Information Security Commons^™

Cyber Whistleblowers: The Black Sheep Of Whistleblowing?, Andrew Wisniewski Jr.

Cybersecurity Undergraduate Research Showcase

From the Introduction:

Contrary to popular belief, this paper argues that cyber whistleblowing can contribute to a greater cyber security posture. However, this requires the development of clearer legal obligations and protections for cyber whistleblowers. This paper will explore the psychology behind whistleblowing, the effectiveness of whistleblowing in a cybersecurity context, how to create a safer and more transparent environment for whistleblowers and companies, and how current laws contribute to cyber whistleblowing.

Nft Sneaker Marketplace Design, Testing, And Challenges, Chris Zhu

Honors Theses

This paper introduces the preliminary background and implementation of the NFT sneaker marketplace. Specifically, we build sneaker NFTs on top of ERC-20 within the Ethereum network and use a top-to-bottom design mechanism. Our website performs well in its functionality, compatibility, and performance. We discuss possible future steps for security implementation. In particular, we recommend using a cold wallet for clients' transactions and implementing multi-signature contracts to avoid spoofing and repudiation. Introducing the sneaker NFT marketplace will vastly reduce the costs of transactions and delivery time in the physical sneaker marketplace. We hope investors in the physical asset space can find …

The Impact Of A Gencyber Camp On In-Service Teachers’ Tpack, Kevin M. Thomas, Jessica Ivy, Kristin Cook, Robert R. Kelley

Journal of Cybersecurity Education, Research and Practice

The purpose of this study was to examine the impact of a GenCyber camp curriculum on teachers’ technology, pedagogy, and content knowledge (TPACK). The camp was designed to engage participants in developing the knowledge and skills to incorporate GenCyber Cybersecurity First Principles and GenCyber Cybersecurity Concepts (GenCyber, 2019) into their curriculums. Participants (37 middle and high school teachers from a variety of disciplines) attended one of two weeklong camps held at a Midwestern liberal arts university. Using the TPACK Self-Reflection and TPACK Self-Assessment Surveys, pre- and post-camp data were collected from participants. Findings indicate that participants demonstrated an increase in …

Toward A Student-Ready Cybersecurity Program: Findings From A Survey Of Stem-Students, Lora Pitman, Brian K. Payne, Tancy Vandecar-Burdin, Lenora Thorbjornsen

Journal of Cybersecurity Education, Research and Practice

As the number of available cybersecurity jobs continues to grow, colleges strive to offer to their cybersecurity students an environment which will make them sufficiently prepared to enter the workforce after graduation. This paper explores the academic and professional needs of STEM-students in various higher education institutions across Virginia and how cybersecurity programs can cater to these needs. It also seeks to propose an evidence-based approach for improving the existing cybersecurity programs so that they can become more inclusive and student-ready. A survey of 251 college students in four higher-education institutions in Virginia showed that while there are common patterns …

A Review Of Distributed Identity Technology In Iot Devices, Myles Perry

Cybersecurity Undergraduate Research Showcase

Distributed identity technology provides solutions to many of the faults currently found in federated identity systems. Applying this technology to internet of things devices has many possible benefits in the realm of device authentication. However, this also provides new challenges not present in existing distributed identity systems. The large number of devices that would enter and leave the system means balancing sybil attack vulnerability and linkage attack vulnerability becomes challenging. Internet of things devices also have less memory and computing power than a standard personal computer or phone. This means any protocol to execute distributed identity in these devices must …

Detecting The Presence Of Electronic Devices In Smart Homes Using Harmonic Radar, Beatrice Perez, Gregory Mazzaro, Timothy J. Pierson, David Kotz

Dartmouth Scholarship

Data about users is collected constantly by phones, cameras, Internet websites, and others. The advent of so-called ‘Smart Things' now enable ever-more sensitive data to be collected inside that most private of spaces: the home. The first step in helping users regain control of their information (inside their home) is to alert them to the presence of potentially unwanted electronics. In this paper, we present a system that could help homeowners (or home dwellers) find electronic devices in their living space. Specifically, we demonstrate the use of harmonic radars (sometimes called nonlinear junction detectors), which have also been used in …

Cybersecurity & Correctional Institutions, Kelly Himelwright

Cybersecurity Undergraduate Research Showcase

Cybersecurity is becoming an increasingly important aspect of correctional operations. To properly maintain security, more jails and prisons are using comprehensive cyber protection techniques. Correctional facilities face risks that were perhaps unimaginable only a few decades ago. Many organizations have used information technology to help them run their businesses, but few have the resources or vision to foresee and adequately manage the cyber dangers that come with it. Institutions need to be more aware of these hazards, as well as have more information security experts on staff.

Towards Secure And Trustworthy Iot Systems, Lan Luo

Electronic Theses and Dissertations, 2020-2023

The boom of the Internet of Things (IoT) brings great convenience to the society by connecting the physical world to the cyber world, but it also attracts mischievous hackers for benefits. Therefore, understanding potential attacks aiming at IoT systems and devising new protection mechanisms are of great significance to maintain the security and privacy of the IoT ecosystem. In this dissertation, we first demonstrate potential threats against IoT networks and their severe consequences via analyzing a real-world air quality monitoring system. By exploiting the discovered flaws, we can impersonate any victim sensor device and polluting its data with fabricated data. …

Cybersecurity Logging & Monitoring Security Program, Thai H. Nguyễn

School of Computer Science & Engineering Undergraduate Publications

With ubiquitous computing becoming pervasive in every aspect of societies around the world and the exponential rise in cyber-based attacks, cybersecurity teams within global organizations are spending a massive amount of human and financial capital on their logging and monitoring security programs. As a critical part of global organizational security risk management processes, it is important that log information is aggregated in a timely, accurate, and relevant manner. It is also important that global organizational security operations centers are properly monitoring and investigating the security use-case alerting based on their log data. In this paper, the author proposes a model …

C2 Microservices Api: Ch4rl3sch4l3m4gn3, Thai H. Nguyễn

School of Computer Science & Engineering Undergraduate Publications

In the 21^st century, cyber-based attackers such as advance persistent threats are leveraging bots in the form of botnets to conduct a plethora of cyber-attacks. While there are several social engineering techniques used to get targets to unknowingly download these bots, it is the command-and-control techniques advance persistent threats use to control their bots that is of critical interest to the author. In this research paper, the author aims to develop a command-and-control microservice application programming interface infrastructure to facilitate botnet command-and-control attack simulations. To achieve this the author will develop a simple bot skeletal framework, utilize the latest …

Formal Modeling And Verification Of A Blockchain-Based Crowdsourcing Consensus Protocol, Hamra Afzaal, Muhammad Imran, Muhammad Umar Janjua, Sarada Prasad Gochhayat

VMASC Publications

Crowdsourcing is an effective technique that allows humans to solve complex problems that are hard to accomplish by automated tools. Some significant challenges in crowdsourcing systems include avoiding security attacks, effective trust management, and ensuring the system’s correctness. Blockchain is a promising technology that can be efficiently exploited to address security and trust issues. The consensus protocol is a core component of a blockchain network through which all the blockchain peers achieve an agreement about the state of the distributed ledger. Therefore, its security, trustworthiness, and correctness have vital importance. This work proposes a Secure and Trustworthy Blockchain-based Crowdsourcing (STBC) …

A Lightweight Reliably Quantified Deepfake Detection Approach, Tianyi Wang, Kam Pui Chow

Annual ADFSL Conference on Digital Forensics, Security and Law

Deepfake has brought huge threats to society such that everyone can become a potential victim. Current Deepfake detection approaches have unsatisfactory performance in either accuracy or efficiency. Meanwhile, most models are only evaluated on different benchmark test datasets with different accuracies, which could not imitate the real-life Deepfake unknown population. As Deepfake cases have already been raised and brought challenges at the court, it is disappointed that no existing work has studied the model reliability and attempted to make the detection model act as the evidence at the court. We propose a lightweight Deepfake detection deep learning approach using the …

Healthcare 5.0 Security Framework: Applications, Issues And Future Research Directions, Mohammad Wazid, Ashok Kumar Das, Noor Mohd, Youngho Park

VMASC Publications

Healthcare 5.0 is a system that can be deployed to provide various healthcare services. It does these services by utilising a new generation of information technologies, such as Internet of Things (IoT), Artificial Intelligence (AI), Big data analytics, blockchain and cloud computing. Due to the introduction of healthcare 5.0, the paradigm has been now changed. It is disease-centered to patient-centered care where it provides healthcare services and supports to the people. However, there are several security issues and challenges in healthcare 5.0 which may cause the leakage or alteration of sensitive healthcare data. This demands that we need a robust …

An Exploration On Apts In Biocybersecurity And Cyberbiosecurity, Xavier-Lewis Palmer, Lucas Potter, Saltuk Karahan

School of Cybersecurity Faculty Publications

Novel and complex digital threats that are increasingly interwoven with means and products of biology that can affect society. Much work in Biocybersecurity/Cyberbiosecurity (BCS/CBS) discuss vulnerabilities, but few deeply address malicious actor varieties as attacks at this intersection are new. The path to those attacks remains mostly theoretical, presenting considerable difficulty to accomplish in practical scenarios. In terms of advanced persistent threats (APTs) this of course needs to change as biomanufacturing facilities are at risk, considering Covid-19 and other potential pandemics. Further attacks are not out of reach and thus we must start to imagine how BCS APTs may appear. …

Ascp-Iomt: Ai-Enabled Lightweight Secure Communication Protocol For Internet Of Medical Things, Mohammad Wazid, Jaskaran Singh, Ashok Kumar Das, Sachin Shetty, Muhammad Khurram Khan, Joel J.P.C. Rodrigues

VMASC Publications

The Internet of Medical Things (IoMT) is a unification of smart healthcare devices, tools, and software, which connect various patients and other users to the healthcare information system through the networking technology. It further reduces unnecessary hospital visits and the burden on healthcare systems by connecting the patients to their healthcare experts (i.e., doctors) and allows secure transmission of healthcare data over an insecure channel (e.g., the Internet). Since Artificial Intelligence (AI) has a great impact on the performance and usability of an information system, it is important to include its modules in a healthcare information system, which will be …

Post-Quantum Secure Identity-Based Encryption Scheme Using Random Integer Lattices For Iot-Enabled Ai Applications, Dharminder Dharminder, Ashok Kumar Das, Sourav Saha, Basudeb Bera, Athanasios V. Vasilakos

VMASC Publications

Identity-based encryption is an important cryptographic system that is employed to ensure confidentiality of a message in communication. This article presents a provably secure identity based encryption based on post quantum security assumption. The security of the proposed encryption is based on the hard problem, namely Learning with Errors on integer lattices. This construction is anonymous and produces pseudo random ciphers. Both public-key size and ciphertext-size have been reduced in the proposed encryption as compared to those for other relevant schemes without compromising the security. Next, we incorporate the constructed identity based encryption (IBE) for Internet of Things (IoT) applications, …

Attitudes About Cybersecurity Articulation Agreements And Transfer Students: A Statewide Survey Of Faculty Members And Advisors, Brian K. Payne, Tracy Vandecar-Burdin, Daniela Cigularova

Sociology & Criminal Justice Faculty Publications

In this study, cybersecurity faculty and academic advisors from community colleges and 4-year universities in the southeast region of the United States completed a survey assessing attitudes about and support for articulation agreements and related transfer policies. Hypothesizing that professional structures shape attitudes and experiences, the researchers conducted an exploratory quantitative study with primarily descriptive analyses. The results reveal differences in attitudes between community college and 4-year stakeholders and between faculty and academic advisors. The results of this study are discussed in relation to faculty and advisor training and communication.

Civiic: Cybercrime In Virginia: Impacts On Industry And Citizens Final Report, Randy Gainey, Tancy Vandecar-Burdin, Jay Albanese, Thomas Dearden, James Hawdon, Katalin Parti

Sociology & Criminal Justice Faculty Publications

[First paragraph] Victimization from cybercrime is a major concern in Virginia, the US, and the world. As individuals and businesses spend more time online, it becomes increasingly important to understand cybercrime and how to protect against it. Such an understanding is dependent on valid and reliable baseline data that identifies the specific nature, extent, and outcomes of cybercrime activity. A better understanding of cybercrime activity is needed to target and prevent it more effectively, minimize its consequences, and provide support for both individual and corporate victims. Before that can occur, however, better baseline data are required, and this project was …

Precursors Of Email Response To Cybersecurity Scenarios: Factor Exploration And Scale Development, Miguel A. Toro-Jarrin, Pilar Pazos-Lago, Miguel Padilla

Engineering Management & Systems Engineering Faculty Publications

In the last decade, information security research has further expanded to include human factors as key elements of the organization's cybersecurity infrastructure. Numerous factors from several theories have been explored to explain and predict the multitude of information security-related behaviors in organizations. Lately, there has been a call for the study of specific cybersecurity behaviors in contextualized scenarios that reflect specific and realistic situations of a potential cyber-attack. This paper focuses on precursors of email response in situations that can be the origin of cybersecurity incidents in organizations (i.e., phishing attacks, ransomware, etc.). This study explores participants' intentions to follow …

Contextualized Vector Embeddings For Malware Detection, Vinay Pandya

Master's Projects

Malware classification is a technique to classify different types of malware which form an integral part of system security. The aim of this project is to use context dependant word embeddings to classify malware. Tansformers is a novel architecture which utilizes self attention to handle long range dependencies. They are particularly effective in many complex natural language processing tasks such as Masked Lan- guage Modelling(MLM) and Next Sentence Prediction(NSP). Different transfomer architectures such as BERT, DistilBert, Albert, and Roberta are used to generate context dependant word embeddings. These embeddings would help in classifying different malware samples based on their similarity …

Generative Adversarial Networks For Image-Based Malware Classification, Huy Nguyen

Master's Projects

Malware detection and analysis are important topics in cybersecurity. For efficient malware removal, determination of malware threat levels, and damage estimation, malware family classification plays a critical role. With the rise in computing power and the advent of cloud computing, deep learning models for malware analysis has gained in popularity. In this paper, we extract features from malware executable files and represent them as images using various approaches. We then focus on Generative Adversarial Networks (GAN) for multiclass classification and compare our GAN results to other popular machine learning techniques, including Support Vector Machine

(SVM), XGBoost, and Restricted Boltzmann Machines …

Faking Sensor Noise Information, Justin Chang

Master's Projects

Noise residue detection in digital images has recently been used as a method to classify images based on source camera model type. The meteoric rise in the popularity of using Neural Network models has also been used in conjunction with the concept of noise residuals to classify source camera models. However, many papers gloss over the details on the methods of obtaining noise residuals and instead rely on the self- learning aspect of deep neural networks to implicitly discover this themselves. For this project I propose a method of obtaining noise residuals (“noiseprints”) and denoising an image, as well as …

Robustness Of Image-Based Malware Analysis, Katrina Tran

Master's Projects

Being able to identify malware is important in preventing attacks. Image-based malware analysis is the study of images that are created from malware. Analyzing these images can help identify patterns in malware families. In previous work, "gist descriptor" features extracted from images have been used in malware classification problems and have shown promising results. In this research, we determine whether gist descriptors are robust with respect to malware obfuscation techniques, as compared to Convolutional Neural Networks (CNN) trained directly on malware images. Using the Python Image Library, we create images from malware executables and from malware that we obfuscate. We …

Investigating Lattice-Based Cryptography, Michaela Molina

Master's Projects

Cryptography is important for data confidentiality, integrity, and authentication. Public key cryptosystems allow for the encryption and decryption of data using two different keys, one that is public and one that is private. This is beneficial because there is no need to securely distribute a secret key. However, the development of quantum computers implies that many public-key cryptosystems for which security depends on the hardness of solving math problems will no longer be secure. It is important to develop systems that have harder math problems which cannot be solved by a quantum computer.

In this project, two public-key cryptosystems which …

Virtual Machine For Spartangold, William Wang

Master's Projects

The field of blockchain and cryptocurrencies can be both difficult to grasp and improve upon, which makes aids that can assist in these tasks very useful. SpartanGold is a simplified blockchain-based cryptocurrency created at San Jose State University as a learning aid for blockchain and cryptocurrencies. In its current state, it closely resembles Bitcoin, and it is also easily expandable to implement other features.

This project extends SpartanGold with a virtual machine resembling the Ethereum Virtual Machine. Implementing this feature results in SpartanGold having Ethereum- related features, which would allow the cryptocurrency to both be a helpful learning aid for …

Proxy Re-Encryption In Blockchain-Based Application, Wangcheng Yuan

Master's Projects

Nowadays, blockchain-based technology has risen to a new dimension. With the advantage of the decentralized identity, data are transferred through decentralized and public ledgers. Those new contracts provide great visibility. However, there is still a need to keep some data private in many cases. Those private data should be encrypted while still benefiting from the decentralized on-chain protocol. Securing those private data in such a decentralized blockchain-based system is thus a critical problem. Our solution provides a decentralized protocol that lets users grant access to their private data with proxy re-encryption in SpartanGold (a blockchain-based cryptocurrency). We implement a third-party …

Evaluating Similarity Of Cross-Architecture Basic Blocks, Elijah L. Meyer

Browse all Theses and Dissertations

Vulnerabilities in source code can be compiled for multiple processor architectures and make their way into several different devices. Security researchers frequently have no way to obtain this source code to analyze for vulnerabilities. Therefore, the ability to effectively analyze binary code is essential. Similarity detection is one facet of binary code analysis. Because source code can be compiled for different architectures, the need can arise for detecting code similarity across architectures. This need is especially apparent when analyzing firmware from embedded computing environments such as Internet of Things devices, where the processor architecture is dependent on the product and …

Sok: Analysis Of Software Supply Chain Security By Establishing Secure Design Properties, Chinenye Okafor, Taylor R. Schorlemmer, Santiao Torres-Arias, James C. Davis

Department of Electrical and Computer Engineering Faculty Publications

This paper systematizes knowledge about secure software supply chain patterns. It identifies four stages of a software supply chain attack and proposes three security properties crucial for a secured supply chain: transparency, validity, and separation. The paper describes current security approaches and maps them to the proposed security properties, including research ideas and case studies of supply chains in practice. It discusses the strengths and weaknesses of current approaches relative to known attacks and details the various security frameworks put out to ensure the security of the software supply chain. Finally, the paper highlights potential gaps in actor and operation-centered …

Exploiting Input Sanitization For Regex Denial Of Service, Efe Barlas, Xin Du, James C. Davis

Department of Electrical and Computer Engineering Faculty Publications

Web services use server-side input sanitization to guard against harmful input. Some web services publish their sanitization logic to make their client interface more usable, e.g., allowing clients to debug invalid requests locally. However, this usability practice poses a security risk. Specifically, services may share the regexes they use to sanitize input strings — and regex-based denial of service (ReDoS) is an emerging threat. Although prominent service outages caused by ReDoS have spurred interest in this topic, we know little about the degree to which live web services are vulnerable to ReDoS.

In this paper, we conduct the first black-box …

Discrepancies Among Pre-Trained Deep Neural Networks: A New Threat To Model Zoo Reliability, Diego Montes, Pongpatapee Peerapatanapokin, Jeff Schultz, Chengjun Guo, Wenxin Jiang, James C. Davis

Department of Electrical and Computer Engineering Faculty Publications

Training deep neural networks (DNNs) takes significant time and resources. A practice for expedited deployment is to use pre-trained deep neural networks (PTNNs), often from model zoos.collections of PTNNs; yet, the reliability of model zoos remains unexamined. In the absence of an industry standard for the implementation and performance of PTNNs, engineers cannot confidently incorporate them into production systems. As a first step, discovering potential discrepancies between PTNNs across model zoos would reveal a threat to model zoo reliability. Prior works indicated existing variances in deep learning systems in terms of accuracy. However, broader measures of reliability for PTNNs from …