Information Security Commons^™

Intelligent Log Analysis For Anomaly Detection, Steven Yen

Master's Projects

Computer logs are a rich source of information that can be analyzed to detect various issues. The large volumes of logs limit the effectiveness of manual approaches to log analysis. The earliest automated log analysis tools take a rule-based approach, which can only detect known issues with existing rules. On the other hand, anomaly detection approaches can detect new or unknown issues. This is achieved by looking for unusual behavior different from the norm, often utilizing machine learning (ML) or deep learning (DL) models. In this project, we evaluated various ML and DL techniques used for log anomaly detection. We …

Breaking Audio Captcha Using Machine Learning/Deep Learning And Related Defense Mechanism, Heemany Shekhar

Master's Projects

CAPTCHA is a web-based authentication method used by websites to distinguish between humans (valid users) and bots(attackers). Audio captcha is an accessible captcha meant for the visually disabled section of users such as color-blind, blind, near-sighted users. In this project, I analyzed the security of audio captchas from attacks that employ machine learning and deep learning models. Audio captchas of varying lengths (5, 7 and 10) and varying background noise (no noise, medium noise or high noise) were analyzed. I found that audio captchas with no background noise or medium background noise were easily attacked with 99% - 100% accuracy. …

Measuring Malware Evolution Using Support Vector Machines, Mayuri Wadkar

Master's Projects

Malware is software that is designed to do harm to computer systems. Malware often evolves over a period of time as malware developers add new features and fix bugs. Thus, malware samples from the same family from different time periods can exhibit significantly different behavior. Differences between malware samples within a single family can originate from various code modifications designed to evade signature-based detection or changes that are made to alter the functionality of the malware itself. In this research, we apply feature ranking based on linear support vector machine (SVM) weights to identify, quantify, and track changes within malware …

Malware Analysis On Pdf, Shubham Shashishekhar Pachpute

Master's Projects

Cyber-attacks are growing day by day and attackers are finding new techniques to cause harm to their target by spreading worms and malware. In the world of innovations and new technologies coming out every day, it creates a possibility of attacking a system and exploiting the vulnerabilities present in the system. One of the methods used for the spread of malware is the Portable Document Format (PDF) files. Due to the flexible nature of these files, it is becoming a sweet spot for the attackers to embed the malware easily into the PDF files. In this report, we are going …

Contract Builder Ethereum Application, Colin M. Fowler

Master's Projects

Developments in Blockchain, smart contract, and decentralized application (“dApps”) technology have enabled new types of software that can improve efficiency within law firms by increasing speed at which attorneys may draft and execute contracts. Smart contracts and dApps are self-executing software that reside on a blockchain. Custom smart contracts can be built in a modular manner in order to emulate contracts that are commonly generated and executed in law firms. Such contracts include those for the transfer of services, goods, and title. This article explores exactly how implementations of smart contracts for law firms may look.

Javascript Metamorphic Malware Detection Using Machine Learning Techniques, Aakash Wadhwani

Master's Projects

Various factors like defects in the operating system, email attachments from unknown sources, downloading and installing a software from non-trusted sites make computers vulnerable to malware attacks. Current antivirus techniques lack the ability to detect metamorphic viruses, which vary the internal structure of the original malware code across various versions, but still have the exact same behavior throughout. Antivirus software typically relies on signature detection for identifying a virus, but code morphing evades signature detection quite effectively.

JavaScript is used to generate metamorphic malware by changing the code’s Abstract Syntax Tree without changing the actual functionality, making it very difficult …

Classifying Classic Ciphers Using Machine Learning, Nivedhitha Ramarathnam Krishna

Master's Projects

We consider the problem of identifying the classic cipher that was used to generate a given ciphertext message. We assume that the plaintext is English and we restrict our attention to ciphertext consisting only of alphabetic characters. Among the classic ciphers considered are the simple substitution, Vigenère cipher, playfair cipher, and column transposition cipher. The problem of classification is approached in two ways. The first method uses support vector machines (SVM) trained directly on ciphertext to classify the ciphers. In the second approach, we train hidden Markov models (HMM) on each ciphertext message, then use these trained HMMs as features …

Smartphone Gesture-Based Authentication, Preethi Sundaravaradhan

Master's Projects

In this research, we consider the problem of authentication on a smartphone based on gestures, that is, movements of the phone. Accelerometer data from a number of subjects was collected and we analyze this data using a variety of machine learning techniques, including support vector machines (SVM) and convolutional neural networks (CNN). We analyze both the fraud rate (or false accept rate) and insult rate (or false reject rate) in each case.

Classification Of Malware Models, Akriti Sethi

Master's Projects

Automatically classifying similar malware families is a challenging problem. In this research, we attempt to classify malware families by applying machine learning to machine learning models. Specifically, we train hidden Markov models (HMM) for each malware family in our dataset. The resulting models are then compared in two ways. First, we treat the HMM matrices as images and experiment with convolutional neural networks (CNN) for image classification. Second, we apply support vector machines (SVM) to classify the HMMs. We analyze the results and discuss the relative advantages and disadvantages of each approach.

Machine Learning Versus Deep Learning For Malware Detection, Parth Jain

Master's Projects

It is often claimed that the primary advantage of deep learning is that such models can continue to learn as more data is available, provided that sufficient computing power is available for training. In contrast, for other forms of machine learning it is claimed that models ‘‘saturate,’’ in the sense that no additional learning can occur beyond some point, regardless of the amount of data or computing power available. In this research, we compare the accuracy of deep learning to other forms of machine learning for malware detection, as a function of the training dataset size. We experiment with a …

Deep Learning For Image Spam Detection, Tazmina Sharmin

Master's Projects

Spam can be defined as unsolicited bulk email. In an effort to evade text-based spam filters, spammers can embed their spam text in an image, which is referred to as image spam. In this research, we consider the problem of image spam detection, based on image analysis. We apply various machine learning and deep learning techniques to real-world image spam datasets, and to a challenge image spam-like dataset. We obtain results comparable to previous work for the real-world datasets, while our deep learning approach yields the best results to date for the challenge dataset.

Earmarked Utxo For Escrow Services And Two-Factor Authentication On The Blockchain, Jisha Pillai

Master's Projects

The security of accounts on the blockchain relies on securing private keys, but they are often lost or compromised due to loopholes in key management strategies or due to human error. With an increasing number of thefts in the last few years due to compromised wallets, the security of digital currency has become a significant concern, and no matter how sophisticated and secure mechanisms are put in place to avoid the security risks, it is impossible to achieve a 100% human compliance.

This project introduces a novel concept of Earmarked Unspent Transaction Outputs (EUTXOs). EUTXOs enable every user on the …

Emulation Vs Instrumentation For Android Malware Detection, Anukriti Sinha

Master's Projects

In resource constrained devices, malware detection is typically based on offline analysis using emulation. In previous work it has been claimed that such emulation fails for a significant percentage of Android malware because well-designed malware detects that the code is being emulated. An alternative to emulation is malware analysis based on code that is executing on an actual Android device. In this research, we collect features from a corpus of Android malware using both emulation and on-phone instrumentation. We train machine learning models based on emulated features and also train models based on features collected via instrumentation, and we compare …

Multifamily Malware Models, Samanvitha Basole

Master's Projects

When training a machine learning model, there is likely to be a tradeoff between the accuracy of the model and the generality of the dataset. Previous research has shown that if we train a model to detect one specific malware family, we obtain stronger results as compared to a case where we train a single model on multiple diverse families. During the detection phase, it would be more efficient to have a single model that could detect multiple families, rather than having to score each sample against multiple models. In this research, we conduct experiments to quantify the relationship between …

Implementation Of Group Based Cryptosystems In Information Security, Bailey J. Moers

Undergraduate University Honors Capstones

This capstone will focus on the implementation of cryptography in information security. The implementation can be achieved by studying different cryptosystems that will be secured using group based mathematics. Group based cryptosystems are preferable because research shows that group based cryptosystems are computationally infeasible. Understanding group based mathematics and its implementation in cryptography will allow us to better study the NTRU (Nth Truncated Ring Unit) cryptosystem with previous knowledge of group based cryptosystems. Although this cryptosystem is still very new, two sections of NTRU cryptosystem will be implemented in information security. The selected sections are: Multiplication of Polynomials modulo p …

Cybersecurity For Critical Infrastructure: Addressing Threats And Vulnerabilities In Canada, Samuel A. Cohen

Graduate Theses/Dissertations

The aim of this thesis is to assess the unique technical and policy-based cybersecurity challenges facing Canada’s critical infrastructure environment and to analyze how current government and industry practices are not equipped to remediate or offset associated strategic risks to the country. Further, the thesis also provides cases and evidence demonstrating that Canada’s critical infrastructure has been specifically targeted by foreign and domestic cyber threat actors to pressure the country’s economic, safety and national security interests. Essential services that Canadians and Canadian businesses rely on daily are intricately linked to the availability and integrity of vital infrastructure sectors, such as …

Forensic Analysis Of Spy Applications In Android Devices, Shinelle Hutchinson, Umit Karabiyik

Annual ADFSL Conference on Digital Forensics, Security and Law

Smartphones with Google's Android operating system are becoming more and more popular each year, and with this increased user base, comes increased opportunities to collect more of these users' private data. There have been several instances of malware being made available via the Google Play Store, which is one of the predominant means for users to download applications. One effective way of collecting users' private data is by using Android Spyware. In this paper, we conduct a forensic analysis of a malicious Android spyware application and present our findings. We also highlight what information the application accesses and what it …

Assessing Code Obfuscation Of Metamorphic Javascript, Kaushik Murli

Master's Projects

Metamorphic malware is one of the biggest and most ubiquitous threats in the digital world. It can be used to morph the structure of the target code without changing the underlying functionality of the code, thus making it very difficult to detect using signature-based detection and heuristic analysis. The focus of this project is to analyze Metamorphic JavaScript malware and techniques that can be used to mutate the code in JavaScript. To assess the capabilities of the metamorphic engine, we performed experiments to visualize the degree of code morphing. Further, this project discusses potential methods that have been used to …

Cptc - A Security Competition Unlike Any Other, Bill Stackpole, Daryl Johnson

Presentations and other scholarship

Participating in cybersecurity competitions has become increasing popular for students in higher education programs that have a focus on computing or cyber security. The Collegiate Penetration Testing Competition was developed to address the industry skills gap and assist in identifying ethically minded security personnel with experience identifying, exercising, and mitigating vulnerabilities.

Analysis Of Computer Audit Data To Create Indicators Of Compromise For Intrusion Detection, Steven Millett, Michael Toolin, Justin Bates

SMU Data Science Review

Network security systems are designed to identify and, if possible, prevent unauthorized access to computer and network resources. Today most network security systems consist of hardware and software components that work in conjunction with one another to present a layered line of defense against unauthorized intrusions. Software provides user interactive layers such as password authentication, and system level layers for monitoring network activity. This paper examines an application monitoring network traffic that attempts to identify Indicators of Compromise (IOC) by extracting patterns in the network traffic which likely corresponds to unauthorized access. Typical network log data and construct indicators are …

Intrusion-Tolerant Order-Preserving Encryption, John Huson

Masters Theses, 2010-2019

Traditional encryption schemes such as AES and RSA aim to achieve the highest level of security, often indistinguishable security under the adaptive chosen-ciphertext attack. Ciphertexts generated by such encryption schemes do not leak useful information. As a result, such ciphertexts do not support efficient searchability nor range queries.

Order-preserving encryption is a relatively new encryption paradigm that allows for efficient queries on ciphertexts. In order-preserving encryption, the data-encrypting key is a long-term symmetric key that needs to stay online for insertion, query and deletion operations, making it an attractive target for attacks.

In this thesis, an intrusion-tolerant order-preserving encryption system …

Managing The Power And Pitfalls Of Data In Ai, Singapore Management University

Perspectives@SMU

Ethics and education are crucial in maintaining data privacy and augmenting human ability

“It’s difficult to imagine the power that you’re going to have when so many different sorts of data are available.” – Tim Berners-Lee, father of the Internet

“Before Google, and long before Facebook, Bezos had realised that the greatest value of an online company lay in the consumer data it collected.” – George Packer, author for the New Yorker

“Greening” Worcester: Municipal Best Practices For Sustainability, Erin Mckeon, Charline Kirongozi, Jared Duval, Antannia Greene, Qianshu Sun, Zewei Yao

School of Professional Studies

In response to the urgent threat posed by climate change, more and more cities, including Worcester, are attempting to become more environmentally responsible and sustainable. Worcester is attempting to develop ways to become more sustainable; both to strengthen their communities and to protect the planet. The Green Worcester Working Group (GWWG) tasked the Clark Capstone Team with researching best practices for municipal sustainability. The GWWG has set the following priorities: climate change mitigation, resilience, open spaces, sustainable resource management, education and awareness. Taking these into account, the Clark Capstone Team researched the sustainability practices of cities in New England, across …

Worcester Chamber Of Commerce: Recruiting Minority Business Owners, Ryan Dimaria, Alexander Hull, Xikun Lu, Haopeng Wang, Jiacheng Hou, Danning Zhao

School of Professional Studies

Our capstone project was to help the Worcester Regional Chamber of Commerce identify how to re-frame their marketing so it would be appealing to immigrant and minority owned businesses. Based on interviews and external research, our group was able to create a tangible and resourceful data set that provided justified recommendations and ideas on how the Chamber could make adjustments to their marketing plan to attract more businesses of this particular demographic in the city of Worcester. By implementing these recommendations, we believe the Chamber has the opportunity to create a more diverse group of Chamber members, add value to …

Service Now: Cmdb Research, Monika Patel, Smita Patil, Katerina Tzanavara, Manish Chauhan, Yuhao Wang, Houmin Xie, Lei Shi

School of Professional Studies

The MAPFRE Capstone team has been tasked with reviewing and recommending roadmap on the existing CMDB configuration. Paper discusses the team’s overall research on ServiceNow CMDB, Client’s deliverables and introduction to the latest technological innovations. Based on given objectives and team’s analysis we have recommended key solutions for the client to better understand the IT environment areas of business service impact, asset management, compliance, and configuration management. In addition, our research has covered all the majority of the technical and functional areas to provide greater visibility and insight into existing CMDB and IT environment.

For One Child, Zion Bereket, Xin Huang, Yitong Lin, Ruobing Pei, Rachel White, Ziyuan Li

School of Professional Studies

The entirety of this project was completed on the foundation of the three focus areas, which were identified by our client as areas of high need. The client wanted to prioritize these three areas as they believed that these three areas were the most integral to the successful achievement of their mission, as well as to the overall health and longevity of the organization.

Hiv/Aids In The Latino Community Of San Francisco: Past And Present, Jessica Da Silva

School of Professional Studies

There are approximately 122,000 people of Latino origin in San Francisco, which account for 15% of the total population (Census, 2010). Historically, Latinos have and still face several barriers to access healthcare and improvements in health (Aguirre-Molina, Molina & Zambrana, 2001). When the world was exposed to the spread of a new and unknown virus, the broader population suffered from the epidemic. The Latino community in San Francisco was and still is one of the hardest hit by the virus.

Changing The Current Perception Of Affordable Housing In Worcester, Simone Mcguinness, William Roberts, Vaske Gjino, Tong Zhou, Mengxin Ma, Sarawadee Sonpuak

School of Professional Studies

One of Worcester Interfaith’s goals is to eradicate the stigma of affordable housing in Worcester. Currently, the perception of affordable housing is of an image of unkept and old residences filled with destitute citizens who cannot afford basic needs to live in a city, let alone housing. This image is perpetuated by media, stigma, and a lack of education of the true reality of affordable housing and who its recipients are. Affordable housing-qualified citizens represent a range of educations, professions, age, race, and income levels. Affordable housing units, too, represent a variety of homes, many of which are extremely well-kept …

A Privacy-Preserving Framework For Collaborative Association Rule Mining In Cloud, Salha Albehairi

Theses, Dissertations and Culminating Projects

Collaborative Data Mining facilitates multiple organizations to integrate their datasets and extract useful knowledge from their joint datasets for mutual benefits. The knowledge extracted in this manner is found to be superior to the knowledge extracted locally from a single organization’s dataset. With the rapid development of outsourcing, there is a growing interest for organizations to outsource their data mining tasks to a cloud environment to effectively address their economic and performance demands. However, due to privacy concerns and stringent compliance regulations, organizations do not want to share their private datasets neither with the cloud nor with other participating organizations. …

A Privacy-Aware Framework For Friend Recommendations In Online Social Networks, Mona Fahad Alkanhal

Theses, Dissertations and Culminating Projects

Online social networks (OSN), such as Facebook, Twitter, and LinkedIn, have revolutionized the way how people share information and stay connected with family and friends. Along this direction, user’s privacy has been a significant concern to all users in the social networks. In this thesis, we propose a privacyaware framework that allows users to outsource their encrypted profile data to a cloud environment. In order to achieve better security and efficiency, our framework utilizes a hybrid approach that consists of Paillier’s encryption scheme and AES. Furthermore, we develop a privacy-aware friend recommendation protocol that recommends new friends to social network …