Information Security Commons^™

Is Web3 Better Than Web2 For Investors? Evidence From Domain Name Auctions, Ping Fan Ke, Yi Meng Lau, Daniel Varghese Hanley

Research Collection School Of Computing and Information Systems

Blockchain-based assets are commonly believed to attract new investors. To investigate this claim, we compared investor preferences for Web2 and Web3 domain name auctions by analyzing daily auction patterns in Namecheap and OpenSea. Our results indicate that Web3 platforms may attract extreme investors with low or high values as a niche market. We found a significantly higher number of bids per auction, higher average bid prices, and greater price spreads on OpenSea, but a significantly lower number of unique bidders per auction. Our findings highlight the importance of considering the auction platform's characteristics and asset context when evaluating bid patterns …

Balancing Privacy And Flexibility Of Cloud-Based Personal Health Records Sharing System, Yudi Zhang, Fuchun Guo, Willy Susilo, Guomin Yang

Research Collection School Of Computing and Information Systems

The Internet of Things and cloud services have been widely adopted in many applications, and personal health records (PHR) can provide tailored medical care. The PHR data is usually stored on cloud servers for sharing. Weighted attribute-based encryption (ABE) is a practical and flexible technique to protect PHR data. Under a weighted ABE policy, the data user's attributes will be “scored”, if and only if the score reaches the threshold value, he/she can access the data. However, while this approach offers a flexible access policy, the data owners have difficulty controlling their privacy, especially sharing PHR data in collaborative e-health …

Beyond "Protected" And "Private": An Empirical Security Analysis Of Custom Function Modifiers In Smart Contracts, Yuzhou Fang, Daoyuan Wu, Xiao Yi, Shuai Wang, Yufan Chen, Mengjie Chen, Yang Liu, Lingxiao Jiang

Research Collection School Of Computing and Information Systems

A smart contract is a piece of application-layer code running on blockchain ledgers and it provides programmatic logic via transaction-based execution of pre-defined functions. Smart contract functions are by default invokable by any party. To safeguard them, the mainstream smart contract language, i.e., Solidity of the popular Ethereum blockchain, proposed a unique language-level keyword called “modifier,” which allows developers to define custom function access control policies beyond the traditional “protected” and “private” modifiers in classic programming languages.In this paper, we aim to conduct a large-scale security analysis of the modifiers used in real-world Ethereum smart contracts. To achieve this, we …

Algorithm For Generation Of S-Box Using Trigonometric Transformation In Genetic Algorithm Parameters, Javokhir Rustamovich Abdurazzokov

Chemical Technology, Control and Management

This article presents a fairly reliable algorithm for generating an S-box using a trigonometric function in the parameters of the genetic algorithm. S-boxes are essential components of modern cryptography and are used for permutation operations in various block cipher algorithms. The efficiency of the algorithm was demonstrated by various experimental experiments, which showed that the created S-box is sufficiently resistant to linear and differential cryptanalysis attacks. During the experimental analysis, the proposed S-box showed good results in various criteria, where the average level of nonlinearity was 105, the criterion of strict avalanche efficiency was 0.4941, the probability of linear convergence …

Possible Attacks On Match-In-Database Fingerprint Authentication, Jadyn Sondrol

Scholarly Horizons: University of Minnesota, Morris Undergraduate Journal

Biometrics are used to help keep users’ data private. There are many different biometric systems, all dealing with a unique attribute of a user, such as fingerprint, face, retina, iris and voice recognition. Fingerprint biometric systems, specifically match-in-database, have universally become the most implemented biometric system. To make these systems more secure, threat models are used to identify potential attacks and ways to mitigate them. This paper introduces a threat model for match-in-database fingerprint authentication systems. It also describes some of the most frequent attacks these systems come across and some possible mitigation efforts that can be adapted to keep …

Lidar Segmentation-Based Adversarial Attacks On Autonomous Vehicles, Blake Johnson

Scholarly Horizons: University of Minnesota, Morris Undergraduate Journal

Autonomous vehicles utilizing LiDAR-based 3D perception systems are susceptible to adversarial attacks. This paper focuses on a specific attack scenario that relies on the creation of adversarial point clusters with the intention of fooling the segmentation model utilized by LiDAR into misclassifying point cloud data. This can be translated into the real world with the placement of objects (such as road signs or cardboard) at these adversarial point cluster locations. These locations are generated through an optimization algorithm performed on said adversarial point clusters that are introduced by the attacker.

A Multimodal Immune System Inspired Defense Architecture For Detecting And Deterring Digital Pathogens In Container Hosted Web Services, Islam Khalil

Theses and Dissertations

With the increased use of web technologies, microservices, and Application Programming Interface (API) for integration between systems, and with the development of containerization of services on operating system level as a method of isolating system execution and for easing the deployment and scaling of systems, there is a growing need as well as opportunities for providing platforms that improve the security of such services. In our work, we propose an architecture for a containerization platform that utilizes various concepts derived from the human immune system. The goal of the proposed containerization platform is to introduce the concept of slowing down …

Efficient Privacy-Preserving Spatial Range Query Over Outsourced Encrypted Data, Yinbin Miao, Yutao Yang, Xinghua Li, Zhiquan Liu, Hongwei Li, Kim-Kwang Raymond Choo, Robert H. Deng

Research Collection School Of Computing and Information Systems

With the rapid development of Location-Based Services (LBS), a large number of LBS providers outsource spatial data to cloud servers to reduce their high computational and storage burdens, but meanwhile incur some security issues such as location privacy leakage. Thus, extensive privacy-preserving LBS schemes have been proposed. However, the existing solutions using Bloom filter do not take into account the redundant bits that do not map information in Bloom filter, resulting in high computational overheads, and reveal the inclusion relationship in Bloom filter. To solve these issues, we propose an efficient Privacy-preserving Spatial Range Query (PSRQ) scheme by skillfully combining …

Digital Transformation In Local Governments: A Case Study Of Abu Dhabi Municipality Transport Department, Alia Sahmi Al Ahbabi

Theses

The new generation is rapidly adapting to the digital era, where government and private services are being transformed into electronic services, commonly known as Eservices. Cities are leveraging digitalization to streamline their business processes and business services. This digitalization has improved service delivery time and quality for individuals. With digitalization, business processes align with technology, enhancing performance and customer satisfaction. However, there are challenges associated with digitalization, particularly people working in various municipality departments who find it challenging to adapt to digitization. Employees may take time to adjust to the new techniques and technologies, which may hamper the actions of …

Performance Modeling For Network Anomaly Detection And Sensor Networks, Jie Chu

Dissertations, Theses, and Capstone Projects

Computer networks have become one of the fundamental communication infrastructures of the modern world. Data collection and data analysis over computer networks is a broad area of research and is getting more and more complicated as the ever-increasing complexity of the computer networks. In this dissertation, I will conduct performance modeling work for a few network scenarios and applications. In the first part of this dissertation, I will focus on two vital perspectives of the Internet, one from network administrators and the other from network users. Network administrators are key to manage and protect a computer network. I will study …

Transformation And Abstraction To Aid Comparison Of Binary Executables Across Compilation Environments, Jeremy D. Seideman

Dissertations, Theses, and Capstone Projects

Binary analysis allows researchers to examine how programs are constructed and how they will impact an underlying system. The various analysis techniques allow the determination of code authorship, reuse, and similarity. Detecting code reuse is significant because code reuse can be a method for vulnerabilities and security issues to spread among software projects. In this work, we examine techniques that can aid in binary analysis, especially those that abstract and transform binaries, so that they can be compared across compilation environments, including possible changes in compiler version, hardware architecture, and compilation options. Historically, this has been difficult to accomplish since …

Distpreserv: Maintaining User Distribution For Privacy-Preserving Location-Based Services, Yanbing Ren, Xinghua Li, Yinbin Miao, Robert H. Deng, Jian Weng, Siqi Ma, Jianfeng Ma

Research Collection School Of Computing and Information Systems

Location-Based Services (LBSs) are one of the most frequently used mobile applications in the modern society. Geo-Indistinguishability (Geo-Ind) is a promising privacy protection model for LBSs since it can provide formal security guarantees for location privacy. However, Geo-Ind undermines the statistical location distribution of users on the LBS server because of perturbed locations, thereby disabling the server to provide distribution-based services (e.g., traffic congestion maps). To overcome this issue, we give a privacy definition, called DistPreserv, to enable the LBS server to acquire valid location distributions while providing users with strict location protection. Then we propose a privacy-preserving LBS scheme …

An Efficient Strategy For Deploying Deception Technology, Noora Abdulla Alhosani

Theses

Implementations of deception technology is crucial in discovering attacks by creating a controlled and monitored environment for detecting malicious activity. This technology involves the deployment of decoys, traps, and honeypots that mimic natural systems and network assets to attract and identify attackers. The use of deception technology provides an early warning system for detecting cyber-attacks, allowing organizations to respond quickly and mitigate damage. This article proposed a framework that focuses on maximizing the efficiency of deception technology in detecting sophisticated attacks. The framework employs multi-layered deception techniques at various levels of the network, system, and application to provide comprehensive coverage …

Structural Anomaly Detection, Shoufu Luo

Dissertations, Theses, and Capstone Projects

As computer systems become more complex and powerful, the threat of sophisticated and persistent computer attacks increases dramatically. Traditional intrusion detection systems that rely on log analysis struggle to keep pace with these evolving threats, as the attacking trails are often buried in high-volume and high-velocity legitimate activities in the system. Despite tremendous progress in applying machine learning techniques to anomaly-based intrusion detection, such methods continue to suffer from a high false positive rate due to the diversity and variability of individual behavior.To address this problem, this thesis proposes a new framework for detecting structural anomalies in computer systems. The …

Privacy Please: Power Distance And People’S Responses To Data Breaches Across Countries, Shilpa Madan, Krishna Savani, Constantine S. Katsikeas

Research Collection Lee Kong Chian School Of Business

Information security and data breaches are perhaps the biggest challenges that global businesses face in the digital economy. Although data breaches can cause significant harm to users, businesses, and society, there is significant individual and national variation in people’s responses to data breaches across markets. This research investigates power distance as an antecedent of people’s divergent reactions to data breaches. Eight studies using archival, correlational, and experimental methods find that high power distance makes users more willing to continue patronizing a business after a data breach (Studies 1–3). This is because they are more likely to believe that the business, …

How To Resuscitate A Sick Vm In The Cloud, Xuhua Ding

Research Collection School Of Computing and Information Systems

A guest virtual machine in a cloud platform may fall “sick” when its kernel encounters a fatal low-level bug or is subverted by an adversary. The VM owner is hence likely to lose her control over it due to a kernel hang or being denied of remote accesses. While the VM can be rebooted with the assistance from the cloud server, the owner not only faces service disruption but also is left with no opportunity to make an in-depth diagnosis and forensics on the spot, not to mention a live rectification. Currently, the cloud service provider has neither incentive nor …

Livoauth: Liveness Detection In Voiceprint Authentication With Random Challenges And Detection Modes, Rui Zhang, Zheng Yan, Xueru Wang, Robert H. Deng

Research Collection School Of Computing and Information Systems

Voiceprint authentication provides great convenience to users in many application scenarios. However, it easily suffers from spoofing attacks including speech synthesis, speech conversion, and speech replay. Liveness detection is an effective way to resist these attacks. But existing methods suffer from many disadvantages, such as extra deployment costs due to precise data collection, environmental disturbance, high computational overhead, and operational complexity. A uniform platform that can offer voiceprint authentication as a service (VAaS) over the cloud is also lacked. Hence, it is imperative to design an economic and effective method for liveness detection in voiceprint authentication. In this article, we …

Privacy-Preserving Ranked Spatial Keyword Query In Mobile Cloud-Assisted Fog Computing, Qiuyun Tong, Yinbin Li Miao, Ximeng Liu, Robert H. Deng, Robert H. Deng

Research Collection School Of Computing and Information Systems

With the increasing popularity of GPS-equipped mobile devices in cloud-assisted fog computing scenarios, massive spatio-textual data is generated and outsourced to cloud servers for storage and analysis. Existing privacy-preserving range query or ranked keyword search schemes does not support a unified index, and are just applicable for the symmetric environment where all users sharing the same secret key. To solve this issue, we propose a Privacy-preserving Ranked Spatial keyword Query in mobile cloud-assisted Fog computing (PRSQ-F). Specifically, we design a novel comparable product encoding strategy that combines both spatial and textual conditions tightly to retrieve the objects in query range …

Trustworthy Machine Learning Through The Lens Of Privacy And Security, Thi Kim Phung Lai

Dissertations

Nowadays, machine learning (ML) becomes ubiquitous and it is transforming society. However, there are still many incidents caused by ML-based systems when ML is deployed in real-world scenarios. Therefore, to allow wide adoption of ML in the real world, especially in critical applications such as healthcare, finance, etc., it is crucial to develop ML models that are not only accurate but also trustworthy (e.g., explainable, privacy-preserving, secure, and robust). Achieving trustworthy ML with different machine learning paradigms (e.g., deep learning, centralized learning, federated learning, etc.), and application domains (e.g., computer vision, natural language, human study, malware systems, etc.) is challenging, …

What Effects Do Large Language Models Have On Cybersecurity, Josiah Marshall

Cybersecurity Undergraduate Research Showcase

Large Language Models (LLMs) are artificial intelligence (AI) tools that can process, summarize, and translate texts and predict future words in a sentence, letting the LLM generate sentences similar to how humans talk and write. One concern that needs to be flagged is that, often, the content generated by different LLMs is inaccurate. LLMs are trained on code that can be used to detect data breaches, detect ransomware, and even pinpoint organizational vulnerabilities in advance of a cyberattack. LLMs are new but have unbelievable potential with their ability to generate code that brings awareness to cyber analysts and IT professionals. …

Hacker, Influencer, Counter-Culture Spy: Cyberspace Actors’ Models Of Misinformation And Counter-Operations, Benjamin Kessell

College of Computing and Digital Media Dissertations

As misinformation continues to spread on social media, its residents have begun to fight back, independent of any platform. This organic resistance to the diffusion of misinformation is a clearly observable phenomenon with roots in Anonymous’ distributed campaigns from the 2010s outwards. Hacker and information security communities are acting in defense of some of their favorite spaces, most notably, Twitter. Security researchers of all stripes use it for sharing indicators of compromise but, as the diffusion of misinformation becomes more problematic it becomes more difficult to find signals in the noise.

These actors’ response to the issues at hand is …

Human And Technical Factors In The Adoption Of Quantum Cryptographic Algorithms, Alyssa Pinkston

Mathematical Sciences Technical Reports (MSTR)

The purpose of this research is to understand what factors would cause users to choose quantum key distribution (QKD) over other methods of cryptography. An Advanced Encryption Standard (AES) key can be exchanged through communication using the Rivest, Shamir, Adleman (RSA) cryptographic algorithm, QKD, or post-quantum cryptography (PQC). QKD relies on quantum physics where RSA and PQC use complex mathematics to encrypt data. The BB84 quantum cryptographic protocol involves communication over a quantum channel and a public channel. The quantum channel can be technically attacked by beamsplitting or intercept/resend. QKD, like other forms of cryptography, is vulnerable to social attacks …

An Empirical Study Of Pre-Trained Model Reuse In The Hugging Face Deep Learning Model Registry, Wenxin Jiang, Nicholas Synovic, Matt Hyattt, Taylor R. Schorlemmer, Rohan Sethi, Yung-Hisang Lu, George K. Thiruvathukal, James C. Davis

Computer Science: Faculty Publications and Other Works

Deep Neural Networks (DNNs) are being adopted as components in software systems. Creating and specializing DNNs from scratch has grown increasingly difficult as state-of-the-art architectures grow more complex. Following the path of traditional software engineering, machine learning engineers have begun to reuse large-scale pre-trained models (PTMs) and fine-tune these models for downstream tasks. Prior works have studied reuse practices for traditional software packages to guide software engineers towards better package maintenance and dependency management. We lack a similar foundation of knowledge to guide behaviors in pre-trained model ecosystems.

In this work, we present the first empirical investigation of PTM reuse. …

An Analysis And Examination Of Consensus Attacks In Blockchain Networks, Thomas R. Clark

Senior Honors Projects, 2020-current

This paper examines consensus attacks as they relate to blockchain networks. Consensus attacks are a significant threat to the security and integrity of blockchain networks, and understanding these attacks is crucial for developers and stakeholders. The primary contribution of the paper is to present blockchain and consensus attacks in a clear and accessible manner, with the aim of making these complex concepts easily understandable for a general audience. Using literature review, the paper identifies various methods to prevent consensus attacks, including multi-chain networks, proof-of-work consensus algorithms, and network auditing and monitoring. An analysis revealed that these methods for preventing consensus …

An Analysis Of Text-Based Machine Learning Models For Vulnerability Detection, Kollin Ryne Napier

Theses and Dissertations

With an increase in complexity of software, developers rely more on reuse and dependencies in their source code via code snippets. As a result, it is becoming harder to identify and mitigate vulnerabilities. Although traditional analysis tools are still utilized, machine learning models are being adopted to expand efforts and combat such threats. Given the possibilities towards usage of such models, research in this area has introduced various approaches which vary in usability and prediction. In generalizing models to a more natural language approach, researchers have opted to train models on source code to identify existing and potential vulnerabilities. Exploratory …

Making The Transition To Post-Quantum Cryptography, J. Simon Richard

The Downtown Review: An Interdisciplinary Journal Written and Peer-Reviewed by Mandel Honors College Students at Cleveland State University

Without intervention, quantum computing could threaten the security of a large portion of our internet in the near future. However, solutions exist. This paper, which is intended for a general audience, provides a wider context for our current state of quantum-preparedness amid the transition from classical cryptosystems to post-quantum cryptosystems—cryptographic algorithms that can resist the attacks of quantum computers. It will also submit a possible way forward inspired by the actions taken around the globe to prevent the millennium (or Y2K) bug.

Du Undergraduate Showcase: Research, Scholarship, And Creative Works, Caitlyn Aldersea, Justin Bravo, Sam Allen, Anna Block, Connor Block, Emma Buechler, Maria De Los Angeles Bustillos, Arianna Carlson, William Christensen, Olivia Kachulis, Noah Craver, Kate Dillon, Muskan Fatima, Angel Fernandes, Emma Finch, Colleen Cassidy, Amy Fishman, Andrea Francis, Stacia Fritz, Simran Gill, Emma Gries, Rylie Hansen, Shannon Powers, Jacqueline Martinez, Zachary Harker, Ashley Hasty, Mykaela Tanino-Springsteen, Kathleen Hopps, Adelaide Kerenick, Colin Kleckner, Ci Koehring, Elijah Kruger, Braden Krumholz, Maddie Leake, Lyneé Alves, Seraphina Loukas, Yatzari Lozano Vazquez, Haley Maki, Emily Martinez, Sierra Mckinney, Audrey Mitchell, Kipling Newman, Audrey Ng, Megan Lucyshyn, Andrew Nguyen, Stevie Ostman, Casandra Pearson, Alexandra Penney, Julia Gielczynski, Tyler Ball, Anna Rini, Christina Rorres, Simon Ruland, Helayna Schafer, Emma Sellers, Sarah Schuller, Claire Shaver, Kevin Summers, Isabella Shaw, Madison Sinar, Claudia Pena, Apshara Siwakoti, Carter Sorensen, Madi Sousa, Anna Sparling, Alexandra Revier, Brandon Thierry, Dylan Tyree, Maggie Williams, Lauren Wols

DU Undergraduate Research Journal Archive

DU Undergraduate Showcase: Research, Scholarship, and Creative Works

Blockchain Security: Double-Spending Attack And Prevention, William Henry Scott Iii

Electronic Theses and Dissertations

This thesis shows that distributed consensus systems based on proof of work are vulnerable to hashrate-based double-spending attacks due to abuse of majority rule. Through building a private fork of Litecoin and executing a double-spending attack this thesis examines the mechanics and principles behind the attack. This thesis also conducts a survey of preventative measures used to deter double-spending attacks, concluding that a decentralized peer-to-peer network using proof of work is best protected by the addition of an observer system whether internal or external.

Digital Dna: The Ethical Implications Of Big Data As The World’S New-Age Commodity, Clark H. Dotson

Honors Theses

In the emerging digital world that we find ourselves in, it becomes apparent that data collection has become a staple of daily life, whether we like it or not. This research discussion aims to bring light to just how much one’s own digital identity is valued in the technologically-infused world of today, with distinct research and local examples to bring awareness to the ethical implications of your online presence. The paper in question examines anecdotal and research evidence of the collection of data, both through true and unjust means, as well as ethical implications of what this information truly represents. …

What Senior U.S. Leaders Say We Should Know About Cyber, Dr. Joseph H. Schafer

Military Cyber Affairs

On April 6, 2023, the Atlantic Council’s Cyber Statecraft Initiative hosted a panel discussion on the new National Cybersecurity Strategy. The panel featured four senior officials from the Office of the National Cyber Director (ONCD), the Department of State (DoS), the Department of Justice (DoJ), and the Department of Homeland Security (DHS). The author attended and asked each official to identify the most important elements that policymakers and strategists must understand about cyber. This article highlights historical and recent struggles to express cyber policy, the responses from these officials, and the author’s ongoing research to improve national security cyber policy.