser Khamayseh, Suhib Bani Melhem, Abdulmalik Alwarafy

All Works

Sixth Generation (6G) wireless networks, which are expected to be deployed in the 2030s, have already created great excitement in academia and the private sector with their extremely high communication speed and low latency rates. However, despite the ultra-low latency, high throughput, and AI-assisted orchestration capabilities they promise, they are vulnerable to stealthy and long-term Advanced Persistent Threats (APTs). Large Language Models (LLMs) stand out as an ideal candidate to fill this gap with their high success in semantic reasoning and threat intelligence. This paper presents the first systematic review and taxonomy for LLM-assisted APT detection in 6G networks. It …

A Secure And Effective Framework For Key Concept Mining From Educational Content Using Large Language Models, Ashika Sameem Abdul Rasheed

Thesis/ Dissertation Defenses

This thesis examines the use of Large Language Models (LLMs) in education, with a focus on improving performance and implementing strong security measures. The research has two main goals, namely, the development of an effective lecture summarization technique using LLMs and identifying and addressing security vulnerabilities in LLM applications according to OWASP (Open Web Application Security Project) guidelines. For the former goal, we have proposed an effective framework for fine-tuning LLMs using real lecture datasets and compared the performance of different LLMs. For the latter goal, we conducted a thorough review of the application dataflow of the proposed framework and …

A Novel Algorithmic Approach To Safeguarding Inter-Vehicular Communications And Privacy, Susan Zehra

Graduate Student Government Association Research Conference

Vehicular networks have become a crucial technology for implementing various safety applications for both drivers and passengers. These networks are currently receiving significant attention due to their ability to facilitate access to a diverse range of ubiquitous services. However, the growing popularity of vehicular networks has also led to an increase in security vulnerabilities within their inter-vehicular services and communications, resulting in a rise in security attacks and threats.

Ensuring the security of vehicular networks is paramount, as their deployment should not compromise the safety and privacy of stakeholders. Effectively defending against a broad spectrum of attacks necessitates the development …

Permission Recommendation For Android Applications: Leveraging Natural Language Processing On App Descriptions, Saeed Salem Al Shebli

Thesis/ Dissertation Defenses

This study develops an NLP-based system to recommend essential permissions for Android apps by analyzing app descriptions. It leverages advanced models, including LSTM and ensemble techniques, to align permissions with app functionality while minimizing unnecessary requests.

A Secure And Effective Framework For Key Concept Mining From Educational Content Using Large Language Models, Ashika Sameem Abdul Rasheed

Theses

This thesis examines the use of Large Language Models (LLMs) in education, with a focus on improving performance and implementing strong security measures. The research has two main goals, namely, the development of an effective lecture summarization technique using LLMs and identifying and addressing security vulnerabilities in LLM applications according to OWASP (Open Web Application Security Project) guidelines. For the former goal, we have proposed an effective framework for fine-tuning LLMs using real lecture datasets and compared the performance of different LLMs. For the latter goal, we conducted a thorough review of the application dataflow of the proposed framework and …

A Survey Of Protocol Fuzzing, Xiaohan Zhang, Cen Zhang, Xinghua Li, Zhengjie Du, Bing Mao, Yeting Li, Pan Li

Research Collection School Of Computing and Information Systems

Communication protocols form the bedrock of our interconnected world, yet vulnerabilities within their implementations pose significant security threats. Recent developments have seen a surge in fuzzing-based research dedicated to uncovering these vulnerabilities within protocol implementations. However, there still lacks a systematic overview of protocol fuzzing for answering the essential questions such as what the unique challenges are, how existing works solve them, and so on. To bridge this gap, we conducted a comprehensive investigation of related works from both academia and industry. Our study includes a detailed summary of the specific challenges in protocol fuzzing and provides a systematic categorization …

Fake Base Station Detection And Link Routing Defense, Sourav Purification, Jinoh Kim, Jonghyun Kim, Sang-Yoon Chang

Faculty Publications

Fake base stations comprise a critical security issue in mobile networking. A fake base station exploits vulnerabilities in the broadcast message announcing a base station’s presence, which is called SIB1 in 4G LTE and 5G NR, to get user equipment to connect to the fake base station. Once connected, the fake base station can deprive the user of connectivity and access to the Internet/cloud. We discovered that a fake base station can disable the victim user equipment’s connectivity for an indefinite period of time, which we validated using our threat prototype against current 4G/5G practices. We designed and built a …

Exploring The Integration Of Blockchain In Iot Use Cases: Challenges And Opportunities, Ivannah George

Electronic Theses, Projects, and Dissertations

Blockchain and The Internet of Things (IoT) is a significant paradigm which has gained traction in today’s digital age as two complimentary technologies. The combination of IoT's connectivity with blockchain's security creates new opportunities and solves problems associated with centralized systems. This culminating project aims to delve deeper into the integration of blockchain technology in IoT applications based on select use cases to uncover potential benefits and significant challenges of blockchain integration across different sectors. The research objectives to be addressed are: (RO1) How emerging vulnerabilities manifest in the implementation of blockchain within current IoT ecosystems. (RO2) How current opportunities …

Anopay: Anonymous Payment For Vehicle Parking With Updatable Credential, Yang Yang, Wenyi Xue, Yonghua Zhan, Minming Huang, Yingjiu Li, Robert H. Deng

Research Collection School Of Computing and Information Systems

Many existing anonymous parking payment schemes lack high efficiency and flexibility. For instance, the calculation and communication costs involved in payment may linearly increase with the payment amount. In this paper, we propose an anonymous payment system (dubbed AnoPay) for vehicle parking, which leverages updatable attribute-based anonymous credentials and efficient zero-knowledge proof (ZKP) to achieve user anonymity and constant overhead for parking fee payment. To further improve the efficiency, we design a secure parking fee aggregation protocol based on linear homomorphic encryption to aggregate parking transactions, where the amount of each parking transaction is hidden and the privacy of the …

Contextualizing Interpersonal Data Sharing In Smart Homes, Weijia He, Nathan Reitinger, Atheer Almogbil, Yi-Shyuan Chiang, Timothy J. Pierson, David Kotz

Dartmouth Scholarship

A key feature of smart home devices is monitoring the environment and recording data. These devices provide security via motion-detection video alerts, cost-savings via thermostat usage history, and peace of mind via functions like auto-locking doors or water leak detectors. At the same time, the sharing of this information in interpersonal relationships---though necessary---is currently accomplished on an all-or-nothing basis. This can easily lead to oversharing in a multi-user environment. Although prior work has studied people's perceptions of information sharing with vendors or ISPs, the sharing of household data among users who interact personally is less well understood. Interpersonal situations make …

A Framework For Evaluating The Security And Privacy Of Smart-Home Devices, And Its Application To Common Platforms, Ravindra Mangar, Timothy Pierson, David Kotz

Dartmouth Scholarship

In this article, we outline the challenges associated with the widespread adoption of smart devices in homes. These challenges are primarily driven by scale and device heterogeneity: a home may soon include dozens or hundreds of devices, across many device types, and may include multiple residents and other stakeholders. We develop a framework for reasoning about these challenges based on the deployment, operation, and decommissioning life cycle stages of smart devices within a smart home. We evaluate the challenges in each stage using the well-known CIA triad—Confidentiality, Integrity, and Availability. In addition, we highlight open research questions at each stage. …

Hardening Interpretable Deep Learning Systems: Investigating Adversarial Threats And Defenses, Eldor Abdukhamidov, Mohammed Abuhamad, Simon S. Woo, Eric Chan-Tin, Tamer Abuhmed

Computer Science: Faculty Publications and Other Works

Deep learning methods have gained increasing attention in various applications due to their outstanding performance. For exploring how this high performance relates to the proper use of data artifacts and the accurate problem formulation of a given task, interpretation models have become a crucial component in developing deep learning-based systems. Interpretation models enable the understanding of the inner workings of deep learning models and offer a sense of security in detecting the misuse of artifacts in the input data. Similar to prediction models, interpretation models are also susceptible to adversarial inputs. This work introduces two attacks, AdvEdge and AdvEdge + …

The Next Strike: Pioneering Forward-Thinking Attack Techniques With Rowhammer In Dram Technologies, Nakul Kochar

Theses

In the realm of DRAM technologies this study investigates RowHammer vulnerabilities in DDR4 DRAM memory across various manufacturers, employing advanced multi-sided fault injection techniques to impose attack strategies directly on physical memory rows. Our novel approach, diverging from traditional victim-focused methods, involves strategically allocating virtual memory rows to their physical counterparts for more potent attacks. These attacks, exploiting the inherent weaknesses in DRAM design, are capable of inducing bit flips in a controlled manner to undermine system integrity. We employed a strategy that compromised system integrity through a nuanced approach of targeting rows situated at a distance of two rows …

Measuring Confidentiality With Multiple Observables, John J. Utley

Computer Science Senior Theses

Measuring the confidentiality of programs that need to interact with the outside world can prevent leakages and is important to protect against dangerous attacks. However, information propagation is difficult to follow through a large program with implicit information flow, tricky loops, and complicated instructions. Previous works have tackled this problem in several ways but often measure leakage a program has on average rather than the leakage produced by a set of particularly compromising interactions. We introduce new methods that target a specific set of observables revealed throughout execution to cut down on the resources needed for analysis. Our implementation examines …

Whisper: Proximity-Based Authentication For Securely Sharing Secrets, Charles A. Vogel

Computer Science Senior Theses

Cryptography offers a wide arsenal of encryption methods to enable secure communication between two
devices that have already exchanged a shared secret. Existing techniques for exchanging a shared secret,
however, are often vulnerable to man-in-the-middle attacks, require special hardware for out-of-band com-
munications, or require a pre-existing Internet connection. With the constantly increasing prevalence of
Internet of Things (IoT) devices sharing sensitive information via wireless networks, the need for a method
to establish secure communication is more pressing than ever.
With this context, we present Whisper, a novel technique that combines elements of digital commu-
nication theory, cryptography, and probability …

We Need A “Building Inspector For Iot” When Smart Homes Are Sold, Timothy J. Pierson, Cesar Arguello, Beatrice Perez, Wondimu Zegeye, Kevin Kornegay, Carl A. Gunter

Dartmouth Scholarship

Internet of Things (IoT) devices left behind when a home is sold create security and privacy concerns for both prior and new residents. We envision a specialized “building inspector for IoT” to help securely facilitate transfer of the home.

Monero: Powering Anonymous Digital Currency Transactions, Jake Braddy

Theses/Capstones/Creative Projects

Cryptocurrencies rely on a distributed public ledger (record of transactions) in order to perform their intended functions. However, the public’s ability to audit the network is both its greatest strength and greatest weakness: Anyone can see what address sent currency, and to whom the currency was sent. If cryptocurrency is ever going to take some of the responsibility of fiat currency, then there needs to be a certain level of confidentiality. Thus far, Monero has come out on top as the preferred currency for embodying the ideas of privacy and confidentiality. Through numerous cryptographic procedures, Monero is able to obfuscate …

Attribute-Hiding Fuzzy Encryption For Privacy-Preserving Data Evaluation, Zhenhua Chen, Luqi Huang, Guomin Yang, Willy Susilo, Xingbing Fu, Xingxing Jia

Research Collection School Of Computing and Information Systems

Privacy-preserving data evaluation is one of the prominent research topics in the big data era. In many data evaluation applications that involve sensitive information, such as the medical records of patients in a medical system, protecting data privacy during the data evaluation process has become an essential requirement. Aiming at solving this problem, numerous fuzzy encryption systems for different similarity metrics have been proposed in literature. Unfortunately, the existing fuzzy encryption systems either fail to achieve attribute-hiding or achieve it, but are impractical. In this paper, we propose a new fuzzy encryption scheme for privacy-preserving data evaluation based on overlap …

Stealthy Backdoor Attack For Code Models, Zhou Yang, Bowen Xu, Jie M. Zhang, Hong Jin Kang, Jieke Shi, Junda He, David Lo

Research Collection School Of Computing and Information Systems

Code models, such as CodeBERT and CodeT5, offer general-purpose representations of code and play a vital role in supporting downstream automated software engineering tasks. Most recently, code models were revealed to be vulnerable to backdoor attacks. A code model that is backdoor-attacked can behave normally on clean examples but will produce pre-defined malicious outputs on examples injected with that activate the backdoors. Existing backdoor attacks on code models use unstealthy and easy-to-detect triggers. This paper aims to investigate the vulnerability of code models with backdoor attacks. To this end, we propose A (dversarial eature as daptive Back). A achieves stealthiness …

Decentralized Multimedia Data Sharing In Iov: A Learning-Based Equilibrium Of Supply And Demand, Jiani Fan, Minrui Xu, Jiale Guo, Lwin Khin Shar, Jiawen Kang, Dusit Niyato, Kwok-Yan Lam

Research Collection School Of Computing and Information Systems

The Internet of Vehicles (IoV) has great potential to transform transportation systems by enhancing road safety, reducing traffic congestion, and improving user experience through onboard infotainment applications. Decentralized data sharing can improve security, privacy, reliability, and facilitate infotainment data sharing in IoVs. However, decentralized data sharing may not achieve the expected efficiency if there are IoV users who only want to consume the shared data but are not willing to contribute their own data to the community, resulting in incomplete information observed by other vehicles and infrastructure, which can introduce additional transmission latency. Therefore, in this paper, by modeling the …

Locally Tight Programs, Jorge Fandinno, Vladimir Lifschitz, Nathan Temple

Computer Science Faculty Publications

Program completion is a translation from the language of logic programs into the language of first-order theories. Its original definition has been extended to programs that include integer arithmetic, accept input, and distinguish between output predicates and auxiliary predicates. For tight programs, that generalization of completion is known to match the stable model semantics, which is the basis of answer set programming. We show that the tightness condition in this theorem can be replaced by a less restrictive “local tightness” requirement. From this fact we conclude that the proof assistant ANTHEM-P2P can be used to verify equivalence between locally tight …

Locally Tight Programs, Jorge Fandinno, Vladimir Lifschitz, Nathan Temple

Computer Science Faculty Publications

Program completion is a translation from the language of logic programs into the language of first-order theories. Its original definition has been extended to programs that include integer arithmetic, accept input, and distinguish between output predicates and auxiliary predicates. For tight programs, that generalization of completion is known to match the stable model semantics, which is the basis of answer set programming. We show that the tightness condition in this theorem can be replaced by a less restrictive “local tightness” requirement. From this fact we conclude that the proof assistant ANTHEM-P2P can be used to verify equivalence between locally tight …

Determining Critical Nodes In Optimal Cost Attacks On Networked Infrastructures, Ishfaq Ahmad, Addison Clark, Muhammad Ali, Hansheng Lei, David Ferris, Alex Aved

Informatics and Engineering Systems Faculty Publications

A wide range of critical infrastructures are connected via wide area networks as well as the Internet-of-Thing (IoT). Apart from natural disasters, these infrastructures, providing services such as electricity, water, gas, and Internet, are vulnerable to terrorist attacks. Clearly, damages to these infrastructures can have dire consequences on economics, health services, security and safety, and various business sectors. An infrastructure network can be represented as a directed graph in which nodes and edges denote operation entities and dependencies between entities, respectively. A knowledgeable attacker who plans to harm the system would aim to use the minimum amount of effort, cost, …

Mobilytics: Mobility Analytics Framework For Transferring Semantic Knowledge, Shreya Ghosh, Soumya K. Ghosh, Sajal K. Das, Prasenjit Mitra

Computer Science Faculty Research & Creative Works

The proliferation of sensor-equipped smartphones has led to the generation of vast amounts of GPS data, such as timestamped location points, enabling a range of location-based services. However, deciphering the spatio-temporal dynamics of mobility to understand the underlying motivations behind travel patterns presents a significant challenge. his paper focuses on how individuals' GPS traces (latitude, longitude, timestamp) interpret the connection and correlations among different entities such as people, locations or point-of-interests (POIs), and semantic contexts (trip-purpose). We introduce a mobility analytics framework, named Mobilytics designed to identify trip purposes from individual GPS traces by leveraging a “mobility knowledge graph” (MKG) …

Secure Location-Based Authenticated Key Establishment Scheme For Maritime Communication, Saurabh Agrawal, Anusha Vangala, Ashok Kumar Das, Neeraj Kumar, Sachin Shetty, Sajal K. Das

Computer Science Faculty Research & Creative Works

Maritime communication helps vessels and ports plan their movements, exchange environmental information, and communicate among themselves. The vessels' movement and changing location are critical to keep them secure from data interception and data tampering by unauthorized parties during transmission. To secure maritime communication, we propose a novel lightweight authentication scheme sensitive to the current ship location. We assess the effectiveness of the proposed protocol in defending against a range of security threats while keeping communication and computation costs low and meeting the desired security and functional requirements of anonymity and untraceability. The detailed security analysis using the widely accepted Scyther …

Trusted Digital Twin Network For Intelligent Vehicles, Asad Malik, Ayan Roy, Sanjay Madria

Computer Science Faculty Research & Creative Works

Vehicle-to-vehicle (V2V) infrastructure facilitates wireless communication among vehicles within close proximity. This allows sharing of contextual information such as speed, location, direction, traffic, route closures, human behavior mental conditions to improve traffic flow, reduce collisions, and enhance safety on the road. However, the assumption of honest peers along with the over-reliability on the information shared in the network can pose a serious threat to human safety. A digital twin is a concept that enables a system to develop a virtual environment that mimics the real-life scenario for any situation. The availability of powerful computing equipment inside vehicles can be leveraged …

On Vulnerabilities Of Building Automation Systems, Michael Cash

Graduate Thesis and Dissertation 2023-2024

Building automation systems (BAS) have become more commonplace in personal and commercial environments in recent years. They provide many functions for comfort and ease of use, from automating room temperature and shading, to monitoring equipment data and status. Even though their convenience is beneficial, their security has become an increased concerned in recent years. This research shows an extensive study on building automation systems and identifies vulnerabilities in some of the most common building communication protocols, BACnet and KNX. First, we explore the BACnet protocol, exploring its Standard BACnet objects and properties. An automation tool is designed and implemented to …

Attitudes And Perceptions Towards Privacy And Surveillance In Australia, Aleatha J. Shanley

Theses: Doctorates and Masters

Understanding attitudes towards privacy and surveillance technologies used to enhance security objectives is a complex, but crucial aspect for policy makers to consider. Historically, terrorism-related incidents justified the uptake of surveillance practices. More recently however, biosecurity concerns have motivated nation-states to adopt more intrusive surveillance measures. There is a growing body of literature that supports the public’s desire to maintain privacy despite fears of biological or physical threats.

This research set out to explore attitudes towards privacy and surveillance in an Australian context. Throughout the course of this endeavour, the COVID-19 pandemic emerged bringing with it a variety of track …

Enhancing Resilience In The Australian Security Vetting Process: Application Of The Psycho-Social Resources For Resilience Scale – Vetting (Prrs-V), Alan James Jnr Davies

Theses: Doctorates and Masters

The disclosure or leaking of classified information by a trusted insider is an ongoing challenge for the national security apparatus in Australia and globally (Auditor General, 2018; Scott, 2020). In an effort to ensure that those with access to sensitive information will not disclose it, the Australian Government has a security vetting process. The Australian security vetting process measures a person's integrity by conducting a 'whole of person' assessment against several suitability indicators. In 2015, the Australian Government added resilience as a suitability indicator to its prescribed guidance on personnel security vetting, the Personnel Security Eligibility and Suitability of Personnel …