Information Security Commons^™

On The Influence Of Biases In Bug Localization: Evaluation And Benchmark, Ratnadira Widyasari, Stefanus Agus Haryono, Ferdian Thung, Jieke Shi, Constance Tan, Fiona Wee, Jack Phan, David Lo

Research Collection School Of Computing and Information Systems

Bug localization is the task of identifying parts of thesource code that needs to be changed to resolve a bug report.As this task is difficult, automatic bug localization tools havebeen proposed. The development and evaluation of these toolsrely on the availability of high-quality bug report datasets. In2014, Kochhar et al. identified three biases in datasets used toevaluate bug localization techniques: (1) misclassified bug report,(2) already localized bug report, and (3) incorrect ground truthfile in a bug report. They reported that already localized bugreports statistically significantly and substantially impact buglocalization results, and thus should be removed. However, theirevaluation is still limited, …

Comparing Online Surveys For Cybersecurity: Sona And Mturk, Anne Wagner, Anna Bakas, Shelia Kennison, Eric Chan-Tin

Computer Science: Faculty Publications and Other Works

People have many accounts and usually need to create a password for each. They tend to create insecure passwords and re-use passwords, which can lead to compromised data. This research examines if there is a link between personality type and password security among a variety of participants in two groups of participants: SONA and MTurk. Each participant in both surveys answered questions based on password security and their personality type. Our results show that participants in the MTurk survey were more likely to choose a strong password and to exhibit better security behaviors and knowledge than participants in the SONA …

Experimental Study To Assess The Impact Of Timers On User Susceptibility To Phishing Attacks, Amy E. Antonucci, Yair Levy, Laurie P. Dringus, Martha Snyder

Journal of Cybersecurity Education, Research and Practice

Social engineering costs organizations billions of dollars. It exploits the weakest link of information systems security, the users. It is well-documented in literature that users continue to click on phishing emails costing them and their employers significant monetary resources and data loss. Training does not appear to mitigate the effects of phishing much; other solutions are warranted. Kahneman introduced the concepts of System-One and System-Two thinking. System-One is a quick, instinctual decision-making process, while System-Two is a process by which humans use a slow, logical, and is easily disrupted. The key aim of our experimental field study was to investigate …

Faculty And Advisor Advice For Cybersecurity Students: Liberal Arts, Interdisciplinarity, Experience, Lifelong Learning, Technical Skills, And Hard Work, Brian K. Payne, Bria Cross, Tancy Vandecar-Burdin

Journal of Cybersecurity Education, Research and Practice

The value of academic advising has been increasingly emphasized in higher education. In this study, attention is given to the most significant types of advice that a sample of cybersecurity faculty and advisors from the Commonwealth of Virginia recommend giving to cybersecurity students. The results show that faculty and advisors recommended that students be aware of six different aspects of cybersecurity education including the value of experience, the need for lifelong learning, the importance of hard work, the need to develop technical skills, the interdisciplinary nature of cybersecurity, and the need to develop liberal arts or professional/soft skills. Implications of …

Subject Matter Experts’ Feedback On Experimental Procedures To Measure User’S Judgment Errors In Social Engineering Attacks, Tommy Pollock, Yair Levy, Wei Li, Ajoy Kumar

Journal of Cybersecurity Education, Research and Practice

Distracted users can fail to correctly distinguish the differences between legitimate and malicious emails or search engine results. Mobile phone users can have a more challenging time identifying malicious content due to the smaller screen size and the limited security features in mobile phone applications. Thus, the main goal of this research study was to design, develop, and validate a set of field experiments to assess user’s judgment when exposed to two types of simulated social engineering attacks: phishing and Potentially Malicious Search Engine Results (PMSER), based on the interaction of the environment (distracting vs. non-distracting) and type of device …

A Taxonomy Of Cyberattacks Against Critical Infrastructure, Miloslava Plachkinova, Ace Vo

Journal of Cybersecurity Education, Research and Practice

The current study proposes a taxonomy to organize existing knowledge on cybercrimes against critical infrastructure such as power plants, water treatment facilities, dams, and nuclear facilities. Routine Activity Theory is used to inform a three-dimensional taxonomy with the following dimensions: hacker motivation (likely offender), cyber, physical, and cyber-physical components of any cyber-physical system (suitable target), and security (capable guardian). The focus of the study is to develop and evaluate the classification tool using Design Science Research (DSR) methodology. Publicly available data was used to evaluate the utility and usability of the proposed artifact by exploring three possible scenarios – Stuxnet, …

The 2020 Twitter Hack – So Many Lessons To Be Learned, Paul D. Witman, Scott Mackelprang

Journal of Cybersecurity Education, Research and Practice

In mid-July 2020, the social media site Twitter had over 100 of its most prominent user accounts start to tweet requests to send Bitcoin to specified Bitcoin wallets. The requests promised that the Bitcoin senders would receive their money back doubled, as a gesture of charity amidst the COVID-19 pandemic. The attack appears to have been carried out by a small group of hackers, leveraging social engineering to get access to internal Twitter support tools. These tools allowed the hackers to gain full control of the high-profile user accounts and post messages on their behalf. The attack provides many paths …

Editorial Vol 2021, No 2, Herbert J. Mattord, Michael E. Whitman, Hossain Shahriar

Journal of Cybersecurity Education, Research and Practice

Welcome to the Winter 2021 edition of the Journal for Cybersecurity Education, Research, and Practice.

Seqseg: A Sequential Method To Achieve Nasopharyngeal Carcinoma Segmentation Free From Background Dominance, Guihua Tao, Haojiang Li, Jiabin Huang, Chu Han, Jiazhou Chen, Guangying Ruan, Wenjie Huang, Yu Hu, Tingting Dan, Bin Zhang, Shengfeng He

Research Collection School Of Computing and Information Systems

Reliable nasopharyngeal carcinoma (NPC) segmentation plays an important role in radiotherapy planning. However, recent deep learning methods fail to achieve satisfactory NPC segmentation in magnetic resonance (MR) images, since NPC is infiltrative and typically has a small or even tiny volume with indistinguishable border, making it indiscernible from tightly connected surrounding tissues from immense and complex backgrounds. To address such background dominance problems, this paper proposes a sequential method (SeqSeg) to achieve accurate NPC segmentation. Specifically, the proposed SeqSeg is devoted to solving the problem at two scales: the instance level and feature level. At the instance level, SeqSeg is …

Provably Weak Instances Of Plwe Revisited, Again, Katherine Mendel

CSB and SJU Distinguished Thesis

Learning with Errors has emerged as a promising possibility for postquantum cryptography. Variants known as RLWE and PLWE have been shown to be more efficient, but the increased structure can leave them vulnerable to attacks for certain instantiations. This work aims to identify specific cases where proposed cryptographic schemes based on PLWE work particularly poorly under a specific attack.

Automated Reverse Engineering Of Role-Based Access Control Policies Of Web Applications, Ha Thanh Le, Lwin Khin Shar, Domenico Bianculli, Lionel C. Briand, Cu Duy Nguyen

Research Collection School Of Computing and Information Systems

Access control (AC) is an important security mechanism used in software systems to restrict access to sensitive resources. Therefore, it is essential to validate the correctness of AC implementations with respect to policy specifications or intended access rights. However, in practice, AC policy specifications are often missing or poorly documented; in some cases, AC policies are hard-coded in business logic implementations. This leads to difficulties in validating the correctness of policy implementations and detecting AC defects.In this paper, we present a semi-automated framework for reverse-engineering of AC policies from Web applications. Our goal is to learn and recover role-based access …

Optimal Eavesdropping In Quantum Cryptography, Atanu Acharyya Dr.

Doctoral Theses

Quantum key distribution (QKD) has raised some promise for more secured communication than its classical counterpart. It allows the legitimate parties to detect eavesdropping which introduces error in the channel. If disturbed, there are ways to distill a secure key within some threshold error-rate. The amount of information gained by an attacker is generally quantified by (Shannon) mutual information. Knowing the maximum amount of information that an intruder can gain is important for post-processing purposes, and we mainly focus on that side in the thesis. Renyi information is also useful especially when post-processing is considered. The scope of this thesis …

Using Memory Forensics To Analyze Programming Language Runtimes, Modhuparna Manna

LSU Doctoral Dissertations

The continued increase in the use of computer systems in recent times has led to a significant rise in the capabilities of malware and attacker toolkits that target different operating systems and their users. Over the last several years, cybersecurity threat reports have documented numerous instances of users that were targeted by governments, intelligence agencies, and criminal groups, and the result was that the victims ended up having highly sophisticated malware installed on their systems. Unfortunately, the rise of these threats has not been met with equal research and development of defensive mechanisms that can detect and analyze such malware. …

Digital Evidence In Appeals Of Criminal Cases Before The U.S. Courts Of Appeal: A Review Of Decisions And Examination Of The Legal Landscape From 2016 – 2020, Martin Novak

Journal of Digital Forensics, Security and Law

This study is a follow-up to Digital Evidence in Criminal Cases before the U.S. Courts of Appeal: Trends and Issues for Consideration – 2010 to 2015. The current study examines appeals of criminal cases before the United States Courts of Appeal from January 2016 through August 2020, where one or more appeal claims were related to digital evidence. The purpose of this research was to determine if the legal landscape has changed since 2015; examine the most relevant legal issues related to digital evidence; and analyze how precedential cases may have affected digital forensics as evidence.

Security Strategy In Combating Online Extremist Ideologies In Uae, Khalid Al-Qasimi

Journal of Police and Legal Sciences

This study aims at identifying the role of security strategies; the foundations of correct belief and good upbringing in the face of extremist ideology in order to protect the intellectual security of society. The researcher adopted the descriptive analytical approach in order to describe and analyze the role of the security strategy, the foundations of the correct faith and good upbringing in spreading moderation and combating extremist ideology through electronic websites.

The study has arrived at a number of findings, the most important of which are: extremist ideology cannot be confronted by traditional methods, but must be combated through modern …

Combating Terrorism Financing In The Cyber Environment A Study In Light Of The Egyptian And Emirati Experiences, Amar Elbably

Journal of Police and Legal Sciences

The research deals with the study of combating the financing of terrorism on the dark Internet, where terrorism "cyber has become an international actor, engages in interactions with states, individuals and institutions, and creates an agreement between the intelligence services and some terrorist movements, that these movements obtain information, finance, arm or training, in exchange for cyber-attacks against a mutual adversary, and the Internet plays a prominent role in the manufacture of extremism, terrorism, incitement to violence, promotion of radical ideas and attracting elements qualified for deviation, exploited in That's the dark part of the Internet, with an expansion of …

Technical Behaviours Of Child Sexual Exploitation Material Offenders, Chad Steel, Emily Newman, Suzanne O'Rourke, Ethel Quayle

Journal of Digital Forensics, Security and Law

An exploration of the technological behaviours of previously convicted child sexual exploitation material (CSEM) offenders provides a foundation for future applied research into deterrence, investigation, and treatment efforts. This study evaluates the technology choices and transitions of individuals previously convicted of CSEM offenses. Based on their inclusion in two sex offender registries, anonymous survey results (n=78) were collected from English-speaking adults within the United States. CSEM offenders chose technologies based on both utility and perceived risk; peer-to-peer and web-browsers were the most common gateway technologies and showed substantial sustained usage; a substantial minority of users never stored CSEM and only …

Forensic Discoverability Of Ios Vault Applications, Alissa Gilbert, Kathryn C. Seigfried-Spellar

Journal of Digital Forensics, Security and Law

Vault Applications are used to store potentially sensitive information on a smartphone; and are available on Android and iOS. The purpose of using these applications could be used to hide potential evidence or illicit photos. After comparing five different iOS photo vaults, each vault left evidence and photos behind. However, of the three forensic toolkits used, each produced different results in their scans of the phone. The media left behind was due to the photo vaults not protecting their information as claimed, and using basic obfuscation techniques in place of security controls. Future research will look at how newer security …

A Predictive Model To Predict Cyberattack Using Self-Normalizing Neural Networks, Oluwapelumi Eniodunmo

Theses, Dissertations and Capstones

Cyberattack is a never-ending war that has greatly threatened secured information systems. The development of automated and intelligent systems provides more computing power to hackers to steal information, destroy data or system resources, and has raised global security issues. Statistical and Data mining tools have received continuous research and improvements. These tools have been adopted to create sophisticated intrusion detection systems that help information systems mitigate and defend against cyberattacks. However, the advancement in technology and accessibility of information makes more identifiable elements that can be used to gain unauthorized access to systems and resources. Data mining and classification tools …

A Probabilistic Perspective Of Human-Machine Interaction, Mustafa Canan, Mustafa Demir, Samuel Kovacic

Engineering Management & Systems Engineering Faculty Publications

Human-machine interaction (HMI) has become an essential part of the daily routine in organizations. Although the machines are designed with state-of-the-art Artificial Intelligence applications, they are limited in their ability to mimic human behavior. The human-human interaction occurs between two or more humans; when a machine replaces a human, the interaction dynamics are not the same. The results indicate that a machine that interacts with a human can increase the mental uncertainty that a human experiences. Developments in decision sciences indicate that using quantum probability theory (QPT) improves the understanding of human decision-making than merely using classical probability theory (CPT). …

Cybersecurity In Fintech Companies, Efstratios Zouros

Cybersecurity Undergraduate Research Showcase

Have you recently accessed your bank account online? Have you accessed any financial instrument through your computer or your mobile device? If you are reading this, chances are you have. Every time you utilize those services, you ultimately put your trust in the financial institutions that offer them. You trust that they can securely keep your private information, while also keeping your savings safe. Ultimately, there is a certain dependability and trust in financial institutions that have been present on earth before most of us.

Digital Forensic Investigation, Dejuan Green

Cybersecurity Undergraduate Research Showcase

Finding, acquiring, processing, analyzing, and reporting data on electronically stored data is the main goal of the forensic science discipline known as "digital forensics." Nearly all illegal acts include the use of electronic evidence, making digital forensics support essential for law enforcement investigations. Furthermore, digital forensics is very important to cases aiding in many cases and can lead to saving lives/ victims and locking up criminals. A wide range of devices, including laptops, cellphones, remote storage, unmanned aerial systems, shipborne equipment, and more, can be used to gather electronic evidence. [2] Digital forensics' major objective is to take data from …

Understanding The Effectivity And Increased Reliance Of Credit Risk Machine Learning Models In Banking, Grishma Baruah

Cybersecurity Undergraduate Research Showcase

Credit risk analysis and making accurate investment and lending decisions has been a challenge for the financial industry for many years, as can be seen with the 2008 financial crisis. However, with the rise of machine learning models and predictive analytics, there has been a shift to increased reliance on technology for determining credit risk. This transition to machine learning comes with both advantages, such as potentially eliminating human error and assumptions from lending decisions, and disadvantages, such as time constraints, data usage inabilities, and lack of understanding nuances in machine learning models. In this paper, I look at four …

Ransombuster Iot: A Intrusion Detection And Dataset Creation Tool For Ransomware Attacks Within Iot Networks, Jackson M. Walker

Cybersecurity Undergraduate Research Showcase

The proposed research follows the design-science guidelines(Hevner, 2004). This paper uses these design-science methods for developing the guidelines for the implementation of the proposed architecture, understanding previous research contributions, and evaluating of research. This paper proposes a network artifact for studying ransomware IoT intrusion detection techniques and offers a proposed network architecture to serve as a framework for creating a publicly available dataset for IoT research on ransomware.

Deepfakes: Ai Technology Of The Future, Hosanna Root

Cybersecurity Undergraduate Research Showcase

Deepfakes technology’s danger stems from its ability to create realistic but fake synthesized media that people often identify as something that is real. With this powerful technology in the wrong hands, deepfakes can cause devastating havoc through information warfare, election campaign disruptions, and more, creating distrust in society. Disinformation is already rampant today, even without wide deployments of deepfakes, which is concerning given the fact that deepfakes’ nefarious full potentials are yet to be reached.

Mitigation Of Algorithmic Bias To Improve Ai Fairness, Kathy Wang

Cybersecurity Undergraduate Research Showcase

As artificial intelligence continues to evolve rapidly with emerging innovations, mass-scale digitization could be disrupted due to unfair algorithms with historically biased data. With the rising concerns of algorithmic bias, detecting biases is essential in mitigating and implementing an algorithm that promotes inclusive representation. The spread of ubiquitous artificial intelligence means that improving modeling robustness is at its most crucial point. This paper examines the omnipotence of artificial intelligence and its resulting bias, examples of AI bias in different groups, and a potential framework and mitigation strategies to improve AI fairness and remove AI bias from modeling techniques.

Cyber Threat On The High Seas. A Growing Threat To Infrastructure, James Cummins

Cybersecurity Undergraduate Research Showcase

In a growing digital and cloud-connected world, all aspects of our lives are becoming interconnected. All these interconnections breed a possibility for ever-increasing cybersecurity threats. The oceans are not impervious to these attacks. In this research paper, we address the following questions.

What threats do commercial ships face today?

What actions are necessary to mitigate these threats?

Exploratory Analysis Of Password And Login Security Methods, Sofia Huang

Cybersecurity Undergraduate Research Showcase

In 2022, the average cost of a data breach is $4.35 million. Passwords are the first line of defense against unauthorized access to accounts and important data. Ensuring that accounts are secure is vital to protect personal and corporate information. Although big tech companies are researching ways to implement password-free authentication systems, they will likely not be replaced by new technology all of a sudden. Therefore, methods to strengthen passwords and optimize security must be used until more advanced options are easily accessible. In this paper, common forms of password attacks and various methods of password security evaluation and login …

Examining Trends And Experiences Of The Last Four Years Of Socially Engineered Ransomware Attacks, William Seymour

Cybersecurity Undergraduate Research Showcase

This study examines and reports the trends of social engineering-based ransomware attacks over the past four years from three major technology corporations. The focus of the reports was on major threat actors and their attacks against the corporations and their clients. The data were organized chronologically by year, and prevalent or abnormal findings were shared in this report. It was found that social engineering attacks were tremendously effective. Many ransomware attacks stemmed from Phishing. Social engineering approaches allowed attackers to conduct breaches using ransomware applications like GandCrab and Ryuk. Humans are incredibly susceptible and fall for social engineering tactics- primarily …

Security Issues With Network Connected Scada Systems, Chad Holm

Cybersecurity Undergraduate Research Showcase

The use of Supervisory Control and Data Acquisition (SCADA) systems has become common place and are being used in several different industries. These have evolved as the technology has progressed. The use of Internet of Things (IOT) devices makes for less human intervention to run daily operations in these industries. This can also allow hackers to gain access to these devices due to security holes that are overlooked. There have several different ways that have been exploited on SCADA networks and the goal is to recognize and secure them so hackers cannot gain access to them.