Information Security Commons^™

Cybersecurity And The New Era Of Space Activities, David P. Fidler

Articles by Maurer Faculty

No abstract provided.

Software Safety And Security Risk Mitigation In Cyber-Physical Systems, Miklos Biro, Atif Mashkoor, Johannes Sametinger, Remzi Seker

Publications

Cyber-physical systems (CPSs) offer many opportunities but pose many challenges--especially regarding functional safety, cybersecurity, and their interplay, as well as the systems' impact on society. Consequently, new methods and techniques are needed for CPS development and assurance. This article [and issue] aims to address some of these challenges.

Determinants Of Personal Information Protection Activities In South Korea, Pilku Kang

MPA/MPP/MPFM Capstone Projects

The purpose of this paper is to investigate how people’s awareness and ways to obtain relevant materials of personal information have influenced individual’s information privacy protection activities. This study uses the data of a 2016 survey on information security published by Korea Information and Security Agency.

The dependent variables of this study are preventive measures for the security of a Personal Computer (PC) and preventive measures against personal information breach. I classify independent variables into four types. They are internet users’ perception about information privacy, such as awareness of the importance of protecting one’s personal information, and awareness of information …

Automatic Log Parser To Support Forensic Analysis, Hudan Studiawan, Ferdous Sohel, Christian Payne

Australian Digital Forensics Conference

Event log parsing is a process to split and label each field in a log entry. Existing approaches commonly use regular expressions or parsing rules to extract the fields. However, such techniques are time-consuming as a forensic investigator needs to define a new rule for each log file type. In this paper, we present a tool, namely nerlogparser, to parse the log entries automatically, where log parsing is modeled as a named entity recognition problem. We use a deep machine learning technique, specifically the bidirectional long short-term memory networks, as the underlying architecture for this purpose. Unlike existing tools, nerlogparser …

Detection Techniques In Operational Technology Infrastructure, Glenn Murray, Matthew Peacock, Priya Rabadia, Paresh Kerai

Australian Information Security Management Conference

In previous decades, cyber-attacks have not been considered a threat to critical infrastructure. However, as the Information Technology (IT) and Operational Technology (OT) domains converge, the vulnerability of OT infrastructure is being exploited. Nation-states, cyber criminals and hacktivists are moving to benefit from economic and political gains. The OT network, i.e. Industrial Control System (ICS) is referred to within OT infrastructure as Supervisory Control and Data Acquisition (SCADA). SCADA systems were introduced primarily to optimise the data transfer within OT network infrastructure. The introduction of SCADA can be traced back to the 1960’s, a time where cyber-attacks were not considered. …

Transfer Learning With Convolutional Neural Networks Applied To Periocular Biometrics, Kushal Vangara

Theses and Dissertations

Biometrics technologies are designed for recognition of the unique physiological and behavioral features of an individual for identification and verification applications. There have been noteworthy advances in this field to recognize individuals based on their biometric trait(s) for authentication and verification applications. Despite these advances, there are many challenging issues which impede the potential of biometric systems and therefore limit the systems performance. Traditional biometric system design involves a selection of handcrafted features for recognition tasks which are not efficient as the size of the system scales up. Face and iris biometrics are reliable for many identification and verification applications …

Software Intrusion Detection Evaluation System: A Cost-Based Evaluation Of Intrusion Detection Capability, Agbotiname L. Imoize, Taiwo Oyedare, Michael E. Otuokere, Sachin Shetty

VMASC Publications

In this paper, we consider a cost-based extension of intrusion detection capability (CID). An objective metric motivated by information theory is presented and based on this formulation; a package for computing the intrusion detection capability of intrusion detection system (IDS), given certain input parameters is developed using Java. In order to determine the expected cost at each IDS operating point, the decision tree method of analysis is employed, and plots of expected cost and intrusion detection capability against false positive rate were generated. The point of intersection between the maximum intrusion detection capability and the expected cost is selected as …

A Reliable Data Provenance And Privacy Preservation Architecture For Business-Driven Cyber-Physical Systems Using Blockchain, Xueping Liang, Sachin Shetty, Deepak K. Tosh, Juan Zhao, Danyi Li, Jihong Liu

VMASC Publications

Cyber-physical systems (CPS) including power systems, transportation, industrial control systems, etc. support both advanced control and communications among system components. Frequent data operations could introduce random failures and malicious attacks or even bring down the whole system. The dependency on a central authority increases the risk of single point of failure. To establish an immutable data provenance scheme for CPS, the authors adopt blockchain and propose a decentralized architecture to assure data integrity. In business-driven CPS, end users are required to share their personal information with multiple third parties. To prevent data leakage and preserve user privacy, the authors isolate …

Introduction: Metrics, Modeling And Simulation For Cyber Physical Systems, Barry Ezell, Luanne Burns

VMASC Publications

[Introduction] In recent years, there has been a massive increase in cyber crime. Cyber breeches have become ubiquitous. The US government is attempting to adapt through legislation and policy. For instance, business in the defense industrial base must be in compliance of NIST 80-71 by 31 December 2017. Insurance companies as well are beginning to build actuaries on cyber risk. Along with NIST, there are many cyber frameworks that exist, each with their own following. Recently, companies have sought mapping from one framework to another but this is imperfect solution because some frameworks are exclusively technical control measures with very …

Cyber Security And Criminal Justice Programs In The United States: Exploring The Intersections, Brian K. Payne, Lora Hadzhidimova

Sociology & Criminal Justice Faculty Publications

The study of cyber security is an interdisciplinary pursuit that includes STEM disciplines as well as the social sciences. While research on cyber security appears to be central in STEM disciplines, it is not yet clear how central cyber security and cyber crime is to criminal justice scholarship. In order to examine the connections between cyber security and criminal justice, in this study attention is given to the way that criminal justice scholars have embraced cyber crime research and coursework. Results show that while there are a number of cyber crime courses included in criminal justice majors there are not …

New Dimensions For A Challenging Security Environment: Growing Exposure To Critical Space Infrastructure Disruption Risk, Adrian V. Gheorghe, Alexandru Georgescu, Olga Bucovetchi, Marilena Lazăr, Cezar Scarlat

Engineering Management & Systems Engineering Faculty Publications

Space systems have become a key enabler for a wide variety of applications that are vital to the functioning of advanced societies. The trend is one of quantitative and qualitative increase of this dependence, so much so that space systems have been described as a new example of critical infrastructure. This article argues that the existence of critical space infrastructures implies the emergence of a new category of disasters related to disruption risks. We inventory those risks and make policy recommendations for what is, ultimately, a resilience governance issue.

Cyber Law And Espionage Law As Communicating Vessels, Asaf Lubin

Books & Book Chapters by Maurer Faculty

Professor Lubin's contribution is "Cyber Law and Espionage Law as Communicating Vessels," pp. 203-225.

Existing legal literature would have us assume that espionage operations and “below-the-threshold” cyber operations are doctrinally distinct. Whereas one is subject to the scant, amorphous, and under-developed legal framework of espionage law, the other is subject to an emerging, ever-evolving body of legal rules, known cumulatively as cyber law. This dichotomy, however, is erroneous and misleading. In practice, espionage and cyber law function as communicating vessels, and so are better conceived as two elements of a complex system, Information Warfare (IW). This paper therefore first draws …

The Rsa Cryptosystem, Rodrigo Iglesias

Williams Honors College, Honors Research Projects

This paper intends to present an overview of the RSA cryptosystem. Cryptosystems are mathematical algorithms that disguise information so that only the people for whom the information is intended can read it. The invention of the RSA cryptosystem in 1977 was a significant event in the history of cryptosystems. We will describe in detail how the RSA cryptosystem works and then illustrate the process with a realistic example using fictional characters. In addition, we will discuss how cryptosystems worked prior to the invention of RSA and the advantage of using RSA over any of the previous cryptosystems. This will help …

A Longitudinal Analysis On The Feasibility Of Iris Recognition Performance For Infants 0-2 Years Old, Torrey Hutchison

Purdue Polytechnic Masters Theses

The focus of this study was to longitudinally evaluate iris recognition for infants between the ages of 0 to 2 years old. Image quality metrics of infant and adult irises acquired on the same iris camera were compared. Matching performance was evaluated for four groups, infants 0 to 6 months, 7 to 12 months, 13 to 24 months, and adults. A mixed linear regression model was used to determine if infants’ genuine similarity scores changed over time. This study found that image quality metrics were different between infants and adults but in the older group, (13 to 24 months old) …

The Relevance Of A Good Internal Control System In A Computerised Accounting Information System, Raymond Lutui, Tau’Aho ‘Ahokovi

Australian Information Security Management Conference

Advancements in information technology (IT) have enabled companies to use computers to carry out their activities that were previously performed manually. Accounting systems that were previously performed manually can now be performed with the help of computers. With all the advantages of computerized accounting software, business owners need to realize that problems do arise for a variety of reasons. Dependence on computers sometimes leads to bigger problems. This paper, therefore provide a detail information about the concept of internal control to its relevance in a computerised accounting information. This study also considers the trend between manual and computerised accounting system. …

An Investigation Into A Denial Of Service Attack On An Ethereum Network, Richard Greene, Michael N. Johnstone

Australian Information Security Management Conference

Apart from its much-publicised use in crypto-currency, blockchain technology is used in a wide range of application areas, from diamonds to wine. The most common application of this technology is in smart contracts in supply chain management, where assurance of delivery and provenance are important. One problem for an Ethereum consortium is the potential for disruption caused by a Denial-of-Service attack across the consortium nodes. Such an attack can be launched from a single source or multiple sources to amplify the effect. This paper investigates the impact of various Denial-of-Service attacks on an Ethereum Consortium deployed on the Azure Cloud …

Mobile Device Wardriving Tools’ Comparison: Nuku’Alofa As Case Study, Raymond Lutui, ‘Osai Tete’Imoana, George Maeakafa

Australian Information Security Management Conference

This paper describes the justification for a project to assess the security status of wireless networks usage in Nuku’alofa, the CBD of Tonga, By War Driving these suburbs, actual data was gathered to indicate the security status of wireless networks and provide an understanding of the users’ level of awareness and attitudes towards wireless security. This paper also takes the opportunity to compare the performance of the War driving tools that this study employed – GMoN, SWardriving, and Wi-Fi Scan. Wireless network communication remains a challenging and critical issue. This study takes an exploratory approach in which it allows the …

Smartphone User Privacy Preserving Through Crowdsourcing, Bahman Rashidi

Theses and Dissertations

In current Android architecture, users have to decide whether an app is safe to use or not. Expert users can make savvy decisions to avoid unnecessary private data breach. However, the majority of regular users are not technically capable or do not care to consider privacy implications to make safe decisions. To assist the technically incapable crowd, we propose a permission control framework based on crowdsourcing. At its core, our framework runs new apps under probation mode without granting their permission requests up-front. It provides recommendations on whether to accept or not the permission requests based on decisions from peer …

Secure Smart Metering Based On Lora Technology, Yao Cheng, Hendra Saputra, Leng Meng Goh, Yongdong Wu

Research Collection School Of Computing and Information Systems

Smart metering allows Substation Automation System (SAS) to remotely and timely read smart meters. Despite its advantages, smart metering brings some challenges. a) It introduces cyber attack risks to the metering system, which may lead to user privacy leakage or even the compromise of smart metering systems. b) Although the majority of meters are located within a regional power supply area, some hard-to-reach nodes are geographically far from the clustered area, which account for a big portion of the entire smart metering operation cost. Facing the above challenges, we propose a secure smart metering infrastructure based on LoRa technology which …

Securing Display Path For Security-Sensitive Applications On Mobile Devices, Jinhua Cui, Yuanyuan Zhang, Zhiping Cai, Anfeng Liu, Yangyang Li

Research Collection School Of Computing and Information Systems

While smart devices based on ARM processor bring us a lot of convenience, they also become an attractive target of cyber-attacks. The threat is exaggerated as commodity OSes usually have a large code base and suffer from various software vulnerabilities. Nowadays, adversaries prefer to steal sensitive data by leaking the content of display output by a security-sensitive application. A promising solution is to exploit the hardware visualization extensions provided by modern ARM processors to construct a secure display path between the applications and the display device. In this work, we present a scheme named SecDisplay for trusted display service, it …

Hybrid Privacy-Preserving Clinical Decision Support System In Fog-Cloud Computing, Ximeng Liu, Robert H. Deng, Yang Yang, Ngoc Hieu Tran, Shangping Zhong

Research Collection School Of Computing and Information Systems

In this paper, we propose a framework for hybrid privacy-preserving clinical decision support system in fog cloud computing, called HPCS. In HPCS, a fog server uses a lightweight data mining method to securely monitor patients' health condition in real-time. The newly detected abnormal symptoms can be further sent to the cloud server for high-accuracy prediction in a privacy-preserving way. Specifically, for the fog servers, we design a new secure outsourced inner-product protocol for achieving secure lightweight single-layer neural network. Also, a privacy-preserving piecewise polynomial calculation protocol allows cloud server to securely perform any activation functions in multiple-layer neural network. Moreover, …

Vulnerability Analysis: Protecting Information In The Iot, Brian Cusack, Feiqiu Zhuang

Australian Information Security Management Conference

The research was designed to study IoT security vulnerabilities and how to better protect IoT communications. By researching the system a Fitbit uses for communications, this research analyzes and reveals security defects in the IoT architecture. The research first uses a man-in the middle (MITM) attack to intercept and analyze the Fitbit system traffic to identify security weakness. Then uses a replay attack to further validate these flaws. Finally, countermeasures against these security threats are proposed. The research findings show the Fitbit’s IoT communication architecture has serious information security risks. Firstly, the Fitbit tested does not encrypt the raw data …

Mitigating Man-In-The-Middle Attacks On Mobile Devices By Blocking Insecure Http Traffic Without Using Vpn, Kevin Chong, Muhammad Imran Malik, Peter Hannay

Australian Information Security Management Conference

Mobile devices are constantly connected to the Internet, making countless connections with remote services. Unfortunately, many of these connections are in cleartext, visible to third-parties while in transit. This is insecure and opens up the possibility for man-in-the-middle attacks. While there is little control over what kind of connection running apps can make, this paper presents a solution in blocking insecure HTTP packets from leaving the device. Specifically, the proposed solution works on the device, without the need to tunnel packets to a remote VPN server, and without special privileges such as root access. Speed tests were performed to quantify …

Bringing Defensive Artificial Intelligence Capabilities To Mobile Devices, Kevin Chong, Ahmed Ibrahim

Australian Information Security Management Conference

Traditional firewalls are losing their effectiveness against new and evolving threats today. Artificial intelligence (AI) driven firewalls are gaining popularity due to their ability to defend against threats that are not fully known. However, a firewall can only protect devices in the same network it is deployed in, leaving mobile devices unprotected once they leave the network. To comprehensively protect a mobile device, capabilities of an AI-driven firewall can enhance the defensive capabilities of the device. This paper proposes porting AI technologies to mobile devices for defence against today’s ever-evolving threats. A defensive AI technique providing firewall-like capability is being …

The Impact Of Personality Traits On User’S Susceptibility To Social Engineering Attacks, Brian Cusack, Kemi Adedokun

Australian Information Security Management Conference

Phishing attacks and other social manipulation attacks are an everyday occurrence for most workers in their email boxes. Others experience social engineering tricks to take and divert payments on legitimate electronic commerce transactions. This exploratory pilot study aims to examine the impact of user’s personality on the likelihood of user’s susceptibility to social engineering attacks. Five expert interviews were conducted to investigate what traits makes some individuals more or sometimes less susceptible to social engineering attack than others. The personality traits were obtained using the big five personality model for correlation with interview data. The result suggests that users with …

Encryption And Decryption Using Matricies, Amit Etiel, James Parsons, Shawn Jenkins-Edwards

Math 365 Class Projects

Mathematician Lester Hill developed the Hill Cipher, the first mathematical encryption method ever developed, in 1929. This method was created in order to strengthen the level of security of previous methods and made it possible to encrypt more than three symbols at a time.

Tinyvisor: An Extensible Secure Framework On Android Platforms, Dong Shen, Zhoujun Li, Xiaojing Su, Jinxin Ma, Deng, Robert H.

Research Collection School Of Computing and Information Systems

As the utilization of mobile platform keeps growing, the security issue of mobile platform becomes a serious threat to user privacy. The current security measures mainly focus on the application level and the framework level, with little protection on the kernel. Virtualization technologies have been used in x86 platforms to protect the security of the kernel. With a higher privilege than the guest operating system, the hypervisor can effectively detect and defend against the malicious activity inside the guest kernel. In this paper, we build a hypervisor framework called TinyVisor leveraging the ARM virtualization extensions to protect the guest system …

Improved Construction For Inner Product Functional Encryption, Qingsong Zhao, Qingkai Zeng, Ximeng Liu

Research Collection School Of Computing and Information Systems

Functional encryption (FE) is a vast new paradigm for encryption scheme which allows tremendous flexibility in accessing encrypted data. In a FE scheme, a user can learn specific function of encrypted messages by restricted functional key and reveals nothing else about the messages. Besides the standard notion of data privacy in FE, it should protect the privacy of the function itself which is also crucial for practical applications. In this paper, we construct a secret key FE scheme for the inner product functionality using asymmetric bilinear pairing groups of prime order. Compared with the existing similar schemes, our construction reduces …

Strong Identity-Based Proxy Signature Schemes, Revisited, Weiwei Liu, Yi Mu, Guomin Yang, Yangguang Tian

Research Collection School Of Computing and Information Systems

Proxy signature is a useful cryptographic primitive that has been widely used in many applications. It has attracted a lot of attention since it was introduced. There have been lots of works in constructing efficient and secure proxy signature schemes. In this paper, we identify a new attack that has been neglected by many existing proven secure proxy signature schemes. We demonstrate this attack by launching it against an identity-based proxy signature scheme which is proven secure. We then propose one method that can effectively prevent this attack. The weakness in some other proxy signature schemes can also be fixed …

Efficient And Privacy-Preserving Outsourced Calculation Of Rational Numbers, Ximeng Liu, Kim-Kwang Raymond Choo, Robert H. Deng, Rongxing Lu, Jian Weng

Research Collection School Of Computing and Information Systems

In this paper, we propose a framework for efficient and privacy-preserving outsourced calculation of rational numbers, which we refer to as POCR. Using POCR, a user can securely outsource the storing and processing of rational numbers to a cloud server without compromising the security of the (original) data and the computed results. We present the system architecture of POCR and the associated toolkits required in the privacy preserving calculation of integers and rational numbers to ensure that commonly used outsourced operations can be handled on-the-fly. We then prove that the proposed POCR achieves the goal of secure integer and rational …