Information Security Commons^™

Cryptanalysis Of Homophonic Substitution Cipher Using Hidden Markov Models, Guannan Zhong

Master's Projects

We investigate the effectiveness of a Hidden Markov Model (HMM) with random restarts as a mean of breaking a homophonic substitution cipher. Based on extensive experiments, we find that such an HMM-based attack outperforms a previously de- veloped nested hill climb approach, particularly when the ciphertext message is short. We then consider a combination cipher, consisting of a homophonic substitution and a column transposition. We develop and analyze an attack on such a cipher. This attack employs an HMM (with random restarts), together with a hill climb to recover the column permutation. We show that this attack can succeed on …

Virtual Values For Taint And Information Flow Analysis, Prakasam Kannan, Thomas Austin, Mark Stamp, Tim Disney, Cormac Flanagan

Faculty Publications, Computer Science

Security controls such as taint analysis and information flow analysis can be powerful tools to protect against many common attacks. However, incorporating these controls into a language such as JavaScript is challenging. Native implementations require the support of all JavaScript VMs. Code rewriting requires developers to reason about the entire abstract syntax of JavaScript. In this paper, we demonstrate how virtual values may be used to more easily integrate these security controls. Virtual values provide hooks to alter the behavior of primitive operations, allowing programmers to create the desired security controls in a more declarative fashion, facilitating more rapid prototyping. …

Image Spam Analysis, Annapurna Sowmya Annadatha

Master's Projects

Image spam is unsolicited bulk email, where the message is embedded in an image. This technique is used to evade text-based spam lters. In this research, we analyze and compare two novel approaches for detecting spam images. Our rst approach focuses on the extraction of a broad set of image features and selection of an optimal subset using a Support Vector Machine (SVM). Our second approach is based on Principal Component Analysis (PCA), where we determine eigenvectors for a set of spam images and compute scores by projecting images onto the resulting eigenspace. Both approaches provide high accuracy with low …

Defeating N-Gram Scores For Http Attack Detection, Samyuktha Sridharan

Master's Projects

Web applications that generate malicious HTTP requests provide a platform that attackers use to exploit vulnerable machines. Such malicious traffic should be identified by network intrusion detection systems, based on traffic analysis. Previous research has shown that n-gram techniques can be successfully applied to detect HTTP attacks. In this research, we analyze the robustness of these n-gram techniques. We show that n-gram scores are surprisingly robust, but can be defeated using certain obfuscation strategies. We also consider the need for a more costlier HMM-based intrusion detection system.

Static And Dynamic Analysis For Android Malware Detection, Ankita Kapratwar

Master's Projects

Static analysis relies on features extracted without executing code, while dynamic analysis extracts features based on code execution (or emulation). In general, static analysis is more e cient, while static analysis is often more informative, particularly in cases of highly obfuscated code. Static analysis of an Android application can rely on features extracted from the manifest le or the Java bytecode, while dynamic analysis of Android applications can deal with features involving dynamic code loading and system calls that are collected while the application is running. In this research, we analyzed the e ectiveness of combining static and dynamic features …

VigenèRe Score For Malware Detection, Suchita Deshmukh

Master's Projects

Previous research has applied classic cryptanalytic techniques to the malware detection problem. Speci cally, scores based on simple substitution cipher cryptanal- ysis and various generalizations have been considered. In this research, we analyze two new malware scoring techniques based on classic cryptanalysis. Our rst ap- proach relies on the Index of Coincidence, which is used, for example, to determine the length of the keyword in a Vigenère ciphertext. We also consider a score based on a more complete cryptanalysis of a Vigenère cipher. We nd that the Vigenère score is competitive with previous statistical-based malware scores.

Library Writers Reward Project, Saravana Kumar Gajendran

Master's Projects

Open-source library development exploits the distributed intelligence of participants in Internet communities. Nowadays, contribution to the open-source community is fading [16] (Stackalytics, 2016) as there is not much recognition for library writers. They can start exploring ways to generate revenue as they actively contribute to the open-source community.

This project helps library writers to generate revenue in the form of bitcoins for their contribution. Our solution to generate revenue for library writers is to integrate bitcoin mining with existing JavaScript libraries, such as jQuery. More use of the library leads to more revenue for the library writers. It uses the …

Malicious Javascript Detection Using Statistical Language Model, Anumeha Shah

Master's Projects

The Internet has an immense importance in our day to day life, but at the same time, it has become the medium of infecting computers, attacking users, and distributing malicious code. As JavaScript is the principal language of client side pro- gramming, it is frequently used in conducting such attacks. Various approaches have been made to overcome the JavaScript security issues. Some advanced approaches utilize machine learning technology in combination with de-obfuscation and emula- tion. Many methods of analysis incorporate static analysis and dynamic analysis. Our solution is entirely based on static analysis, which avoids unnecessary runtime overhead.

The central …

Tracking User Activity While Safeguarding Data From Attackers, Justin Dahmubed

Master's Projects

Companies constantly look for ways to better understand customer activity on their websites. Website owners may want to be able to analyze customer activity without having to concern themselves with a government agency forcing them to reveal their information. Multiple analytical tools have been created, most notably Google Analytics.

In my thesis, I demonstrate how analytics data can be stored so that only the site owners can view the data about their customers. With my design, even the analytics site itself cannot decrypt the data after a given window of time has elapsed. The novel aspect of my design is …

Secure Declassification In Faceted Javascript, Tam Wing

Master's Projects

Information leaks currently represent a major security vulnerability. Malicious code, when injected into a trusted environment and executed in the context of the victim’s privileges, often results in the loss of sensitive information. To address this security issue, this paper focuses on the idea of information flow control using faceted execution [3]. This mechanism allows the interpreter to efficiently keep track of variables across multiple security levels, achieving termination-insensitive non-interference (TINI). With TINI, a program can only leak one bit of data, caused by the termination of a program. One key benefit of having faceted execution is that flow policy …

Taint And Information Flow Analysis Using Sweet.Js Macros, Prakasam Kannan

Master's Projects

JavaScript has been the primary language for application development in browsers and with the advent of JIT compilers, it is increasingly becoming popular on server side development as well. However, JavaScript suffers from vulnerabilities like cross site scripting and malicious advertisement code on the the client side and on the server side from SQL injection.

In this paper, we present a dynamic approach to efficiently track information flow and taint detection to aid in mitigation and prevention of such attacks using JavaScript based hygienic macros. We use Sweet.js and object proxies to override built-in JavaScript operators to track information flow …

Dueling-Hmm Analysis On Masquerade Detection, Peter Chou

Master's Projects

Masquerade detection is the ability to detect attackers known as masqueraders that intrude on another user’s system and pose as legitimate users. Once a masquerader obtains access to a user’s system, the masquerader has free reign over whatever data is on that system. In this research, we focus on masquerade detection and user classi cation using the following two di erent approaches: the heavy hitter approach and 2 di erent approaches based on hidden Markov models (HMMs), the dueling-HMM and threshold-HMM strategies.

The heavy hitter approach computes the frequent elements seen in the training data sequence and test data sequence …

Support Vector Machines And Metamorphic Malware Detection, Tanuvir Singh

Master's Projects

Metamorphic malware changes its internal structure with each infection, which makes it challenging to detect. In this research, we test several scor- ing techniques that have shown promise in metamorphic detection. We then perform a careful robustness analysis by employing morphing strategies that cause each score to fail. Finally, we show that combining scores using a Sup- port Vector Machine (SVM) yields results that are significantly more robust than we obtained using any of the individual scores.

Cryptanalysis Of Classic Ciphers Using Hidden Markov Models, Rohit Vobbilisetty

Master's Projects

Cryptanalysis is the study of identifying weaknesses in the implementation of cryptographic algorithms. This process would improve the complexity of such algo- rithms, making the system secure.

In this research, we apply Hidden Markov Models (HMMs) to classic cryptanaly- sis problems. We show that with sufficient ciphertext, an HMM can be used to break a simple substitution cipher. We also show that when limited ciphertext is avail- able, using multiple random restarts for the HMM increases our chance of successful decryption.

Malware Detection Using Dynamic Analysis, Swapna Vemparala

Master's Projects

In this research, we explore the field of dynamic analysis which has shown promis- ing results in the field of malware detection. Here, we extract dynamic software birth- marks during malware execution and apply machine learning based detection tech- niques to the resulting feature set. Specifically, we consider Hidden Markov Models and Profile Hidden Markov Models. To determine the effectiveness of this dynamic analysis approach, we compare our detection results to the results obtained by using static analysis. We show that in some cases, significantly stronger results can be obtained using our dynamic approach.

A Comparison Of Clustering Techniques For Malware Analysis, Swathi Pai

Master's Projects

In this research, we apply clustering techniques to the malware detection problem. Our goal is to classify malware as part of a fully automated detection strategy. We compute clusters using the well-known �-means and EM clustering algorithms, with scores obtained from Hidden Markov Models (HMM). The previous work in this area consists of using HMM and �-means clustering technique to achieve the same. The current effort aims to extend it to use EM clustering technique for detection and also compare this technique with the �-means clustering.

Clustering Versus Svm For Malware Detection, Usha Narra

Master's Projects

Previous work has shown that we can effectively cluster certain classes of mal- ware into their respective families. In this research, we extend this previous work to the problem of developing an automated malware detection system. We first compute clusters for a collection of malware families. Then we analyze the effectiveness of clas- sifying new samples based on these existing clusters. We compare results obtained using �-means and Expectation Maximization (EM) clustering to those obtained us- ing Support Vector Machines (SVM). Using clustering, we are able to detect some malware families with an accuracy comparable to that of SVMs. One …

Firefox Add-On For Metamorphic Javascript Malware Detection, Sravan Kumar Reddy Javaji

Master's Projects

With the increasing use of the Internet, malicious software has more frequently been designed to take control of users computers for illicit purposes. Cybercriminals are putting a lot of efforts to make malware difficult to detect. In this study, we demonstrate how the metamorphic JavaScript malware can effect a victim’s machine using a malicious or compromised Firefox add-on. Following the same methodology, we develop another add-on with malware static detection technique to detect metamorphic JavaScript malware.

Cheating Detection In Online Examinations, Gaurav Kasliwal

Master's Projects

In this research, we develop and analyze a tool that monitor student browsing activity during online examination. Our goal is to detect cheating in real time. In our design, a server capture packets using KISMET and detects cheating based on either a whitelist or blacklist of URLs. We provide implementation details and give experimental results, and we analyze various attack strategies. Finally, we show that the system is practical and lightweight in comparison to other available tools.

Static Analysis Of Malicious Java Applets, Nikitha Ganesh

Master's Projects

In this research, we consider the problem of detecting malicious Java applets, based on static analysis. In general, dynamic analysis is more informative, but static analysis is more efficient, and hence more practical. Consequently, static analysis is preferred, provided we can obtain results comparable to those obtained using dynamic analysis. We conducted experiments with the machine learning technique, Hidden Markov Model (HMM). We show that in some cases a static technique can detect malicious Java applets with greater accuracy than previously published research that relied on dynamic analysis.

Combining Dynamic And Static Analysis For Malware Detection, Anusha Damodaran

Master's Projects

Well-designed malware can evade static detection techniques, such as signature scanning. Dynamic analysis strips away one layer of obfuscation and hence such an approach can potentially provide more accurate detection results. However, dynamic analysis is generally more costly than static analysis. In this research, we analyze the effectiveness of using dynamic analysis to enhance the training phase, while using only static techniques in the detection phase. Relative to a fully static approach, the additional overhead is minimal, since training is essentially one-time work.

A Hash-Cash Based Music Streaming Payment System, Timothy Chen

Master's Projects

This project develops a hash-cash based, streaming music payment system. In our system, musicians are paid based on how long their works are listened to. Artists can upload their works to our proof-of-concept service so that people can discover and listen to them. While their works are being listened to, a mining process is run in parallel. The mining process discovers a “listening coin” based on the hash-cash algorithm. Users of our service would pay a monthly fee to access the music library. The monthly fees are then distributed to all artists proportionate to the number of virtual coins they …

Masquerade Detection Using Singular Value Decomposition, Sweta Vikram Shah

Master's Projects

Information systems and networks are highly susceptible to attacks in the form of intrusions. One such attack is by the masqueraders who impersonate legitimate users. Masqueraders can be detected in anomaly based intrusion detection by identifying the abnormalities in user behavior. This user behavior is logged in log files of different types. In our research we use the score based technique of Singular Value Decomposition to address the problem of masquerade detection on a unix based system. We have data collected in the form of sequential unix commands ran by 50 users. SVD is a linear algebraic technique, which has …

Spartan Web Application Firewall, Brian C. Lee

Master's Projects

Computer security is an ongoing issue and attacks are growing more sophisit- cated. One category of attack utilizes cross-site scripting (XSS) to extract confiden- tial data such as a user’s login credential’s without the knowledge of either the user nor the web server by utilizing vulnerabilities on web pages and internet browsers. Many people develop their own web applications without learning about or having good coding practices or security in mind. Web application firewalls are able to help but can be enhanced to be more effective than they currently are at detecting re- flected XSS attacks by analyzing the request …

An Interview With David Brin, Switch Staffs

SWITCH

This is an interview with David Brin, a science fiction author, and the Switch staff. They discuss some topics of Brin’s book, "The Transparent Society". The main hypothesis of this book is reciprocal surveillance for accountability and decentralization of power. Brin discusses his thoughts on privacy, such as real privacy, illusory privacy, and a third kind of privacy. He goes on to connect surveillance with power and the government. He continues with how people react to the advances of technology and how they learn from past generations.

The "Hoover" Project: Home Occupants Vehicular Electronic Reconnaissance, Kelvin Chan

SWITCH

The article explains telepresence, as well as its potential in safety and security, along with its traditional usage of traversing dangerous situations. This article describes a dystopian plan to place drones equipped with cameras and microphones in all homes in the Silicon Valley as a vehicle for telepresence. The data achieved through this method would also be stored into a public domain browser on the internet, free for anyone in the public to view, including larger corporations and the government. The idea behind this is the assimilation of data behind all cultures for understanding and to assist law enforcement in …

Gnarly Rantings About The Hacker And The Ants, Rudy Rucker

SWITCH

The article is an excerpt from Rucker’s book “The Happy Mutant”. It begins with his reflection of his career with GoMotion. He discusses the relation that he saw between design and cyberspace. Later he discusses his experience with a game a colleague found on the net: a virtual world where player is an ant. He talks about the struggles he goes through in this virtual world because of game difficulty and poor visuals. He ties it all in with how the Silicon Valley works in a similar way, and is filled with hackers and programers all needing each other to …