Information Security Commons^™

Lightweight Pairwise Key Distribution Scheme For Iots, Kanwalinderjit Kaur

Journal of Cybersecurity Education, Research and Practice

Embedding a pairwise key distribution approach in IoT systems is challenging as IoT devices have limited resources, such as memory, processing power, and battery life. This paper presents a secure and lightweight approach that is applied to IoT devices that are divided into Voronoi clusters. This proposed algorithm comprises XOR and concatenation operations for interactive authentication between the server and the IoT devices. Predominantly, the authentication is carried out by the server. It is observed that the algorithm is resilient against man-in-the-middle attacks, forward secrecy, Denial of Service (DoS) attacks, and offers mutual authentication. It is also observed that the …

Reinventing Cybersecurity Internships During The Covid-19 Pandemic, Lori L. Sussman

Journal of Cybersecurity Education, Research and Practice

The Cybersecurity Ambassador Program provides professional skills training for emerging cybersecurity professionals remotely. The goal is to reach out to underrepresented populations who may use Federal Work-Study (FWS) or grant sponsored internships to participate. Cybersecurity Ambassadors (CAs) develop skills that will serve them well as cybersecurity workers prepared to do research, lead multidisciplinary, technical teams, and educate stakeholders and community members. CAP also reinforces leadership skills so that the next generation of cybersecurity professionals becomes a sustainable source of management talent for the program and profession. The remote curriculum innovatively builds non-technical professional skills (communications, teamwork, leadership) for cybersecurity research …

Risk Perceptions About Personal Internet-Of-Things: Research Directions From A Multi-Panel Delphi Study, Paul M. Di Gangi, Barbara A. Wech, Jennifer D. Hamrick, James L. Worrell, Samuel H. Goh

Journal of Cybersecurity Education, Research and Practice

Internet-of-Things (IoT) research has primarily focused on identifying IoT devices' organizational risks with little attention to consumer perceptions about IoT device risks. The purpose of this study is to understand consumer risk perceptions for personal IoT devices and translate these perceptions into guidance for future research directions. We conduct a sequential, mixed-methods study using multi-panel Delphi and thematic analysis techniques to understand consumer risk perceptions. The results identify four themes focused on data exposure and user experiences within IoT devices. Our thematic analysis also identified several emerging risks associated with the evolution of IoT device functionality and its potential positioning …

Cybersecurity Continuity Risks: Lessons Learned From The Covid-19 Pandemic, Tyler Fezzey, John H. Batchelor, Gerald F. Burch, Randall Reid

Journal of Cybersecurity Education, Research and Practice

The scope and breadth of the COVID-19 pandemic were unprecedented. This is especially true for business continuity and the related area of cybersecurity. Historically, business continuity and cybersecurity are viewed and researched as separate fields. This paper synthesizes the two disciplines as one, thus pointing out the need to address both topics simultaneously. This study identifies blind spots experienced by businesses as they navigated through the difficult time of the pandemic by using data collected during the height of the COVID-19 pandemic. One major shortcoming was that most continuity and cybersecurity plans focused on single-axis threats. The COVID-19 pandemic resulted …

Alpha Phi-Shing Fraternity: Phishing Assessment In A Higher Education Institution, Marco Casagrande, Mauro Conti, Monica Fedeli, Eleonora Losiouk

Journal of Cybersecurity Education, Research and Practice

Phishing is a common social engineering attack aimed to steal personal information. Universities attract phishing attacks because: 1) they store employees and students sensitive data, 2) they save confidential documents, 3) their infrastructures often lack security. In this paper, we showcase a phishing assessment at the University of Redacted aimed to identify the people, and the features of such people, that are more susceptible to phishing attacks. We delivered phishing emails to 1.508 subjects in three separate batches, collecting a clickrate equal to 30%, 11% and 13%, respectively. We considered several features (i.e., age, gender, role, working/studying field, email template) …

Finding Forensic Evidence In The Operating System's Graphical User Interface, Edward X. Wilson Mr.

LSU Master's Theses

A branch of cyber security known as memory forensics focuses on extracting meaningful evidence from system memory. This analysis is often referred to as volatile memory analysis, and is generally performed on memory captures acquired from target systems. Inside of a memory capture is the complete state of a system under investigation, including the contents of currently running as well as previously executed applications. Analysis of this data can reveal a significant amount of activity that occurred on a system since the last reboot. For this research, the Windows operating system is targeted. In particular, the graphical user interface component …

Unmasking Deception In Vanets: A Decentralized Approach To Verifying Truth In Motion, Susan Zehra, Syed R. Rizvi, Steven Olariu

College of Sciences Posters

VANET, which stands for "Vehicular Ad Hoc Network," is a wireless network that allows vehicles to communicate with each other and with infrastructure, such as Roadside Units (RSUs), with the aim of enhancing road safety and improving the overall driving experience through real-time exchange of information and data. VANET has various applications, including traffic management, road safety alerts, and navigation. However, the security of VANET can be compromised if a malicious user alters the content of messages transmitted, which can harm both individual vehicles and the overall trust in VANET technology. Ensuring the correctness of messages is crucial for the …

A Systematic Review Of Cryptocurrencies Use In Cybercrimes, Kieran B D Human

Graduate Thesis and Dissertation 2023-2024

Cryptocurrencies are one of the most prominent applications of blockchain systems. While cryptocurrencies promise many features and advantages, such as decentralization, anonymity, and ease of access, those very features can be abused. For instance, as documented in various recent works, cryptocurrencies have been frequently abused in many different forms of cybercrime. Despite the plethora of works on measuring and understanding the abuse of cryptocurrencies in the digital space, there has been no work on systemizing this knowledge by comprehensively understanding those contributions, contrasting them based on their merit, and understanding the gap in this research space.

This thesis initiates the …

Towards A Holistic And Comparative Analysis Of The Free Content Web: Security, Privacy, And Performance, Abdulrahman Alabduljabbar

Electronic Theses and Dissertations, 2020-2023

Free content websites that provide free books, music, games, movies, etc., have existed on the Internet for many years. While it is a common belief that such websites might be different from premium websites providing the same content types in terms of their security, a rigorous analysis that supports this belief is lacking from the literature. In particular, it is unclear if those websites are as safe as their premium counterparts. In this dissertation, we set out to investigate the similarities and differences between free content and premium websites, including their risk profiles. Moreover, we analyze and quantify through measurements …

Unlocking User Identity: A Study On Mouse Dynamics In Dual Gaming Environments For Continuous Authentication, Marcho Setiawan Handoko

All Graduate Theses, Dissertations, and Other Capstone Projects

With the surge in information management technology reliance and the looming presence of cyber threats, user authentication has become paramount in computer security. Traditional static or one-time authentication has its limitations, prompting the emergence of continuous authentication as a frontline approach for enhanced security. Continuous authentication taps into behavior-based metrics for ongoing user identity validation, predominantly utilizing machine learning techniques to continually model user behaviors. This study elucidates the potential of mouse movement dynamics as a key metric for continuous authentication. By examining mouse movement patterns across two contrasting gaming scenarios - the high-intensity "Team Fortress" and the low-intensity strategic …

Applying Machine Learning To Categorize Distinct Categories Of Network Traffic, Isaac M. Dunham

Senior Honors Theses and Projects

The recent rapid growth of the field of data science has made available to all fields opportunities to leverage machine learning. Computer network traffic classification has traditionally been performed using static, pre-written rules that are easily made ineffective if changes, legitimate or not, are made to the applications or protocols underlying a particular category of network traffic. This paper explores the problem of network traffic classification and analyzes the viability of having the process performed using a multitude of classical machine learning techniques against significant statistical similarities between classes of network traffic as opposed to traditional static traffic identifiers.

To …

Discovering Vulnerabilities And Designing Trustworthy Defenses In Iot Systems And Devices, Bryan Pearson

Electronic Theses and Dissertations, 2020-2023

Internet of Things (IoT) dominates many functions in the modern world, from sensing and reporting temperature, humidity, and air quality, to controlling and automating homes, commercial buildings, and equipment. However, IoT systems have received scrutiny in recent years due to countless security incidents, which can have physical and even deadly consequences. This research provides a comprehensive assessment of the security of IoT systems and devices, including low-cost microcontroller (MCU) based sensors, cloud services, and Building Automation Systems (BAS). We begin by exploring the current landscape of vulnerabilities and defenses in modern IoT applications. We show that many security needs can …

Campus Safety Data Gathering, Classification, And Ranking Based On Clery-Act Reports, Walaa F. Abo Elenin

College of Graduate Studies: Theses & Dissertations

Most existing campus safety rankings are based on criminal incident history with minimal or no consideration of campus security conditions and standard safety measures. Campus safety information published by universities/colleges is usually conceptual/qualitative and not quantitative and are based-on criminal records of these campuses. Thus, no explicit and trusted ranking method for these campuses considers the level of compliance with the standard safety measures. A quantitative safety measure is important to compare different campuses easily and to learn about specific campus safety conditions.

In this thesis, we utilize Clery-Act reports of campuses to automatically analyze their safety conditions and generate …

A Novel Approach To Detecting And Mitigating Keyloggers, Damilola Osedumbi Elelegwu

College of Graduate Studies: Theses & Dissertations

As the digital world gets increasingly ingrained in our daily lives, cyberattacks—especially those involving malware—are growing more complex and common, which calls for developing innovative safeguards. Keylogger spyware, which combines keylogging and spyware functionalities, is one of the most insidious types of cyberattacks. This malicious software stealthily monitors and records user keystrokes, amassing sensitive data, such as passwords and confidential personal information, which can then be exploited. This research work introduces a novel browser extension designed to thwart keylogger spyware attacks effectively. The extension is underpinned by a cutting-edge algorithm that meticulously analyzes input-related processes, promptly identifying and flagging any …

Material Extrusion-Based Additive Manufacturing: G-Code And Firmware Attacks And Defense Frameworks, Haris Rais

Theses and Dissertations

Additive Manufacturing (AM) refers to a group of manufacturing processes that create physical objects by sequentially depositing thin layers. AM enables highly customized production with minimal material wastage, rapid and inexpensive prototyping, and the production of complex assemblies as single parts in smaller production facilities. These features make AM an essential component of Industry 4.0 or Smart Manufacturing. It is now used to print functional components for aircraft, rocket engines, automobiles, medical implants, and more. However, the increased popularity of AM also raises concerns about cybersecurity. Researchers have demonstrated strength degradation attacks on printed objects by injecting cavities in the …

Intrusion Detection Based On Bidirectional Long Short-Term Memory With Attention Mechanism, Yongjie Yang, Shanshan Tu, Raja Hashim Ali, Hisham Alasmary, Muhammad Waqas, Muhammad Nouman Amjad

Research outputs 2022 to 2026

With the recent developments in the Internet of Things (IoT), the amount of data collected has expanded tremendously, resulting in a higher demand for data storage, computational capacity, and real-time processing capabilities. Cloud computing has traditionally played an important role in establishing IoT. However, fog computing has recently emerged as a new field complementing cloud computing due to its enhanced mobility, location awareness, heterogeneity, scalability, low latency, and geographic distribution. However, IoT networks are vulnerable to unwanted assaults because of their open and shared nature. As a result, various fog computing-based security models that protect IoT networks have been developed. …

Going Beyond: Cyber Security Curriculum In Western Australian Primary And Secondary Schools. Final Report, Nicola F. Johnson, Ahmed Ibrahim, Leslie Sikos, Marnie Mckee

Research outputs 2022 to 2026

There is no doubt cyber security is of national interest given the rife nature of cyber crime and the alarming increase of victims who have endured identify theft, fraud and scams. Curriculum within K-12 schools tends to be fixed and any modifications are subject to extensive consultation within a prolonged review cycle. Therefore, this report has gone beyond curriculum to explore the potential of national awareness campaigns and dynamic digital cyber security licences as alternative possibilities for instigation. The role of leaders in various school sectors and systems is critical for a successful roll out. This final report culminates from …

Physical Layer Authenticated Image Encryption For Iot Network Based On Biometric Chaotic Signature For Mpfrft Ofdm System, Esam A. A. Hagras, Saad Aldosary, Haitham Khaled, Tarek Hassan

Research outputs 2022 to 2026

In this paper, a new physical layer authenticated encryption (PLAE) scheme based on the multi-parameter fractional Fourier transform–Orthogonal frequency division multiplexing (MP-FrFT-OFDM) is suggested for secure image transmission over the IoT network. In addition, a new robust multi-cascaded chaotic modular fractional sine map (MCC-MF sine map) is designed and analyzed. Also, a new dynamic chaotic biometric signature (DCBS) generator based on combining the biometric signature and the proposed MCC-MF sine map random chaotic sequence output is also designed. The final output of the proposed DCBS generator is used as a dynamic secret key for the MPFrFT OFDM system in which …

T-Counter: Trustworthy And Efficient Cpu Resource Measurement Using Sgx In The Cloud, Chuntao Dong, Qingni Shen, Xuhua Ding, Daoqing Yu, Wu Luo, Pengfei Wu, Zhonghai Wu

Research Collection School Of Computing and Information Systems

As cloud services have become popular, and their adoption is growing, consumers are becoming more concerned about the cost of cloud services. Cloud Service Providers (CSPs) generally use a pay-per-use billing scheme in the cloud services model: consumers use resources as they needed and are billed for their resource usage. However, CSPs are untrusted and privileged; they have full control of the entire operating system (OS) and may tamper with bills to cheat consumers. So, how to provide a trusted solution that can keep track of and verify the consumers’ resource usage has been a challenging problem. In this paper, …

Determinants Of Intention To Use E-Wallet: Personal Innovativeness And Propensity To Trust As Moderators, Madugoda Gunaratnege Senali, Mohammad Iranmanesh, Fatin Nadzirah Ismail, Noor Fareen Abdul Rahim, Mana Khoshkam, Maryam Mirzaei

Research outputs 2022 to 2026

This study aims to investigate the determinants of intention to use e-wallets. Drawing on the technology acceptance model (TAM), the conceptual framework was developed. The study extends the TAM in the context of e-wallets, by testing the influences of product-related factors namely perceived compatibility, perceived risk, and perceived emotions and investigating the moderating impacts of personal innovativeness and propensity to trust. To conduct an empirical study, the data were collected from Malaysian individuals with no experience with e-wallets using an online survey. Data from 374 participants were obtained and analyzed using the partial least squares technique. The results showed that …

Malbot-Drl: Malware Botnet Detection Using Deep Reinforcement Learning In Iot Networks, Mohammad Al-Fawa'reh, Jumana Abu-Khalaf, Patryk Szewczyk, James J. Kang

Research outputs 2022 to 2026

In the dynamic landscape of cyber threats, multi-stage malware botnets have surfaced as significant threats of concern. These sophisticated threats can exploit Internet of Things (IoT) devices to undertake an array of cyberattacks, ranging from basic infections to complex operations such as phishing, cryptojacking, and distributed denial of service (DDoS) attacks. Existing machine learning solutions are often constrained by their limited generalizability across various datasets and their inability to adapt to the mutable patterns of malware attacks in real world environments, a challenge known as model drift. This limitation highlights the pressing need for adaptive Intrusion Detection Systems (IDS), capable …

Knowledge Organization System For Partial Automation To Improve The Security Posture Of Iomt Networks, Kulsoom Saima Bughio

Research outputs 2022 to 2026

Remote patient monitoring is a healthcare delivery model that uses technology to collect and transmit patient data from a remote location to healthcare providers for analysis and treatment. Remote patient monitoring systems rely on a network infrastructure to gather and transmit data from patients to healthcare providers through a network. While these systems become more prevalent, they may also become targets for cyberattacks. This paper deals with the development of a domain ontology to facilitate partial automation to improve the security posture of IoT networks used in remote patient monitoring. For this purpose, it captures the semantics of the concepts …

A Review Of Cyber Vigilance Tasks For Network Defense, Oliver A. Guidetti, Craig Speelman, Peter Bouhlas

Research outputs 2022 to 2026

The capacity to sustain attention to virtual threat landscapes has led cyber security to emerge as a new and novel domain for vigilance research. However, unlike classic domains, such as driving and air traffic control and baggage security, very few vigilance tasks exist for the cyber security domain. Four essential challenges that must be overcome in the development of a modern, validated cyber vigilance task are extracted from this review of existent platforms that can be found in the literature. Firstly, it can be difficult for researchers to access confidential cyber security systems and personnel. Secondly, network defense is vastly …

A Cross-Domain Trust Model Of Smart City Iot Based On Self-Certification, Yao Wang, Yubo Wang, Zhenhu Ning, Sadaqat Ur Rehman, Muhammad Waqas

Research outputs 2022 to 2026

Smart city refers to the information system with Internet of things and cloud computing as the core technology and government management and industrial development as the core content, forming a large-scale, heterogeneous and dynamic distributed Internet of things environment between different Internet of things. There is a wide demand for cooperation between equipment and management institutions in the smart city. Therefore, it is necessary to establish a trust mechanism to promote cooperation, and based on this, prevent data disorder caused by the interaction between honest terminals and malicious terminals. However, most of the existing research on trust mechanism is divorced …

Identity-Based Edge Computing Anonymous Authentication Protocol, Naixin Kang, Zhenhu Ning, Shiqiang Zhang, Sadaqat Ur Rehman, Muhammad Waqas

Research outputs 2022 to 2026

With the development of sensor technology and wireless communication technology, edge computing has a wider range of applications. The privacy protection of edge computing is of great significance. In the edge computing system, in order to ensure the credibility of the source of terminal data, mobile edge computing (MEC) needs to verify the signature of the terminal node on the data. During the signature process, the computing power of edge devices such as wireless terminals can easily become the bottleneck of system performance. Therefore, it is very necessary to improve efficiency through computational offloading. Therefore, this paper proposes an identity-based …

Hybrid Warfare And Disinformation: A Ukraine War Perspective, Sascha-Dominik Dov Bachmann, Dries Putter, Guy Duczynski

Research outputs 2022 to 2026

Misinformation, disinformation and mal information are part of the information disorder construct, dominating the information warfare domain. These are key enablers associated with grey zone operations, and an integral part of current adversaries' and competitors' hybrid warfare tool kit. Disinformation, in combination with influence operations, also plays an important role within the concept of hybrid warfare; both from a threat–and own resilience perspective. This article reflects on these information warfare tools and their application by Russia in the current Russo-Ukraine war, offering potentially considerable force multipliers in the information domain for the Russian aggressor. Hybrid warfare and associated threats, specifically …

A Review Of Multi-Factor Authentication In The Internet Of Healthcare Things, Tance Suleski, Mohiuddin Ahmed, Wencheng Yang, Eugene Wang

Research outputs 2022 to 2026

Objective: This review paper aims to evaluate existing solutions in healthcare authentication and provides an insight into the technologies incorporated in Internet of Healthcare Things (IoHT) and multi-factor authentication (MFA) applications for next-generation authentication practices. Our review has two objectives: (a) Review MFA based on the challenges, impact and solutions discussed in the literature; and (b) define the security requirements of the IoHT as an approach to adapting MFA solutions in a healthcare context. Methods: To review the existing literature, we indexed articles from the IEEE Xplore, ACM Digital Library, ScienceDirect, and SpringerLink databases. The search was refined to combinations …

Enabling Dapps Data Exchange With Hardware-Assisted Secure Oracle Network, Yue Li

Theses and Dissertations--Computer Science

Decentralized applications (dApps), enabled by the blockchain and smart contract technology, are known for allowing distrustful parties to execute business logic without relying on a central authority. Compared to regular applications, dApps offer a wide range of benefits, including security by design, trustless transactions, and resistance to censorship. However, dApps need to access real-world data to achieve their full potential, relying on the data oracles. Oracles act as bridges between blockchains and the outside world, providing essential data to the smart contracts that power dApps. A significant challenge in integrating oracles into the dApp ecosystem is the Oracle Problem …

An Empirical Assessment Of The Use Of Password Workarounds And The Cybersecurity Risk Of Data Breaches, Michael Joseph Rooney

CCAC Theses and Dissertations

Passwords have been used for a long time to grant controlled access to classified spaces, electronics, networks, and more. However, the dramatic increase in user accounts over the past few decades has exposed the realization that technological measures alone cannot ensure a high level of IS security; this leaves the end-users holding a critical role in protecting their organization and personal information. The increased use of IS as a working tool for employees increases the number of accounts and passwords required. Despite being more aware of password entropy, users still often participate in deviant password behaviors, known as ‘password workarounds’ …

A Survey And Evaluation Of Android-Based Malware Evasion Techniques And Detection Frameworks, Parvez Faruki, Rhati Bhan, Vinesh Jain, Sajal Bhatia, Nour El Madhoun, Rajendra Pamula

School of Computer Science & Engineering Faculty Publications

Android platform security is an active area of research where malware detection techniques continuously evolve to identify novel malware and improve the timely and accurate detection of existing malware. Adversaries are constantly in charge of employing innovative techniques to avoid or prolong malware detection effectively. Past studies have shown that malware detection systems are susceptible to evasion attacks where adversaries can successfully bypass the existing security defenses and deliver the malware to the target system without being detected. The evolution of escape-resistant systems is an open research problem. This paper presents a detailed taxonomy and evaluation of Android-based malware evasion …