Information Security Commons^™

Privacy-Preserving Ranked Spatial Keyword Query In Mobile Cloud-Assisted Fog Computing, Qiuyun Tong, Yinbin Li Miao, Ximeng Liu, Robert H. Deng, Robert H. Deng

Research Collection School Of Computing and Information Systems

With the increasing popularity of GPS-equipped mobile devices in cloud-assisted fog computing scenarios, massive spatio-textual data is generated and outsourced to cloud servers for storage and analysis. Existing privacy-preserving range query or ranked keyword search schemes does not support a unified index, and are just applicable for the symmetric environment where all users sharing the same secret key. To solve this issue, we propose a Privacy-preserving Ranked Spatial keyword Query in mobile cloud-assisted Fog computing (PRSQ-F). Specifically, we design a novel comparable product encoding strategy that combines both spatial and textual conditions tightly to retrieve the objects in query range …

Trustworthy Machine Learning Through The Lens Of Privacy And Security, Thi Kim Phung Lai

Dissertations

Nowadays, machine learning (ML) becomes ubiquitous and it is transforming society. However, there are still many incidents caused by ML-based systems when ML is deployed in real-world scenarios. Therefore, to allow wide adoption of ML in the real world, especially in critical applications such as healthcare, finance, etc., it is crucial to develop ML models that are not only accurate but also trustworthy (e.g., explainable, privacy-preserving, secure, and robust). Achieving trustworthy ML with different machine learning paradigms (e.g., deep learning, centralized learning, federated learning, etc.), and application domains (e.g., computer vision, natural language, human study, malware systems, etc.) is challenging, …

What Effects Do Large Language Models Have On Cybersecurity, Josiah Marshall

Cybersecurity Undergraduate Research Showcase

Large Language Models (LLMs) are artificial intelligence (AI) tools that can process, summarize, and translate texts and predict future words in a sentence, letting the LLM generate sentences similar to how humans talk and write. One concern that needs to be flagged is that, often, the content generated by different LLMs is inaccurate. LLMs are trained on code that can be used to detect data breaches, detect ransomware, and even pinpoint organizational vulnerabilities in advance of a cyberattack. LLMs are new but have unbelievable potential with their ability to generate code that brings awareness to cyber analysts and IT professionals. …

Hacker, Influencer, Counter-Culture Spy: Cyberspace Actors’ Models Of Misinformation And Counter-Operations, Benjamin Kessell

College of Computing and Digital Media Dissertations

As misinformation continues to spread on social media, its residents have begun to fight back, independent of any platform. This organic resistance to the diffusion of misinformation is a clearly observable phenomenon with roots in Anonymous’ distributed campaigns from the 2010s outwards. Hacker and information security communities are acting in defense of some of their favorite spaces, most notably, Twitter. Security researchers of all stripes use it for sharing indicators of compromise but, as the diffusion of misinformation becomes more problematic it becomes more difficult to find signals in the noise.

These actors’ response to the issues at hand is …

Human And Technical Factors In The Adoption Of Quantum Cryptographic Algorithms, Alyssa Pinkston

Mathematical Sciences Technical Reports (MSTR)

The purpose of this research is to understand what factors would cause users to choose quantum key distribution (QKD) over other methods of cryptography. An Advanced Encryption Standard (AES) key can be exchanged through communication using the Rivest, Shamir, Adleman (RSA) cryptographic algorithm, QKD, or post-quantum cryptography (PQC). QKD relies on quantum physics where RSA and PQC use complex mathematics to encrypt data. The BB84 quantum cryptographic protocol involves communication over a quantum channel and a public channel. The quantum channel can be technically attacked by beamsplitting or intercept/resend. QKD, like other forms of cryptography, is vulnerable to social attacks …

An Empirical Study Of Pre-Trained Model Reuse In The Hugging Face Deep Learning Model Registry, Wenxin Jiang, Nicholas Synovic, Matt Hyattt, Taylor R. Schorlemmer, Rohan Sethi, Yung-Hisang Lu, George K. Thiruvathukal, James C. Davis

Computer Science: Faculty Publications and Other Works

Deep Neural Networks (DNNs) are being adopted as components in software systems. Creating and specializing DNNs from scratch has grown increasingly difficult as state-of-the-art architectures grow more complex. Following the path of traditional software engineering, machine learning engineers have begun to reuse large-scale pre-trained models (PTMs) and fine-tune these models for downstream tasks. Prior works have studied reuse practices for traditional software packages to guide software engineers towards better package maintenance and dependency management. We lack a similar foundation of knowledge to guide behaviors in pre-trained model ecosystems.

In this work, we present the first empirical investigation of PTM reuse. …

An Analysis And Examination Of Consensus Attacks In Blockchain Networks, Thomas R. Clark

Senior Honors Projects, 2020-current

This paper examines consensus attacks as they relate to blockchain networks. Consensus attacks are a significant threat to the security and integrity of blockchain networks, and understanding these attacks is crucial for developers and stakeholders. The primary contribution of the paper is to present blockchain and consensus attacks in a clear and accessible manner, with the aim of making these complex concepts easily understandable for a general audience. Using literature review, the paper identifies various methods to prevent consensus attacks, including multi-chain networks, proof-of-work consensus algorithms, and network auditing and monitoring. An analysis revealed that these methods for preventing consensus …

An Analysis Of Text-Based Machine Learning Models For Vulnerability Detection, Kollin Ryne Napier

Theses and Dissertations

With an increase in complexity of software, developers rely more on reuse and dependencies in their source code via code snippets. As a result, it is becoming harder to identify and mitigate vulnerabilities. Although traditional analysis tools are still utilized, machine learning models are being adopted to expand efforts and combat such threats. Given the possibilities towards usage of such models, research in this area has introduced various approaches which vary in usability and prediction. In generalizing models to a more natural language approach, researchers have opted to train models on source code to identify existing and potential vulnerabilities. Exploratory …

Making The Transition To Post-Quantum Cryptography, J. Simon Richard

The Downtown Review: An Interdisciplinary Journal Written and Peer-Reviewed by Mandel Honors College Students at Cleveland State University

Without intervention, quantum computing could threaten the security of a large portion of our internet in the near future. However, solutions exist. This paper, which is intended for a general audience, provides a wider context for our current state of quantum-preparedness amid the transition from classical cryptosystems to post-quantum cryptosystems—cryptographic algorithms that can resist the attacks of quantum computers. It will also submit a possible way forward inspired by the actions taken around the globe to prevent the millennium (or Y2K) bug.

Du Undergraduate Showcase: Research, Scholarship, And Creative Works, Caitlyn Aldersea, Justin Bravo, Sam Allen, Anna Block, Connor Block, Emma Buechler, Maria De Los Angeles Bustillos, Arianna Carlson, William Christensen, Olivia Kachulis, Noah Craver, Kate Dillon, Muskan Fatima, Angel Fernandes, Emma Finch, Colleen Cassidy, Amy Fishman, Andrea Francis, Stacia Fritz, Simran Gill, Emma Gries, Rylie Hansen, Shannon Powers, Jacqueline Martinez, Zachary Harker, Ashley Hasty, Mykaela Tanino-Springsteen, Kathleen Hopps, Adelaide Kerenick, Colin Kleckner, Ci Koehring, Elijah Kruger, Braden Krumholz, Maddie Leake, Lyneé Alves, Seraphina Loukas, Yatzari Lozano Vazquez, Haley Maki, Emily Martinez, Sierra Mckinney, Audrey Mitchell, Kipling Newman, Audrey Ng, Megan Lucyshyn, Andrew Nguyen, Stevie Ostman, Casandra Pearson, Alexandra Penney, Julia Gielczynski, Tyler Ball, Anna Rini, Christina Rorres, Simon Ruland, Helayna Schafer, Emma Sellers, Sarah Schuller, Claire Shaver, Kevin Summers, Isabella Shaw, Madison Sinar, Claudia Pena, Apshara Siwakoti, Carter Sorensen, Madi Sousa, Anna Sparling, Alexandra Revier, Brandon Thierry, Dylan Tyree, Maggie Williams, Lauren Wols

DU Undergraduate Research Journal Archive

DU Undergraduate Showcase: Research, Scholarship, and Creative Works

Blockchain Security: Double-Spending Attack And Prevention, William Henry Scott Iii

Electronic Theses and Dissertations

This thesis shows that distributed consensus systems based on proof of work are vulnerable to hashrate-based double-spending attacks due to abuse of majority rule. Through building a private fork of Litecoin and executing a double-spending attack this thesis examines the mechanics and principles behind the attack. This thesis also conducts a survey of preventative measures used to deter double-spending attacks, concluding that a decentralized peer-to-peer network using proof of work is best protected by the addition of an observer system whether internal or external.

Digital Dna: The Ethical Implications Of Big Data As The World’S New-Age Commodity, Clark H. Dotson

Honors Theses

In the emerging digital world that we find ourselves in, it becomes apparent that data collection has become a staple of daily life, whether we like it or not. This research discussion aims to bring light to just how much one’s own digital identity is valued in the technologically-infused world of today, with distinct research and local examples to bring awareness to the ethical implications of your online presence. The paper in question examines anecdotal and research evidence of the collection of data, both through true and unjust means, as well as ethical implications of what this information truly represents. …

What Senior U.S. Leaders Say We Should Know About Cyber, Dr. Joseph H. Schafer

Military Cyber Affairs

On April 6, 2023, the Atlantic Council’s Cyber Statecraft Initiative hosted a panel discussion on the new National Cybersecurity Strategy. The panel featured four senior officials from the Office of the National Cyber Director (ONCD), the Department of State (DoS), the Department of Justice (DoJ), and the Department of Homeland Security (DHS). The author attended and asked each official to identify the most important elements that policymakers and strategists must understand about cyber. This article highlights historical and recent struggles to express cyber policy, the responses from these officials, and the author’s ongoing research to improve national security cyber policy.

Combining Frameworks To Improve Military Health System Quality And Cybersecurity, Dr. Maureen L. Schafer, Dr. Joseph H. Schafer

Military Cyber Affairs

Existing conceptual frameworks and commercially available technology could be considered to rapidly operationalize the use of Quality Measures (QM) within military health systems (Costantino et al. 2020). Purchased healthcare as well as digital healthcare services have paved the way for data collection from multiple information systems thus offering stakeholders actionable intelligence to both guide and measure healthcare outcomes. However, the collection of data secondary to Smart Devices, disparate information systems, cloud services, and the Internet of Medical Things (IOMT) is a complication for security experts that also affect clients, stakeholders, organizations, and businesses delivering patient care. We have combined three …

A Survey And Comparative Study On Vulnerability Scanning Tools, Cassidy Khounborine

Computer Science and Computer Engineering Undergraduate Honors Theses

Vulnerability scanners are a tool used by many organizations and developers as part of their vulnerability management. These scanners aid in the security of applications, databases, networks, etc. There are many different options available for vulnerability scanners that vary in the analysis method they encompass or target for which they scan, among many other features. This thesis explores the different types of scanners available and aims to ease the burden of selecting the ideal vulnerability scanner for one’s needs by conducting a survey and comparative analysis of vulnerability scanners. Before diving into the vulnerability scanners available, background information is provided …

Linux Malware Obfuscation, Brian Roden

Computer Science and Computer Engineering Undergraduate Honors Theses

Many forms of malicious software use techniques and tools that make it harder for their functionality to be parsed, both by antivirus software and reverse-engineering methods. Historically, the vast majority of malware has been written for the Windows operating system due to its large user base. As such, most efforts made for malware detection and analysis have been performed on that platform. However, in recent years, we have seen an increase in malware targeting servers running Linux and other Unix-like operating systems resulting in more emphasis of malware research on these platforms. In this work, several obfuscation techniques for Linux …

Reverse Engineering Post-Quantum Cryptography Schemes To Find Rowhammer Exploits, Sam Lefforge

Computer Science and Computer Engineering Undergraduate Honors Theses

Post-quantum cryptography is a necessary countermeasure to protect against attacks from quantum computer. However, the post-quantum cryptography schemes are potentially vulnerable to side channel attacks. One such method of attacking involves creating bit-flips in victim memory through a process called Rowhammer. These attacks can vary in nature, but can involve rowhammering bits to raise the encryption scheme's decryption failure rate, or modifying the scheme's random seed. With a high enough decryption failure rate, it becomes feasible to generate sufficient information about the secret key to perform a key recovery attack. This thesis proposed two attacks on proposed post-quantum cryptography algorithms, …

Critical Infrastructure Workforce Development Pods For Teaching Cybersecurity Using Netlab+, Gideon Sutterfield

Computer Science and Computer Engineering Undergraduate Honors Theses

As digital automation for Industrial Control Systems has grown, so has its vulnerability to cyberattacks. The world of industry has responded effectively to this, but the world of academia is still lagging as its emphasis is still almost entirely on information technology. Considering this, we created a workforce development pod that serves as a hands-on learning module for teaching students key cybersecurity ideas surrounding operational technology using the NETLAB+ platform. A pod serves as the virtual environment where the learning exercise takes place. This project’s implementation involved the creation of a segmented network within the pod where a student starts …

Rbac Attack Exposure Auditor. Tracking User Risk Exposure Per Role-Based Access Control Permissions, Adelaide Damrau

Undergraduate Honors Theses

Access control models and implementation guidelines for determining, provisioning, and de-provisioning user permissions are challenging due to the differing approaches, unique for each organization, the lack of information provided by case studies concerning the organization’s security policies, and no standard means of implementation procedures or best practices. Although there are multiple access control models, one stands out, role-based access control (RBAC). RBAC simplifies maintenance by enabling administrators to group users with similar permissions. This approach to managing user permissions supports the principle of least privilege and separation of duties, which are needed to ensure an organization maintains acceptable user access …

Low-Complexity Three-Dimensional Aoa-Cross Geometric Center Localization Methods Via Multi-Uav Network, Baihua Shi, Yifan Li, Guilu Wu, Riqing Chen, Shihao Yan, Feng Shu

Research outputs 2022 to 2026

The angle of arrival (AOA) is widely used to locate a wireless signal emitter in unmanned aerial vehicle (UAV) localization. Compared with received signal strength (RSS) and time of arrival (TOA), AOA has higher accuracy and is not sensitive to the time synchronization of the distributed sensors. However, there are few works focusing on three-dimensional (3-D) scenarios. Furthermore, although the maximum likelihood estimator (MLE) has a relatively high performance, its computational complexity is ultra-high. Therefore, it is hard to employ it in practical applications. This paper proposed two center of inscribed sphere-based methods for 3-D AOA positioning via multiple UAVs. …

Trace Dna Detection Using Diamond Dye: A Recovery Technique To Yield More Dna, Leah Davis

Master's Theses

This study aspires to find a new screening approach to trace DNA recovery techniques to yield a higher quantity of trace DNA from larger items of evidence. It takes the path of visualizing trace DNA on items of evidence with potential DNA so analysts can swab a more localized area rather than attempting to recover trace DNA through the general swabbing technique currently used for trace DNA recovery. The first and second parts consisted of observing trace DNA interaction with Diamond Dye on porous and non-porous surfaces.

The third part involved applying the Diamond Dye solution by spraying it onto …

An Application Risk Assessment Of Werner Enterprises, Nathan Andres

Theses/Capstones/Creative Projects

Risk assessments provide a systematic approach to identifying potential risks that could negatively impact an organization’s operations, financial performance, and reputation. Using a risk assessment, companies can evaluate potential risks and vulnerabilities, prioritize them based on their potential impact, and develop strategies to manage and address these risks effectively.

Werner Enterprises Inc. is a nationally known trucking company headquartered in Omaha, Nebraska. Our cybersecurity capstone project motivation was to partner with Werner to produce an assessment of known application risks in a functional way that can be repeated for all of Werner’s applications. To achieve this, we created a risk …

Towards Privacy-Preserving Social Media Networks: Protecting The Facial Privacy Of Images Uploaded On Social Media, Ahsi Lo

Theses and Dissertations

Since the 2000s, social media has allowed individuals the ability to communicate online. As the popularity of social media increased, the sharing of information such as pictures increased as well. Recently, there have been privacy concerns about the information shared online such as cases where third parties were able to gain access to users’ information without being given explicit access through scraping or other means. When user images are scraped from social media, there is a risk that these individuals can be identified o✏ine. Bystanders, who may be captured in images also run this risk of identification. This research investigates …

Iot Health Devices: Exploring Security Risks In The Connected Landscape, Abasi-Amefon Obot Affia, Hilary Finch, Woosub Jung, Issah Abubakari Samori, Lucas Potter, Xavier-Lewis Palmer

School of Cybersecurity Faculty Publications

The concept of the Internet of Things (IoT) spans decades, and the same can be said for its inclusion in healthcare. The IoT is an attractive target in medicine; it offers considerable potential in expanding care. However, the application of the IoT in healthcare is fraught with an array of challenges, and also, through it, numerous vulnerabilities that translate to wider attack surfaces and deeper degrees of damage possible to both consumers and their confidence within health systems, as a result of patient-specific data being available to access. Further, when IoT health devices (IoTHDs) are developed, a diverse range of …

Design, Modeling, And Simulation Of Secure X.509 Certificate Revocation, Sai Medury

Masters Theses and Doctoral Dissertations

TLS communication over the internet has risen rapidly in the last seven years (2015--2022), and there were over 156M active SSL certificates in 2022. The state-of-the-art Public Key Infrastructure (PKI), encompassing protocols, computational resources, and digital certificates, has evolved for 24 years to become the de-facto choice for encrypted communication over the Internet even on newer platforms such as mobile devices and Internet-of-Things (IoT) (despite being low powered with computational constraints). However, certificate revocation is one sub-protocol in TLS communication that fails to meet the rising scalability demands and remains open to exploitation. In this dissertation, the standard for X.509 …

The Effect Of Cybersecurity Training On Government Employee’S Knowledge Of Cybersecurity Issues And Practices, Juan Jaime Saldana Ii

Theses and Dissertations

There is an ever-pressing need for cybersecurity awareness and implementation of learning strategies in the workplace to mitigate the increased threat posed by cyber-attacks and exacerbated by an untrained workforce. The lack of cybersecurity knowledge amongst government employees has increased to critical levels due to the amount of sensitive information their agencies are responsible for. The digital compromise of a government entity often leads to a compromise of constituent data along with the disruption of public services (Axelrod, 2019; Yazdanpanahi, 2021). The need for awareness is further complicated by agencies looking to cater to a digital culture looking for a …

Rattus Norvegicus As A Biological Detector Of Clandestine Remains And The Use Of Ultrasonic Vocalizations As A Locating Mechanism, Gabrielle M. Johnston

Master's Theses

In investigations, locating missing persons and clandestine remains are imperative. One way that first responder and police agencies can search for the remains is by using cadaver dogs as biological detectors. Cadaver dogs are typically used due to their olfactory sensitivity and ability to detect low concentrations of volatile organic compounds produced by biological remains. Cadaver dogs are typically chosen for their stamina, agility, and olfactory sensitivity. However, what is not taken into account often is the size of the animal and the expense of maintaining and training the animal. Cadaver dogs are typically large breeds that cannot fit in …

Gaslight: Attacking Hard-Label Black-Box Classifiers Via Deep Reinforcement Learning, Rajat Sethi

All Theses

Through artificial intelligence, algorithms can classify arrays of data, such as images or videos, into a predefined set of categories. With enough labeled data, a classifier can analyze an input’s components and calculate confidence scores for each category. However, machine learning relies heavily on approximation, which allows attackers to exploit classifiers by providing adversarial
examples. Specifically, attackers can modify their input so that the victim classifier cannot correctly label it, while a human observer would be unable to notice the difference.
This thesis proposes Gaslight, a system that uses deep reinforcement learning to generate adversarial examples against a victim classifier. …

Individual Differences In Vulnerability To Phishing, Fake News, And Vishing, Jeff Black

All Theses

Digital deception, such as phishing emails, scam phone calls, and fake news, poses a threat to anyone using digital devices. Research on digital deception often points to individual differences like age, cognitive impulsivity, and digital literacy, but has only investigated different types of digital deception independent of each other. Therefore, it is unclear whether users vulnerable to one type of deception are also vulnerable to others, and why. The present research examined relationships between vulnerability to different types of deception, and how this vulnerability is associated with common individual differences like age, cognitive impulsivity, digital literacy, and gullibility, and exploratory …

Graphprompt: Unifying Pre-Training And Downstream Tasks For Graph Neural Networks, Zemin Liu, Xingtong Yu, Yuan Fang, Xinming Zhang

Research Collection School Of Computing and Information Systems

Graphs can model complex relationships between objects, enabling a myriad of Web applications such as online page/article classification and social recommendation. While graph neural networks (GNNs) have emerged as a powerful tool for graph representation learning, in an end-to-end supervised setting, their performance heavily relies on a large amount of task-specific supervision. To reduce labeling requirement, the "pre-train, fine-tune"and "pre-train, prompt"paradigms have become increasingly common. In particular, prompting is a popular alternative to fine-tuning in natural language processing, which is designed to narrow the gap between pre-training and downstream objectives in a task-specific manner. However, existing study of prompting on …