Computer Sciences Commons^™

Towards Detection And Control Of Civilian Unmanned Aerial Vehicles, Matthew Peacock, Michael N. Johnstone

Australian Information Warfare and Security Conference

Considering the significant number of non‐military unmanned aerial vehicles (UAVs) that can be purchased to operate in unregulated air space and the range of such devices, the potential for security and privacy problems to arise is significant. This can lead to consequent harm for critical infrastructure in the event of these UAVs being used for criminal or terrorist purposes. Further, if these devices are not being detected, there is a privacy problem to be addressed as well. In this paper we test a specific UAV, the Parrot AR Drone version 2, and present a forensic analysis of tests used to …

Privacy And Legal Issues In Cloud Computing - The Smme Position In South Africa, Mathias Mujinga

Australian Information Security Management Conference

Cloud computing (CC) brings substantial benefits to organizations and their clients. Information technology (IT) users in developing countries, especially those in underdeveloped communities, are gaining easy and cost‐effective access to a variety of services, from entertainment to banking. South Africa has outlined a national e‐strategy that aims to improve those communities, by providing frameworks for access to information and communications technology (ICT). The products and services of small‐, medium and micro‐sized enterprises (SMME) are now reaching a wider audience through the use of technology. CC can go a long way to help government realize the national e‐strategy. There are numerous …

A 2013 Study Of Wireless Network Security In New Zealand: Are We There Yet?, Alastair Nisbet

Australian Information Security Management Conference

This research examines the current level of security in wireless networks in New Zealand. A comprehensive wardrive covering the length of the country was made in January 2013 to ensure accurate comparisons from two previous wardrives as well as comparisons between the four main cities and the suburbs can be made. With 16 years since the introduction of the original IEEE 802.11 wireless standard having passed, an examination is made of the current state of wireless security of networks throughout New Zealand and the Auckland suburbs, and where possible compares these results with similar studies undertaken in 2004 and 2011. …

A Secure And Effective Anonymous User Authentication Scheme For Roaming Service In Global Mobility Networks, Fengtong Wen, Willy Susilo, Guomin Yang

Research Collection School Of Computing and Information Systems

In global mobility networks, anonymous user authentication is an essential task for enabling roaming service. In a recent paper, Jiang et al. proposed a smart card based anonymous user authentication scheme for roaming service in global mobility networks. This scheme can protect user privacy and is believed to have many abilities to resist a range of network attacks, even if the secret information stored in the smart card is compromised. In this paper, we analyze the security of Jiang et al.’s scheme, and show that the scheme is in fact insecure against the stolen-verifier attack and replay attack. Then, we …

Securing Information Technology In Healthcare, Denise Anthony, Andrew T. Campbell, Thomas Candon, Andrew Gettinger, David Kotz, Lisa A. Marsch, Andrés Molina-Markham, Karen M. Page, Sean W. Smith, Carl A. Gunter, M. Eric Johnson

Dartmouth Scholarship

Information technology (IT) has great potential to improve healthcare quality while also improving efficiency, and thus has been a major focus of recent healthcare reform efforts. However, developing, deploying and using IT that is both secure and genuinely effective in the complex clinical, organizational and economic environment of healthcare is a significant challenge. Further, it is imperative that we better understand the privacy concerns of patients and providers, as well as the ability of current technologies, policies, and laws to adequately protect privacy. The Securing Information Technology in Healthcare (SITH) workshops were created to provide a forum to discuss security …

Improved Kernel Security Through Code Validation, Diversification, And Minimization, Dannie Michael Stanley

Open Access Dissertations

The vast majority of hosts on the Internet, including mobile clients, are running one of three commodity, general-purpose operating system families. In such operating systems the kernel software executes at the highest processor privilege level. If an adversary is able to hijack the kernel software then by extension he has full control of the system. This control includes the ability to disable protection mechanisms and hide evidence of compromise.

The lack of diversity in commodity, general-purpose operating systems enables attackers to craft a single kernel exploit that has the potential to infect millions of hosts. If enough variants of the …

Mitigating Event Confidentiality Violations In Smart Grids: An Information Flow Security-Based Approach, Thoshitha T. Gamage, Thomas P. Roth, Bruce M. Mcmillin, Mariesa L. Crow

Computer Science Faculty Research & Creative Works

Modern smart grids, by and large, merge physical interconnections and cyber controllers. Invariably, this tight coupling results in cyber commands manifesting in the physical layer as observable changes, leading to possible disclosure of sensitive system settings. Thus, cyber event confidentiality of the smart grid is violated. Attacks on confidentiality can ultimately lead to integrity and availability attacks; with adequate knowledge of the system topology, internal settings, and how the physical layer responds to cyber commands, a malicious adversary gains knowledge to attack the system. This work shows how to develop self-obfuscating systems based on information flow security properties that can …

Securearray: Improving Wifi Security With Fine-Grained Physical-Layer, Jie Xiong, Kyle Jamieson

Research Collection School Of Computing and Information Systems

Despite the important role that WiFi networks play in home and enterprise networks they are relatively weak from a security standpoint. With easily available directional antennas, attackers can be physically located off-site, yet compromise WiFi security protocols such as WEP, WPA, and even to some extent WPA2 through a range of exploits specific to those protocols, or simply by running dictionary and human-factors attacks on users' poorly-chosen passwords. This presents a security risk to the entire home or enterprise network. To mitigate this ongoing problem, we propose SecureArray, a system designed to operate alongside existing wireless security protocols, adding defense …

A Similarity Measure For Comparing Xacml Policies, Dan Lin, Prathima Rao, Rodolfo Ferrini, Elisa Bertino, Jorge Lobo

Computer Science Faculty Research & Creative Works

Assessing similarity of policies is crucial in a variety of scenarios, such as finding the cloud service providers which satisfy users' privacy concerns or finding collaborators which have matching security and privacy settings. Existing approaches to policy similarity analysis are mainly based on logical reasoning and Boolean function comparison. Such approaches are computationally expensive and do not scale well for large heterogeneous distributed environments (like the cloud). In this paper, we propose a policy similarity measure as a lightweight ranking approach to help one party quickly locate parties with potentially similar policies. In particular, given a policy P, the similarity …

Forensic Analysis Of Whatsapp On Android Smartphones, Neha S. Thakur

LSU New Orleans Theses and Dissertations

Android forensics has evolved over time offering significant opportunities and exciting challenges. On one hand, being an open source platform Android is giving developers the freedom to contribute to the rapid growth of the Android market whereas on the other hand Android users may not be aware of the security and privacy implications of installing these applications on their phones. Users may assume that a password-locked device protects their personal information, but applications may retain private information on devices, in ways that users might not anticipate. In this thesis we will be concentrating on one such application called 'WhatsApp', a …

Is Security Sustainable?, Jeremy W. Crampton

Geography Faculty Publications

No abstract provided.

Dynamic Near Field Communication Pairing For Wireless Sensor Networks, Steven Charles Cook

Theses and Dissertations

Wireless sensor network (WSN) nodes communicate securely using pre-installed cryptographic keys. Although key pre-installation makes nodes less expensive, the technical process of installing keys prevents average users from deploying and controlling their own WSNs. Wireless pairing enables users to set up WSNs without pre-installing keys, but current pairing techniques introduce numerous concerns regarding security, hardware expense, and usability. This thesis introduces dynamic Near Field Communication (NFC) pairing, a new pairing technique designed for WSNs. This pairing overcomes the limitations of both key pre-installation and current pairing techniques. Dynamic NFC pairing is as secure as using pre-installed keys, requires only inexpensive …

An Efficient And Probabilistic Secure Bit-Decomposition, Bharath K.K. Samanthula, Hu Chun, Wei Jiang

Computer Science Faculty Research & Creative Works

Many secure data analysis tasks, such as secure clustering and classification, require efficient mechanisms to convert the intermediate encrypted integers into the corresponding encryptions of bits. The existing bit-decomposition algorithms either do not offer sufficient security or are computationally inefficient. In order to provide better security as well as to improve efficiency, we propose a novel probabilistic-based secure bit-decomposition protocol for values encrypted using public key additive homomorphic encryption schemes. The proposed protocol guarantees security as per the semi-honest security definition of secure multi-party computation (MPC) and is also very efficient compared to the existing method. Our protocol always returns …

A Secure And Fair Resource Sharing Model For Community Clouds, Santhosh S. Anand

Graduate Theses and Dissertations

Cloud computing has gained a lot of importance and has been one of the most discussed segment of today's IT industry. As enterprises explore the idea of using clouds, concerns have emerged related to cloud security and standardization. This thesis explores whether the Community Cloud Deployment Model can provide solutions to some of the concerns associated with cloud computing. A secure framework based on trust negotiations for resource sharing within the community is developed as a means to provide standardization and security while building trust during resource sharing within the community. Additionally, a model for fair sharing of resources is …

Hybrid Spread-Spectrum Tcp For Combating Fraudulent Cyber Activities Against Reconnaissance Attacks, Simon Enoch Yusuf, Olumide Longe

The African Journal of Information Systems

The inefficiencies of current intrusion detection system against fraudulent cyber activities attracts the attention of computer gurus, also known as “hackers” to exploit known weakness on a particular host or network. These hackers are expert programmers who mainly focus on how the Internet works, and they interact with each other to know its strengths and weaknesses. Then they develop advanced tools which an average attacker with little background can use to know the liveness, reachability and running service on the network. Once an attacker identifies these details, he can accurately launch an effective attack and get maximum benefit out of …

Raising The Game: Applying Theory And Analytics To Real-World Threats, Singapore Management University

Perspectives@SMU

Safety and security are, on many levels, essential priorities for governments, businesses and individuals. While an increase of defence and security budgets may bring some assurance of peaceful times to come, it seems the world has no lack of insane perpetrators who can still somehow evade, breach, ambush, assail and attack as they please. Enter the “Bayesian Stackelberg Game”, a game theory model that can, and has been applied rather successfully to the allocation of security resources in the United States by Prof Milind Tambe, University of Southern California.

Security Risks And Protection In Online Learning: A Survey, Yong Chen, Wu He

Distance Learning Faculty & Staff Publications

This paper describes a survey of online learning which attempts to determine online learning providers' awareness of potential security risks and the protection measures that will diminish them. The authors use a combination of two methods: blog mining and a traditional literature search. The findings indicate that, while scholars have identified diverse security risks and have proposed solutions to mitigate the security threats in online learning, bloggers have not discussed security in online learning with great frequency. The differences shown in the survey results generated by the two different methods confirm that online learning providers and practitioners have not considered …

Assessing The Role Of User Computer Self-Efficacy, Cybersecurity Countermeasures Awareness, And Cybersecurity Skills Toward Computer Misuse Intention At Government Agencies, Min Suk Choi

CCAC Theses and Dissertations

Cybersecurity threats and vulnerabilities are causing substantial financial losses for governments and organizations all over the world. Cybersecurity criminals are stealing more than one billion dollars from banks every year by exploiting vulnerabilities caused by bank users' computer misuse. Cybersecurity breaches are threatening the common welfare of citizens since more and more terrorists are using cyberterrorism to target critical infrastructures (e.g., transportation, telecommunications, power, nuclear plants, water supply, banking) to coerce the targeted government and its people to accomplish their political objectives. Cyberwar is another major concern that nations around the world are struggling to get ready to fight. It …

Application Of A Layered Hidden Markov Model In The Detection Of Network Attacks, Lawrence Taub

CCAC Theses and Dissertations

Network-based attacks against computer systems are a common and increasing problem. Attackers continue to increase the sophistication and complexity of their attacks with the goal of removing sensitive data or disrupting operations. Attack detection technology works very well for the detection of known attacks using a signature-based intrusion detection system. However, attackers can utilize attacks that are undetectable to those signature-based systems whether they are truly new attacks or modified versions of known attacks. Anomaly-based intrusion detection systems approach the problem of attack detection by detecting when traffic differs from a learned baseline. In the case of this research, the …

Defining And Preventing Code-Injection Attacks, Donald Ray

USF Tampa Graduate Theses and Dissertations

This thesis shows that existing definitions of code-injection attacks (e.g., SQL-injection attacks) are flawed. The flaws make it possible for attackers to circumvent existing mechanisms, by supplying code-injecting inputs that are not recognized as such. The flaws also make it possible for benign inputs to be treated as attacks. After describing these flaws in conventional definitions of code-injection attacks, this thesis proposes a new definition, which is based on whether the symbols input to an application get used as (normal-form) values in the application's output. Because values are already fully evaluated, they cannot be considered ``code'' when injected. This simple …

Utilizing Cyber Espionage To Combat Terrorism, Gary Adkins

Open Access Theses & Dissertations

The world has effectively exited the Industrial Age and is firmly planted in the Information Age. Global communication at the speed of light has been a great asset to both businesses and private citizens. However, there is a dark side to the age we live in, where terrorist groups are able to communicate, plan, fund, recruit, and spread their message to the world. The relative anonymity the internet provides hinders law enforcement and security agencies in not only locating would-be terrorists but also in disrupting their operations. The internet is a loosely knit group of computers and routers and is …

Opacity Of Discrete Event Systems: Analysis And Control, Majed Mohamed Ben Kalefa

Wayne State University Dissertations

The exchange of sensitive information in many systems over a network can be manipulated

by unauthorized access. Opacity is a property to investigate security and

privacy problems in such systems. Opacity characterizes whether a secret information

of a system can be inferred by an unauthorized user. One approach to verify security

and privacy properties using opacity problem is to model the system that may leak confidential

information as a discrete event system. The problem that has not investigated

intensively is the enforcement of opacity properties by supervisory control. In other

words, constructing a minimally restrictive supervisor to limit the system's …

Automated Detection Of Vehicles With Machine Learning, Michael N. Johnstone, Andrew Woodward

Australian Information Security Management Conference

Considering the significant volume of data generated by sensor systems and network hardware which is required to be analysed and intepreted by security analysts, the potential for human error is significant. This error can lead to consequent harm for some systems in the event of an adverse event not being detected. In this paper we compare two machine learning algorithms that can assist in supporting the security function effectively and present results that can be used to select the best algorithm for a specific domain. It is suggested that a naive Bayesian classiifer (NBC) and an artificial neural network (ANN) …

Exploiting Human Factors In User Authentication, Payas Gupta

Dissertations and Theses Collection (Open Access)

Our overarching issue in security is the human factor – and dealing with it is perhaps one of the biggest challenges we face today. Human factor is often described as the weakest part of a security system and users are often described as the weakest link in the security chain. In this thesis, we focus on two problems which are caused by human factors in user authentication and propose respective solutions. a) Secrecy information inference attack – publicly available information can be used to infer some secrecy information about the user. b) Coercion attack – where an attacker forces a …

Physical Unclonable Function Techniques Applied For Digital Hardware Protection, Anthony Barrera

Dissertations and Theses

"Privacy is an important property that is growing harder to keep as people develop new ways to steal information from users on their computers. Software alone cannot ensure privacy since an infected system is untrustworthy. This paper presents several challenges malware brings that can be solved by using an external processor. Techniques such as keystroke encryption and message authentication can be used to protect users from having their passwords and other private data stolen. To take advantage of the external hardware, a physical unclonable function can be used to generate private keys without the need for storing them in memory. …

Secure Key Deployment And Exchange Protocol For Manet Information Management, Brian Cusack, Alastair Nisbet

Australian Digital Forensics Conference

Secure Key Deployment and Exchange Protocol (SKYE) is an innovative encryption Key Management Scheme (KMS) based on a combination of features from recent protocols combined with new features for Mobile Ad Hoc Networks (MANETs). The design focuses on a truly ad hoc networking environment where geographical size of the network, numbers of network members and mobility of the members is all unknown before deployment. This paper describes the process of development of the protocol and the application to system design to assure information security and potential evidential retention for forensic purposes. Threshold encryption key management is utilized and simulation results …

Understanding The Vulnerabilities In Wi-Fi And The Impact On Its Use In Cctv Systems, Michael Coole, Andrew Woodward, Craig Valli

Australian Security and Intelligence Conference

Modern surveillance devices are increasingly being taken off private networks and placed onto networks connected via gateway to the Internet or into Wi-Fi based local area wireless networks (LAWN). The devices are also increasingly using IPv4 and IPv6 network stacks and some form of embedded processing or compute built in. Additionally, some specialist devices are using assistive technologies such as GPS or A-GPS. This paper explored the issues with use of the technologies in a networked environment, both wireless and internetworked. Analysis of these systems shows that the use of IP based CCTV systems carries greater risk than traditional CCTV …

The Regulation Of Space And Cyberspace: One Coin, Two Sides, Brett Biddington

Australian Information Warfare and Security Conference

In the 1960s, during some very tense days in the Cold War the United States of America (USA) and the Union of Socialist Soviet Republics (USSR) brokered a deal in the United Nations for a treaty regime to govern human activities in outer space. This regime has served well enough for almost 50 years. In recent years, however, fears of space weaponisation, the proliferation of space debris in the Low Earth Orbits (LEO) and increasing demands on the electromagnetic spectrum (EMS) have led to demands for regulatory reform. Some nations now consider space to be the fourth domain of modern …

Forensic Readiness For Wireless Medical Systems, Brian Cusack, Ar Kar Kyaw

Australian Digital Forensics Conference

Wireless medical devices and related information systems are vulnerable to use and abuse by unauthorized users. Medical systems are designed for a range of end users in different professional skill groups and also people who carry the devices in and on their bodies. Open, accurate and efficient communication is the priority for medical systems and as a consequence strong protection costs are traded against the utility benefits for open systems. Flexible security provisions are required and strong forensic capabilities built into the systems to treat the risk. In this paper we elaborate the problem area and discuss potential solutions to …

Three Point Encryption (3pe): Secure Communications In Delay Tolerant Networks, Roy Cabaniss, Vimal Kumar, Sanjay Madria

Computer Science Faculty Research & Creative Works

Mobile ad hoc networks (MANET) are a subset of Delay Tolerant Networks (DTNs) composed of several mobile devices. These dynamic environments make conventional security algorithms unreliable, nodes that are far apart may not have access to the other's public key, making secure message exchange difficult. Other security methods rely on requesting the key from a trusted third party, which can be unavailable in DTN. the purpose of this paper is to introduce two message security algorithms capable of delivering messages securely against either eavesdropping or manipulation. the first algorithm, Chaining, uses multiple midpoints to re-encrypt the message for the destination …