Information Security Commons^™

Enterprise Environment Modeling For Penetration Testing On The Openstack Virtualization Platform, Vincent Karovic Jr., Jakub Bartalos, Vincent Karovic, Michal Gregus

Journal of Global Business Insights

The article presents the design of a model environment for penetration testing of an organization using virtualization. The need for this model was based on the constantly increasing requirements for the security of information systems, both in legal terms and in accordance with international security standards. The model was created based on a specific team from the unnamed company. The virtual working environment offered the same functions as the physical environment. The virtual working environment was created in OpenStack and tested with a Linux distribution Kali Linux. We demonstrated that the virtual environment is functional and its security testable. Virtualizing …

Enterprise Resource Allocation For Intruder Detection And Interception, Adam B. Haywood

Theses and Dissertations

This research considers the problem of an intruder attempting to traverse a defender's territory in which the defender locates and employs disparate sets of resources to lower the probability of a successful intrusion. The research is conducted in the form of three related research components. The first component examines the problem in which the defender subdivides their territory into spatial stages and knows the plan of intrusion. Alternative resource-probability modeling techniques as well as variable bounding techniques are examined to improve the convergence of global solvers for this nonlinear, nonconvex optimization problem. The second component studies a similar problem but …

Determining Physical Characteristics Through Information Leakage In 802.11ac Beamforming, Albert D. Taglieri

Theses and Dissertations

The risk of information leakage in 802.11ac allows an eavesdropper to monitor wireless traffic and correlate physical locations between devices, as well as environment changes such as the motion of a person. Previous pattern-analysis mitigation methods, which used nonexistent devices to fool an eavesdropper, are not effective in an 802.11ac network, because devices on the network can be correlated to their physical location, which a nonexistent device does not have. Further, additional information about motion in the target environment can be observed and analyzed, providing a new potential for pattern analysis and sensing. 802.11ac makes it possible to plug in …

Robust And Ethical Data Governance Critical To Growth In Digital Age, Themin Suwardy, Melvin Yong

Research Collection School Of Accountancy

With increasing digitalisation, and companies collecting an ever-increasing amount of their customer and business data, organisations have to become more accountable to stakeholders such as regulators, customers and investors on the issue of data. Observers say expectations are also increasing, with incidents of data breaches capturing much media attention. Just as corporate governance encompasses more than just compliance, experts say data governance is more than just data protection and security but also about creating value.

Adversarial Attacks And Mitigation For Anomaly Detectors Of Cyber-Physical Systems, Yifan Jia, Jingyi Wang, Christopher M. Poskitt, Sudipta Chattopadhyay, Jun Sun, Yuqi Chen

Research Collection School Of Computing and Information Systems

The threats faced by cyber-physical systems (CPSs) in critical infrastructure have motivated research into a multitude of attack detection mechanisms, including anomaly detectors based on neural network models. The effectiveness of anomaly detectors can be assessed by subjecting them to test suites of attacks, but less consideration has been given to adversarial attackers that craft noise specifically designed to deceive them. While successfully applied in domains such as images and audio, adversarial attacks are much harder to implement in CPSs due to the presence of other built-in defence mechanisms such as rule checkers (or invariant checkers). In this work, we …

Secure And Verifiable Outsourced Data Dimension Reduction On Dynamic Data, Zhenzhu Chen, Anmin Fu, Robert H. Deng, Ximeng Liu, Yang Yang, Yinghui Zhang

Research Collection School Of Computing and Information Systems

Dimensionality reduction aims at reducing redundant information in big data and hence making data analysis more efficient. Resource-constrained enterprises or individuals often outsource this time-consuming job to the cloud for saving storage and computing resources. However, due to inadequate supervision, the privacy and security of outsourced data have been a serious concern to data owners. In this paper, we propose a privacypreserving and verifiable outsourcing scheme for data dimension reduction, based on incremental Non-negative Matrix Factorization (NMF) method. We emphasize the importance of incremental data processing, exploiting the properties of NMF to enable data dynamics in consideration of data updating …

An Empirical Study Of Thermal Attacks On Edge Platforms, Tyler Holmes

Symposium of Student Scholars

Cloud-edge systems are vulnerable to thermal attacks as the increased energy consumption may remain undetected, while occurring alongside normal, CPU-intensive applications. The purpose of our research is to study thermal effects on modern edge systems. We also analyze how performance is affected from the increased heat and identify preventative measures. We speculate that due to the technology being a recent innovation, research on cloud-edge devices and thermal attacks is scarce. Other research focuses on server systems rather than edge platforms. In our paper, we use a Raspberry Pi 4 and a CPU-intensive application to represent thermal attacks on cloud-edge systems. …

Is Australia Really Lost In Space?, Brett Biddington

Research outputs 2014 to 2021

Australia is one of the world's most wealthy nations. Yet to the surprise and puzzlement of many observers, Australian governments over many years steadfastly refused to become involved in space activities in ways judged to be commensurate to the nation's wealth and place in the world. Repeated calls to establish a space agency were ignored or firmly rejected and civil and commercial investment in space activities was limited. In the past decade, there have been substantial developments and new investments in the policy, national security, civil and commercial domains. Perhaps the salient feature is the establishment of the Australian Space …

Forensic Artifact Finder (Forensicaf): An Approach & Tool For Leveraging Crowd-Sourced Curated Forensic Artifacts, Tyler Balon, Krikor Herlopian, Ibrahim Baggili, Cinthya Grajeda-Mendez

Electrical & Computer Engineering and Computer Science Faculty Publications

Current methods for artifact analysis and understanding depend on investigator expertise. Experienced and technically savvy examiners spend a lot of time reverse engineering applications while attempting to find crumbs they leave behind on systems. This takes away valuable time from the investigative process, and slows down forensic examination. Furthermore, when specific artifact knowledge is gained, it stays within the respective forensic units. To combat these challenges, we present ForensicAF, an approach for leveraging curated, crowd-sourced artifacts from the Artifact Genome Project (AGP). The approach has the overarching goal of uncovering forensically relevant artifacts from storage media. We explain our approach …

Forensicast: A Non-Intrusive Approach & Tool For Logical Forensic Acquisition & Analysis Of The Google Chromecast Tv, Alex Sitterer, Nicholas Dubois, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

The era of traditional cable Television (TV) is swiftly coming to an end. People today subscribe to a multitude of streaming services. Smart TVs have enabled a new generation of entertainment, not only limited to constant on-demand streaming as they now offer other features such as web browsing, communication, gaming etc. These functions have recently been embedded into a small IoT device that can connect to any TV with High Definition Multimedia Interface (HDMI) input known as Google Chromecast TV. Its wide adoption makes it a treasure trove for potential digital evidence. Our work is the primary source on forensically …

An Adaptive Cryptosystem On A Finite Field, Awnon Bhowmik, Unnikrishnan Menon

Publications and Research

Owing to mathematical theory and computational power evolution, modern cryptosystems demand ingenious trapdoor functions as their foundation to extend the gap between an enthusiastic interceptor and sensitive information. This paper introduces an adaptive block encryption scheme. This system is based on product, exponent, and modulo operation on a finite field. At the heart of this algorithm lies an innovative and robust trapdoor function that operates in the Galois Field and is responsible for the superior speed and security offered by it. Prime number theorem plays a fundamental role in this system, to keep unwelcome adversaries at bay. This is a …

Duck Hunt: Memory Forensics Of Usb Attack Platforms, Tyler Thomas, Mathew Piscitelli, Bhavik Ashok Nahar, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

To explore the memory forensic artifacts generated by USB-based attack platforms, we analyzed two of the most popular commercially available devices, Hak5's USB Rubber Ducky and Bash Bunny. We present two open source Volatility plugins, usbhunt and dhcphunt, which extract artifacts generated by these USB attacks from Windows 10 system memory images. Such artifacts include driver-related diagnostic events, unique device identifiers, and DHCP client logs. Our tools are capable of extracting metadata-rich Windows diagnostic events generated by any USB device. The device identifiers presented in this work may also be used to definitively detect device usage. Likewise, the DHCP logs …

Another Brick In The Wall: An Exploratory Analysis Of Digital Forensics Programs In The United States, Syria Mccullough, Stella Abudu, Ebere Onwubuariri, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

We present a comprehensive review of digital forensics programs offered by universities across the United States (U.S.). While numerous studies on digital forensics standards and curriculum exist, few, if any, have examined digital forensics courses offered across the nation. Since digital forensics courses vary from university to university, online course catalogs for academic institutions were evaluated to curate a dataset. Universities were selected based on online searches, similar to those that would be made by prospective students. Ninety-seven (n = 97) degree programs in the U.S. were evaluated. Overall, results showed that advanced technical courses are missing from curricula. We …

Browser Fingerprinting And The Importance Of Digital Privacy, Aaron M. Corpstein

Scholarly Horizons: University of Minnesota, Morris Undergraduate Journal

Browser fingerprinting is a type of internet tracking where the attributes of a user’s computer and browser accessing a web page are remotely recorded and then used for profiling, tracking, and advertising purposes. This paper focuses on defining browser fingerprinting and enumerating ways in which the user can combat fingerprinting. Browser fingerprinting can be thwarted by changing attributes within the user’s browser or machine, using a browser designed to combat fingerprinting, or with security and anti-fingerprinting focused browser extensions. All of these methods are capable of increasing the security of the user.

Information Security Maturity Model For Healthcare Organizations In The United States, Bridget Joan Barnes Page

Dissertations and Theses

This research provides a maturity model for information security for healthcare organizations in the United States. Healthcare organizations are faced with increasing threats to the security of their information systems. The maturity model identifies specific performance metrics, with relative importance measures, that can be used to enhance information security at healthcare organizations allowing them to focus scarce resources on mitigating the most important information security threat vectors. This generalizable, hierarchical decision model uses both qualitative and quantitative metrics based on objective goals. This model may be used as a baseline by which to measure individual organizational performance, to measure performance …

Secure Self-Checkout Kiosks Using Alma Api With Two-Factor Authentication, Ron Bulaon

Research Collection Library

Self-checkout kiosks have become a staple feature of many modern and digitized libraries. These devices are used by library patrons for self-service item loans. Most implementations are not new, in fact many of these systems are simple, straight forward and work as intended. But behind this useful technology, there is a security concern on authentication that has to be addressed.

In my proposed presentation, I will discuss the risk factors of self-checkout kiosks and propose a solution using Alma APIs. I will address the technical shortcomings of the current implementations, compared to the proposed solution, and where the weakest link …

The Affect Of Globalization On Terrorism, Philip R. Passante

Master's Theses

This thesis proposal will dive into the concept of terrorism and how it is an act of force and has proven to be detrimental to the modern world. In addition, this thesis will analyze the concept of terrorism as well as the rationale behind it. It is important to understand and study this as terrorism is a complex entity made up of different themes. The concentration of this thesis will highlight how globalization has affected the phenomena of terrorism in the past, present, and ultimately the future. Globalization and terrorism have a relationship that many scholars and researchers have noticed. …

Mining Bitcoin To Avoid Sanctions, Tyler C. Lubin

Master's Theses

Though the world’s first cryptocurrency, Bitcoin, was introduced over a decade ago, it was not until recently that it became a mainstream subject. While cryptocurrencies offer many advantages, a potential downside for governments, is that no central bank controls the monetary policy and new coins can be mined by anyone anywhere in the world. Governments have always been deeply involved with how a their countries’ currency is ran and the policies they create are meant to keep a currencies’ value stable and make sure other factors like inflation is under control. Even though as of 2021, there were well over …

Lightweight Mutual Authentication And Privacy Preservation Schemes For Iot Systems., Samah Mansour

Electronic Theses and Dissertations

Internet of Things (IoT) presents a holistic and transformative approach for providing services in different domains. IoT creates an atmosphere of interaction between humans and the surrounding physical world through various technologies such as sensors, actuators, and the cloud. Theoretically, when everything is connected, everything is at risk. The rapid growth of IoT with the heterogeneous devices that are connected to the Internet generates new challenges in protecting and preserving user’s privacy and ensuring the security of our lives. IoT systems face considerable challenges in deploying robust authentication protocols because some of the IoT devices are resource-constrained with limited computation …

Outsourcing Service Fair Payment Based On Blockchain And Its Applications In Cloud Computing, Yinghui Zhang, Robert H. Deng, Ximeng Liu, Dong Zheng

Research Collection School Of Computing and Information Systems

As a milestone in the development of outsourcing services, cloud computing enables an increasing number of individuals and enterprises to enjoy the most advanced services from outsourcing service providers. Because online payment and data security issues are involved in outsourcing services, the mutual distrust between users and service providers may severely impede the wide adoption of cloud computing. Nevertheless, most existing solutions only consider a specific type of services and rely on a trusted third-party to realize fair payment. In this paper, to realize secure and fair payment of outsourcing services in general without relying on any third-party, trusted or …

Cybersecurity: Creating A Cybersecurity Culture, Steven Edward Ogden

Electronic Theses, Projects, and Dissertations

Human error has been identified as one of the highest contributing factors to successful cyber-attacks and security incidents that result in data leaks and theft of sensitive information. Human error has been caused by employees not behaving securely when interacting with information systems. This culminating experience project investigated how a cybersecurity culture can be developed to address the human error problem. The research was based on several key questions that focus on influencing factors of human behavior and best practices that have been used to develop a cybersecurity culture so that employees engage in secure behaviors. Social Cognitive Theory was …

A Lightweight And Privacy-Preserving Answer Collection Scheme For Mobile Crowdsourcing, Yingling Dai, Jian Weng, Anjia Yang, Shui Yu, Robert H. Deng

Research Collection School Of Computing and Information Systems

Mobile Crowdsourcing (MCS) has become an emerging paradigm evolved from crowdsourcing by employing advanced features of mobile devices such as smartphones to perform more complicated, especially spatial tasks. One of the key procedures in MCS is to collect answers from mobile users (workers), which may face several security issues. First, authentication is required to ensure that answers are from authorized workers. In addition, MCS tasks are usually location-dependent, so the collected answers could disclose workers' location privacy, which may discourage workers to participate in the tasks. Finally, the overhead occurred by authentication and privacy protection should be minimized since mobile …

Towards Generative Aspect-Based Sentiment Analysis, Wenxuan Zhang, Xin Li, Yang Deng, Lidong Bing, Wai Lam

Research Collection School Of Computing and Information Systems

Aspect-based sentiment analysis (ABSA) has received increasing attention recently. Most existing work tackles ABSA in a discriminative manner, designing various task-specific classification networks for the prediction. Despite their effectiveness, these methods ignore the rich label semantics in ABSA problems and require extensive task-specific designs. In this paper, we propose to tackle various ABSA tasks in a unified generative framework. Two types of paradigms, namely annotation-style and extraction-style modeling, are designed to enable the training process by formulating each ABSA task as a text generation problem. We conduct experiments on four ABSA tasks across multiple benchmark datasets where our proposed generative …

Receiver-Anonymity In Rerandomizable Rcca-Secure Cryptosystems Resolved, Yi Wang, Rongmao Chen, Guomin Yang, Xinyi Huang, Baosheng Wang, Moti Yung

Research Collection School Of Computing and Information Systems

In this work we resolve the open problem raised by Prabhakaran and Rosulek at CRYPTO 2007, and present the first anonymous, rerandomizable, Replayable-CCA (RCCA) secure public-key encryption scheme. This solution opens the door to numerous privacy-oriented applications with a highly desired RCCA security level. At the core of our construction is a non-trivial extension of smooth projective hash functions (Cramer and Shoup, EUROCRYPT 2002), and a modular generic framework developed for constructing rerandomizable RCCA-secure encryption schemes with receiver-anonymity. The framework gives an enhanced abstraction of the original Prabhakaran and Rosulek’s scheme (which was the first construction of rerandomizable RCCA-secure encryption …

Editorial Introduction To The Special Issue: Supporting Future Scholarship On Cybercrime, Jaeyong Choi, Brandon Dulisse, Richard L. Wentling, Nathan Kruis

International Journal of Cybersecurity Intelligence & Cybercrime

This editorial introduction will present an overview of the three papers published in this special issue of the International Journal of Cybersecurity Intelligence and Cybercrime. The winners of the student paper competition during the 2021 Whitehat Conference have prepared their papers for this special issue. Their research directs our attention to key issues regarding cybercrime that have often been overlooked in the literature ranging from North Korean cyberterrorism to the relationship between COVID-19 and cybercrime and to fear of online victimization.

North Korean Cyber Attacks And Policy Responses: An Interdisciplinary Theoretical Framework, Jeeseon Hwang, Kyung-Shick Choi

International Journal of Cybersecurity Intelligence & Cybercrime

No abstract provided.

Malware Infections In The U.S. During The Covid-19 Pandemic: An Empirical Study, Sydney Gero, Sinchul Back, Jennifer Laprade, Joonggon Kim

International Journal of Cybersecurity Intelligence & Cybercrime

The COVID-19 pandemic has changed the world in many ways, especially in the landscape of cyber threats. The pandemic has pro-vided cybercriminals with more opportunities to commit crimes due to more people engaging in online activities, along with the increased use of computers for school, work, and social events. The current study seeks to explore cybercrime trends, in particular malware infections, during the COVID-19 pandemic. Thus, this study examines the relationship between the number of malware in-fections, COVID-19 positive cases, closed non-essential businesses, and closed K-12 public schools in the United States. Data utilized in this study derives from (1) …

Level Of Engagement With Social Networking Services And Fear Of Online Victimization: The Role Of Online Victimization Experiences, Yeonjae Park, Lynne M. Vieraitis

International Journal of Cybersecurity Intelligence & Cybercrime

No abstract provided.

Unlinkable And Revocable Secret Handshake, Yangguang Tian, Yingliu Li, Guomin Yang, Guomin Yang

Research Collection School Of Computing and Information Systems

In this paper, we introduce a new construction for unlinkable secret handshake that allows a group of users to perform handshakes anonymously. We define formal security models for the proposed construction and prove that it can achieve session key security, anonymity and affiliation hiding. In particular, the proposed construction ensures that (i) anonymity against protocol participants (including group authority) is achieved since a hierarchical identity-based signature is used in generating group user's pseudonym-credential pairs and (ii) revocation is achieved using a secret sharing-based revocation mechanism.

On The Vulnerability Of Openthread To Agile Denial Of Service Attacks, Casey Cronin, Sarah Diesburg Ph.D., Dheryta Jaisinghani Ph.D.

Summer Undergraduate Research Program (SURP) Symposium

The Internet of Things (IoT) includes physical devices such as sensors, connected home appliances, video monitoring systems, and smart classroom or smart warehouse applications. These devices can capture large amounts of data while using low amount of power to do it, as well as keep track of things going on around it and turn it into usable data for the user depending on what task it is performing.

IoT devices are not immune from security concerns, such as Denial of Service (DoS) attacks. These attacks are important to investigate because they can play a dangerous role in shutting down applications, …