Information Security Commons^™

Defense Of A Small Network, Isabella Adkins

Williams Honors College, Honors Research Projects

A sample network will be virtually created consisting of three routers, one switch, and three hosts. The network will be secured using various methods such as enabling passwords and encryption. After the network has been properly secured, various attacks will be attempted with the goal of breaking into the network. These attacks include reconnaissance (gathering information), penetrating the network using the tool Metasploit, and attempting to get a credential phishing email to end users. If successful in the attacks, the network will be revisited and analyzed for any weaknesses or oversights.

Small Business Office Network, Michael Gerome

Williams Honors College, Honors Research Projects

This project will emulate a small office network environment. The project will demonstrate the process of building and configuring the network to meet the requirements laid out in the project plan. This network includes four subnets with Windows 10 end devices and a Kali Linux device, it also includes five Cisco layer 2 switches and three Cisco routers. There are also three subnets connecting the routers to each other to enable routing between the subnets. After the network environment is set up, various penetration tests are performed from the Kali Linux device to gather information. The Nmap reconnaissance tool is …

Anomaly Based Intrusion Detection System Through Remote Virtual Machine Introspection, Huseyn Huseynov

Dissertations and Theses

Research on identifying malicious applications is an important direction in information security, especially when it comes to detection of evasive malware such as keyloggers, trojans, rootkits and their derivatives. Inspired by a biological immune system and based on negative selection algorithm approach to detect various types of malwares is proposed in this paper.

By deeply studying Linux kernel, understanding links behind different internal system processes, examining, and experimenting with hundreds of various keyloggers we propose a single Artificial Intelligence based solution as a comprehensive protection against wide range of malwares. Developed Intrusion Detection System (IDS) can be deployed in the …

A Brief Review Of Dns, Root Servers, Vulnerabilities And Decentralization, Mallory Runyan

Cybersecurity Undergraduate Research Showcase

Since the 1980’s and creation of the World Wide Web, Internet utilization is a common and arguably, necessary, part of daily life. The internet is young and still relatively new, but as of 2016, 3.4 billion people were online, and that number has since grown [1]. This is a significant number, but as such a common part of daily life, how elements of the internet or its infrastructure work is complex. The world would very likely be thrown into dark ages if DNS or any other significant aspect of the internet's infrastructure were to succumb to an attack. The Colonial …

Applications Of Blockchain In Business Processes: A Comprehensive Review, Wattana Viriyasitavat, Li Xu, Dusit Niyato, Zhuming Bi, Danupol Hoonsopon

Information Technology & Decision Sciences Faculty Publications

Blockchain (BC), as an emerging technology, is revolutionizing Business Process Management (BPM) in multiple ways. The main adoption is to serve as a trusted infrastructure to guarantee the trust of collaborations among multiple partners in trustless environments. Especially, BC enables trust of information by using Distributed Ledger Technology (DLT). With the power of smart contracts, BC enforces the obligations of counterparties that transact in a business process (BP) by programming the contracts as transactions. This paper aims to study the state-of-the-art of BC technologies by (1) exploring its applications in BPM with the focus on how BC provides the trust …

Cyber Deception For Critical Infrastructure Resiliency, Md Ali Reza Al Amin

Computational Modeling & Simulation Engineering Theses & Dissertations

The high connectivity of modern cyber networks and devices has brought many improvements to the functionality and efficiency of networked systems. Unfortunately, these benefits have come with many new entry points for attackers, making systems much more vulnerable to intrusions. Thus, it is critically important to protect cyber infrastructure against cyber attacks. The static nature of cyber infrastructure leads to adversaries performing reconnaissance activities and identifying potential threats. Threats related to software vulnerabilities can be mitigated upon discovering a vulnerability and-, developing and releasing a patch to remove the vulnerability. Unfortunately, the period between discovering a vulnerability and applying a …

Privacy Assessment Breakthrough: A Design Science Approach To Creating A Unified Methodology, Lisa Mckee

Masters Theses & Doctoral Dissertations

Recent changes have increased the need for and awareness of privacy assessments. Organizations focus primarily on Privacy Impact Assessments (PIA) and Data Protection Impact Assessments (DPIA) but rarely take a comprehensive approach to assessments or integrate the results into a privacy risk program. There are numerous industry standards and regulations for privacy assessments, but the industry lacks a simple unified methodology with steps to perform privacy assessments. The objectives of this research project are to create a new privacy assessment methodology model using the design science methodology, update industry standards and present training for conducting privacy assessments that can be …

Analysis Of Gpu Memory Vulnerabilities, Jarrett Hoover

Computer Science and Computer Engineering Undergraduate Honors Theses

Graphics processing units (GPUs) have become a widely used technology for various purposes. While their intended use is accelerating graphics rendering, their parallel computing capabilities have expanded their use into other areas. They are used in computer gaming, deep learning for artificial intelligence and mining cryptocurrencies. Their rise in popularity led to research involving several security aspects, including this paper’s focus, memory vulnerabilities. Research documented many vulnerabilities, including GPUs not implementing address space layout randomization, not zeroing out memory after deallocation, and not initializing newly allocated memory. These vulnerabilities can lead to a victim’s sensitive data being leaked to an …

Comparative Study Of Snort 3 And Suricata Intrusion Detection Systems, Cole Hoover

Computer Science and Computer Engineering Undergraduate Honors Theses

Network Intrusion Detection Systems (NIDS) are one layer of defense that can be used to protect a network from cyber-attacks. They monitor a network for any malicious activity and send alerts if suspicious traffic is detected. Two of the most common open-source NIDS are Snort and Suricata. Snort was first released in 1999 and became the industry standard. The one major drawback of Snort has been its single-threaded architecture. Because of this, Suricata was released in 2009 and uses a multithreaded architecture. Snort released Snort 3 last year with major improvements from earlier versions, including implementing a new multithreaded architecture …

Cova Cci Undergrad Cyber Research, Nana Jeffrey

Cybersecurity Undergraduate Research Showcase

Is your digital assistant your worst enemy? Modern technology has impacted our lives in a positive way making tasks that were once time consuming become more convenient. For example a few years ago writing down your grocery list with a paper and pen was a norm, now with technology we have access to IoT devices such as smart fridges that can inform us on what items are low in stock, send a message to our digital assistants such as iOS Siri and Amazon's Alexa to remind us to buy those groceries. Although these digital assistants have helped make our daily …

Ransombuster Iot: A Intrusion Detection And Dataset Creation Tool For Ransomware Attacks Within Iot Networks, Jackson M. Walker

Cybersecurity Undergraduate Research Showcase

The proposed research follows the design-science guidelines(Hevner, 2004). This paper uses these design-science methods for developing the guidelines for the implementation of the proposed architecture, understanding previous research contributions, and evaluating of research. This paper proposes a network artifact for studying ransomware IoT intrusion detection techniques and offers a proposed network architecture to serve as a framework for creating a publicly available dataset for IoT research on ransomware.

Deepfakes: Ai Technology Of The Future, Hosanna Root

Cybersecurity Undergraduate Research Showcase

Deepfakes technology’s danger stems from its ability to create realistic but fake synthesized media that people often identify as something that is real. With this powerful technology in the wrong hands, deepfakes can cause devastating havoc through information warfare, election campaign disruptions, and more, creating distrust in society. Disinformation is already rampant today, even without wide deployments of deepfakes, which is concerning given the fact that deepfakes’ nefarious full potentials are yet to be reached.

Security Issues With Network Connected Scada Systems, Chad Holm

Cybersecurity Undergraduate Research Showcase

The use of Supervisory Control and Data Acquisition (SCADA) systems has become common place and are being used in several different industries. These have evolved as the technology has progressed. The use of Internet of Things (IOT) devices makes for less human intervention to run daily operations in these industries. This can also allow hackers to gain access to these devices due to security holes that are overlooked. There have several different ways that have been exploited on SCADA networks and the goal is to recognize and secure them so hackers cannot gain access to them.

Corporate Cybersecurity In The Context Of M&A Transactions, Cameron Beck

Cybersecurity Undergraduate Research Showcase

The rapid rise of digital devices has unlocked a new dimension of innovation and prosperity in the 21st century. Computers are now an integrated and ubiquitous part of our global culture. You would be hard-pressed to walk into any given room without several computer chips humming inaudibly inside the machines that facilitate our modern world. Even lightbulbs and doorbells are connected to the Internet, capturing information from the world around them and sending that information to the Cloud. The Internet expands access to communication, international marketplaces, entertainment, professional resources, and nearly every book in the world.

Modeling Iot Solutions: A Lack Of Iot Device Security, And User Education, Benjamin Newlin

Cybersecurity Undergraduate Research Showcase

The Internet of Things, more commonly known as IoT devices, is an ever growing topic, both in the marketplace and in cyber security. While new devices are released into the public every year, a lack of standardized security concepts is also growing ever so clear. By having a model or standard for IoT devices and manufacturers to follow, the customer-base of these devices will have an easier time identifying trustworthy devices as well as how to secure their own devices.

Ggnb: Graph-Based Gaussian Naive Bayes Intrusion Detection System For Can Bus, Riadul Islam, Maloy K. Devnath, Manar D. Samad, Syed Md Jaffrey Al Kadry

Computer Science Faculty Research

The national highway traffic safety administration (NHTSA) identified cybersecurity of the automobile systems are more critical than the security of other information systems. Researchers already demonstrated remote attacks on critical vehicular electronic control units (ECUs) using controller area network (CAN). Besides, existing intrusion detection systems (IDSs) often propose to tackle a specific type of attack, which may leave a system vulnerable to numerous other types of attacks. A generalizable IDS that can identify a wide range of attacks within the shortest possible time has more practical value than attack-specific IDSs, which is not a trivial task to accomplish. In this …

Don't Bite The Bait: Phishing Attack For Internet Banking (E-Banking), Ilker Kara

Journal of Digital Forensics, Security and Law

Phishing attacks are based on obtaining desired information from users quickly and easily with the help of misdirecting, panicking, curiosity, or excitement. Most of the phishing web sites are designed on internet banking(e-banking) and the attackers can acquire financial information of misled users with the tactics and discourses they develop. Despite the increase of prevention techniques against phishing attacks day by day, an effective solution could not be found for this issue due to the human factor. Because of this reason, real phishing attack studies are essential to study and analyze the attackers’ attack techniques and strategies. This study focused …

Protection Of Patient Privacy On Mobile Device Machine Learning, Matthew Nguyen

Cybersecurity Undergraduate Research Showcase

An existing StudentLife Study mobile dataset was evaluated and organized to be applied to different machine learning methods. Different variables like user activity, exercise, sleep, study space, social, and stress levels are optimized to train a model that could predict user stress level. The different machine learning methods would test if both patient data privacy and training efficiency can be ensured.

Effects Of Cloud Computing In The Workforce, Kevin Rossi Acosta

Cybersecurity Undergraduate Research Showcase

In recent years, the incorporation of cloud computing and cloud services has increased in many different types of organizations and companies. This paper will focus on the philosophical, economical, and political factors that cloud computing and cloud services have in the workforce and different organizations. Based on various scholarly articles and resources it was observed that organizations used cloud computing and cloud services to increase their overall productivity as well as decrease the overall cost of their operations, as well as the different policies that were created by lawmakers to control the realm of cloud computing. The results of this …

Privacy-Preserving Cloud-Assisted Data Analytics, Wei Bao

Graduate Theses and Dissertations

Nowadays industries are collecting a massive and exponentially growing amount of data that can be utilized to extract useful insights for improving various aspects of our life. Data analytics (e.g., via the use of machine learning) has been extensively applied to make important decisions in various real world applications. However, it is challenging for resource-limited clients to analyze their data in an efficient way when its scale is large. Additionally, the data resources are increasingly distributed among different owners. Nonetheless, users' data may contain private information that needs to be protected.

Cloud computing has become more and more popular in …

Development Of A Reference Design For Intrusion Detection Using Neural Networks For A Smart Inverter, Ammar Mohammad Khan

Graduate Theses and Dissertations

The purpose of this thesis is to develop a reference design for a base level implementation of an intrusion detection module using artificial neural networks that is deployed onto an inverter and runs on live data for cybersecurity purposes, leveraging the latest deep learning algorithms and tools. Cybersecurity in the smart grid industry focuses on maintaining optimal standards of security in the system and a key component of this is being able to detect cyberattacks. Although researchers and engineers aim to design such devices with embedded security, attacks can and do still occur. The foundation for eventually mitigating these attacks …

Securing Fog Federation From Behavior Of Rogue Nodes, Mohammed Saleh H. Alshehri

Graduate Theses and Dissertations

As the technological revolution advanced information security evolved with an increased need for confidential data protection on the internet. Individuals and organizations typically prefer outsourcing their confidential data to the cloud for processing and storage. As promising as the cloud computing paradigm is, it creates challenges; everything from data security to time latency issues with data computation and delivery to end-users. In response to these challenges CISCO introduced the fog computing paradigm in 2012. The intent was to overcome issues such as time latency and communication overhead and to bring computing and storage resources close to the ground and the …

Role Of Artificial Intelligence In The Internet Of Things (Iot) Cybersecurity, Murat Kuzlu, Corinne Fair, Ozgur Guler

Engineering Technology Faculty Publications

In recent years, the use of the Internet of Things (IoT) has increased exponentially, and cybersecurity concerns have increased along with it. On the cutting edge of cybersecurity is Artificial Intelligence (AI), which is used for the development of complex algorithms to protect networks and systems, including IoT systems. However, cyber-attackers have figured out how to exploit AI and have even begun to use adversarial AI in order to carry out cybersecurity attacks. This review paper compiles information from several other surveys and research papers regarding IoT, AI, and attacks with and against AI and explores the relationship between these …

On The Usage And Vulnerabilities Of Api Systems, Conner D. Yu

Cybersecurity Undergraduate Research Showcase

To some, Application Programming Interface (API) is one of many buzzwords that seem to be blanketed in obscurity because not many people are overly familiar with this term. This obscurity is unfortunate, as APIs play a crucial role in today’s modern infrastructure by serving as one of the most fundamental communication methods for web services. Many businesses use APIs in some capacity, but one often overlooked aspect is cybersecurity. This aspect is most evident in the 2018 misuse case by Facebook, which led to the leakage of 50 million users’ records.1 During the 2018 Facebook data breach incident, threat actors …

Snitch Application: Addressing Cyber Trust In Future Living Spaces, Russell Moore

Cybersecurity Undergraduate Research Showcase

The future of smart homes is filled with excitement and ample opportunity to live in an environment that features extraordinary convenience and energy efficiency. Devices such as Amazon Alexa and Roku Smart TV’s feature voice interaction options that provide the user with enhanced functionality. While voice-activated devices are accommodating, it is imperative to acknowledge how they work on the backend. The problem is that these devices collect and share a large amount of data from users who are oftentimes unaware that it’s even happening. The Snitch App is being developed in order to inform the user of what exactly is …

Human Behavior Is A Significant Flaw In Maintaining Cyber Security, Elizabeth Jackson

Cybersecurity Undergraduate Research Showcase

Human behavior and data security utilization must be intertwined; in order to mitigate the negative effects of cyber attacks. No consumer wants their data hacked, breached, stolen, shared or wiped out. It is imperative to survey the type of education is needed to keep users safe and interested in securing their data. This can be done by simply seeking out the consumer's view of data security. The information obtained would allow the cybersecurity community to offer a simple way for consumers to protect their mobile data. There is a constant interaction between human behavior and the need for increased data …

Side-Channel Power Resistance For Encryption Algorithms Using Implementation Diversity, Ivan M. Bow

Electrical and Computer Engineering ETDs

This thesis paper investigates countermeasures to hardware side-channel attacks and proposes a new solution to this ever growing threat against data integrity and security. The side-channel attack methods, differential power analysis and correlation power analysis, are both very powerful techniques and are used to gain access to secrets inside of a field programmable gate array that are otherwise inaccessible, in particular the cryptographic key for the Advanced Encryption Standard algorithm. To counter these attacks, we propose a method of changing the internal hardware configuration of the field programmable gate array using dynamic partial reconfiguration. Using this method, we change the …

Geopolitics And The Digital Domain: How Cyberspace Is Impacting International Security, Georgia Wood

Independent Study Project (ISP) Collection

The digital domain is the emerging environment for which the internet and data connectivity exists. This new domain is challenging the traditional place for geopolitics to exist, and creating new challenges to international relations. The use of cyberweapons through direct cyberattacks, such as the possibility of an attack on the U.S. power grid, or misinformation campaigns, such as the one launched by Russia against the 2016 U.S. Presidential election, can expand the international threat landscape. While these new threats increase, states are widely not prepared to address the new challenges in the digital domain. This paper will use three primary …

Interoperable Ads-B Confidentiality, Brandon C. Burfeind

Theses and Dissertations

The worldwide air traffic infrastructure is in the late stages of transition from legacy transponder systems to Automatic Dependent Surveillance - Broadcast (ADS-B) based systems. ADS-B relies on position information from GNSS and requires aircraft to transmit their identification, state, and position. ADS-B promises the availability of high-fidelity air traffic information; however, position and identification data are not secured via authentication or encryption. This lack of security for ADS-B allows non-participants to observe and collect data on both government and private flight activity. This is a proposal for a lightweight, interoperable ADS-B confidentiality protocol which uses existing format preserving encryption …

Iot Devices In The Public Health Sector, Cayla Young

Cybersecurity Undergraduate Research Showcase

In this research, proper attention is drawn to privacy and security concerns with the integration of Internet of Things (IoT) devices in the public health sector. Often, not much attention is given to IoT devices and its vulnerabilities concerning the medical industry. Effects of COVID-19 contact tracing applications are explored through research of various source types. Mitigation techniques for these privacy and security issues is given. Focus is brought to topics outlining the risks associated with genetic testing companies and the vulnerabilities of data collection and data storage. Recommendations are provided to help consumers avoid these risks. Lastly, a comprehensive …