Cybersecurity Commons^™

A Systematic Review And Taxonomy For Privacy Breach Classification: Trends, Gaps, And Future Directions, Clint Fuchs, John Hastings

Research & Publications

In response to the rising frequency and complexity of data breaches and evolving global privacy regulations, this study presents a comprehensive examination of academic literature on the classification of privacy breaches and violations between 2010-2024. Through a systematic literature review, a corpus of screened studies was assembled and analyzed to identify primary research themes, emerging trends, and gaps in the field. A novel taxonomy is introduced to guide efforts by categorizing research efforts into seven domains: breach classification, report classification, breach detection, threat detection, breach prediction, risk analysis, and threat classification. An analysis reveals that breach classification and detection dominate …

T3-Ciders: Train-The-Trainer And Community Building To Increase Cyberinfrastructure Adoption In Cybersecurity Research And Education, Wirawan Purwanto, Mohan Yang, Peng Jiang, Shanan Chappell Moots, Masha Sosonkina, Hongyi Wu

University Administration Publications

T³-CIDERS is a train-the-trainer program to increase the adoption of advanced cyberinfrastructure (CI) and data skills into the fabric of research and education in cybersecurity and cyber-related disciplines. T³-CIDERS trains faculty, researchers, and students as “future trainers” (FTs) with hands-on technical and instructional skills to enable more people to effectively leverage CI in cybersecurity. The program includes a series of technical pre-training modules, a weeklong summer institute, ongoing learning engagements conducted over an academic year; it culminates with the FTs conducting locally tailored CI-infused training events at their respective home institutions. Ultimately, T³-CIDERS aims to build a “CI+cybersecurity” community of …

Watchdogs Or Lapdogs: How Audit Committees Influence Financial Reporting Quality And Cybersecurity, Yanru Yang

2025

With the increasing complexity of the business environment, the role of corporate governance and oversight is expanding continuously. Grounded in archival research, my dissertation consists of three studies that explore the features of audit committees in monitoring both financial reporting and broader areas, such as cybersecurity.

The first paper, co-authored with Gopal Krishnan and Wei Yu, examines the implications of audit committee (AC) director departure for financial reporting quality and audit risk. We find that the departures in the firms with most concerning AC departures are associated with a higher likelihood of a future “Big R” restatement announcement and auditor …

Exploring Research And Tools In Ai Security: A Systematic Mapping Study, Sidhant Narula, Mohammad Ghasemigol, Javier Carnerero-Cano, Amanda Minnich, Emil Lupu, Daniel Takabi

School of Cybersecurity Faculty Publications

With the pervasive integration of artificial intelligence (AI) in various facets of modern technology, the importance of AI security has been thrust into the spotlight. The field is rapidly evolving, with new challenges and solutions emerging at a swift pace. However, the breadth and depth of AI security research have not been comprehensively mapped in recent times, presenting a crucial need for an extensive review and synthesis of existing literature. Given the increasing reliance on AI in critical domains such as healthcare, finance, and national security, ensuring the resilience and trustworthiness of these systems is imperative. This survey fulfills the …

A Governance-Centric Framework For Strengthening Healthcare Cybersecurity: A Systems Perspective, Sujatha Alla, Sai Gireesh Komaragiri, Teresa Duvall, Satluk Karahan, Nagesh Bheesetty, Vijay Kumar Chattu

Engineering Management & Systems Engineering Faculty Publications

Healthcare systems face unprecedented security and privacy challenges due to increasing digitization and interconnectedness. This paper provides a comprehensive analysis of these challenges by examining various cyberattacks, defensive mechanisms, and governance frameworks within modern healthcare infrastructure. The research systematically categorizes prevalent security threats, such as ransomware, insider threats, and data breaches, identifying vulnerabilities specific to healthcare systems. Furthermore, the study evaluates current defensive strategies, including encryption techniques, access control systems, and intrusion detection tools, assessing their effectiveness against complex cyber threats. A key focus is placed on governance structures and their role in cybersecurity resilience. The research explores how regulatory …

Potsdam: Pareto Optimization Targeting Security, Data, And Mediation, J Peter Brady

Dartmouth College Ph.D Dissertations

Given the growing amount and variety of data handled by modern systems, it is crucial to guarantee the accuracy and protection of input data without errors or malicious intentions. The need to improve security in software programs often conflicts with the assurance of maximum performance, making developers and maintainers hesitant to incorporate more testing.

LangSec (Language-Theoretic Security) is a security approach that treats input validation as a formal language recognition problem, ensuring that only well-defined, unambiguous inputs are processed to eliminate exploitable parsing flaws. This dissertation explores integrating LangSec principles with Pareto optimization to enhance safety and robustness in digital …

Machine Learning Methods For Intrusion Detection And Response In Network Security, Ayomide Oyemaja

College of Graduate Studies: Theses & Dissertations

Intrusion Detection Systems (IDS) play a crucial role in computer network security by identifying malicious activities and potential cyberattacks. This thesis combines machine learning and cybersecurity by applying Reinforcement Learning (RL) in intrusion detection and response using the NSL-KDD dataset.

We designed and implemented a Q-learning framework where an agent learns to classify network traffic over time by interacting with the environment and receiving rewards based on detection accuracy. We also look at the importance of feature selection and classification techniques and how effective they are in improving model performance, reducing the complexity of computation, and producing more desirable results. …

Dynamic Analysis Of Malware Detection Using Customized Payloads: Examining The Effectiveness Of Manual And Automated Approaches In Web Applications, Jiban Krisna Das

College of Graduate Studies: Theses & Dissertations

Web applications are becoming the prime targets for cyber-attacks, where SQL injection (SQLi) and Cross Site Scripting (XSS) are the most exploited vulnerabilities. The study explores a novel approach using customized payloads to examine the effectiveness of manual and automated techniques of malware detection. This dynamic approach can effectively generate attack payloads and identify the vulnerabilities in a website thereby strengthening website security measures. This research focuses on dynamic analysis in a controlled environment while testing and analyzing SQL and XSS payloads under varying security conditions. This quantitative analysis involves crafting targeted payloads to bypass Web Application Firewall (WAF) filters …

A Comprehensive Exploration Of 6g Wireless Communication Technologies, Md Nurul Absar Siddiky, Muhammad Enayetur Rahman, Md. Shahriar Uzzal, H. M. Dipu Kabir

Electrical & Computer Engineering Faculty Publications

As the telecommunications landscape braces for the post-5G era, this paper embarks on delineating the foundational pillars and pioneering visions that define the trajectory toward 6G wireless communication systems. Recognizing the insatiable demand for higher data rates, enhanced connectivity, and broader network coverage, we unravel the evolution from the existing 5G infrastructure to the nascent 6G framework, setting the stage for transformative advancements anticipated in the 2030s. Our discourse navigates through the intricate architecture of 6G, highlighting the paradigm shifts toward superconvergence, non-IP-based networking protocols, and information-centric networks, all underpinned by a robust 360-degree cybersecurity and privacy-by-engineering design. Delving into …

Securing Secrets: Exploring The Aes Encryption And Key Security Capabilities Of Chatgpt, Kayla Taylor

Student Works

The development and increasing accessibility of generative artificial intelligence (AI) tools and large language models (LLMs) have allowed cryptographers to explore a variety of cryptanalysis problems in dynamic and interactive ways. Prompt engineering, the process by which input text is tested and refined to elicit a desired response from LLMs, is a nascent area of research that remains largely unexplored in many contexts, including cryptography. This study will explore the potential applications and limitations of prompt engineering in the context of Advanced Encryption Standard (AES) encryption and key security with OpenAI’s ChatGPT (GPT-4o) through two main objectives: First, given a …

Safeguard Cyberspace In Ransomware Era: Risk Analysis & Cyber Insurance, Li Huang

Electronic Theses & Dissertations (2024 - present)

The increasing frequency and severity of ransomware attacks pose significant challenges for organizational cybersecurity. Fragmentation across disciplines in cyber defense has created practical gaps in the development of the necessary capabilities needed to address rapidly evolving cyber threats. This study explores the impact of ransomware attacks and the evolving role of cyber insurance as a proactive cybersecurity partner. Bridging the gap between actuarial science and cyber risk management, it proposes an interdisciplinary framework that quantifies the impact of ransomware and integrates cyber insurance into cybersecurity strategies.

The primary contribution of this study is methodology. We present a framework that remains …

Qos-Aware Link Adaptation For Beyond 5g Networks: A Deep Reinforcement Learning Approach, Ali Parsa, Neda Moghim, Sachin Shetty

Center for Secure and Intelligent Critical Systems (CSICS) Publications

Modern wireless communication systems face increasingly complex challenges due to rapidly changing channel conditions and the growing diversity of application-specific Quality of Service (QoS) requirements. Traditional link adaptation mechanisms primarily aim to maximize throughput and often lack the flexibility to support emerging applications, such as Extended Reality (XR) and Virtual Reality (VR), which demand simultaneous guarantees for high data rates, ultra low latency, and high reliability. These stringent and multidimensional QoS needs call for more intelligent and adaptive solutions. In this paper, we propose QDRLLA (QoS-aware Deep Reinforcement Learning-based Link Adaptation), a novel framework that employs deep reinforcement learning to …

A Trust-By-Learning Framework For Secure 6g Wireless Networks Under Native Generative Ai Attacks, Md Shirajum Munir, Sravanthi Proddatoori, Manjushree Muralidhara, Trinidad Mario Dena, Walid Saad, Zhu Han, Sachin Shetty

Center for Secure and Intelligent Critical Systems (CSICS) Publications

Sixth-generation (6G) wireless networks will become vulnerable due to native generative AI (GenAI)-driven intelligent poisoning attacks in both the radio unit and the core network. In particular, network parameters and metrics in cross-layer design pose fundamentally uncertain conditions and can be compromised through the native GenAI mechanism, which leverages data augmentation and reconstruction capabilities. This work investigates the capabilities of native GenAI to create novel poisoning attacks in wireless networks, while investigating their impact through uncertainty-informed root analysis. Then, detected attacks are mitigated by developing a trustworthy service aggregation in the wireless network. First, a joint decision problem is formulated …

Studies On Convexity Of Dnf Formulae, Josue A. Ruiz

Electronic Theses & Dissertations (2024 - present)

In this dissertation, we investigate the problem of determining whether a Boolean formula given in disjunctive normal form (DNF) is convex. Although Boolean formulas have various applications, our research focuses on the practical application for rule-based access control policies, where policies are often expressed as a set of Boolean rules. Understanding the structural properties of such formulas is crucial for determining whether a policy can be efficiently represented within a specific access control model.

The main contribution of this research is the conception and analysis of convexity derived from the “gap problem.” In this context, convexity is characterized by the …

Problem-Centered Post-Secondary Computer Science Education: A Study Of The Private Artificial Intelligence Curriculum, Golnoush Haddadian, Prajwal Panzade, Daniel Takabi, Min Kyu Kim

School of Cybersecurity Faculty Publications

In response to the demand for Artificial Intelligence (AI) experts, this study introduced a curriculum development initiative. The aim was to design and implement a Private AI curriculum to understand the computer science (CS) students’ evaluations of the curricular activities and their levels of interest and motivation. Twenty-five students, a mix of undergraduates and graduates, were recruited and a scaled-down version of the curriculum was implemented. A parallel mixed-methods approach was employed. The results reinforced the significance of problem-centered curricula in CS context. Students rated the curricular activities highly and demonstrated strong motivation; however, graduates expressed more favorable view of …

Privacy-Preserved And Incentivized Knowledge Sharing For Reinforced-Learning Based Iot Platform Security, Weichao Wang, Md Morshed Alam, Yu Wang

School of Cybersecurity Faculty Publications

With the fast development and deep penetration of IoT devices and smart environments, using localized machine learning models to detect malicious activities has also been developed and deployed. However, these isolated learning models and results cannot be effectively federated together because of privacy concerns and lack of incentivization. This paper proposed several mechanisms to solve the problem. A verification method was designed for phased learning results to protect user privacy and prevent individual parties from manipulating the verification selection. The paper also presented an incentive method based on delay of distribution of the latest federated learning results. Extensive simulations were …

Security Enhancement In Uav Swarms: A Case Study Using Federated Learning And Shap Analysis, Sushmitha Halli Sudhakara, Lida Haghnegahdar

School of Cybersecurity Faculty Publications

As cyber-physical systems (CPSs) increasingly integrate physical and digital realms, securing critical infrastructure, such as the Port of Virginia, becomes paramount. Among CPSs, Unmanned Aerial Vehicles (UAVs) are vital for monitoring, communication, and supporting the command and control through remote reconnaissance and surveillance missions. These UAV applications often require coordination, planning, and runtime reconfiguration, traditionally managed by human decision-makers. However, this approach has limitations, as extensively documented in the literature. Artificial Intelligence (AI) has emerged as a pivotal tool to address these limitations, enhancing risk mitigation and informed decision-making. This research proposes a machine learning (ML) based security mechanism, leveraging …

Deepsecure: A Novel Deep Learning Model For Effective Detection Of Attacks On Big Data In Internet Of Urban Things, Laiba Sabir, Nadeem Javaid, Mariam Akbar, Nabil Alrajeh, Safdar Hussain Bouk, Abdulaziz Aldegheishem

School of Cybersecurity Faculty Publications

The Internet of Urban Things (IoUTs) regularly generates large amounts of data, making it a focus of cyberthreats such as denial-of-service attacks and malware bot networks. Traditional intrusion detection systems struggle to detect intricate attack patterns, handle class imbalance, capture temporal dependencies, and exhibit transparency. To address these limitations, we introduce a novel deep machine learning model, DeepSecure, a hybrid model that combines Deep Belief Networks (DBN) for hierarchical feature extraction and Deep Neural Networks for attack classification. DBN is used for feature selection through unsupervised learning to extract hierarchical representations in the IoUTs network data. We assess the random …

Security Enhancement In Aav Swarms: A Case Study Using Federated Learning And Shap Analysis, Sushmitha Halli Sudhakara, Lida Haghnegahdar

School of Cybersecurity Faculty Publications

As cyber-physical systems (CPSs) increasingly integrate physical and digital realms, securing critical infrastructure, such as the Port of Virginia, becomes paramount. Among CPSs, Autonomous Aerial Vehicles (AAVs) are vital for monitoring, communication, and supporting the command and control through remote reconnaissance and surveillance missions. These AAV applications often require coordination, planning, and runtime reconfiguration, traditionally managed by human decision-makers. However, this approach has limitations, as extensively documented in the literature. Artificial Intelligence (AI) has emerged as a pivotal tool to address these limitations, enhancing risk mitigation and informed decision-making. This research proposes a machine learning (ML) based security mechanism, leveraging …

Long-Term Traffic Prediction Using Deep Learning Long Short-Term Memory, Ange-Lionel Toba, Sameer Kulkarni, Wael Khallouli, Timothy Pennington

School of Cybersecurity Faculty Publications

Traffic conditions are a key factor in our society, contributing to quality of life and the economy, as well as access to professional, educational, and health resources. This emphasizes the need for a reliable road network to facilitate traffic fluidity across the nation and improve mobility. Reaching these characteristics demands good traffic volume prediction methods, not only in the short term but also in the long term, which helps design transportation strategies and road planning. However, most of the research has focused on short-term prediction, applied mostly to short-trip distances, while effective long-term forecasting, which has become a challenging issue …

Sting: A Stealthy Backdoor Attack On Gnn-Based Malicious Domain Detection Via Dns Perturbations, Muhammad Anan, Mahmoud Nazzal, Abdallah Khreishah, Issa Khalil, Nhathai Phan, Ahmad Sawalmeh

Computer Science Faculty Publications

Detecting malicious Internet domains is essential for safeguarding against various online threats. The current approach to detecting malicious domains (MDD) employs a graph neural network (GNN) method, which uses DNS logs to construct heterogeneous graphs for determining the maliciousness of unknown domains. Despite its success, this method is vulnerable to data poisoning attacks where an adversary can manipulate specific graph nodes to implant a backdoor into the model during training. To showcase the vulnerability, we propose a stealthy trigger injection attack on node features and graph structure in MDD, dubbed (STING). The attacker carefully manipulates selected features and edges of …

Understanding Pii Leakage In Large Language Models: A Systematic Survey, Shuai Cheng, Zhao Li, Shu Meng, Mengxia Ren, Haitao Xu, Shuai Hao, Chuan Yue, Fang Zhang

Computer Science Faculty Publications

Large Language Models (LLMs) have demonstrated exceptional success across a variety of tasks, particularly in natural language processing, leading to their growing integration into numerous facets of daily life. However, this widespread deployment has raised substantial privacy concerns, especially regarding personally identifiable information (PII), which can be directly associated with specific individuals. The leakage of such information presents significant real-world privacy threats. In this paper, we conduct a systematic investigation into existing research on PII leakage in LLMs, encompassing commonly utilized PII datasets, evaluation metrics, and current studies on both PII leakage attacks and defensive strategies. Finally, we identify unresolved …

Privshap: A Finer-Granularity Network Linearization Method For Private Inference, Xiangrui Xu, Zhenzhen Wang, Rui Ning, Chunsheng Xiu, Hongyi Wu

Computer Science Faculty Publications

Private inference applies cryptographic techniques like homomorphic encryption, garble circuit and secret sharing to keep both sides privacy in a client-server setting during inference. It is often hindered by the high communication overheads, especially at non-linear activation layers such as ReLU. Hence ReLU pruning has been widely recognized as an efficient way to accelerate private inference. Existing approaches to ReLU pruning typically rely on coarse hypothesis, which assume an inverse correlation between the importance of ReLU and linear layers or shallow activation layers have less importance for universal models, to assign the budgets according to the layer while preserving the …

Effective Pii Extraction From Llms Through Augmented Few-Shot Learning, Shuai Cheng, Shu Meng, Haitao Xu, Haoran Zhang, Shuai Hao, Chuan Yue, Wenrui Ma, Meng Han, Fang Zhang, Zhao Li

Computer Science Faculty Publications

Large Language Models (LLMs) exhibit strong natural language processing capabilities but also pose significant privacy risks, particularly regarding the leakage of Personally Identifiable Information (PII) embedded in their training data. Existing PII extraction methods suffer from the limitations of low success rates or impracticality for large-scale PII extraction. In this study, we propose a novel PII extraction approach based on enhanced few-shot learning techniques, which achieves efficient and cost-effective PII retrieval without relying on fine-tuning or jailbreaking. We evaluated our approach on both open-source and closed-source LLMs. The experimental results demonstrate that, for non-targeted PII extraction, the attack success rate …

Nexus: Network Exploration For Exploiting Unsafe Sequences In Multi-Turn Llm Jailbreaks, Javad Rafiei Asl, Sidhant Narula, Mohammad Ghasemigol, Eduardo Blanco, Daniel Takabi

Computer Science Faculty Publications

Large Language Models (LLMs) have revolutionized natural language processing, yet remain vulnerable to jailbreak attacks—particularly multi-turn jailbreaks that distribute malicious intent across benign exchanges, thereby bypassing alignment mechanisms. Existing approaches often suffer from limited exploration of the adversarial space, rely on hand-crafted heuristics, or lack systematic query refinement. We propose NEXUS (Network Exploration for eXploiting Unsafe Sequences), a modular framework for constructing, refining, and executing optimized multi-turn attacks. NEXUS comprises: (1) ThoughtNet, which hierarchically expands a harmful intent into a structured semantic network of topics, entities, and query chains; (2) a feedback-driven Simulator that iteratively refines and prunes these chains …

An Overview Of Video Game Biometrics Collection And Considerations For Cyberbiosecurity, Lucas Potter, Christen Westberry, Xavier-Lewis Palmer

Electrical & Computer Engineering Faculty Publications

Over the past fifty years, the global cost of consumer electronics has significantly decreased, leading to greater accessibility to both biosensing systems and interactive entertainment platforms. This increased access has naturally resulted in higher usage of medical and entertainment electronics. However, the intersection of these technologies, combined with invasive data harvesting practices, has raised concerns about the potential misuse of biological signals to manipulate individuals' behavior both within and beyond the video game environment. Currently, biometric data in video games are employed in various ways, such as using Heart Rate Variability (HRV) as a performance metric and integrating eye tracking …

Leveraging Large Language Models To Create Learner Personas For Training Design, N. Lovett, M. Yang, K. Herman, B. Li, M. Sosonkina, W. Purwanto, P. Jiang, M. H. Wu

Electrical & Computer Engineering Faculty Publications

This case examines the innovative use of Large Language Models (LLMs) to generate learner personas for developing learner-centered cybersecurity training materials when direct access to initial learner data is not available. The team developed a nine-stage iterative process for creating and refining AI-generated personas to address this constraint, integrating ethical review, stakeholder feedback, and action research principles. The process expanded upon Kouprie and Visser’s (2009) empathic design framework to ensure cultural responsiveness and mitigate potential biases in LLM outputs. Through multiple refinement cycles, initial generic personas evolved into detailed, context-rich archetypes which informed the development of effective and context-responsive training …

Enhancing Cyber Situational Awareness Through Dynamic Adaptive Symbology: The Dass Framework, Nicholas Macrino, Sergio Pallas Enguita, Chung-Hao Chen

Electrical & Computer Engineering Faculty Publications

The static nature of traditional military symbology, such as MIL-STD-2525D, hinders effective real-time threat detection and response in modern cybersecurity operations. This research introduces the Dynamic Adaptive Symbol System (DASS), a novel framework enhancing cyber situational awareness in military and enterprise environments. The DASS addresses static symbology limitations by employing a modular Python 3.10 architecture that uses machine learning-driven threat detection to dynamically adapt symbol visualization based on threat severity and context. Empirical testing assessed the DASS against a MIL-STD-2525D baseline using active cybersecurity professionals. Results show that the DASS significantly improves threat identification rates by 30% and reduces response …

T3-Ciders: Fostering A Community Of Practice In Ci-And Data Enabled Cybersecurity Research Through A Train-The-Trainer Program, Wirawan Purwanto, Mohan Yang, Peng Jiang, Masha Sosonkina

Electrical & Computer Engineering Faculty Publications

We present a training program named T³-CIDERS, the Train- The-Trainer approach to fostering cyberinfrastructure (CI)- and Data-Enabled Research in CyberSecurity. T³-CIDERS is a train-the-trainer program for advanced cyberinfrastructure (CI) skills that is designed to be synergistic with research, teaching, and learning activities in cybersecurity and cyber-related disciplines. The participants, termed 'future trainers' (FTs), are trained in effective instructional design and CI hands-on materials from DeapSECURE, developed in a previous CyberTraining program. T³-CIDERS aims to enhance cybersecurity research and education through broader adoption of advanced CI techniques such as artificial intelligence, big data, parallel programming, and platforms like high-performance computing (HPC) …

Data Injustice In Global Justice, Asaf Lubin, Cherry Tang

Articles by Maurer Faculty

In May 2020, the United Nations Secretary-General unveiled a sweeping “Data Strategy for Action by Everyone, Everywhere,” seeking to unlock the UN’s “full data potential.” The International Criminal Court’s Office of the Prosecutor followed suit, declaring in 2023 its intent to acquire advanced cyber forensic tools so as to hold the “widest range of digital evidence globally.” Across international institutions, data-driven governance has become the norm, with humanitarian agencies and tribunals transforming into “data hubs and information clearinghouses.” This Article critiques the unfettered datafication of global justice by international courts and organizations. These entities have aggressively expanded their data-driven operations …