Information Security Commons^™

Distinguishing Between Fe And Ddos Using Randomness Check, Hyundo Park, Peng Li, Debin Gao, Heejo Lee, Robert H. Deng

Research Collection School Of Computing and Information Systems

Threads posed by Distributed Denial of Service (DDoS) attacks are becoming more serious day by day. Accurately detecting DDoS becomes an important and necessary step in securing a computer network. However, Flash Event (FE), which is created by legitimate requests, shares very similar characteristics with DDoS in many aspects and makes it hard to be distinguished from DDoS attacks. In this paper, we propose a simple yet effective mechanism called FDD (FE and DDoS Distinguisher) to distinguish FE and DDoS. To the best of our knowledge, this is the first effective and practical mechanism that distinguishes FE and DDoS attacks. …

An Efficient Pir Construction Using Trusted Hardware, Yanjiang Yang, Xuhua Ding, Robert H. Deng, Feng Bao

Research Collection School Of Computing and Information Systems

For a private information retrieval (PIR) scheme to be deployed in practice, low communication complexity and low computation complexity are two fundamental requirements it must meet. Most existing PIR schemes only focus on the communication complexity. The reduction on the computational complexity did not receive the due treatment mainly because of its O(n) lower bound. By using the trusted hardware based model, we design a novel scheme which breaks this barrier. With constant storage, the computation complexity of our scheme, including offline computation, is linear to the number of queries and is bounded by after optimization.

Multi-Class Classification For Identifying Jpeg Steganography Embedding Methods, Benjamin M. Rodriguez Ii

Theses and Dissertations

Over 725 steganography tools are available over the Internet, each providing a method for covert transmission of secret messages. This research presents four steganalysis advancements that result in an algorithm that identifies the steganalysis tool used to embed a secret message in a JPEG image file. The algorithm includes feature generation, feature preprocessing, multi-class classification and classifier fusion. The first contribution is a new feature generation method which is based on the decomposition of discrete cosine transform (DCT) coefficients used in the JPEG image encoder. The generated features are better suited to identifying discrepancies in each area of the decomposed …

Securing Network Data, Robert E. Holtfreter

All Faculty Scholarship for the College of Business

The purpose of this article is to present the major issues regarding threats to the security of network data, define internal/external intrusion and provide a list of the common methods of detection and significant established intrusion preventive practices for maximizing Internet network data security.

Empirical Analysis Of Certificate Revocation Lists, Daryl Walleck, Yingjiu Li, Shouhuai Xu

Research Collection School Of Computing and Information Systems

Managing public key certificates revocation has long been a central issue in public key infrastructures. Though various certificate revocation mechanisms have been proposed to address this issue, little effort has been devoted to the empirical analysis of real-world certificate revocation data. In this paper, we conduct such an empirical analysis based on a large amount of data collected from VeriSign. Our study enables us to understand how long a revoked certificate lives and what the difference is in the lifetime of revoked certificates by certificate types, geographic locations, and organizations. Our study also provides a solid foundation for future research …

Front Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Back Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Masthead

Journal of Digital Forensics, Security and Law

No abstract provided.

Developing Network Situational Awareness Through Visualization Of Fused Intrusion Detection System Alerts, Serafin A. Avitia V

Theses and Dissertations

With networks increasing in physical size, bandwidth, traffic volume, and malicious activity, network analysts are experiencing greater difficulty in developing network situational awareness. Traditionally, network analysts have used Intrusion Detection Systems to gain awareness but this method is outdated when analysts are unable to process the alerts at the rate they are being generated. Analysts are unwittingly placing the computer assets they are charged to protect at risk when they are unable to detect these network attacks. This research effort examines the theory, application, and results of using visualizations of fused alert data to develop network situational awareness. The fused …

An Analysis Of Botnet Vulnerabilities, Sean W. Hudson

Theses and Dissertations

Botnets are a significant threat to computer networks and data stored on networked computers. The ability to inhibit communication between servers controlling the botnet and individual hosts would be an effective countermeasure. The objective of this research was to find vulnerabilities in Unreal IRCd that could be used to shut down the server. Analysis revealed that Unreal IRCd is a very mature and stable IRC server and no significant vulnerabilities were found. While this research does not eliminate the possibility that a critical vulnerability is present in the Unreal IRCd software, none were identified during this effort.

Traceable And Retrievable Identity-Based Encryption, Man Ho Au, Qiong Huang, Joseph K. Liu, Willy Susilo, Duncan S. Wong, Guomin Yang

Research Collection School Of Computing and Information Systems

Very recently, the concept of Traceable Identity-based Encryption (IBE) scheme (or Accountable Authority Identity based Encryption scheme) was introduced in Crypto 2007. This concept enables some mechanisms to reduce the trust of a private key generator (PKG) in an IBE system. The aim of this paper is threefold. First, we discuss some subtleties in the first traceable IBE scheme in the Crypto 2007 paper. Second, we present an extension to this work by having the PKG’s master secret key retrieved automatically if more than one user secret key are released. This way, the user can produce a concrete proof of …

An Efficient Hardware Implementation Of Target Recognition Algorithms And Investigation Of Secure Wireless Communication For A Modified Manet, Stephen Barnes

Computer Science and Computer Engineering Undergraduate Honors Theses

This paper presents a scheme for effective wireless security of a open broadcast mobile ad-hoc network, MANET, network without significant loss of bandwidth and data integrity through a double tiered encryption scheme, and the feasibility of reducing the target tracking algorithm in [1] into a compact and efficient hardware package. Due to the open nature of MANET, modifications are necessary to secure wireless data in a potential hostile environment. Furthermore, due to power and processing limitations of small unmanned aerial vehicles (UAVs) and the processing intensive calculations of image processing, a sample hardware implementation of key functions of the target …

A Dynamic Trust Management Scheme To Mitigate Malware Proliferation In P2p Networks, Xuhua Ding, Wei Yu, Ying Pan

Research Collection School Of Computing and Information Systems

The surge of peer-to-peer (P2P) networks consisting of thousands of of hosts makes them a breeding ground for malware proliferation. Although some existing studies have shown that malware proliferation can pose significant threats to P2P networks, defending against such an attack is largely an open problem. This paper aims to develop the countermeasure that can effectively mitigate the malware proliferation while preserving P2P networks' performance. To this end, we propose a dynamic trust management scheme based upon localized trust evaluation and alert propagation which prevents innocent peers from downloading files from infected peers. Our analysis and experimental results show that …

The Cyber-Workplace – Identifying Liability Issues In The Information Age And Managing E-Risk, Nigel Wilson

Annual ADFSL Conference on Digital Forensics, Security and Law

The information age provides numerous opportunities for modern society but also presents significant challenges in identifying liability issues and in managing risk. Technological change has occurred rapidly and is continuing at the same time as other major trends and changes are taking place in society and, in particular, in the workplace. The prospect of global liability and the complexity of jurisdictional differences present a considerable hurdle to the uniform regulation of liability issues. General legislation and legal principles have been readily applied to the cyber-world and to modern business practices and the workplace. Where necessary, legislatures have introduced specific legislation …

Data Mining Techniques For Fraud Detection, Rekha Bhowmik

Annual ADFSL Conference on Digital Forensics, Security and Law

The paper presents application of data mining techniques to fraud analysis. We present some classification and prediction data mining techniques which we consider important to handle fraud detection. There exist a number of data mining algorithms and we present statistics-based algorithm, decision tree-based algorithm and rule-based algorithm. We present Bayesian classification model to detect fraud in automobile insurance. Naïve Bayesian visualization is selected to analyze and interpret the classifier predictions. We illustrate how ROC curves can be deployed for model assessment in order to provide a more intuitive analysis of the models.

Keywords: Data Mining, Decision Tree, Bayesian Network, ROC …

Simple - Rethinking The Monolithic Approach To Digital Forensic Software, Craig Valli

Annual ADFSL Conference on Digital Forensics, Security and Law

This paper outlines a collaborative project nearing completion between the sec.au Security Research Group at Edith Cowan University and Western Australian Police Computer Crime Squad. The primary goal of this project is to create a software tool for use by non-technical law enforcement officers during the initial investigation and assessment of an electronic crime scene. This tool will be designed as an initial response tool, to quickly and easily find, view and export any relevant files stored on a computer, establishing if further expert investigation of that computer is warranted. When fully developed, the tool will allow investigators unprecedented real …

How Virtualized Environments Affect Computer Forensics, Diane Barrett

Annual ADFSL Conference on Digital Forensics, Security and Law

Virtualized environments can make forensics investigation more difficult. Technological advances in virtualization tools essentially make removable media a PC that can be carried around in a pocket or around a neck. Running operating systems and applications this way leaves very little trace on the host system. This paper will explore all the newest methods for virtualized environments and the implications they have on the world of forensics. It will begin by describing and differentiating between software and hardware virtualization. It will then move on to explain the various methods used for server and desktop virtualization. Next, it will describe the …

The Virtual Digital Forensics Lab - Expanding Law Enforcement Capabilities, Mark Mccoy, Sean A. Ensz

Annual ADFSL Conference on Digital Forensics, Security and Law

Law enforcement is attempting to respond to the growing and complex need to examine all manner of digital evidence using stand-alone forensic workstations and limited storage solutions. Digital forensic investigators often find their cases stalled by cumbersome and inflexible technology limiting their effectiveness. The Virtual Digital Forensics Lab (VDFL) is a new concept that applies existing enterprise host, storage, and network virtualization technologies to current forensic investigative methods. This paper details the concept of the VDFL, the technology solutions it employs, and the flexibility it provides for digital forensic investigators.

Keywords: Virtual Digital Forensics, digital forensic investigations, law enforcement, virtual …

Digital Forensic Certification Versus Forensic Science Certification, Nena Lim

Annual ADFSL Conference on Digital Forensics, Security and Law

Companies often rely on certifications to select appropriate individuals in disciplines such as accounting and engineering. The general public also tends to have confidence in a professional who has some kinds of certification because certification implies a standard of excellence and that the individual has expert knowledge in a specific discipline. An interesting question to the digital forensic community is: How is a digital forensic certification compared to a forensic science certification? The objective of this paper is to compare the requirements of a digital forensic certification to those of a forensic science certification. Results of the comparison shed lights …

Efficient Optimistic Fair Exchange Secure In The Multi-User Setting And Chosen-Key Model Without Random Oracles, Qiong Huang, Guomin Yang, Duncan S. Wong, Willy Susilo

Research Collection School Of Computing and Information Systems

Optimistic fair exchange is a kind of protocols to solve the problem of fair exchange between two parties. Almost all the previous work on this topic are provably secure only in the random oracle model. In PKC 2007, Dodis et al. considered optimistic fair exchange in a multi-user setting, and showed that the security of an optimistic fair exchange in a single-user setting may no longer be secure in a multi-user setting. Besides, they also proposed one and reviewed several previous construction paradigms and showed that they are secure in the multi-user setting. However, their proofs are either in the …

Back Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Front Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Masthead

Journal of Digital Forensics, Security and Law

No abstract provided.

Using Hierarchical Temporal Memory For Detecting Anomalous Network Activity, Gerod M. Bonhoff

Theses and Dissertations

This thesis explores the nature of cyberspace and forms an argument for it as an intangible world. This research is motivated by the notion of creating intelligently autonomous cybercraft to reside in that environment and maintain domain superiority. Specifically, this paper offers 7 challenges associated with development of intelligent, autonomous cybercraft. The primary focus is an analysis of the claims of a machine learning language called Hierarchical Temporal Memory (HTM). In particular, HTM theory claims to facilitate intelligence in machines via accurate predictions. It further claims to be able to make accurate predictions of unusual worlds, like cyberspace. The research …

What Constitutes An Act Of War In Cyberspace, Kelli S. Kinley

Theses and Dissertations

In December 2005 a new mission statement was released by the Air Force Leadership, "to deliver sovereign options for the defense of the United States of America and its global interests...to fly and fight in Air, Space and Cyberspace." (Wynne & Mosley, 2005) With the stand up of the AFCYBER command and the use of cyberspace to carry out our daily mission the U.S. needs to have a clear understanding of what war in cyberspace looks like and what the laws are governing war in cyberspace. This research and it's resulting data analysis is intended to provide a better understanding …

Comparing Information Assurance Awareness Training For End-Users: A Content Analysis Examination Of Air Force And Defense Information Systems Agency User Training Modules, John W. Frugé

Theses and Dissertations

Today, the threats to information security and assurance are great. While there are many avenues for IT professionals to safeguard against these threats, many times these defenses prove useless against typical system users. Mandated by laws and regulations, all government agencies and most private companies have established information assurance (IA) awareness programs, most of which include user training. Much has been given in the existing literature to laying out the guidance for the roles and responsibilities of IT professionals and higher level managers, but less is specified for "everyday" users of information systems. This thesis attempts to determine the content …

A Delphi Study Assessing Long-Term Access To Electronic Medical Records (Emr), Byron D. Nicholson

Theses and Dissertations

This research effort addressed the issue of long-term access to electronic medical records as technological generations become obsolete, thereby preventing the access to patient health information. Using the Delphi methodology, experts with experience in electronic medical records and applicable systems provided insight based on their years of hands-on experience managing and/or using records and these systems. The end result of this research was a collection of ideas that medical institutions and medical informaticians must consider to ensure that patients and hospitals do not lose long-term access to electronic medical records as electronic medical records and technology continually evolves. Results of …

Suspicion Modeling In Support Of Cyber-Influence Operations/Tactics, Henry G. Paguirigan

Theses and Dissertations

Understanding the cognitive process of IT user suspicion may assist organizations in development of network protection plans, personnel training, and tools necessary to identify and mitigate nefarious intrusions of IT systems. Exploration of a conceptual common ground between psycho-social and technology-related concepts of suspicion are the heart of this investigation. The complexities involved in merging these perspectives led to the overall research question: What is the nature of user suspicion toward IT: The research problem/phenomenon was addressed via extensive literature review, and use of the Interactive Qualitative Analysis problem/phenomenon. Analysis of the system led to the development of a model …

Software Assurance Best Practices For Air Force Weapon And Information Technology Systems - Are We Bleeding?, Ryan A. Maxon

Theses and Dissertations

In the corporate world, "bits mean money," and as the Department of Defense (DoD) becomes more and more reliant on net-centric warfare, bits mean national security. Software security threats are very real, as demonstrated by the constant barrage of Internet viruses, worms, Trojans, and hackers seeking to exploit the latest vulnerability. Most organizations focus their resources on reactive defenses such as firewalls, antivirus software, and encryption, however as demonstrated by the numerous attacks that are successful, those post facto measures are not enough to stop the bleeding. The DoD defines software assurance (SwA) as the "level of confidence that software …

An Examination Into How Group Performance Is Influenced By Various Communication Channels, Jason C. Norgaard

Theses and Dissertations

This purpose of this research was to look at the how group performance is influenced by various communication channels. Specifically, this research sought to determine what communication factors are affected when groups are forced to use different communications channels. The three communications channels tested were face-to-face communications, audio conferencing, and computer-mediated communications through an Internet chat program. Each channel was measured on accuracy, efficiency, and total number of ideas generated. The research found that the groups using computer-mediated communications had a difficult time completing the exercises in the allotted time. Additionally, the computer-mediated produced significantly fewer total words and total …