Information Security Commons^™

Social Media User Relationship Framework (Smurf), Anne David, Sarah Morris, Gareth Appleby-Thomas

Journal of Digital Forensics, Security and Law

The use of social media has spread through many aspects of society, allowing millions of individuals, corporate as well as government entities to leverage the opportunities it affords. These opportunities often end up being exploited by a small percentage of the user community who use it for objectionable or unlawful activities; for example, trolling, cyber bullying, grooming, luring. In some cases, these unlawful activities result in investigations where swift retrieval of critical evidence required in order to save a life.

This paper presents a proof of concept (PoC) framework for social media user attribution. The framework aims to provide digital …

Understanding Adversarial Robustness Via Critical Attacking Route, Tianlin Li, Aishan Liu, Xianglong Liu, Yitao Xu, Chongzhi Zhang, Xiaofei Xie

Research Collection School Of Computing and Information Systems

Deep neural networks (DNNs) are vulnerable to adversarial examples which are generated by inputs with imperceptible perturbations. Understanding adversarial robustness of DNNs has become an important issue, which would for certain result in better practical deep learning applications. To address this issue, we try to explain adversarial robustness for deep models from a new perspective of critical attacking route, which is computed by a gradient-based influence propagation strategy. Similar to rumor spreading in social net-works, we believe that adversarial noises are amplified and propagated through the critical attacking route. By exploiting neurons' influences layer by layer, we compose the critical …

Role Of Artificial Intelligence In The Internet Of Things (Iot) Cybersecurity, Murat Kuzlu, Corinne Fair, Ozgur Guler

Engineering Technology Faculty Publications

In recent years, the use of the Internet of Things (IoT) has increased exponentially, and cybersecurity concerns have increased along with it. On the cutting edge of cybersecurity is Artificial Intelligence (AI), which is used for the development of complex algorithms to protect networks and systems, including IoT systems. However, cyber-attackers have figured out how to exploit AI and have even begun to use adversarial AI in order to carry out cybersecurity attacks. This review paper compiles information from several other surveys and research papers regarding IoT, AI, and attacks with and against AI and explores the relationship between these …

Divide And Capture: An Improved Cryptanalysis Of The Encryption Standard Algorithm Rsa, Willy Susilo, Joseph Tonien, Guomin Yang

Research Collection School Of Computing and Information Systems

RSA is a well known standard algorithm used by modern computers to encrypt and decrypt messages. In some applications, to save the decryption time, it is desirable to have a short secret key d compared to the modulus N. The first significant attack that breaks RSA with short secret key given by Wiener in 1990 is based on the continued fraction technique and it works with d < 1/4 root 18 N-.(25). A decade later, in 2000, Boneh and Durfee presented an improved attack based on lattice technique which works with d < N-.(292). Until this day, Boneh-Durfee attack remain as the best attack on RSA with short secret key. In this paper, we revisit the continued fraction technique and propose a new attack on RSA. Our main result shows that when d < root t (2 root 2 + 8/3) N-.(75)/root e, where e is the public exponent and t is a chosen parameter, our attack can break the RSA with the running time of O(tlog (N)). Our attack is especially well suited for the case where e is much smaller than N. When e approximate to N, the Boneh-Durfee attack outperforms ours. As a result, we could simultaneously run both attacks, our new attack and the classical Boneh-Durfee attack as a backup.

Differential Training: A Generic Framework To Reduce Label Noises For Android Malware Detection, Jiayun Xu, Yingjiu Li, Robert H. Deng

Research Collection School Of Computing and Information Systems

A common problem in machine learning-based malware detection is that training data may contain noisy labels and it is challenging to make the training data noise-free at a large scale. To address this problem, we propose a generic framework to reduce the noise level of training data for the training of any machine learning-based Android malware detection. Our framework makes use of all intermediate states of two identical deep learning classification models during their training with a given noisy training dataset and generate a noise-detection feature vector for each input sample. Our framework then applies a set of outlier detection …

Zynq System-On-Chip Dma Messaging For Processor Monitoring, Daniel F. Koranek, Douglas D. Hodson, Scott R. Graham

Faculty Publications

Xilinx Zynq-7000 System-on-Chip architectures combine an ARM Cortex-A9 core with an FPGA fabric. One benefit of this hybrid architecture is that it allows fast prototyping of designs where the security of either the processing system (PS) is monitored by the programmable logic (PL) or vice versa. The choice of implementing a design in the PS or PL is driven by cost-to-benefit analysis across many factors. This effort examines the design process required to construct security monitoring designs that use both the PS and PL. For background, this effort reviews similar security monitoring projects. For the effort, a PL peripheral was …

Zooming Into The Pandemic! A Forensic Analysis Of The Zoom Application, Andrew Mahr, Meghan Cichon, Sophia Mateo, Cinthya Grajeda, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

The global pandemic of COVID-19 has turned the spotlight on video conferencing applications like never before. In this critical time, applications such as Zoom have experienced a surge in its user base jump over the 300 million daily mark (ZoomBlog, 2020). The increase in use has led malicious actors to exploit the application, and in many cases perform Zoom Bombings. Therefore forensically examining Zoom is inevitable. Our work details the primary disk, network, and memory forensic analysis of the Zoom video conferencing application. Results demonstrate it is possible to find users' critical information in plain text and/or encrypted/encoded, such …

Gophish: Implementing A Real-World Phishing Exercise To Teach Social Engineering, Andy Luse, Jim Burkman

Journal of Cybersecurity Education, Research and Practice

Social engineering is a large problem in our modern technological world, but while conceptually understood, it is harder to teach compared to traditional pen testing techniques. This research details a class project where students implemented a phishing exercise against real-world targets. Through cooperation with an external corporate partner, students learned the legal, technical, behavioral, analysis, and reporting aspects of social engineering. The outcome provided both usable data for a real-world corporation as well as valuable educational experience for the students.

Applying High Impact Practices In An Interdisciplinary Cybersecurity Program, Brian K. Payne, Lisa Mayes, Tisha Paredes, Elizabeth Smith, Hongyi Wu, Chunsheng Xin

Journal of Cybersecurity Education, Research and Practice

The Center for Cybersecurity Education and Research at Old Dominion University has expanded its use of high impact practices in the university’s undergraduate cybersecurity degree program. Strategies developed to promote student learning included learning communities, undergraduate research, a robust internship program, service learning, and electronic portfolios. This paper reviews the literature on these practices, highlights the way that they were implemented in our cybersecurity program, and discusses some of the challenges encountered with each practice. Although the prior literature on high impact practices rarely touches on cybersecurity coursework, the robust evidence of the success of those practices provides a sound …

An Assessment Of Internet Use And Cyber-Risk Prevalence Among Students In Selected Nigerian Secondary Schools, Adeola O. Opesade Dr, Abiodun O. Adetona Mr

Journal of Cybersecurity Education, Research and Practice

The use of the Internet has become highly pervasive among adolescents. While these people derive numerous benefits from their use of this technology, they are also faced with a challenge of being exposed to many cyber risks. Nigeria is a developing country with a teeming population of adolescents who are regular users of the Internet, but with inadequate research on adolescent Internet safety. There is therefore, a need to conduct studies on child online risks in Nigeria, to help evaluate the enormity of child online abuses. The present study investigated Internet use and cyber-risk prevalence among four hundred secondary school …

Using Torchattacks To Improve The Robustness Of Models With Adversarial Training, William S. Matos Díaz

Cybersecurity: Deep Learning Driven Cybersecurity Research in a Multidisciplinary Environment

Adversarial training has proven to be one of the most successful ways to defend models against adversarial examples. This process consists of training a model with an adversarial example to improve the robustness of the model. In this experiment, Torchattacks, a Pytorch library made for importing adversarial examples more easily, was used to determine which attack was the strongest. Later on, the strongest attack was used to train the model and make it more robust against adversarial examples. The datasets used to perform the experiments were MNIST and CIFAR-10. Both datasets were put to the test using PGD, FGSM, and …

Fireeye: Cybersecurity In Action, Singapore Management University

Perspectives@SMU

FireEye built its success on its ‘Human + AI’ philosophy. But can a cybersecurity firm get ahead of the attackers and predict an attack…on itself?

Exploring Cybersecurity Education At The K-12 Level, Weiru Chen, Yuming He, Xin Tian, Wu He, E. Langran (Ed.), D. Rutledge (Ed.)

Information Technology & Decision Sciences Faculty Publications

K-12 cybersecurity education is receiving growing attention with the growing number of cyberattacks and a shortage of cybersecurity professionals. However, there are many barriers for teachers to implement effective cybersecurity education in formal classroom environments. This study conducts a systematic literature review to examine the current state-of-the-art on K-12 cybersecurity education. Through the systematic literature review, we identified 20 closely relevant papers and recognized that a well-designed curriculum in cybersecurity education at the K-12 level is strongly needed to motivate students to pursue cybersecurity pathways and careers. The challenge and suggestions of curriculum design, teaching strategy, and learning assessment are …

Promoting Diversity In Teaching Cybersecurity Through Gicl, Yuming He, Wu He, Xiaohong Yuan, Li Yang, Theo Bastiaens (Ed.)

Information Technology & Decision Sciences Faculty Publications

In summary, it is necessary to develop a diverse group of K-12 students’ interest and skills in cybersecurity as cyber threats continue to grow. Evidence shows that educating the next generation of cyber workers is a crucial job that should begin in elementary school. To ensure the effectiveness of cybersecurity education and equity at the K-12 level, teachers must create thoughtful plans for considering communities’ interests and needs, and to continually reconsider what’s working and how to adjust our strategies, approaches, design, and research plan to meet their specific needs, challenges, and strengths, particularly with students from under-served and underrepresented …

Fpga-Augmented Secure Crash-Consistent Non-Volatile Memory, Yu Zou

Electronic Theses and Dissertations, 2020-2023

Emerging byte-addressable Non-Volatile Memory (NVM) technology, although promising superior memory density and ultra-low energy consumption, poses unique challenges to achieving persistent data privacy and computing security, both of which are critically important to the embedded and IoT applications. Specifically, to successfully restore NVMs to their working states after unexpected system crashes or power failure, maintaining and recovering all the necessary security-related metadata can severely increase memory traffic, degrade runtime performance, exacerbate write endurance problem, and demand costly hardware changes to off-the-shelf processors. In this thesis, we summarize and expand upon two of our innovative works, ARES and HERMES, to design …

Best Cybersecurity Practices For Companies, Post Van Buren, Mary Riley

Cybersecurity Undergraduate Research Showcase

Imagine this scenario: you are a small business owner, and you’ve just been informed of a network security breach. In your Zoom meeting with the IT Department, you learned the details: network activity logs revealed aberrant behavior after hours. Threat actors accessed systems containing sensitive information and downloaded copies of key files containing company trade secrets, market strategies, and customer data – all within a matter of minutes. Immediately, you review the consequences of the breach in your mind: reputational harm, monetary loss, and potential lawsuits. You ask the IT professional about the root cause of the breach. Was it …

Leverage Psychological Factors Associated With Lapses In Cybersecurity In Organizational Management, Chad Holm

Cybersecurity Undergraduate Research Showcase

With computers being a standard part of life now with the evolution of the internet, many aspects of our lives have changed, and new ways of thinking must come. One of the biggest challenges in most cyber security problems is not related to the software or the hardware; it is the people that are using the computers to access the data and communicate with others, where the hackers could simply find a weak entry point that naturally exists and a weak link caused by human hands. The human factor as an “insider threat” will affect unauthorized access, credentials stealing, and …

On The Usage And Vulnerabilities Of Api Systems, Conner D. Yu

Cybersecurity Undergraduate Research Showcase

To some, Application Programming Interface (API) is one of many buzzwords that seem to be blanketed in obscurity because not many people are overly familiar with this term. This obscurity is unfortunate, as APIs play a crucial role in today’s modern infrastructure by serving as one of the most fundamental communication methods for web services. Many businesses use APIs in some capacity, but one often overlooked aspect is cybersecurity. This aspect is most evident in the 2018 misuse case by Facebook, which led to the leakage of 50 million users’ records.1 During the 2018 Facebook data breach incident, threat actors …

Cybersecurity: Building A Better Defense With A Great Offense, David M. Cooke

Cybersecurity Undergraduate Research Showcase

The current industry standard for cybersecurity is risk mitigation, which is the identification, evaluation, and categorization of threats that are posed to an organization's network. The goal is to prevent attacks and if an organization is attacked popular standard is to react and remedy the attack. This form of cyber defense isn’t very reassuring to an organization and its users, once an attack is executed based on a study conducted by Booz Allen the average time an advanced persistent threat (APT) dwells on a victims’ network before it’s discovered is 200-250 days. That’s plenty of time for a malicious third …

Family Communication: Examining The Differing Perceptions Of Parents And Teens Regarding Online Safety Communication, Tara Rutkowski

Honors Undergraduate Theses

The opportunity for online engagement increases possible exposure to potentially risky behaviors for teens, which may have significant negative consequences (Hair et al., 2009). Effective family communication about online safety can help reduce the risky adolescent behavior and limit the consequences after it occurs. This paper contributes a theory of communication factors that positively influence teen and parent perception of communication about online safety and provides design implications based on those findings. Previous work identified gaps in family communication, however, this study seeks to empirically identify factors that would close the communication gap from the perspective of both teens and …

Proposed Data Governance Framework For Small And Medium Scale Enterprises (Smes), Rejoice Okoro

All Graduate Theses, Dissertations, and Other Capstone Projects

Data governance is not a one size fits all, instead, it should be an evolutionary process that can be started small and measurable along the way. This research aims at proposing a data governance framework by ensuring data management processes, data security and control are compliant with laws and policies. This article also presents the first results of a comparative analysis between three data privacy laws and outlines five components which together form a data governance framework for SMEs. The data governance model documents data quality roles and their type of interaction with data quality management activities exploring how data …

A Monte-Carlo Analysis Of Monetary Impact Of Mega Data Breaches, Mustafa Canan, Omer Ilker Poyraz, Anthony Akil

Engineering Management & Systems Engineering Faculty Publications

The monetary impact of mega data breaches has been a significant concern for enterprises. The study of data breach risk assessment is a necessity for organizations to have effective cybersecurity risk management. Due to the lack of available data, it is not easy to obtain a comprehensive understanding of the interactions among factors that affect the cost of mega data breaches. The Monte Carlo analysis results were used to explicate the interactions among independent variables and emerging patterns in the variation of the total data breach cost. The findings of this study are as follows: The total data breach cost …

Enhancing Cyberweapon Effectiveness Methodology With Se Modeling Techniques: Both For Offense And Defense, C. Ariel Pinto, Matthew Zurasky, Fatine Elakramine, Safae El Amrani, Raed M. Jaradat, Chad Kerr, Vidanelage L. Dayarathna

Engineering Management & Systems Engineering Faculty Publications

A recent cyberweapons effectiveness methodology clearly provides a parallel but distinct process from that of kinetic weapons – both for defense and offense purposes. This methodology promotes consistency and improves cyberweapon system evaluation accuracy – for both offensive and defensive postures. However, integrating this cyberweapons effectiveness methodology into the design phase and operations phase of weapons systems development is still a challenge. The paper explores several systems engineering modeling techniques (e.g., SysML) and how they can be leveraged towards an enhanced effectiveness methodology. It highlights how failure mode analyses (e.g., FMEA) can facilitate cyber damage determination and target assessment, how …

Arnold Transformations As Applied To Data Encryption, Haley N. Anderson

College of Graduate Studies: Theses & Dissertations

As our world becomes increasingly digital, data security becomes key. Data must be encrypted such that it can be easily encrypted only by the intended recipient. Arnold Transformations are a useful tool in this because of its unpredictable periodicity. Our goal is to outline a method for choosing an Arnold Transformation that is both secure and easy to implement. We find the necessary and sufficient condition that a key matrix has periodicity. The chosen key matrix has a random structure, and it has a periodicity that is sufficiently high. We apply this method to several image and data string examples …

From The Editors, Michael E. Whitman, Herbert J. Mattord, Hossain Shahriar

Journal of Cybersecurity Education, Research and Practice

A commentary from the editors, with an overview of the articles contained in this issue of the Journal.

Cyber Insurance Effects On Cyber Hygiene: Does The Homeostatic Effect Apply?, Wendi M. Kappers, Aaron Glassman, Michael S. Wills

Publications

A theoretical framework and research strategy is proposed to gain insight into perceptions and decisions as to how SMBs make decisions regarding cybersecurity hygiene measures, which could lead to betterinformed decisions regarding insurance as part of an ISA program, as well as have a bearing on policy structures and pricing for such insurance. This is because the definition of “cybersecurity hygiene habits”(CHH) as a task appears to vary within the industry and makes the practice hard to measure and evaluate. Research suggests that there may be a poorly understood connection between CHHs undertaken by organizations and their perceptions and/or adoption …

Automated Waterloo Rubric For Concept Map Grading, Shresht Bhatia, Sajal Bhatia, Irfan Ahmed

School of Computer Science & Engineering Faculty Publications

Concept mapping is a well-known pedagogical tool to help students organize, represent, and develop an understanding of a topic. The grading of concept maps is typically manual, time-consuming, and tedious, especially for a large class. Existing research mostly focuses on topological scoring based-on structural features of concept maps. However, the scoring does not achieve comparable accuracy to well-defined rubrics for manual analysis on the quality of content in a concept map. This paper presents Kastor, a new method to automate the Waterloo Rubric of scoring concept maps by quantifying the rubric’s quality assessment parameters. The evaluation is performed on a …

Cybersecurity Analysis Of Load Frequency Control In Power Systems: A Survey, Sahaj Saxena, Sajal Bhatia, Rahul Gupta

School of Computer Science & Engineering Faculty Publications

Today, power systems have transformed considerably and taken a new shape of geographically distributed systems from the locally centralized systems thereby leading to a new infrastructure in the framework of networked control cyber-physical system (CPS). Among the different important operations to be performed for smooth generation, transmission, and distribution of power, maintaining the scheduled frequency, against any perturbations, is an important one. The load frequency control (LFC) operation actually governs this frequency regulation activity after the primary control. Due to CPS nature, the LFC operation is vulnerable to attacks, both from physical and cyber standpoints. The cyber-attack strategies ranges from …

Law Library Blog (January 2021): Legal Beagle's Blog Archive, Roger Williams University School Of Law

Law Library Newsletters/Blog

No abstract provided.

Simulation For Cybersecurity: State Of The Art And Future Directions, Hamdi Kavak, Jose J. Padilla, Daniele Vernon-Bido, Saikou Y. Diallo, Ross Gore, Sachin Shetty

VMASC Publications

In this article, we provide an introduction to simulation for cybersecurity and focus on three themes: (1) an overview of the cybersecurity domain; (2) a summary of notable simulation research efforts for cybersecurity; and (3) a proposed way forward on how simulations could broaden cybersecurity efforts. The overview of cybersecurity provides readers with a foundational perspective of cybersecurity in the light of targets, threats, and preventive measures. The simulation research section details the current role that simulation plays in cybersecurity, which mainly falls on representative environment building; test, evaluate, and explore; training and exercises; risk analysis and assessment; and humans …