Information Security Commons^™

Legislative Requirements For Cyber Peacekeeping, Nikolay Akatyev, Joshua I. James

Journal of Digital Forensics, Security and Law

Cyber Peacekeeping strives for the prevention, mitigation and cessation of cyber and physical conflicts. The creation of a Cyber Peacekeeping organization, however, has major legal and political implications. In this work we review current international legislation applicable for functions of Cyber Peacekeeping. Specifically, we analyze prominent works which contribute to definitions, law and ethics regulating cyber conflicts from the perspective of the creation of a CPK organization. Legislative and terminological foundations are analyzed and adopted from current practice. Further, this work analyzes guiding principles of global organizations such as ITU IMPACT, INTERPOL and regional organizations such as NATO and the …

The Use Of Information Technologies To Combat Counterfeit Alcohol Products And Ensure The Right To Life In Russia, Pavel Syosoevich Pastukhov, Svetlana Polyakova, Evelina Frolovich

Journal of Digital Forensics, Security and Law

The paper is aimed to analyze implementation of an integrated information system that provides forecasting, monitoring, prevention and elimination of possible threats, such as violation of information support of public authorities, businesses and municipal services and others as well as control of elimination of consequences of emergency situations and offenses with integration under its control action information and control duty subsystems, control, municipal services for their operational cooperation in the interests of of the municipality. In particular, it consideres how this unified system is applied in accounting of production volume and turnover of ethyl alcohol, alcoholic and alcohol-containing products (USAIS) …

Security And The Transnational Information Polity, Michael M. Losavio, Adel Said Elmaghraby

Journal of Digital Forensics, Security and Law

Global information and communications technologies create criminal opportunities in which criminal violation and physical proximity are decoupled. As in all our endeavors, the good become the prey of the bad. Murderous and venal exploitation of ICT has followed from the inception of the Internet, threatening all the good it brings and the trust we need so badly as a people. As the work continues to expand the implementation of Smart Cities and the Internet of Things, there will be more opportunities for exploitation of these technologies. We examine the social and liberty risks our data and technology-driven responses may entail.

Vurle: Automatic Vulnerability Detection And Repair By Learning From Examples, Ma Siqi, Ferdian Thung, David Lo, Cong Sun, Robert H. Deng

Research Collection School Of Computing and Information Systems

Vulnerability becomes a major threat to the security of many systems. Attackers can steal private information and perform harmful actions by exploiting unpatched vulnerabilities. Vulnerabilities often remain undetected for a long time as they may not affect typical systems’ functionalities. Furthermore, it is often difficult for a developer to fix a vulnerability correctly if he/she is not a security expert. To assist developers to deal with multiple types of vulnerabilities, we propose a new tool, called VuRLE, for automatic detection and repair of vulnerabilities. VuRLE (1) learns transformative edits and their contexts (i.e., code characterizing edit locations) from examples of …

Vcksm: Verifiable Conjunctive Keyword Search Over Mobile E-Health Cloud In Shared Multi-Owner Settings, Yinbin Miao, Jianfeng Ma, Ximeng Liu, Qi Jiang, Junwei Zhang, Limin Shen, Zhiquan Liu

Research Collection School Of Computing and Information Systems

Searchable encryption (SE) is a promising technique which enables cloud users to conduct search over encrypted cloud data in a privacy-preserving way, especially for the electronic health record (EHR) system that contains plenty of medical history, diagnosis, radiology images, etc. In this paper, we focus on a more practical scenario, also named as the shared multi-owner settings, where each e-health record is co-owned by a fixed number of parties. Although the existing SE schemes under the unshared multi-owner settings can be adapted to this shared scenario, these schemes have to build multiple indexes,which definitely incur higher computational overhead. To save …

Evopass: Evolvable Graphical Password Against Shoulder-Surfing Attacks, Xingjie Yu, Zhan Wang, Yingjiu Li, Liang Li, Wen Tao Zhu, Li Song

Research Collection School Of Computing and Information Systems

The passwords for authenticating users are susceptible to shoulder-surfing attacks in which attackers learn users' passwords through direct observations without any technical support. A straightforward solution to defend against such attacks is to change passwords periodically or even constantly, making the previously observed passwords useless. However, this may lead to a situation in which users run out of strong passwords they can remember, or they are forced to choose passwords that are weak, correlated, or difficult to memorize. To achieve both security and usability in user authentication, we propose EvoPass, the first evolvable graphical password authentication system. EvoPass transforms a …

Stylizing Face Images Via Multiple Exemplars, Yibing Song, Linchao Bao, Shengfeng He, Qingxiong Yang, Ming-Hsuan Yang

Research Collection School Of Computing and Information Systems

We address the problem of transferring the style of a headshot photo to face images. Existing methods using a single exemplar lead to inaccurate results when the exemplar does not contain sufficient stylized facial components for a given photo. In this work, we propose an algorithm to stylize face images using multiple exemplars containing different subjects in the same style. Patch correspondences between an input photo and multiple exemplars are established using a Markov Random Field (MRF), which enables accurate local energy transfer via Laplacian stacks. As image patches from multiple exemplars are used, the boundaries of facial components on …

Ind-Pca Secure Kem Is Enough For Password-Based Authenticated Key Exchange (Short Paper), Haiyang Xue, Bao Li, Xianhui Lu

Research Collection School Of Computing and Information Systems

There are several frameworks for password-based authenticated key exchange (PAKE) protocols with common reference string following the work of Katz, Ostrovsky and Yung (Eurocrypt’01), and it seems that the IND-CCA secure encryption is inevitable when constructing PAKE in standard model.In this paper, we show that IND-PCA secure key encapsulation mechanism (KEM) is enough for PAKE, which is weaker and easier to be constructed than IND-CCA secure encryption. Our refined PAKE consists of a smooth projective hash function on IND-CPA secure encryption and an IND-PCA secure KEM. Based on DDH assumption, the total communication of PAKE consists of 6 group elements …

Genomic Security (Lest We Forget), Tatiana Bradley, Xuhua Ding, Gene Tsudik

Research Collection School Of Computing and Information Systems

Genomic privacy has attracted much attention from the research community, because its risks are unique and breaches can lead to terrifying leakage of sensitive information. The less-explored topic of genomic security must address threats of digitized genomes being altered, which can have dire consequences in medical or legal settings.

Personal Data Protection Act 2012: Understanding The Consent Obligation, Man Yip

Research Collection Yong Pung How School Of Law

The Personal Data Protection Act 20121 (“PDPA”) provides the baseline standards of protection of personal data and works in tandem with existing law to provide comprehensive protection. The birth of the legislation clearly signals Singapore’s commitment to protect the collection, use and disclosure of personal data in the age of big data and its awareness of the importance of such protection in strengthening Singapore’s position as a leading commercial hub. Significantly, the PDPA protection model balances “both the rights of individuals to protect their personal data” against “the needs of organisations to collect, use or disclose personal data for legitimate …

Ua8 It Security Bulletin, Wku Information Technology

WKU Administration Documents

WKU Information Technology security bulletin issued to faculty & staff via email.

• Ciampa, Mark. Ransomware
• Securing the Human
• New to WKU?
• Phone Scams
• Phishing
• SMiShing
• Handling Sensitive Data
• University Policy

Forensic State Acquisition From Internet Of Things (Fsaiot): A General Framework And Practical Approach For Iot Forensics Through Iot Device State Acquisition, Christopher S. Meffert, Devon R. Clark, Ibrahim Baggili, Frank Breitinger

Electrical & Computer Engineering and Computer Science Faculty Publications

IoT device forensics is a difficult problem given that manufactured IoT devices are not standardized, many store little to no historical data, and are always connected; making them extremely volatile. The goal of this paper was to address these challenges by presenting a primary account for a general framework and practical approach we term Forensic State Acquisition from Internet of Things (FSAIoT). We argue that by leveraging the acquisition of the state of IoT devices (e.g. if an IoT lock is open or locked), it becomes possible to paint a clear picture of events that have occurred. To this end, …

Enhancing Security Incident Response Follow-Up Efforts With Lightweight Agile Retrospectives, George Grispos, William Bradley Glisson, Tim Storer

Interdisciplinary Informatics Faculty Publications

Security incidents detected by organizations are escalating in both scale and complexity. As a result, security incident response has become a critical mechanism for organizations in an effort to minimize the damage from security incidents. The final phase within many security incident response approaches is the feedback/follow-up phase. It is within this phase that an organization is expected to use information collected during an investigation in order to learn from an incident, improve its security incident response process and positively impact the wider security environment. However, recent research and security incident reports argue that organizations find it difficult to learn …

A Longitudinal Study Of Privacy Awareness In The Digital Age And The Influence Of Knowledge, Therese L. Williams

Theses and Dissertations

Privacy, in the modern connected world, has become a much discussed topic in society ranging from privacy concerns to impacts, attitudes, practices and technologies. In today’s environment of vast social media and revelations of government spying, personal privacy is being highlighted as either non-existent or something that can be achieved to different degrees with knowledge or awareness of how our private information is collected and used. This research strives to answer the question "Using Alan Westin's privacy categories, what is the general awareness of privacy issues in social media and smartphone usage and how does it change when knowledge is …

Information Theoretic Study Of Gaussian Graphical Models And Their Applications, Ali Moharrer

LSU Doctoral Dissertations

In many problems we are dealing with characterizing a behavior of a complex stochastic system or its response to a set of particular inputs. Such problems span over several topics such as machine learning, complex networks, e.g., social or communication networks; biology, etc. Probabilistic graphical models (PGMs) are powerful tools that offer a compact modeling of complex systems. They are designed to capture the random behavior, i.e., the joint distribution of the system to the best possible accuracy. Our goal is to study certain algebraic and topological properties of a special class of graphical models, known as Gaussian graphs. First, …

Lightweight Environment For Cyber Security Education, Vivek Oliparambil Shanmughan

LSU New Orleans Theses and Dissertations

The use of physical systems and Virtual Machines has become inefficient and expensive for creating tailored, hands-on exercises for providing cyber security training. The main purpose of this project is to directly address these issues faced in cyber security education with the help of Docker containers. Using Docker, a lightweight and automated platform was developed for creating, sharing, and managing hands-on exercises. With the help of orchestration tools, this platform provides a centralized point to monitor and control the systems and exercises with a high degree of automation. In a classroom/lab environment, this infrastructure enables instructors and students not only …

Forensic Analysis Of G Suite Collaborative Protocols, Shane Mcculley

LSU New Orleans Theses and Dissertations

Widespread adoption of cloud services is fundamentally changing the way IT services are delivered and how data is stored. Current forensic tools and techniques have been slow to adapt to new challenges and demands of collecting and analyzing cloud artifacts. Traditional methods focusing only on client data collection are incomplete, as the client may have only a (partial) snapshot and misses cloud-native artifacts that may contain valuable historical information.

In this work, we demonstrate the importance of recovering and analyzing cloud-native artifacts using G Suite as a case study. We develop a tool that extracts and processes the history of …

Automatic Forensic Analysis Of Pccc Network Traffic Log, Saranyan Senthivel

LSU New Orleans Theses and Dissertations

Most SCADA devices have a few built-in self-defence mechanisms and tend to implicitly trust communications received over the network. Therefore, monitoring and forensic analysis of network traffic is a critical prerequisite for building an effective defense around SCADA units. In this thesis work, We provide a comprehensive forensic analysis of network traffic generated by the PCCC(Programmable Controller Communication Commands) protocol and present a prototype tool capable of extracting both updates to programmable logic and crucial configuration information. The results of our analysis shows that more than 30 files are transferred to/from the PLC when downloading/uplloading a ladder logic program using …

Ancr—An Adaptive Network Coding Routing Scheme For Wsns With Different-Success-Rate Links †, Xiang Ji, Anwen Wang, Chunyu Li, Chun Ma, Yao Peng, Dajin Wang, Qingyi Hua, Feng Chen, Dingyi Fang

Department of Computer Science Faculty Scholarship and Creative Works

As the underlying infrastructure of the Internet of Things (IoT), wireless sensor networks (WSNs) have been widely used in many applications. Network coding is a technique in WSNs to combine multiple channels of data in one transmission, wherever possible, to save node’s energy as well as increase the network throughput. So far most works on network coding are based on two assumptions to determine coding opportunities: (1) All the links in the network have the same transmission success rate; (2) Each link is bidirectional, and has the same transmission success rate on both ways. However, these assumptions may not be …

Anomalydetection: Implementation Of Augmented Network Log Anomaly Detection Procedures, Robert J. Gutierrez, Bradley C. Boehmke, Kenneth W. Bauer, Cade M. Saie, Trevor J. Bihl

Faculty Publications

As the number of cyber-attacks continues to grow on a daily basis, so does the delay in threat detection. For instance, in 2015, the Office of Personnel Management discovered that approximately 21.5 million individual records of Federal employees and contractors had been stolen. On average, the time between an attack and its discovery is more than 200 days. In the case of the OPM breach, the attack had been going on for almost a year. Currently, cyber analysts inspect numerous potential incidents on a daily basis, but have neither the time nor the resources available to perform such a task. …

A Feature-Based Structural Measure: An Image Similarity Measure For Face Recognition, Noor A. Shnain, Zahir Hussain, Song F. Lu

Research outputs 2014 to 2021

Facial recognition is one of the most challenging and interesting problems within the field of computer vision and pattern recognition. During the last few years, it has gained special attention due to its importance in relation to current issues such as security, surveillance systems and forensics analysis. Despite this high level of attention to facial recognition, the success is still limited by certain conditions; there is no method which gives reliable results in all situations. In this paper, we propose an efficient similarity index that resolves the shortcomings of the existing measures of feature and structural similarity. This measure, called …

Breaking Into The Vault: Privacy, Security And Forensic Analysis Of Android Vault Applications, Xiaolu Zhang, Ibrahim Baggili, Frank Breitinger

Electrical & Computer Engineering and Computer Science Faculty Publications

In this work we share the first account for the forensic analysis, security and privacy of Android vault applications. Vaults are designed to be privacy enhancing as they allow users to hide personal data but may also be misused to hide incriminating files. Our work has already helped law enforcement in the state of Connecticut to reconstruct 66 incriminating images and 18 videos in a single criminal case. We present case studies and results from analyzing 18 Android vault applications (accounting for nearly 220 million downloads from the Google Play store) by reverse engineering them and examining the forensic artifacts …

Marketing Strategy Of School Of Professional Studies In China, Jiahui Liu, Jing Wang, Shuo An, Wengxing Wang, Yiwei Wang

School of Professional Studies

Chinese students are the most visible international presence at many universities across the United States, and the number continues to grow. Since 2010, The number of graduate students studying abroad has entered the period in which the increase has been declining. Under the circumstance of the weak global economy and high cost of education, the administration needs to attract the attention of Chinese students. In the process of competing for applicants, how to develop marketing strategies to attract students’ eyeballs has become an important means of trying to increase school income through Chinese students. The marketing strategy mentioned in this …

Cybersecurity In An Age Of Cyberterrorism, University Of South Alabama

Crime/Violence

Bibliography and photographs of a display of government documents from the University of South Alabama.

Designing Secure Access Control Model In Cyber Social Networks, Katanosh Morovat

Graduate Theses and Dissertations

Nowadays, information security in online communication has become an indisputable topic. People prefer pursuing their connection and public relations due to the greater flexibility and affordability of online communication. Recently, organizations have established online networking sites concerned with sharing assets among their employees. As more people engage in social network, requirements for protecting information and resources becomes vital. Over the years, many access control methods have been proposed. Although these methods cover various information security aspects, they have not provided an appropriate approach for securing information within distributed online networking sites. Moreover, none of the previous research provides an access …

Dynamic Adversarial Mining - Effectively Applying Machine Learning In Adversarial Non-Stationary Environments., Tegjyot Singh Sethi

Electronic Theses and Dissertations

While understanding of machine learning and data mining is still in its budding stages, the engineering applications of the same has found immense acceptance and success. Cybersecurity applications such as intrusion detection systems, spam filtering, and CAPTCHA authentication, have all begun adopting machine learning as a viable technique to deal with large scale adversarial activity. However, the naive usage of machine learning in an adversarial setting is prone to reverse engineering and evasion attacks, as most of these techniques were designed primarily for a static setting. The security domain is a dynamic landscape, with an ongoing never ending arms race …

Efficiently Representing The Integer Factorization Problem Using Binary Decision Diagrams, David Skidmore

All Graduate Plan B and other Reports, Spring 1920 to Spring 2023

Let p be a prime positive integer and let α be a positive integer greater than 1. A method is given to reduce the problem of finding a nontrivial factorization of α to the problem of finding a solution to a system of modulo p polynomial congruences where each variable in the system is constrained to the set {0,...,p − 1}. In the case that p = 2 it is shown that each polynomial in the system can be represented by an ordered binary decision diagram with size less than 20.25log₂(α)³ + 16.5log₂(α)² + …

Hibs-Ksharing: Hierarchical Identity-Based Signature Key Sharing For Automotive, Zhuo Wei, Yanjiang Yang, Yongdong Wu, Jian Weng, Robert H. Deng

Research Collection School Of Computing and Information Systems

Equipped with various sensors and intelligent systems, modern cars turn into entities with connectivity, autonomy, and safety. Car rental/car sharing is an innovative transportation concept and integral in today's urban living. It enables users to access a fleet of vehicles located throughout cities. Complementing public transportation, the car-sharing service helps people to meet their transportation needs economically and in an environmentally responsible manner. When a customer wants to rent a car from a rental company or an owner wants to share a private car with his/her friends or family members, the customer or the user should gain admission to the …

Enforcing Database Security On Cloud Using A Trusted Third Party Based Model, Victor Fuentes Tello

Graduate Theses and Dissertations

Cloud computing offers a considerable number of advantages to clients and organizations that use several capabilities to store sensitive data, interact with applications, or use technology infrastructure to perform daily activities. The development of new models in cloud computing brings with it a series of elements that must be considered by companies, particularly when the sensitive data needs to be protected. There are some concerns related to security that need to be taken into consideration when a service provider manage and store the data in a location outside the company. In this research, a model that uses a trusted third …

Sequence Aware Functional Encryption And Its Application In Searchable Encryption, Tran Viet Xuan Phuong, Guomin Yang, Willy Susilo, Fuchun Guo, Qiong Huang

Research Collection School Of Computing and Information Systems

As a new broad vision of public-key encryption systems, functional encryption provides a promising solution for many challenging security problems such as expressive access control and searching on encrypted data. In this paper, we present two Sequence Aware Function Encryption (SAFE) schemes. Such a scheme is very useful in many forensics applications where the order (or pattern) of the attributes forms an important characteristic of an attribute sequence. Our first scheme supports the matching of two bit strings, while the second scheme can support the matching of general characters. These two schemes are constructed based on the standard Decision Linear …