Open Access. Powered by Scholars. Published by Universities.®

Information Security Commons™

Open Access. Powered by Scholars. Published by Universities.®

Singapore Management University

Discipline
Keyword
Publication Year
Publication
Publication Type

Articles 841 - 870 of 1102

Full-Text Articles in Information Security

Guest Editors’ Introduction: Methods Innovations For The Empirical Study Of Technology Adoption And Diffusion, Robert John Kauffman, Angsana A. Techatassanasoontorn Sep 2012

Guest Editors’ Introduction: Methods Innovations For The Empirical Study Of Technology Adoption And Diffusion, Robert John Kauffman, Angsana A. Techatassanasoontorn

Research Collection School Of Computing and Information Systems

The literature on technology adoption and diffusion is ahighly mature area of Information Systems (IS) research,which requires a deft hand in research to support the creationof new contributions of knowledge. In this specialissue, we focus on the application of various methods,including new ones, to shed light on research questions thathave not been understood fully in prior research. In particular,we will showcase research that involves theapplication of event history analysis and spatial econometrics,as well as count data models to study frequencyrelatedphenomena for changes and development in technologyadoption and diffusion. We also include an articlethat employs game theory, as well as another …

Go to article

No Tradeoff Between Confidentiality And Performance: An Analysis On H.264/Svc Partial Encryption, Zhuo Wei, Xuhua Ding, Robert H. Deng, Yongdong Wu Sep 2012

No Tradeoff Between Confidentiality And Performance: An Analysis On H.264/Svc Partial Encryption, Zhuo Wei, Xuhua Ding, Robert H. Deng, Yongdong Wu

Research Collection School Of Computing and Information Systems

Partial encryption is often used as a tradeoff between security and performance to protect scalable video data. In this paper, we argue that although partial encryption is strong enough for access control, it is not adequate for content confidentiality protection. We conduct experiments to show that partially encrypted H.264/SVC (scalable video coding) streams leak significant content information from the enhancement layers in all three scalability dimensions. Our analysis concludes that such leakage is caused by the underlying coding techniques used in H.264/SVC, and all layers should be encrypted to protect confidential video streams.

Go to article

Learning Fine-Grained Structured Input For Memory Corruption Detection, Lei Zhao, Debin Gao, Lina Wang Sep 2012

Learning Fine-Grained Structured Input For Memory Corruption Detection, Lei Zhao, Debin Gao, Lina Wang

Research Collection School Of Computing and Information Systems

Inputs to many application and server programs contain rich and consistent structural information. The propagation of such input in program execution could serve as accurate and reliable signatures for detecting memory corruptions. In this paper, we propose a novel approach to detect memory corruptions at the binary level. The basic insight is that different parts of an input are usually processed in different ways, e.g., by different instructions. Identifying individual parts in an input and learning the pattern in which they are processed is an attractive approach to detect memory corruptions. We propose a fine-grained dynamic taint analysis system to …

Go to article

Reputation As Public Policy For Internet Security, Leigh L. Linden, John S. Quarterman, Qian Tang, Andrew B. Whinston Sep 2012

Reputation As Public Policy For Internet Security, Leigh L. Linden, John S. Quarterman, Qian Tang, Andrew B. Whinston

Research Collection School Of Computing and Information Systems

Insufficient resource allocation causes an Internet information security (infosec) problem that public policy could improve. Lack of transparency lets organizations avoid addressing internal risks, leaving vulnerabilities that are exploited by botnets, threatening information security of other Internet participants. Their protection provides no economic benefit to the firm, so this negative externality causes underinvestment in infosec. Public policy could provide a partial solution by adding incentives for organizations to have well-configured infosec. Specifically, mandatory reporting of security issues plus presenting this information to the public, can impose shame and fame on organizations through publicity and peer influence by comparison with major …

Go to article

Defeating Sql Injection, Lwin Khin Shar, Hee Beng Kuan Tan Aug 2012

Defeating Sql Injection, Lwin Khin Shar, Hee Beng Kuan Tan

Research Collection School Of Computing and Information Systems

The best strategy for combating SQL injection, which has emerged as the most widespread website security risk, calls for integrating defensive coding practices with both vulnerability detection and runtime attack prevention methods.

Go to article

A Secure And Efficient Discovery Service System In Epcglobal Network, Jie Shi, Yingjiu Li, Robert H. Deng Aug 2012

A Secure And Efficient Discovery Service System In Epcglobal Network, Jie Shi, Yingjiu Li, Robert H. Deng

Research Collection School Of Computing and Information Systems

In recent years, the Internet of Things (IOT) has drawn considerable attention from the industrial and research communities. Due to the vast amount of data generated through IOT devices and users, there is an urgent need for an effective search engine to help us make sense of this massive amount of data. With this motivation, we begin our initial works on developing a secure and efficient search engine (SecDS) based on EPC Discovery Services (EPCDS) for EPCglobal network, an integral part of IOT. SecDS is designed to provide a bridge between different partners of supply chains to share information while …

Go to article

A Pollution Attack To Public-Key Watermarking Schemes, Yongdong Wu, Robert H. Deng Jul 2012

A Pollution Attack To Public-Key Watermarking Schemes, Yongdong Wu, Robert H. Deng

Research Collection School Of Computing and Information Systems

Public-key watermarking schemes are required to possess two desirable properties: allowing everyone to determine whether a watermark exists in an image or not and ensuring high detection probability in case of malicious modification. In this paper we propose an attack which pollutes the watermark embedded in an image with an optimal colored noise so as to fool the detector of the underlying public-key watermarking scheme. We further show how to apply the proposed pollution attack to public-key subspace watermarking schemes to generate pirated images of high quality but of low detection probability. Our experiment results demonstrate that the proposed pollution …

Go to article

Mining Input Sanitization Patterns For Predicting Sql Injection And Cross Site Scripting Vulnerabilities, Lwin Khin Shar, Hee Beng Kuan Tan Jun 2012

Mining Input Sanitization Patterns For Predicting Sql Injection And Cross Site Scripting Vulnerabilities, Lwin Khin Shar, Hee Beng Kuan Tan

Research Collection School Of Computing and Information Systems

Static code attributes such as lines of code and cyclomatic complexity have been shown to be useful indicators of defects in software modules. As web applications adopt input sanitization routines to prevent web security risks, static code attributes that represent the characteristics of these routines may be useful for predicting web application vulnerabilities. In this paper, we classify various input sanitization methods into different types and propose a set of static code attributes that represent these types. Then we use data mining methods to predict SQL injection and cross site scripting vulnerabilities in web applications. Preliminary experiments show that our …

Go to article

Where Should The Bugs Be Fixed? More Accurate Information Retrieval-Based Bug Localization Based On Bug Reports, Jian Zhou, Hongyu Zhang, David Lo Jun 2012

Where Should The Bugs Be Fixed? More Accurate Information Retrieval-Based Bug Localization Based On Bug Reports, Jian Zhou, Hongyu Zhang, David Lo

Research Collection School Of Computing and Information Systems

For a large and evolving software system, the project team could receive a large number of bug reports. Locating the source code files that need to be changed in order to fix the bugs is a challenging task. Once a bug report is received, it is desirable to automatically point out to the files that developers should change in order to fix the bug. In this paper, we propose BugLocator, an information retrieval based method for locating the relevant files for fixing a bug. BugLocator ranks all files based on the textual similarity between the initial bug report and the …

Go to article

A New Framework For Privacy Of Rfid Path Authentication, Shaoying Cai, Robert H. Deng, Yingjiu Li, Yunlei Zhao Jun 2012

A New Framework For Privacy Of Rfid Path Authentication, Shaoying Cai, Robert H. Deng, Yingjiu Li, Yunlei Zhao

Research Collection School Of Computing and Information Systems

RFID-based path authentication enables supply chain managers to verify the exact path that a tag has taken. In this paper, we introduce a new oracle Move that models a tag's movement along a designed or an arbitrary path in a supply chain. With this oracle, we refine the existing security and privacy notions for RFID-based path authentication. In addition, we propose a new privacy notion, called path privacy, for RFID-based path authentication. Our privacy notion captures the privacy of both tag identity and path information in a single game. Compared to existing two-game based privacy notions, it is more rigorous, …

Go to article

Active Malware Analysis Using Stochastic Games, Simon Williamson, Pradeep Reddy Varakantham, Debin Gao, Chen Hui Ong Jun 2012

Active Malware Analysis Using Stochastic Games, Simon Williamson, Pradeep Reddy Varakantham, Debin Gao, Chen Hui Ong

Research Collection School Of Computing and Information Systems

Cyber security is increasingly important for defending computer systems from loss of privacy or unauthorised use. One important aspect is threat analysis - how does an attacker infiltrate a system and what do they want once they are inside. This paper considers the problem of Active Malware Analysis, where we learn about the human or software intruder by actively interacting with it with the goal of learning about its behaviours and intentions, whilst at the same time that intruder may be trying to avoid detection or showing those behaviours and intentions. This game-theoretic active learning is then used to obtain …

Go to article

Trurepec: A Trust-Behavior-Based Reputation And Recommender System For Mobile Applications, Zheng Yan, Peng Zhang, Robert H. Deng Jun 2012

Trurepec: A Trust-Behavior-Based Reputation And Recommender System For Mobile Applications, Zheng Yan, Peng Zhang, Robert H. Deng

Research Collection School Of Computing and Information Systems

Mobile applications are software packages that can be installed and executed in a mobile device. Which mobile application is trustworthy for a user to purchase, download, install, execute or recommend becomes a crucial issue that impacts its final success. This paper proposes TruBeRepec, a trust-behavior-based reputation and recommender system for mobile applications. We explore a model of trust behavior for mobile applications based on the result of a large-scale user survey. We further develop a number of algorithms that are used to evaluate individual user’s trust in a mobile application through trust behavior observation, generate the application’s reputation by aggregating …

Go to article

Distributed Path Authentication For Dynamic Rfid-Enabled Supply Chains, Shaoying Cai, Yingjiu Li, Yunlei Zhao Jun 2012

Distributed Path Authentication For Dynamic Rfid-Enabled Supply Chains, Shaoying Cai, Yingjiu Li, Yunlei Zhao

Research Collection School Of Computing and Information Systems

In this paper, we propose a distributed path authentication solution for dynamic RFID-enabled supply chains to address the counterfeiting problem. Compared to existing general anti-counterfeiting solutions, our solution requires non sharing of item-level RFID information among supply chain parties, thus eliminating the requirement on high network bandwidth and fine-grained access control. Our solution is secure, privacy-preserving, and practical. It leverages on the standard EPCglobal network to share information about paths and parties in path authentication. Our solution can be implemented on standard EPC class 1 generation 2 tags with only 720 bits storage and no computational capability.

Go to article

Expressive Cp-Abe With Partially Hidden Access Structures, Junzuo Lai, Robert H. Deng, Yingjiu Li May 2012

Expressive Cp-Abe With Partially Hidden Access Structures, Junzuo Lai, Robert H. Deng, Yingjiu Li

Research Collection School Of Computing and Information Systems

At Eurocrypt 2005, Sahai and Waters [7] introduced the concept of attribute-based encryption (ABE). ABE enables public key based one-to-many encryption and is envisioned as a promising cryptographic primitive for realizing scalable and fine-grained access control systems. There are two kinds of ABE schemes [1], key-policy ABE (KP-ABE) and ciphertext-policy ABE (CP-ABE) schemes. This paper, our concern is on the latter.

Go to article

Coercion Resistance In Authentication Responsibility Shifting, Payas Gupta, Xuhua Ding, Debin Gao May 2012

Coercion Resistance In Authentication Responsibility Shifting, Payas Gupta, Xuhua Ding, Debin Gao

Research Collection School Of Computing and Information Systems

Responsibility shifting, a popular solution used in the event of failure of primary authentication where a human helper is involved in regaining access, is vulnerable to coercion attacks. In this work, we report our user study which investigates the helper’s emotional status when being coerced to assist in an attack. Results show that the coercion causes involuntary skin conductance fluctuation on the helper, which indicates that he/she is nervous and stressed. This response can be used to strengthen the security of the authentication system by providing coercion resistance.

Go to article

Evaluation Of Different Electronic Product Code Discovery Service Models, Su Mon Kywe, Jie Shi, Yingjiu Li, Raghuwanshi Kailash Apr 2012

Evaluation Of Different Electronic Product Code Discovery Service Models, Su Mon Kywe, Jie Shi, Yingjiu Li, Raghuwanshi Kailash

Research Collection School Of Computing and Information Systems

Electronic Product Code Discovery Service (EPCDS) is an important concept in supply chain processes and in Internet of Things (IOT). It allows supply chain participants to search for their partners, communicate with them and share product information using standardized interfaces securely. Many researchers have been proposing different EPCDS models, considering different requirements. In this paper, we describe existing architecture designs of EPCDS systems, namely Directory Service Model, Query Relay Model and Aggregating Discovery Service Model (ADS). We also briefly mention Secure Discovery Service (SecDS) Model, which is an improved version of Directory Service Model with a secure attribute-based access control …

Go to article

Hasbe: A Hierarchical Attribute-Based Solution For Flexible And Scalable Access Control In Cloud Computing, Zhiguo Wan, Jun'e Liu, Robert H. Deng Apr 2012

Hasbe: A Hierarchical Attribute-Based Solution For Flexible And Scalable Access Control In Cloud Computing, Zhiguo Wan, Jun'e Liu, Robert H. Deng

Research Collection School Of Computing and Information Systems

Cloud computing has emerged as one of the most influential paradigms in IT industry in recent years. Since this new computing technology requires users to entrust their valuable data to cloud providers, there have been increasing security and privacy concerns on outsourced data. Several schemes employing attribute-based encryption (ABE) have been proposed for access control of outsourced data in cloud computing; however, most of them suffer from inflexibility in implementing complex access control policies. In order to realize scalable, flexible, and fine-grained access control of outsourced data in cloud computing, in this paper we propose hierarchical attribute-set-based encryption (HASBE) by …

Go to article

A Comparative Study Of Cyberattacks, Seung Hyun Kim, Qiu-Hong Wang, Johannes B. Ullrich Mar 2012

A Comparative Study Of Cyberattacks, Seung Hyun Kim, Qiu-Hong Wang, Johannes B. Ullrich

Research Collection School Of Computing and Information Systems

Cyberattacks are computer-to-computer attacks undermining the confidentiality, integrity, and/or availability of computers and/or the information they hold. The importance of securing cyberspace is increasing, along with the sophistication and potential significance of the results of the attacks. Moreover, attacksb involve increasingly sophisticated coordination among multiple hackers across international boundaries, where the aim has shifted from fun and self-satisfaction to financial or military gain, with clear and self-reinforcing motivation; for example, the number of new malicious code threats worldwide increased more than 71% from 2008 to 2009.

Go to article

Human: Creating Memorable Fingerprints Of Mobile Users, Gupta Payas, Kiat Wee Tan, Narayanasamy Ramasubbu, David Lo, Debin Gao, Rajesh Krishna Balan Mar 2012

Human: Creating Memorable Fingerprints Of Mobile Users, Gupta Payas, Kiat Wee Tan, Narayanasamy Ramasubbu, David Lo, Debin Gao, Rajesh Krishna Balan

Research Collection School Of Computing and Information Systems

In this paper, we present a new way of generating behavioral (not biometric) fingerprints from the cellphone usage data. In particular, we explore if the generated behavioral fingerprints are memorable enough to be remembered by end users. We built a system, called HuMan, that generates fingerprints from cellphone data. To test HuMan, we conducted an extensive user study that involved collecting about one month of continuous usage data (including calls, SMSes, application usage patterns etc.) from 44 Symbian and Android smartphone users. We evaluated the memorable fingerprints generated from this rich multi-context data by asking each user to answer various …

Go to article

Secds: A Secure Epc Discovery Services System In Epcglobal Network, Jie Shi, Darren Sim, Yingjiu Li, Robert H. Deng Feb 2012

Secds: A Secure Epc Discovery Services System In Epcglobal Network, Jie Shi, Darren Sim, Yingjiu Li, Robert H. Deng

Research Collection School Of Computing and Information Systems

In recent years, the Internet of Things (IOT) has drawn considerable attention from the industrial and research communities. Due to the vast amount of data generated through IOT devices and users, there is an urgent need for an effective search engine to help us make sense of this massive amount of data. With this motivation, we begin our initial works on developing a secure and efficient search engine (SecDS) based on EPC Discovery Services (EPCDS) for EPCglobal network, an integral part of IOT. SecDS is designed to provide a bridge between different partners of supply chains to share information while …

Go to article

Privacy-Preserving Data Sharing In High Dimensional Regression And Classification Settings, Stephen E. Fienberg, Jiashun Jin Jan 2012

Privacy-Preserving Data Sharing In High Dimensional Regression And Classification Settings, Stephen E. Fienberg, Jiashun Jin

LARC Research Publications

We focus on the problem of multi-party data sharing in high dimensional data settings where the number of measured features (or the dimension) p is frequently much larger than the number of subjects (or the sample size) n, the so-called p>> n scenario that has been the focus of much recent statistical research. Here, we consider data sharing for two interconnected problems in high dimensional data analysis, namely the feature selection and classification. We characterize the notions of “cautious", “regular", and “generous" data sharing in terms of their privacy-preserving implications for the parties and their share of data, with focus …

Go to article

Achieving Both Valid And Secure Logistic Regression Analysis On Aggregated Data From Different Private Sources, Yuval Nardi, Stephen Fienberg, Robert J. Hall Jan 2012

Achieving Both Valid And Secure Logistic Regression Analysis On Aggregated Data From Different Private Sources, Yuval Nardi, Stephen Fienberg, Robert J. Hall

LARC Research Publications

Preserving the privacy of individual databases when carrying out statistical calculations has a relatively long history in statistics and had been the focus of much recent attention in machine learning. In this paper, we present a protocol for fitting a logistic regression when the data are held by separate parties - without actually combining information sources - by exploiting results from the literature on multi-party secure computation. Our protocol provides only the final result of the calculation compared with other methods that share intermediate values and thus present an opportunity for compromise of values in the individual databases. Our paper …

Go to article

Crisis Response Information Networks, Shan L. Pan, Gary Pan, Dorothy Leidner Jan 2012

Crisis Response Information Networks, Shan L. Pan, Gary Pan, Dorothy Leidner

Research Collection School Of Accountancy

In the past two decades, organizational scholars have focused significant attention on how organizations manage crises. While most of these studies concentrate on crisis prevention, there is a growing emphasis on crisis response. Because information that is critical to crisis response may become outdated as crisis conditions change, crisis response research recognizes that the management of information flows and networks is critical to crisis response. Yet despite its importance, little is known about the various types of crisis information networks and the role of IT in enabling these information networks. Employing concepts from information flow and social network theories, this …

Go to article

Novel Techniques Of Using Diversity In Software Security And Information Hiding, Jin Han Jan 2012

Novel Techniques Of Using Diversity In Software Security And Information Hiding, Jin Han

Dissertations and Theses Collection (Open Access)

Diversity is an important and valuable concept that has been adopted in many fields to reduce correlated risks and to increase survivability. In information security, diversity also helps to increase both defense capability and fault tolerance for information systems and communication networks, where diversity can be adopted from many different perspectives. This dissertation, in particular, focuses mainly on two aspects of diversity – the application software diversity and the diversity in data interpretation. Software diversity has many advantages over mono-culture in improving system security. A number of previous researches focused on utilizing existing off-theshelf diverse software for network protection and …

Go to article

A New Efficient Optimistic Fair Exchange Protocol Without Random Oracles, Qiong Huang, Guomin Yang, Duncan S. Wong, Willy Susilo Jan 2012

A New Efficient Optimistic Fair Exchange Protocol Without Random Oracles, Qiong Huang, Guomin Yang, Duncan S. Wong, Willy Susilo

Research Collection School Of Computing and Information Systems

Optimistic fair exchange (OFE) is a kind of protocols to solve the problem of fair exchange between two parties. Most of the previous work on this topic are provably secure in the random oracle model. In this work, we propose a new construction of OFE from another cryptographic primitive, called time capsule signature. The construction is efficient and brings almost no overhead other than the primitive itself. The security of our new construction is based on that of the underlying primitive without relying on the random oracle heuristic. Applying our generic construction to the time capsule signature scheme recently proposed …

Go to article

A Survey On Privacy Frameworks For Rfid Authentication, Chunhua Su, Yingjiu Li, Yunlei Zhao, Robert H. Deng, Yiming Zhao, Jianying Zhou Jan 2012

A Survey On Privacy Frameworks For Rfid Authentication, Chunhua Su, Yingjiu Li, Yunlei Zhao, Robert H. Deng, Yiming Zhao, Jianying Zhou

Research Collection School Of Computing and Information Systems

Due to rapid growth of RFID system applications, the security and privacy problems become more and more important to guarantee the validity of RFID systems. Without introducing proper privacy protection mechanisms, widespread deployment of RFID could raise privacy concerns to both companies and individuals. As a fundamental issue for the design and analysis of secure RFID systems, some formal RFID privacy frameworks were proposed in recent years to give the principles for evaluating the security and privacy in RFID system. However, readers can be confused with so many proposed frameworks. In this paper, we make a comparative and survey study …

Go to article

Dynamic Secure Cloud Storage With Provenance, Sherman S. M. Chow, Cheng-Kang Chu, Xinyi Huang, Jianying Zhou, Robert H. Deng Jan 2012

Dynamic Secure Cloud Storage With Provenance, Sherman S. M. Chow, Cheng-Kang Chu, Xinyi Huang, Jianying Zhou, Robert H. Deng

Research Collection School Of Computing and Information Systems

One concern in using cloud storage is that the sensitive data should be confidential to the servers which are outside the trust domain of data owners. Another issue is that the user may want to preserve his/her anonymity in the sharing or accessing of the data (such as in Web 2.0 applications). To fully enjoy the benefits of cloud storage, we need a confidential data sharing mechanism which is fine-grained (one can specify who can access which classes of his/her encrypted files), dynamic (the total number of users is not fixed in the setup, and any new user can decrypt …

Go to article

On Two Rfid Privacy Notions And Their Relations, Yingjiu Li, Robert H. Deng, Junzuo Lai, Changshe Ma Dec 2011

On Two Rfid Privacy Notions And Their Relations, Yingjiu Li, Robert H. Deng, Junzuo Lai, Changshe Ma

Research Collection School Of Computing and Information Systems

Privacy of RFID systems is receiving increasing attention in the RFID community. Basically, there are two kinds of RFID privacy notions in the literature: one based on the indistinguishability of two tags, denoted as ind-privacy, and the other based on the unpredictability of the output of an RFID protocol, denoted as unp*-privacy. In this article, we first revisit the existing unpredictability-based RFID privacy models and point out their limitations. We then propose a new RFID privacy model, denoted as unp*-privacy, based on the indistinguishability of a real tag and a virtual tag. We formally clarify its relationship with the ind-privacy …

Go to article

Understanding And Protecting Privacy: Formal Semantics And Principled Audit Mechanisms, Anupam Datta, Jeremiah Blocki, Nicolas Christin, Henry Deyoung, Deepak Garg, Limin Jia, Dilsun Kaynar, Arunesh Sinha Dec 2011

Understanding And Protecting Privacy: Formal Semantics And Principled Audit Mechanisms, Anupam Datta, Jeremiah Blocki, Nicolas Christin, Henry Deyoung, Deepak Garg, Limin Jia, Dilsun Kaynar, Arunesh Sinha

Research Collection School Of Computing and Information Systems

Privacy has become a significant concern in modern society as personal information about individuals is increasingly collected, used, and shared, often using digital technologies, by a wide range of organizations. Certain information handling practices of organizations that monitor individuals’ activities on the Web, data aggregation companies that compile massive databases of personal information, cell phone companies that collect and use location data about individuals, online social networks and search engines—while enabling useful services—have aroused much indignation and protest in the name of privacy. Similarly, as healthcare organizations are embracing electronic health record systems and patient portals to enable patients, employees, …

Go to article

Automated Removal Of Cross Site Scripting Vulnerabilities In Web Applications, Lwin Khin Shar, Hee Beng Kuan Tan Dec 2011

Automated Removal Of Cross Site Scripting Vulnerabilities In Web Applications, Lwin Khin Shar, Hee Beng Kuan Tan

Research Collection School Of Computing and Information Systems

Context: Cross site scripting (XSS) vulnerability is among the top web application vulnerabilities according to recent surveys. This vulnerability occurs when a web application uses inputs received from users in web pages without properly checking them. This allows an attacker to inject malicious scripts in web pages via such inputs such that the scripts perform malicious actions when a client visits the exploited web pages. Such an attack may cause serious security violations such as account hijacking and cookie theft. Current approaches to mitigate this problem mainly focus on effective detection of XSS vulnerabilities in the programs or prevention of …

Go to article

First Prev Next Last