Information Security Commons^™

Adversarially Attacking Graph Properties And Sparsification In Graph Learning, Chunjiang Zhu, Blake Gaines, Jing Deng, Jinbo Bi

Computer Science Faculty Publications

Graph neural networks and graph transformers explicitly or implicitly rely on fundamental properties of the underlying graph, such as spectral properties and shortest-path distances. However, it is still not clear how these graph properties are vulnerable to adversarial attacks and what impacts this has on the downstream graph learning. Moreover, while graph sparsification has been used to improve computational cost of learning over graphs, its susceptibility to adversarial attacks has not been studied. In this paper, we study adversarial attacks on graph properties and graph sparsification and their impacts on downstream graph learning, paving the way for how to protect …

Effective Pii Extraction From Llms Through Augmented Few-Shot Learning, Shuai Cheng, Shu Meng, Haitao Xu, Haoran Zhang, Shuai Hao, Chuan Yue, Wenrui Ma, Meng Han, Fang Zhang, Zhao Li

Computer Science Faculty Publications

Large Language Models (LLMs) exhibit strong natural language processing capabilities but also pose significant privacy risks, particularly regarding the leakage of Personally Identifiable Information (PII) embedded in their training data. Existing PII extraction methods suffer from the limitations of low success rates or impracticality for large-scale PII extraction. In this study, we propose a novel PII extraction approach based on enhanced few-shot learning techniques, which achieves efficient and cost-effective PII retrieval without relying on fine-tuning or jailbreaking. We evaluated our approach on both open-source and closed-source LLMs. The experimental results demonstrate that, for non-targeted PII extraction, the attack success rate …

Understanding Pii Leakage In Large Language Models: A Systematic Survey, Shuai Cheng, Zhao Li, Shu Meng, Mengxia Ren, Haitao Xu, Shuai Hao, Chuan Yue, Fang Zhang

Computer Science Faculty Publications

Large Language Models (LLMs) have demonstrated exceptional success across a variety of tasks, particularly in natural language processing, leading to their growing integration into numerous facets of daily life. However, this widespread deployment has raised substantial privacy concerns, especially regarding personally identifiable information (PII), which can be directly associated with specific individuals. The leakage of such information presents significant real-world privacy threats. In this paper, we conduct a systematic investigation into existing research on PII leakage in LLMs, encompassing commonly utilized PII datasets, evaluation metrics, and current studies on both PII leakage attacks and defensive strategies. Finally, we identify unresolved …

Digital Humanities: Using Computational Methods On Literature To Understand Human-Water Relations, Ariel Yang

Cybersecurity Undergraduate Research Showcase

By using computational techniques to analyze literature, deeper insights can be gained into human-water relationships across different historical and cultural contexts. Natural Language Processing (NLP) and other data science methods can explore applications of traditional ecological knowledge (TEK) and underlying emotions or beliefs in literature to help understand sustainability. Protecting this sensitive cultural data through ethical applications can further secure future implementations of policies, urban planning, and environmental relationships.

Security Vulnerabilities In Mobile Operating Systems Used In Iot Devices: An Examination Of Current Challenges And Countermeasures, Isain Cortes Jr.

Cybersecurity Undergraduate Research Showcase

No abstract provided.

A Dynamical Systems Approach For Modeling Malware Propagating Through A Network And Potential Solutions Towards Mitigating Spread, James Johnson

Cybersecurity Undergraduate Research Showcase

Many people draw close parallels between malware propagating through a network and an epidemic spreading through a population. Epidemics are often modeled by a Susceptible-Infected-Recovered (SIR) model, in which a similar system of equations can model the spread of a virus through a computer network, and can be simplified when making assumptions about the network itself and its fixed number of nodes and edges. In this instance, malware propagating in a network also should reflect the network it is propagating through, in which the dynamical system will factor in the nodes of the network and their properties. The system itself …

Phishing Emails: An Evolving Cyberattack, Brooke Waltz

Cybersecurity Undergraduate Research Showcase

This paper describes the history of phishing attacks and how they turned into cyberattacks, focusing on companies. Over the course of 34 years, phishing has been evolving at an alarming rate, especially with AI now coming into play. As phishing attacks have become more prominent towards companies, there has been an increase in financial loss and data breaches, resulting in a loss of trust in companies. With this loss, companies are trying to find solutions to this problem. Some notable attacks were the RSA breach in 2011, the Texas Energy Company in 2014, and the ILOVEYOU virus in 2000. They …

Privacy-Preserving Deep Learning Framework For Iot Malware Detection, Sabbir Ahmed Khan

Computer Science Theses & Dissertations

Cyberattacks on IoT devices are accelerating at an unprecedented rate, largely driven by IoT malware activities. The IoT malware attacks typically comprise three stages: intrusion, infection, and monetization. Existing IoT malware detection methods fail to identify malicious activities at the intrusion and infection stages and thus cannot stop potential attacks timely. In our research, we have leveraged power side-channel information as input to our deep learning model to identify malware at early stages of intrusion on IoT devices. But, deploying a resource-intensive deep learning model on highly resource-constrained IoT devices is a significant challenge. Consequently, utilizing a Machine Learning as …

A Design Science Approach To Investigating Decentralized Identity Technology, Janelle Krupicka

Cybersecurity Undergraduate Research Showcase

The internet needs secure forms of identity authentication to function properly, but identity authentication is not a core part of the internet’s architecture. Instead, approaches to identity verification vary, often using centralized stores of identity information that are targets of cyber attacks. Decentralized identity is a secure way to manage identity online that puts users’ identities in their own hands and that has the potential to become a core part of cybersecurity. However, decentralized identity technology is new and continually evolving, which makes implementing this technology in an organizational setting challenging. This paper suggests that, in the future, decentralized identity …

What Students Have To Say On Data Privacy For Educational Technology, Stephanie Choi

Cybersecurity Undergraduate Research Showcase

The literature on data privacy in terms of educational technology is a growing area of study. The perspective of educators has been captured extensively. However, the literature on students’ perspectives is missing, which is what we explore in this paper. We use a pragmatic qualitative approach with an experiential lens to capture students’ attitudes towards data privacy in terms of educational technology. We identified preliminary, common themes that appeared in the survey responses. The paper concludes by calling for more research on how students perceive data privacy in terms of educational technology.

A Case Study Of The Crashoverride Malware, Its Effects And Possible Countermeasures, Samuel Rector

Cybersecurity Undergraduate Research Showcase

CRASHOVERRIDE is a modular malware tailor-made for electric grid Industrial Control System (ICS) equipment and was deployed by a group named ELECTRUM in a Ukrainian substation. The malware would launch a protocol exploit to flip breakers and would then wipe the system of ICS files. Finally, it would execute a Denial Of Service (DOS) attack on protective relays. In effect, months of damage and thousands out of power. However, due to oversights the malware only caused a brief power outage. Though the implications of the malware are cause for researching and implementing countermeasures against others to come. The CISA recommends …

Investigating Vulnerabilities In The Bluetooth Host Layer In Linux, Jack Dibari

Cybersecurity Undergraduate Research Showcase

This paper investigates vulnerabilities within the Bluetooth host layer in Linux systems. It examines the Bluetooth protocol's evolution, focusing on its implementation in Linux, particularly through the BlueZ host software. Various vulnerabilities, including BleedingTooth, BLESA, and SweynTooth, are analyzed.

Data Profits Vs. Privacy Rights: Ethical Concerns In Data Commerce, Amiah Armstrong

Cybersecurity Undergraduate Research Showcase

In today’s digital age, the collection and sale of customer data for advertising is gaining a growing number of ethical concerns. The act of amassing extensive datasets encompassing customer preferences, behaviors, and personal information raises questions of its true purpose. It is widely acknowledged that companies track and store their customer’s digital activities under the pretext of benefiting the customer, but at what cost? Are users aware of how much of their data is being collected? Do they understand the trade-off between personalized services and the potential invasion of their privacy? This paper aims to show the advantages and disadvantages …

A Trustworthy Self-Sovereign Data And Identity Management Framework, Efat Fathalla

Electrical & Computer Engineering Theses & Dissertations

Data is a fundamental building block in the digital world, providing a basis for decision making and growth across numerous applications. In our modern world, we have become accustomed to collecting data on everything, including devices, machines, and people. The increased value of such data has led to aggressive harvesting mechanisms that prioritize data collection, storage, and pervasiveness while often disregarding security, privacy concerns, and compliance with regulations and standards. Such a pervasive attitude towards data has resulted in a loss of control, prompting concerns among individuals and mobilizing the scientific community towards advocating for data self-sovereignty.

Self-Sovereign Identity (SSI) …

Improving Educational Delivery And Content In Juvenile Detention Centers, Yomna Elmousalami

Undergraduate Research Symposium

Students in juvenile detention centers have the greatest need to receive improvements in educational delivery and content; however, they are one of the “truly disadvantaged” populations in terms of receiving those improvements. This work presents a qualitative data analysis based on a focus group meeting with stakeholders at a local Juvenile Detention Center. The current educational system in juvenile detention centers is based on paper worksheets, single-room style teaching methods, outdated technology, and a shortage of textbooks and teachers. In addition, detained students typically have behavioral challenges that are deemed "undesired" in society. As a result, many students miss classes …

A Review Of Hybrid Cyber Threats Modelling And Detection Using Artificial Intelligence In Iiot, Yifan Liu, Shancang Li, Xinheng Wang, Li Xu

Information Technology & Decision Sciences Faculty Publications

The Industrial Internet of Things (IIoT) has brought numerous benefits, such as improved efficiency, smart analytics, and increased automation. However, it also exposes connected devices, users, applications, and data generated to cyber security threats that need to be addressed. This work investigates hybrid cyber threats (HCTs), which are now working on an entirely new level with the increasingly adopted IIoT. This work focuses on emerging methods to model, detect, and defend against hybrid cyber attacks using machine learning (ML) techniques. Specifically, a novel ML-based HCT modelling and analysis framework was proposed, in which regularisation and Random Forest …

It Is Not Only About Having Good Attitudes: Factor Exploration Of The Attitudes Toward Security Recommendations, Miguel A. Toro-Jarrin, Pilar Pazos, Miguel A. Padilla

Engineering Management & Systems Engineering Faculty Publications

Numerous factors determine information security-related actions (IS-actions) in the workplace. Attitudes toward following security rules and recommendations and attitudes toward specific IS actions determine intentions associated with those actions. IS research has examined the role of the instrumental aspect of attitudes. However, authors argue that attitudes toward a behavioral object are a multidimensional construct. We examined the dimensionality of attitudes toward security recommendations, hypothesized its multidimensional nature, and developed a new scale [attitudes toward security recommendations (ASR scale)]. The results indicated the multidimensional nature of attitudes toward security recommendations supporting our hypothesis. The results revealed two dimensions corresponding to the …

Tapped In: The Rise Of Mobile Malware, Chrystofuer Davenport

Cybersecurity Undergraduate Research Showcase

As the world of technology continues to evolve and become more advanced with our life, so do the dangers and threats that are determined to hinder that development. Malware continues to be a danger to internet surfers or people with access to technology. At first it was an issue that existed only with computers but since the evolution of smartphones in the early twenty-first century, mobile devices have been a target for multiple malware viruses. It’s important to be aware of what different viruses are capable of doing and how to avoid them when they are encountered. Even though computers …

Sscm: A Secured Approach To Supply Chain Management Using Blowfish Optimization, Shitharth Selvarajan, Hariprasath Manoharan, Alaa O. Khadidos, Achyut Shankar, Adil O. Khadidos, Wattana Viriyasitavat, Li Da Xu

Information Technology & Decision Sciences Faculty Publications

This study examines the importance of enterprise information systems that link several corporate organisations to share information about diverse products under high security settings. The primary goal of the proposed strategy is to create a direct link between product demand and production to minimise the impact of rising costs. The research motive to make a connection cannot be resolved without suitable data that shows both quantity and quality in each organisation unit. The suggested method is designed to deliver accurate data to authorised end users while preventing any data exposure to unauthorised users. Security cryptographic keys are utilised to create …

Data Science In Finance: Challenges And Opportunities, Xianrong Zheng, Elizabeth Gildea, Sheng Chai, Tongxiao Zhang, Shuxi Wang

Information Technology & Decision Sciences Faculty Publications

Data science has become increasingly popular due to emerging technologies, including generative AI, big data, deep learning, etc. It can provide insights from data that are hard to determine from a human perspective. Data science in finance helps to provide more personal and safer experiences for customers and develop cutting-edge solutions for a company. This paper surveys the challenges and opportunities in applying data science to finance. It provides a state-of-the-art review of financial technologies, algorithmic trading, and fraud detection. Also, the paper identifies two research topics. One is how to use generative AI in algorithmic trading. The other is …

Designing High-Performance Identity-Based Quantum Signature Protocol With Strong Security, Sunil Prajapat, Pankaj Kumar, Sandeep Kumar, Ashok Kumar Das, Sachin Shetty, M. Shamim Hossain

VMASC Publications

Due to the rapid advancement of quantum computers, there has been a furious race for quantum technologies in academia and industry. Quantum cryptography is an important tool for achieving security services during quantum communication. Designated verifier signature, a variant of quantum cryptography, is very useful in applications like the Internet of Things (IoT) and auctions. An identity-based quantum-designated verifier signature (QDVS) scheme is suggested in this work. Our protocol features security attributes like eavesdropping, non-repudiation, designated verification, and hiding sources attacks. Additionally, it is protected from attacks on forgery, inter-resending, and impersonation. The proposed scheme benefits from the traditional designated …

Cyclegan-Gradient Penalty For Enhancing Android Adversarial Malware Detection In Gray Box Setting, Fabrice Setephin Atedjio, Jean-Pierre Lienou, Frederica F. Nelson, Sachin S. Shetty, Charles A. Kamhoua

VMASC Publications

Adversarial attacks pose significant threats to Android malware detection by undermining the effectiveness of machine learning-based systems. The rapid increase in Android apps complicates the management of malicious software that can compromise user defense solutions. Many current Android defense techniques rely on deep learning methods. Malicious users exploit GAN-based attacks to achieve adversarial attack transferability and deceive target models by crafting adversarial examples based on known models. We propose a new model based on a Cycle Generative Adversarial Network (CycleGAN) to detect GAN-based attacks. This model incorporates a gradient penalty to enhance the detection rate of the target model. Our …

Applications Of Ai/Ml In Maritime Cyber Supply Chains, Rafael Diaz, Ricardo Ungo, Katie Smith, Lida Haghnegahdar, Bikash Singh, Tran Phuong

School of Cybersecurity Faculty Publications

Digital transformation is a new trend that describes enterprise efforts in transitioning manual and likely outdated processes and activities to digital formats dominated by the extensive use of Industry 4.0 elements, including the pervasive use of cyber-physical systems to increase efficiency, reduce waste, and increase responsiveness. A new domain that intersects supply chain management and cybersecurity emerges as many processes as possible of the enterprise require the convergence and synchronizing of resources and information flows in data-driven environments to support planning and execution activities. Protecting the information becomes imperative as big data flows must be parsed and translated into actions …

Age Of Sensing Empowered Holographic Isac Framework For Nextg Wireless Networks: A Vae And Drl Approach, Apurba Adhikary, Avi Deb Raha, Yu Qiao, Md. Shirajum Munir, Monishanker Halder, Choong Seon Hong

School of Cybersecurity Faculty Publications

This paper proposes an artificial intelligence (AI) framework that leverages integrated sensing and communication (ISAC), aided by the age of sensing (AoS) to ensure the timely location updates of the users for a holographic MIMO (HMIMO)- enabled wireless network. The AI-driven framework guarantees optimal power allocation for efficient beamforming by activating the minimal number of grids from the HMIMO base station. An optimization problem is formulated to maximize the sensing utility function, aiming to maximize the signal-to-interference-plus-noise ratio (SINR) of the received signal, beam-pattern gains to improve the sensing SINR of reflected echo signals and maximizing the evidence lower bound …

Heuristic Machine Learning Approaches For Identifying Phishing Threats Across Web And Email Platforms, Ramprasath Jayaprakash, Krishnaraj Natarajan, J. Alfred Daniel, Chandru Vignesh Chinnappan, Jayant Giri, Hong Qin, Saurav Mallik

Data Science Faculty Publications

Life has become more comfortable in the era of advanced technology in this cutthroat competitive world. However, there are also emerging harmful technologies that pose a threat. Without a doubt, phishing is one of the rising concerns that leads to stealing vital information such as passwords, security codes, and personal data from any target node through communication hijacking techniques. In addition, phishing attacks include delivering false messages that originate from a trusted source. Moreover, a phishing attack aims to get the victim to run malicious programs and reveal confidential data, such as bank credentials, one-time passwords, and user login credentials. …

Anonymous Attribute-Based Broadcast Encryption With Hidden Multiple Access Structures, Tran Viet Xuan Phuong

School of Cybersecurity Faculty Publications

Due to the high demands of data communication, the broadcasting system streams the data daily. This service not only sends out the message to the correct participant but also respects the security of the identity user. In addition, when delivered, all the information must be protected for the party who employs the broadcasting service. Currently, Attribute-Based Broadcast Encryption (ABBE) is useful to apply for the broadcasting service. (ABBE) is a combination of Attribute-Based Encryption (ABE) and Broadcast Encryption (BE), which allows a broadcaster (or encrypter) to broadcast an encrypted message, including a predefined user set and specified access policy to …

Robustsentembed: Robust Sentence Embeddings Using Adversarial Self-Supervised Contrastive Learning, Javad Rafiei Asl, Prajwal Panzade, Eduardo Blanco, Daniel Takabi, Zhipeng Cai

School of Cybersecurity Faculty Publications

Pre-trained language models (PLMs) have consistently demonstrated outstanding performance across a diverse spectrum of natural language processing tasks. Nevertheless, despite their success with unseen data, current PLM-based representations often exhibit poor robustness in adversarial settings. In this paper, we introduce RobustSentEmbed, a self-supervised sentence embedding framework designed to improve both generalization and robustness in diverse text representation tasks and against a diverse set of adversarial attacks. Through the generation of high-risk adversarial perturbations and their utilization in a novel objective function, RobustSentEmbed adeptly learns high-quality and robust sentence embeddings. Our experiments confirm the superiority of RobustSentEmbed over state-of-the-art representations. Specifically, …

A Systemic Mapping Study On Intrusion Response Systems, Adel Rezapour, Mohammad Ghasemigol, Daniel Takabi

School of Cybersecurity Faculty Publications

With the increasing frequency and sophistication of network attacks, network administrators are facing tremendous challenges in making fast and optimum decisions during critical situations. The ability to effectively respond to intrusions requires solving a multi-objective decision-making problem. While several research studies have been conducted to address this issue, the development of a reliable and automated Intrusion Response System (IRS) remains unattainable. This paper provides a Systematic Mapping Study (SMS) for IRS, aiming to investigate the existing studies, their limitations, and future directions in this field. A novel semi-automated research methodology is developed to identify and summarize related works. The innovative …

A Secure And Privacy-Preserving Signature Protocol Using Quantum Teleportation In Metaverse Environment, Pankaj Kumar, Vivek Bharmaik, Sunil Prajapat, Garima Thakur, Ashok Kumar Das, Sachin Shetty, Joel J. P. C. Rodrigues

VMASC Publications

The burgeoning concept of the metaverse as an interconnected virtual space represents the forefront of the next-generation internet. Quantum teleportation, known for its prowess in ensuring secure and reliable communications, stands poised to revolutionize interactions within this immersive digital realm. In this context, we propose a comprehensive interaction protocol tailored for the metaverse environment. The designed protocol entails two fundamental components: first, the interaction between a user and their avatar, facilitated by a secure seven-qubit entangled state; and second, the interaction between two avatars, enabled through an efficient two-qubit entangled state. To fortify the protocol’s resilience, quantum key distribution (QKD) …

Designing A Blockchain-Empowered Telehealth Artifact For Decentralized Identity Management And Trustworthy Communication: Interdisciplinary Approach, Xueping Liang, Nabid Alam, Tahmina Sultana, Eranga Bandara, Sachin Shetty

VMASC Publications

Background: Telehealth played a critical role during the COVID-19 pandemic and continues to function as an essential component of health care. Existing platforms cannot ensure privacy and prevent cyberattacks.

Objective: The main objectives of this study are to understand existing cybersecurity issues in identity management and trustworthy communication processes in telehealth platforms and to design a software architecture integrated with blockchain to improve security and trustworthiness with acceptable performance.

Methods: We improved personal information security in existing telehealth platforms by adopting an innovative interdisciplinary approach combining design science, social science, and computer science in the health care domain, with prototype …