Information Security Commons^™

A Blockchain-Based Anomalous Detection System For Internet Of Things Devices, Joshua K. Mosby

Theses and Dissertations

Internet of Things devices are highly susceptible to attack, and owners often fail to realize they have been compromised. This thesis describes an anomalous-based intrusion detection system that operates directly on Internet of Things devices utilizing a custom-built Blockchain. In this approach, an agent on each node compares the node's behavior to that of its peers, generating an alert if they are behaving differently. An experiment is conducted to determine the effectiveness at detecting malware. Three different code samples simulating common malware are deployed against a testbed of 12 Raspberry Pi devices. Increasing numbers are infected until two-thirds of the …

Testing The Fault Tolerance Of A Wide Area Backup Protection System Using Spin, Kenneth James

Theses and Dissertations

Cyber-physical systems are increasingly prevalent in daily life. Smart grids in particular are becoming more interconnected and autonomously operated. Despite the advantages, new challenges arise in the form of defending these assets. Recent studies reveal that small-scale, coordinated cyber-attacks on only a few substations across the U.S. could result in cascading failures affecting the entire nation. In support of defending critical infrastructure, this thesis tests the fault tolerance of a backup protection system. Each transmission line in the system incorporates autonomous agents which monitor the status of the line and make decisions regarding the safety of the grid. Various malfunctions …

Evaluating Machine Learning Techniques For Smart Home Device Classification, Angelito E. Aragon Jr.

Theses and Dissertations

Smart devices in the Internet of Things (IoT) have transformed the management of personal and industrial spaces. Leveraging inexpensive computing, smart devices enable remote sensing and automated control over a diverse range of processes. Even as IoT devices provide numerous benefits, it is vital that their emerging security implications are studied. IoT device design typically focuses on cost efficiency and time to market, leading to limited built-in encryption, questionable supply chains, and poor data security. In a 2017 report, the United States Government Accountability Office recommended that the Department of Defense investigate the risks IoT devices pose to operations security, …

Cyber-Attack Drone Payload Development And Geolocation Via Directional Antennae, Clint M. Bramlette

Theses and Dissertations

The increasing capabilities of commercial drones have led to blossoming drone usage in private sector industries ranging from agriculture to mining to cinema. Commercial drones have made amazing improvements in flight time, flight distance, and payload weight. These same features also offer a unique and unprecedented commodity for wireless hackers -- the ability to gain ‘physical’ proximity to a target without personally having to be anywhere near it. This capability is called Remote Physical Proximity (RPP). By their nature, wireless devices are largely susceptible to sniffing and injection attacks, but only if the attacker can interact with the device via …

Confidence Inference In Defensive Cyber Operator Decision Making, Graig S. Ganitano

Theses and Dissertations

Cyber defense analysts face the challenge of validating machine generated alerts regarding network-based security threats. Operations tempo and systematic manpower issues have increased the importance of these individual analyst decisions, since they typically are not reviewed or changed. Analysts may not always be confident in their decisions. If confidence can be accurately assessed, then analyst decisions made under low confidence can be independently reviewed and analysts can be offered decision assistance or additional training. This work investigates the utility of using neurophysiological and behavioral correlates of decision confidence to train machine learning models to infer confidence in analyst decisions. Electroencephalography …

Preserving Privacy In Automotive Tire Pressure Monitoring Systems, Kenneth L. Hacker

Theses and Dissertations

The automotive industry is moving towards a more connected ecosystem, with connectivity achieved through multiple wireless systems. However, in the pursuit of these technological advances and to quickly satisfy requirements imposed on manufacturers, the security of these systems is often an afterthought. It has been shown that systems in a standard new automobile that one would not expect to be vulnerable can be exploited for a variety of harmful effects. This thesis considers a seemingly benign, but government mandated, safety feature of modern vehicles; the Tire Pressure Monitoring System (TPMS). Typical implementations have no security-oriented features, leaking data that can …

Self Organized Multi Agent Swarms (Somas) For Network Security Control, Eric M. Holloway

Theses and Dissertations

Computer network security is a very serious concern in many commercial, industrial, and military environments. This paper proposes a new computer network security approach defined by self-organized agent swarms (SOMAS) which provides a novel computer network security management framework based upon desired overall system behaviors. The SOMAS structure evolves based upon the partially observable Markov decision process (POMDP) formal model and the more complex Interactive-POMDP and Decentralized-POMDP models, which are augmented with a new F(*-POMDP) model. Example swarm specific and network based behaviors are formalized and simulated. This paper illustrates through various statistical testing techniques, the significance of this proposed …

Frameup: An Incriminatory Attack On Storj: A Peer To Peer Blockchain Enabled Distributed Storage System, Xiaolu Zhang, Justin Grannis, Ibrahim Baggili, Nicole Lang Beebe

Electrical & Computer Engineering and Computer Science Faculty Publications

In this work we present a primary account of frameup, an incriminatory attack made possible because of existing implementations in distributed peer to peer storage. The frameup attack shows that an adversary has the ability to store unencrypted data on the hard drives of people renting out their hard drive space. This is important to forensic examiners as it opens the door for possibly framing an innocent victim. Our work employs Storj as an example technology, due to its popularity and market size. Storj is a blockchain enabled system that allows people to rent out their hard drive space …

Peeling Back The (Onion) Layers Of The Dark Web, Singapore Management University

Perspectives@SMU

Manoeuvring the minefield of risk and exposure

Matching Possible Mitigations To Cyber Threats: A Document-Driven Decision Support Systems Approach, Martha Wagner Mcneil

Masters Theses & Doctoral Dissertations

Cyber systems are ubiquitous in all aspects of society. At the same time, breaches to cyber systems continue to be front-page news (Calfas, 2018; Equifax, 2017) and, despite more than a decade of heightened focus on cybersecurity, the threat continues to evolve and grow, costing globally up to $575 billion annually (Center for Strategic and International Studies, 2014; Gosler & Von Thaer, 2013; Microsoft, 2016; Verizon, 2017). To address possible impacts due to cyber threats, information system (IS) stakeholders must assess the risks they face. Following a risk assessment, the next step is to determine mitigations to counter the threats …

Self-Efficacy In Information Security: A Mixed Methods Study Of Deaf End-Users, Kyle Murbach

Masters Theses & Doctoral Dissertations

This explanatory sequential mixed methods study focuses on gaining an overall understanding of the potential variances in self-efficacy in information security and security practice behavior in the deaf population. Very little is understood about the deaf experience when engaging in security practices and their confidence levels in doing so. Due to the fastpaced nature of cyber security and its many facets, the human factor plays a crucial role in the success of cyber security. It is important to understand the potential implications of variances that may affect a deaf end-user’s security practice behavior to be able to provide more effective …

Malgazer: An Automated Malware Classifier With Running Window Entropy And Machine Learning, Keith Jones

Masters Theses & Doctoral Dissertations

This dissertation explores functional malware classification using running window entropy and machine learning classifiers. This topic was under researched in the prior literature, but the implications are important for malware defense. This dissertation will present six new design science artifacts. The first artifact was a generalized machine learning based malware classifier model. This model was used to categorize and explain the gaps in the prior literature. This artifact was also used to compare the prior literature to the classifiers created in this dissertation, herein referred to as “Malgazer” classifiers.

Running window entropy data was required, but the algorithm was too …

Flashlight In A Dark Room: A Grounded Theory Study On Information Security Management At Small Healthcare Provider Organizations, Gerald Auger

Masters Theses & Doctoral Dissertations

Healthcare providers have a responsibility to protect patient’s privacy and a business motivation to properly secure their assets. These providers encounter barriers to achieving these objectives and limited academic research has been conducted to examine the causes and strategies to overcome them. A subset of this demographic, businesses with less than 10 providers, compose a majority 57% of provider organizations in the United States. This grounded theory study provides exploratory findings, discovering these small healthcare provider organizations (SHPO) have limited knowledge on information technology (IT) and information security that results in assumptions and misappropriations of information security implementation, who is …

Advanced Code-Reuse Attacks: A Novel Framework For Jop, Bramwell J. Brizendine

Masters Theses & Doctoral Dissertations

Return-oriented programming is the predominant code-reuse attack, where short gadgets or borrowed chunks of code ending in a RET instruction can be discovered in binaries. A chain of ROP gadgets placed on the stack can permit control flow to be subverted, allowing for arbitrary computation. Jump-oriented programming is a class of code-reuse attack where instead of using RET instructions, indirect jumps and indirect calls are utilized to subvert the control flow. JOP is important because can allow for important mitigations and protections against ROP to be bypassed, and some protections against JOP are imperfect. This dissertation presents a design science …

A Malware Analysis And Artifact Capture Tool, Dallas Wright

Masters Theses & Doctoral Dissertations

Malware authors attempt to obfuscate and hide their execution objectives in their program’s static and dynamic states. This paper provides a novel approach to aid analysis by introducing a malware analysis tool which is quick to set up and use with respect to other existing tools. The tool allows for the intercepting and capturing of malware artifacts while providing dynamic control of process flow. Capturing malware artifacts allows an analyst to more quickly and comprehensively understand malware behavior and obfuscation techniques and doing so interactively allows multiple code paths to be explored. The faster that malware can be analyzed the …

Evaluating The Impacts Of Detecting X.509 Covert Channels, Cody Welu

Masters Theses & Doctoral Dissertations

This quasi-experimental before-and-after study examined the performance impacts of detecting X.509 covert channels in the Suricata intrusion detection system. Relevant literature and previous studies surrounding covert channels and covert channel detection, X.509 certificates, and intrusion detection system performance were evaluated. This study used Jason Reaves’ X.509 covert channel proof of concept code to generate malicious network traffic for detection (2018). Various detection rules for intrusion detection systems were created to aid in the detection of the X.509 covert channel. The central processing unit (CPU) and memory utilization impacts that each rule had on the intrusion detection system was studied and …

International Nuclear Cyber Security Threat Landscape, Shannon Eggers, Charles Nickerson

Purdue Workshop on Nonproliferation: Technology and Approaches

The Idaho National Laboratory (INL) Nuclear Cyber Team (NCT) is a recognized leader in international nuclear cyber program assessments as well as nuclear cyber training development and delivery. This paper discusses how the NCT is implementing their vision to protect global nuclear infrastructure from cyber threats. Also outlined is the team’s perspectives on the global nuclear cyber threat landscape and the top ten approachable cyber security measures that can be applied to immediately improve a country’s nuclear cyber security posture.

Suaa: A Secure User Authentication Scheme With Anonymity For The Single & Multi-Server Environments, Nassoro M. R. Lwamo, Liehuang Zhu, Chang Xu, Kashif Sharif, Ximeng Liu, Chuan Zhang

Research Collection School Of Computing and Information Systems

The rapid increase in user base and technological penetration has enabled the use of a wide range of devices and applications. The services are rendered to these devices from single-server or highly distributed server environments, irrespective of their location. As the information exchanged between servers and clients is private, numerous forms of attacks can be launched to compromise it. To ensure the security, privacy, and availability of the services, different authentication schemes have been proposed for both single-server and multi-server environments. The primary performance objective of such schemes is to prevent most (if not all) attacks, with minimal computational costs …

See No Evil, Hear No Evil? Dissecting The Impact Of Online Hacker Forums, Wei T. Yue, Qiu-Hong Wang, Kai‐Lung Hui

Research Collection School Of Computing and Information Systems

Online hacker forums offer a prominent avenue for sharing hacking knowledge. Using a field dataset culled from multiple sources, we find that online discussion of distributed denial of service (DDOS) attacks in hackforums.net decreases the number of DDOS-attack victims. A 1% increase in discussion decreases DDOS attacks by 0.032% to 0.122%. This means that two DDOS-attack posts per day could reduce the number of victims by 700 to 2,600 per day. We find that discussion topics with similar keywords can variously increase or decrease DDOS attacks, meaning we cannot ascertain the impact of the discussion just by the post nature. …

Mirai Bot Scanner Summation Prototype, Charles V. Frank Jr.

Masters Theses & Doctoral Dissertations

The Mirai botnet deploys a distributed mechanism with each Bot continually scanning for a potential new Bot Victim. A Bot continually generates a random IP address to scan the network for discovering a potential new Bot Victim. The Bot establishes a connection with the potential new Bot Victim with a Transmission Control Protocol (TCP) handshake. The Mirai botnet has recruited hundreds of thousands of Bots. With 100,000 Bots, Mirai Distributed Denial of Service (DDoS) attacks on service provider Dyn in October 2016 triggered the inaccessibility to hundreds of websites in Europe and North America (Sinanović & Mrdovic, 2017). A month …

Chip-Off Success Rate Analysis Comparing Temperature And Chip Type, Choli Ence, Joan Runs Through, Gary D. Cantrell

Journal of Digital Forensics, Security and Law

Throughout the digital forensic community, chip-off analysis provides examiners with a technique to obtain a physical acquisition from locked or damaged digital device. Thermal based chip-analysis relies upon the application of heat to remove the flash memory chip from the circuit board. Occasionally, a flash memory chip fails to successfully read despite following similar protocols as other flash memory chips. Previous research found the application of high temperatures increased the number of bit errors present in the flash memory chip. The purpose of this study is to analyze data collected from chip-off analyses to determine if a statistical difference exists …

Towards Secure Data Flow Oriented Multi-Vendor Ict Governance Model, Lars Magnusson, Patrik Elm, Anita Mirijamdotter

International Journal of Business and Technology

Today, still, ICT Governance is being regarded as a departmental concern, not an overall organizational concern. History has shown us that implementation strategies, which are based on departments, results in fractional implementations leading to ad hoc solutions with no central control and stagnation for the in-house ICT strategy. Further, this recently has created an opinion trend; many are talking about the ICT department as being redundant, a dying out breed, which should be replaced by on-demand specialized external services. Clearly, the evermore changing surroundings do force organizations to accelerate the pace of new adaptations within their ICT plans, more vivacious …

Implications Of Eu-Gdpr In Low-Grade Social, Activist And Ngo Settings, Lars Magnusson, Sarfraz Iqbal

International Journal of Business and Technology

Social support services are becoming popular among the citizens of every country and every age. Though, social support services easily accessible on mobile phones are used in different contexts, ranging from extending your presence and connectivity to friends, family and colleagues to using social media services for being a social activist seeking to help individuals confined in miserable situations such as homeless community, drug addicts or even revolutionists fighting against dictatorships etc. However, a very recent development in the European Parliament’s law (2016/679) on the processing and free movement of personal data in terms of EU-GDPR (General data protection rules) …

An Approach To Information Security For Smes Based On The Resource-Based View Theory, Blerton Abazi

International Journal of Business and Technology

The main focus of this proposal is to analyze implementation challenges, benefits and requirements in implementation of Information Systems and managing information security in small and medium size companies in Western Balkans countries. In relation to the study, the proposal will focus in the following questions to investigate: What are the benefits that companies mostly find after the implementation of Information Systems has been implemented, efficiency, how to they manage security of the information’s, competitive advantage, return of investments etc. The study should give a clear approach to Information Systems implementation, information security, maintenance, measurable benefits, challenges companies have gone …

Some Issues In The Testing Of Computer Simulation Models, David J. Murray-Smith

International Journal of Business and Technology

The testing of simulation models has much in common with testing processes in other types of application involving software development. However, there are also important differences associated with the fact that simulation model testing involves two distinct aspects, which are known as verification and validation. Model validation is concerned with investigation of modelling errors and model limitations while verification involves checking that the simulation program is an accurate representation of the mathematical and logical structure of the underlying model. Success in model validation depends upon the availability of detailed information about all aspects of the system being modelled. It also …

Cs04all: Cryptography Module, Hunter R. Johnson

Open Educational Resources

Cryptography module

This archive contains a series of lessons on cryptography suitable for use in a CS0 course. The only requirement is familiarity with Python, particularly dictionaries, lists, and file IO. It is also assumed that students know how to create stand-alone Python programs and interact with them through the terminal. Most of the work is done in Jupyter notebooks.

The material found in the notebooks is a combination of reading material, exercises, activities and assignments. Below are descriptions of each lesson or assignment and links to notebooks on Cocalc. The same files are available for batch download in this …

Awareness And Perception Of Cybercrimes And Cybercriminals, Hannarae Lee, Hyeyoung Lim

International Journal of Cybersecurity Intelligence & Cybercrime

Awareness is a starting point to recognize, understand, or know a situation or fact, and the perception makes a difference in how to deal with it. Although the term cybercrime may not be new to the most public and the police, not all of them are well aware of the nature and extent of cybercrimes, cybercriminals, and cyber-victims, which in turn affects their perceptions of matters. The four papers in this issue of the International Journal of Cybersecurity Intelligence and Cybercrime empirically examine these important topics and discuss policy implications.

Phishing And Cybercrime Risks In A University Student Community, Roderic Broadhurst, Katie Skinner, Nicholas Sifniotis, Bryan Matamoros-Macias, Yuguang Ipsen

International Journal of Cybersecurity Intelligence & Cybercrime

In an exploratory quasi-experimental observational study, 138 participants recruited during a university orientation week were exposed to social engineering directives in the form of fake email or phishing attacks over several months in 2017. These email attacks attempted to elicit personal information from participants or entice them into clicking links which may have been compromised in a real-world setting. The study aimed to determine the risks of cybercrime for students by observing their responses to social engineering and exploring attitudes to cybercrime risks before and after the phishing phase. Three types of scam emails were distributed that varied in the …

Examining Perceptions Of Online Harassment Among Constables In England And Wales, Thomas J. Holt, Jin R. Lee, Roberta Liggett, Karen M. Holt, Adam Bossler

International Journal of Cybersecurity Intelligence & Cybercrime

The ubiquity of the Internet and computer technology has enabled individuals to engage in bullying, threats, and harassing communications online. Limited research has found that local line officers may not view these offenses as serious compared to real world crimes despite their negative physical and emotional impact on victims. The perceptions of officers can produce poor interactions with victims during calls for service, particularly victim blaming, which can reduce citizens’ confidence in police agencies generally. However, local law enforcement agencies are increasingly mandated to respond to these cases, calling to question how their views may impact the community. This study …

Cybercrime And Digital Forensics: Bridging The Gap In Legislation, Investigation And Prosecution Of Cybercrime In Nigeria, Kabiru H. Mohammed, Yusuf D. Mohammed, Abiodun A. Solanke

International Journal of Cybersecurity Intelligence & Cybercrime

The advancement of Information and Communication Technologies (ICT) opens new avenues and ways for cybercriminals to commit crime. The primary goal of this paper is to raise awareness regarding gaps that exist with regards to Nigeria’s capabilities to adequately legislate, investigate and prosecute cases of cybercrimes. The major source of cybercrime legislation in Nigeria is an act of the National Assembly which is majorly a symbolic legislation rather than a full and active legislation. In perusing these avenues of inquiry, the authors seek to identify systemic impediments which hinder law enforcement agencies, prosecutors, and investigators from properly carrying out their …