Information Security Commons^™

Pattern-Of-Life Modeling Using Data Leakage In Smart Homes, Steven M. Beyer

Theses and Dissertations

This work investigates data leakage in smart homes by providing a Smart Home Automation Architecture (SHAA) and a device classifier and pattern-of-life analysis tool, CITIoT (Classify, Identify, and Track Internet of things). CITIoT was able to capture traffic from SHAA and classify 17 of 18 devices, identify 95% of the events that occurred, and track when users were home or away with near 100% accuracy. Additionally, a mitigation tool, MIoTL (Mitigation of IoT Leakage) is provided to defend against smart home data leakage. With mitigation, CITIoT was unable to identify motion and camera devices and was inundated with an average …

Methods Of Reverse Engineering A Bitstream For Field Programmable Gate Array Protection, Daniel J. Celebucki

Theses and Dissertations

Field Programmable Gate Arrays (FPGAs) are found in numerous industries including consumer electronics, automotive, military and aerospace, and critical infrastructure. The ability to be reprogrammed as well as large computational power and relatively low price make them a good fit for low-volume applications that cannot justify the Non-Recurring Engineering (NRE) costs associated with producing Application-Specific Integrated Circuits (ASICs). FPGAs however, have seen a variety of security issues stemming from the fact that their configuration files are not inherently protected. This research assesses the feasibility of reverse engineering the bitstream format for a previously unexplored FPGA, as well as the utilization …

Passive Radiolocation Of Ieee 802.11 Emitters Using Directional Antennae, Bradford E. Law

Theses and Dissertations

Low-cost commodity hardware and cheaper, more capable consumer-grade drones make the threat of home-made, inexpensive drone-mounted wireless attack platforms (DWAPs) greater than ever. Fences and physical security do little to impede a drone from approaching private, commercial, or government wireless access points (WAPs) and conducting wireless attacks. At the same time, unmanned aerial vehicles (UAVs) present a valuable tool for network defenders conducting site surveys and emulating threats. These platforms present near-term dangers and opportunities for corporations and governments. Despite the vast leaps in technology these capabilities represent, UAVs are noisy and consequently difficult to conceal as they approach a …

Estimating Defensive Cyber Operator Decision Confidence, Markus M. Borneman

Theses and Dissertations

As technology continues to advance the domain of cyber defense, signature and heuristic detection mechanisms continue to require human operators to make judgements about the correctness of machine decisions. Human cyber defense operators rely on their experience, expertise, and understanding of network security, when conducting cyber-based investigations, in order to detect and respond to cyber alerts. Ever growing quantities of cyber alerts and network traffic, coupled with systemic manpower issues, mean no one has the time to review or change decisions made by operators. Since these cyber alert decisions ultimately do not get reviewed again, an inaccurate decision could cause …

Assured Android Execution Environments, Brandon P. Froberg

Theses and Dissertations

Current cybersecurity best practices, techniques, tactics and procedures are insufficient to ensure the protection of Android systems. Software tools leveraging formal methods use mathematical means to assure both a design and implementation for a system and these methods can be used to provide security assurances. The goal of this research is to determine methods of assuring isolation when executing Android software in a contained environment. Specifically, this research demonstrates security properties relevant to Android software containers can be formally captured and validated, and that an implementation can be formally verified to satisfy a corresponding specification. A three-stage methodology called "The …

Variable Speed Simulation For Accelerated Industrial Control System Cyber Training, Luke M. Bradford

Theses and Dissertations

It is important for industrial control system operators to receive quality training to defend against cyber attacks. Hands-on training exercises with real-world control systems allow operators to learn various defensive techniques and see the real-world impact of changes made to a control system. Cyber attacks and operator actions can have unforeseen effects that take a significant amount of time to manifest and potentially cause physical harm to the system, making high-fidelity training exercises time-consuming and costly. This thesis presents a method for accelerating training exercises by simulating and predicting the effects of a cyber event on a partially-simulated control system. …

Securing Critical Infrastructure: A Ransomware Study, Blaine M. Jeffries

Theses and Dissertations

This thesis reviews traditional ransomware attack trends in order to present a taxonomy for ransomware targeting industrial control systems. After reviewing a critical infrastructure ransomware attack methodology, a corresponding response and recovery plan is described. The plan emphasizes security through redundancy, specifically the incorporation of standby programmable logic controllers. This thesis goes on to describe a set of experiments conducted to test the viability of defending against a specialized ransomware attack with a redundant controller network. Results support that specific redundancy schemes are effective in recovering from a successful attack. Further experimentation is conducted to test the feasibility of industrial …

Assessing And Expanding Extracurricular Cybersecurity Youth Activities' Impact On Career Interest, Michael H. Dunn

Theses and Dissertations

This thesis assesses and expands the potential of extracurricular activities to address the shortage of cybersecurity workers by increasing secondary school students’ interest in these careers. Competitions and badges, two forms of gamification often applied in extracurricular educational activities, have potential to improve motivation and increase interest in related careers, but are significantly understudied in the context of cybersecurity activities. CyberPatriot is the largest cybersecurity competition in the United States for secondary school students. Impact on participants’ career interests is assessed by analyzing responses to recent surveys conducted by the competition organizers. Analysis demonstrates significantly increased interest in cybersecurity in …

Expected Coverage (Excov): A Proposal To Compare Fuzz Test Coverage Within An Infinite Input Space, Evan V. Swihart

Theses and Dissertations

A Fuzz test is an approach used to discover vulnerabilities by intentionally sending invalid inputs to a system for the purpose of triggering some type of fault or unintended effect that renders the system vulnerable to an exploit. Fuzz testing is an important cyber-testing technique used to find and fix vulnerabilities before they are exploited. The fuzzing of military data links presents a particular challenge because existing fuzzing tools cannot be easily applied to these systems. As a result, the tools and techniques used to fuzz these links vary widely in sophistication and effectiveness. Because of the infinite, or nearly …

Securing Data In Transit Using Two Channel Communication, Clark L. Wolfe

Theses and Dissertations

Securing data in transit is critically important to the Department of Defense in todays contested environments. While encryption is often the preferred method to provide security, there exist applications for which encryption is too resource intensive, not cost-effective or simply not available. In this thesis, a two-channel communication system is proposed in which the message being sent can be intelligently and dynamically split over two or more channels to provide a measure of data security either when encryption is not available, or perhaps in addition to encryption. This data spiting technique employs multiple wireless channels operating at the physical layer, …

Keep It Simple, Keep It Safe - Research On The Impacts Of Increasing Complexity Of Modern Enterprise Applications, Shawn Ware, David Phillips

UNO Student Research and Creative Activity Fair

As the Cybersecurity program within UNO continues to adapt to the ever-changing world of information systems and information security, the Cybersecurity Capstone has recently become an active, community-involvement project, where real-world organizations can receive valuable, useful research and information from students on their way towards a degree. This presentation encompasses two such projects from the Cybersecurity Capstone, looking at how modern, more complex systems can often increase system vulnerability.

Amazon Alexa: The Best Personal Assistant Or An Eavesdropping Witch, Alisa Bohac, Michael Keck

UNO Student Research and Creative Activity Fair

The prolific integration of Internet-of-Things (IoT) devices into our homes is continuously generating discussions surrounding the security and privacy of these devices. One device that has received particular attention in the past few years is the Amazon Alexa, a ‘personal assistant’ IoT device, which listens to user commands and performs certain actions. According to Amazon, “millions of Alexa devices” were sold in the 2017 Holiday period alone [1]. However, the continuous amalgamation of technology has prompted the idea that many digital devices, through their overall functionality, could be utilized by cybercriminals to digitally intrude into our personal lives [2]. Hence, …

Vmkdo: Verifiable Multi-Keyword Search Over Encrypted Cloud Data For Dynamic Data-Owner, Yibin Miao, Jianfeng Ma, Ximeng Liu, Zhiquan Liu, Limin Shen, Fushan Wei

Research Collection School Of Computing and Information Systems

The advantages of cloud computing encourage individuals and enterprises to outsource their local data storage and computation to cloud server, however, data security and privacy concerns seriously hinder the practicability of cloud storage. Although searchable encryption (SE) technique enables cloud server to provide fundamental encrypted data retrieval services for data-owners, equipping with a result verification mechanism is still of prime importance in practice as semi-trusted cloud server may return incorrect search results. Besides, single keyword search inevitably incurs many irrelevant results which result in waste of bandwidth and computation resources. In this paper, we are among the first to tackle …

A Holistic Methodology For Profiling Ransomware Through Endpoint Detection, Stefani K. Hobratsch

Masters Theses & Doctoral Dissertations

Computer security incident response is a critical capability in light of the growing threat of malware infecting endpoint systems today. Ransomware is one type of malware that is causing increasing harm to organizations. Ransomware infects an endpoint system by encrypting files until a ransom is paid. Ransomware can have a negative impact on an organization’s daily functions if critical business files are encrypted and are not backed up properly.

Many tools exist that claim to detect and respond to malware. Organizations and small businesses are often short-staffed and lack the technical expertise to properly configure security tools. One such endpoint …

An Efficient And Expressive Ciphertext-Policy Attribute-Based Encryption Scheme With Partially Hidden Access Structures, Revisited, Hui Cui, Robert H. Deng, Junzuo Lai, Xun Yi, Surya Nepal

Research Collection School Of Computing and Information Systems

Ciphertext-policy attribute-based encryption (CP-ABE) has been regarded as one of the promising solutions to protect data security and privacy in cloud storage services. In a CP-ABE scheme, an access structure is included in the ciphertext, which, however, may leak sensitive information about the underlying plaintext and the privileged recipients in that anyone who sees the ciphertext is able to learn the attributes of the privileged recipients from the associated access structure. In order to address this issue, CP-ABE with partially hidden access structures was introduced where each attribute is divided into an attribute name and an attribute value and the …

Obfuscation At-Source: Privacy In Context-Aware Mobile Crowd-Sourcing, Thivya Kandappu, Archan Misra, Shih-Fen Cheng, Randy Tandriansyah, Hoong Chuin Lau

Research Collection School Of Computing and Information Systems

By effectively reaching out to and engaging larger population of mobile users, mobile crowd-sourcing has become a strategy to perform large amount of urban tasks. The recent empirical studies have shown that compared to the pull-based approach, which expects the users to browse through the list of tasks to perform, the push-based approach that actively recommends tasks can greatly improve the overall system performance. As the efficiency of the push-based approach is achieved by incorporating worker's mobility traces, privacy is naturally a concern. In this paper, we propose a novel, 2-stage and user-controlled obfuscation technique that provides a trade off-amenable …

Sclib: A Practical And Lightweight Defense Against Component Hijacking In Android Applications, Daoyuan Wu, Yao Cheng, Debin Gao, Yingjiu Li, Robert H. Deng

Research Collection School Of Computing and Information Systems

Cross-app collaboration via inter-component communication is a fundamental mechanism on Android. Although it brings the benefits such as functionality reuse and data sharing, a threat called component hijacking is also introduced. By hijacking a vulnerable component in victim apps, an attack app can escalate its privilege for operations originally prohibited. Many prior studies have been performed to understand and mitigate this issue, but no defense is being deployed in the wild, largely due to the deployment difficulties and performance concerns. In this paper we present SCLib, a secure component library that performs in-app mandatory access control on behalf of app …

Mining Sandboxes: Are We There Yet?, Lingfeng Bao, Tien Duy B. Le, David Lo

Research Collection School Of Computing and Information Systems

The popularity of Android platform on mobile devices has attracted much attention from many developers and researchers, as well as malware writers. Recently, Jamrozik et al. proposed a technique to secure Android applications referred to as mining sandboxes. They used an automated test case generation technique to explore the behavior of the app under test and then extracted a set of sensitive APIs that were called. Based on the extracted sensitive APIs, they built a sandbox that can block access to APIs not used during testing. However, they only evaluated the proposed technique with benign apps but not investigated whether …

Urlnet: Learning A Url Representation With Deep Learning For Malicious Url Detection, Hung Le, Hong Quang Pham, Doyen Sahoo, Steven C. H. Hoi

Research Collection School Of Computing and Information Systems

Malicious URLs host unsolicited content and are used to perpetrate cybercrimes. It is imperative to detect them in a timely manner. Traditionally, this is done through the usage of blacklists, which cannot be exhaustive, and cannot detect newly generated malicious URLs. To address this, recent years have witnessed several efforts to perform Malicious URL Detection using Machine Learning. The most popular and scalable approaches use lexical properties of the URL string by extracting Bag-of-words like features, followed by applying machine learning models such as SVMs. There are also other features designed by experts to improve the prediction performance of the …

An Efficient And Expressive Ciphertext-Policy Attribute-Based Encryption Scheme With Partially Hidden Access Structures, Revisited, Hui Cui, Robert H. Deng, Junzuo Lai, Xun Yi, Surya Nepal

Research Collection School Of Computing and Information Systems

Ciphertext-policy attribute-based encryption (CP-ABE) has been regarded as one of the promising solutions to protect data security and privacy in cloud storage services. In a CP-ABE scheme, an access structure is included in the ciphertext, which, however, may leak sensitive information about the underlying plaintext and the privileged recipients in that anyone who sees the ciphertext is able to learn the attributes of the privileged recipients from the associated access structure. In order to address this issue, CP-ABE with partially hidden access structures was introduced where each attribute is divided into an attribute name and an attribute value and the …

An Efficient And Privacy-Preserving Biometric Identification Scheme In Cloud Computing, Liehuang Zhu, Chuan Zhang, Chang Xu, Ximeng Liu, Cheng Huang

Research Collection School Of Computing and Information Systems

Biometric identification has become increasingly popular in recent years.With the development of cloud computing, database owners are motivated to outsource the large size of biometric data and identification tasks to the cloud to get rid of the expensive storage and computation costs, which, however, brings potential threats to users’ privacy. In this paper, we propose an efficient and privacy-preserving biometric identification outsourcing scheme. Specifically, the biometric: To execute a biometric identification, the database owner encrypts the query data and submits it to the cloud. The cloud performs identification operations over the encrypted database and returns the result to the database …

Constant-Size Ciphertexts In Threshold Attribute-Based Encryption Without Dummy Attributes, Willy Susilo, Guomin Yang, Fuchun Guo, Qiong Huang

Research Collection School Of Computing and Information Systems

Attribute-based encryption (ABE) is an augmentation of public key encryption that allows users to encrypt and decrypt messages based on users' attributes. In a (t, s) threshold ABE, users who can decrypt a ciphertext must hold at least t attributes among the s attributes specified by the encryptor. At PKC 2010, Herranz, Laguillaumie and Raft& proposed the first threshold ABE with constant-size ciphertexts. In order to ensure the encryptor can flexibly select the attribute set and a threshold value, they use dummy attributes to satisfy the decryption requirement. The advantage of their scheme is that any addition or removal of …

Use Of House Arrest In The Context Of The Respecting The Constitutional Rights Of An Individual In Russia, Svetlana Afanasieva 2365999, Irina Kilina

Journal of Digital Forensics, Security and Law

The authors analyze the selection of preventive measures in the form of house arrest in Russian criminal procedures on the basis of universal and European standards of guaranteeing respect for individual rights. The article states that the application of preventive measures significantly restricts the right to protect the dignity of the individual, the right to freedom and personal inviolability, the right to free movement, choose the place of residence. The authors argue for the alternative method of applying the house arrest. as a form of prevention This preventive measure, unlike detention does not provide for the isolation of a person …

Back Matter, Adfsl

Annual ADFSL Conference on Digital Forensics, Security and Law

No abstract provided.

Front Matter, Adfsl

Annual ADFSL Conference on Digital Forensics, Security and Law

No abstract provided.

Contents, Adfsl

Annual ADFSL Conference on Digital Forensics, Security and Law

No abstract provided.

Hack The Planet! -- Cybersecurity Tips To Keep You, Your Data, And Your Clients Safe, Jason Tubinis

Continuing Legal Education Presentations

It is really easy to make you, your practice, and your clients safe from being the victims of a cyber-crime. This paper will discuss some tips, tricks, and considerations you can implement quickly, safely, and on the cheap.

These are relatively simple suggestions, though. You should be able to implement most of these practices within an hour, and while they will save you from the most common security flaws Bad Guys are looking to exploit.

When Good Components Go Bad: Formally Secure Compilation Despite Dynamic Compromise, Guglielmo Fachini, CăTăLin Hriţcu, Marco Stronati, Arthur Azevedo De Amorim, Carmine Abate, Roberto Blanco, Théo Laurent, Benjamin C. Pierce, Andrew Tolmach

Computer Science Faculty Publications and Presentations

We propose a new formal criterion for secure compilation, giving strong end-to-end security guarantees for software components written in unsafe, low-level languages with C-style undefined behavior. Our criterion is the first to model dynamic compromise in a system of mutually distrustful components running with least privilege. Each component is protected from all the others—in particular, from components that have encountered undefined behavior and become compromised. Each component receives secure compilation guarantees up to the point when it becomes compromised, after which an attacker can take complete control over the component and use any of its privileges to attack the remaining …

Long Term Key Management Architecture For Scada Systems, Hendra Saputra, Zhigang Zhao

Research Collection School Of Computing and Information Systems

A SCADA key management is required to provide a key management protocol that will be used to secure the communication channel of the SCADA entities. The SCADA key management scheme often uses symmetric cryptography due to resource constraints of the SCADA entities. Normally the use of symmetric cryptography mechanism is in the form of pre-shared keys, which are installed manually and are fixed. Then, these pre-shared keys or long term keys are used to generate session keys. However, it is important that these long term keys can be updated and refreshed dynamically. With the nature of SCADA systems which may …

Attribute-Based Cloud Storage With Secure Provenance Over Encrypted Data, Hui Cui, Robert H. Deng, Yingjiu Li

Research Collection School Of Computing and Information Systems

To securely and conveniently enjoy the benefits of cloud storage, it is desirable to design a cloud data storage system which protects data privacy from storage servers through encryption, allows fine-grained access control such that data providers can expressively specify who are eligible to access the encrypted data, enables dynamic user management such that the total number of data users is unbounded and user revocation can be carried out conveniently, supports data provider anonymity and traceability such that a data provider’s identity is not disclosed to data users in normal circumstances but can be traced by a trusted authority if …