Information Security Commons^™

Evaluating Staff Attitudes, Intentions, And Behaviors Related To Cyber Security In Large Australian Health Care Environments: Mixed Methods Study, Martin Dart, Mohiuddin Ahmed

Research outputs 2022 to 2026

Background: Previous studies have identified that the effective management of cyber security in large health care environments is likely to be significantly impacted by human and social factors, as well as by technical controls. However, there have been limited attempts to confirm this by using measured and integrated studies to identify specific user motivations and behaviors that can be managed to achieve improved outcomes.

Objective: This study aims to document and analyze survey and interview data from a diverse range of health care staff members, to determine the primary motivations and behaviors that influence their acceptance and application of cyber …

The Wacdt, A Modern Vigilance Task For Network Defense, Oliver A. Guidetti, Craig Speelman, Peter Bouhlas

Research outputs 2022 to 2026

Vigilance decrement refers to a psychophysiological decline in the capacity to sustain attention to monotonous tasks after prolonged periods. A plethora of experimental tasks exist for researchers to study vigilance decrement in classic domains such as driving and air traffic control and baggage security; however, the only cyber vigilance tasks reported in the research literature exist in the possession of the United States Air Force (USAF). Moreover, existent cyber vigilance tasks have not kept up with advances in real-world cyber security and consequently no longer accurately reflect the cognitive load associated with modern network defense. The Western Australian Cyber Defense …

Insecure Deserialization Detection In Python, Aneesh Verma

Master's Projects

The importance of Cyber Security is increasing every single day. From the emergence of new ransomware to major data breaches, the online world is getting dangerous. A multinational non- profit group devoted to online application security is called OWASP, or the Open Web Application Security Project. The OWASP Top 10 is a frequently updated report that highlights the ten most important vulnerabilities to web application security. Among these 10 vulnerabilities, there exists a vulnerability called Software and Data Integrity Failures. A subset of this vulnerability is Insecure Deserialization. An object is transformed into a stream of bytes through the serialization …

Light Auditor: Power Measurement Can Tell Private Data Leakage Through Iot Covert Channels, Woosub Jung, Kailai Cui, Kenneth Koltermann, Junjie Wang, Chunsheng Xin, Gang Zhou

Electrical & Computer Engineering Faculty Publications

Despite many conveniences of using IoT devices, they have suffered from various attacks due to their weak security. Besides well-known botnet attacks, IoT devices are vulnerable to recent covert-channel attacks. However, no study to date has considered these IoT covert-channel attacks. Among these attacks, researchers have demonstrated exfiltrating users' private data by exploiting the smart bulb's capability of infrared emission.

In this paper, we propose a power-auditing-based system that defends the data exfiltration attack on the smart bulb as a case study. We first implement this infrared-based attack in a lab environment. With a newly-collected power consumption dataset, we pre-process …

A Survey Of Using Machine Learning In Iot Security And The Challenges Faced By Researchers, Khawlah M. Harahsheh, Chung-Hao Chen

Electrical & Computer Engineering Faculty Publications

The Internet of Things (IoT) has become more popular in the last 15 years as it has significantly improved and gained control in multiple fields. We are nowadays surrounded by billions of IoT devices that directly integrate with our lives, some of them are at the center of our homes, and others control sensitive data such as military fields, healthcare, and datacenters, among others. This popularity makes factories and companies compete to produce and develop many types of those devices without caring about how secure they are. On the other hand, IoT is considered a good insecure environment for cyber …

A Review Of Iot Security And Privacy Using Decentralized Blockchain Techniques, Vinay Gugueoth, Sunitha Safavat, Sachin Shetty, Danda Rawat

Electrical & Computer Engineering Faculty Publications

IoT security is one of the prominent issues that has gained significant attention among the researchers in recent times. The recent advancements in IoT introduces various critical security issues and increases the risk of privacy leakage of IoT data. Implementation of Blockchain can be a potential solution for the security issues in IoT. This review deeply investigates the security threats and issues in IoT which deteriorates the effectiveness of IoT systems. This paper presents a perceptible description of the security threats, Blockchain based solutions, security characteristics and challenges introduced during the integration of Blockchain with IoT. An analysis of different …

Social-Engineering, Bio-Economies, And Nation-State Ontological Security: A Commentary, Brandon Griffin, Keitavius Alexander, Xavier-Lewis Palmer, Lucas Potter

Electrical & Computer Engineering Faculty Publications

Biocybersecurity is an evolving discipline that aims to identify the gaps and risks associated with the convergence of Biology (the science of life and living organisms) and cybersecurity (the science, study, and theory of cyberspace and cybernetics) to protect the bioeconomy. The biological industries’ increased reliance on digitization, automation, and computing power has resulted in benefits for the scientific community, it has simultaneously multiplied the risk factors associated with industrial espionage and the protection of data both commercial and proprietary. The sensitive and potentially destructive power of this data and its access inherently poses a risk to the national and …

Implications Of Cyberbiosecurity In Advanced Agriculture, Simone Stephen, Keitavius Alexander, Lucas Potter, Xavier-Lewis Palmer

Electrical & Computer Engineering Faculty Publications

The world is currently undergoing a rapid digital transformation sometimes referred to as the fourth industrial revolution. During this transformation, it is increasingly clear that many scientific fields are not prepared for this change. One specific area is agriculture. As the sector which creates global food supply, this critical infrastructure requires detailed assessment and research via newly developed technologies (Millett et al, 2019; Peccoud et al, 2018) . Despite its fundamental significance to modern civilization, many aspects of industrial agriculture have not yet adapted to the digital world. This is evident in the many vulnerabilities currently present within agricultural systems, …

A Reflection Of Typology And Verification Flaws In Consideration Of Biocybersecurity/Cyberbiosecurity: Just Another Gap In The Wall, Luke Potter, Kim Mossberg, Xavier Palmer

Electrical & Computer Engineering Faculty Publications

Verification is central to any process in a functional and enduring cyber-secure organization. This verification is how the validity or accuracy of a state of being is assessed (Schlick, 1936; Balci, 1998). Conversely, breakdown in verification procedures is core to the interruption of normal operations for an organization. A key problem for organizations that utilize biology as an interlock within their systems is that personnel lack sufficient ability to verify all practically relevant biological information for procedures such as a nurse logging a blood draw, or a molecular biology technician preparing agar to culture microbes for study. This has several …

Mitigation Of Cache Attacks On Cloud Services, Mudassiruddin Mohammed

All Student Theses and Dissertations

Cloud computing is frequently used due to its low cost and flexibility, but it also raises security issues to cloud service providers and customers. Cache attacks are a critical security risk in cloud computing. Cache attacks use weaknesses in cloud servers' cache memory to steal sensitive information, interrupt services, and decrease cloud performance. This study examines the many forms of cache attacks, their possible effects, and known mitigation measures. The study approach includes a review of current methods and their effectiveness in combating cache attack. The report also suggests future research topics for developing more effective and economical methods for …

Seqadver: Automatic Payload Construction And Injection In Sequence-Based Android Adversarial Attack, Fei Zhang, Ruitao Feng, Xiaofei Xie, Xiaohong Li, Lianshuan Shi

Research Collection School Of Computing and Information Systems

Machine learning has achieved a great success in the field of Android malware detection. In order to avoid being caught by these ML-based Android malware detection, malware authors are inclined to initiate adversarial sample attacks by tampering with mobile applications. Although machine learning has high capability, it lacks robustness against adversarial attacks. Currently, many of the adversarial attacking tools not only inject dead code into target applications, which can never be executed, but also require the injection of many benign features into a malicious APK. This can be easily noticeable by program analysis techniques. In this paper, we propose SeqAdver, …

Dial "N" For Nxdomain: The Scale, Origin, And Security Implications Of Dns Queries To Non-Existent Domains, Gunnan Liu, Lin Jin, Shuai Hao, Yubao Zhang, Daiping Liu, Angelos Stavrou, Haining Wang

Computer Science Faculty Publications

Non-Existent Domain (NXDomain) is one type of the Domain Name System (DNS) error responses, indicating that the queried domain name does not exist and cannot be resolved. Unfortunately, little research has focused on understanding why and how NXDomain responses are generated, utilized, and exploited. In this paper, we conduct the first comprehensive and systematic study on NXDomain by investigating its scale, origin, and security implications. Utilizing a large-scale passive DNS database, we identify 146,363,745,785 NXDomains queried by DNS users between 2014 and 2022. Within these 146 billion NXDomains, 91 million of them hold historic WHOIS records, of which 5.3 million …

Reks: Role-Based Encrypted Keyword Search With Enhanced Access Control For Outsourced Cloud Data, Yibin Miao, Feng Li, Xiaohua Jia, Huaxiong Wang, Ximeng Liu, Kim-Kwang Raymond Choo, Robert H. Deng

Research Collection School Of Computing and Information Systems

Keyword-based search over encrypted data is an important technique to achieve both data confidentiality and utilization in cloud outsourcing services. While commonly used access control mechanisms, such as identity-based encryption and attribute-based encryption, do not generally scale well for hierarchical access permissions. To solve this problem, we propose a Role-based Encrypted Keyword Search (REKS) scheme by using the role-based access control and broadcast encryption. Specifically, REKS allows owners to deploy hierarchical access control by allowing users with parent roles to have access permissions from child roles. Using REKS, we further facilitate token generation preprocessing and efficient user management, thereby significantly …

Intelligent Adaptive Gossip-Based Broadcast Protocol For Uav-Mec Using Multi-Agent Deep Reinforcement Learning, Zen Ren, Xinghua Li, Yinbin Miao, Zhuowen Li, Zihao Wang, Mengyao Zhu, Ximeng Liu, Deng, Robert H.

Research Collection School Of Computing and Information Systems

UAV-assisted mobile edge computing (UAV-MEC) has been proposed to offer computing resources for smart devices and user equipment. UAV cluster aided MEC rather than one UAV-aided MEC as edge pool is the newest edge computing architecture. Unfortunately, the data packet exchange during edge computing within the UAV cluster hasn't received enough attention. UAVs need to collaborate for the wide implementation of MEC, relying on the gossip-based broadcast protocol. However, gossip has the problem of long propagation delay, where the forwarding probability and neighbors are two factors that are difficult to balance. The existing works improve gossip from only one factor, …

A Secure Emr Sharing System With Tamper Resistance And Expressive Access Control, Shengmin Xu, Jianting Ning, Yingjiu Li, Yinghui Zhang, Guowen Xu, Xinyi Huang, Robert H. Deng

Research Collection School Of Computing and Information Systems

To reduce the cost of human and material resources and improve the collaborations among medical systems, research laboratories and insurance companies for healthcare researches and commercial activities, electronic medical records (EMRs) have been proposed to shift from paperwork to friendly shareable electronic records. To take advantage of EMRs efficiently and reduce the cost of local storage, EMRs are usually outsourced to the remote cloud for sharing medical data with authorized users. However, cloud service providers are untrustworthy. In this paper, we propose an efficient, secure, and flexible EMR sharing system by introducing a novel cryptosystem called dual-policy revocable attribute-based encryption …

Ranked Keyword Search Over Encrypted Cloud Data Through Machine Learning Method, Yinbin Miao, Wei Zheng, Xiaohua Jia, Ximeng Liu, Kim-Kwang Raymond Choo, Robert H. Deng

Research Collection School Of Computing and Information Systems

Ranked keyword search over encrypted data has been extensively studied in cloud computing as it enables data users to find the most relevant results quickly. However, existing ranked multi-keyword search solutions cannot achieve efficient ciphertext search and dynamic updates with forward security simultaneously. To solve the above problems, we first present a basic Machine Learning-based Ranked Keyword Search (ML-RKS) scheme in the static setting by using the k-means clustering algorithm and a balanced binary tree. ML-RKS reduces the search complexity without sacrificing the search accuracy, but is still vulnerable to forward security threats when applied in the dynamic setting. Then, …

Challenges And Measurements For Governance Of Modern Cyber Space Society, Pinghui Wang, Hongbin Pei, Junzhou Zhao, Tao Qin, Chao Shen, Dongliang Liu, Xiaohong Guan

Bulletin of Chinese Academy of Sciences (Chinese Version)

The rapid development of information technology has unprecedentedly created a prosperous cyber society and greatly enhanced productivity facilitated by social interaction. At the same time, many problems emerge in the cyber society, such as telecom fraud, privacy leakage, Internet pollution, and algorithmic discrimination. The problems bring new challenges to social order and security. In order to find the way of cyber society governance and promote the modernization of national governance, this paper first presents the analyses on the new problems encountered in the cyber society in three typical scenarios, i.e., identity governance, behavior governance, and algorithm governance, as well as …

Two Studies On Binary Program Stylometry: A White-Box Analysis And A Deep Learning Analysis On Some Crypto Ransomware, Alexander Mitchell

Masters Theses, 2020-current

Computer programmers often leave their individual programming styles in source code. Recent studies show that contrary to a popular belief, many of such programming styles can survive, in controlled environments, code compilation into binary. From the binary programming styles can be effectively retrieved for enhanced binary authorship attribution; such binary authorship attribution is often called binary program stylometry. In this thesis, we first perform a white-box impact analysis of various factors in code compilation on programming styles. For the MS Windows platform, we study the impact of multiple compilers, including gcc, Clang, and MSVC, their optimization levels, symbol stripping, and …

Federated Learning And Applications In Cybersecurity, Ani Sreekumar

Cybersecurity Undergraduate Research Showcase

Machine learning is a subfield of artificial intelligence that focuses on making predictions about some outcome based on information from a dataset. In cybersecurity, machine learning is often used to improve intrusion detection systems and identify trends in data that could indicate an oncoming cyber attack. Data privacy is an extremely important aspect of cybersecurity, and there are many industries that have more demanding laws to ensure the security of user data. Due to these regulations, machine learning algorithms can not be widely utilized in these industries to improve outcomes and accuracy of predictions. However, federated learning is a recent …

Is Cybersecurity Training Practical Or Not?, Bhawnish Sharma

Cybersecurity Undergraduate Research Showcase

With technology growing, there has been an increase in cybercrime. Because of this, private and public sectors face global problems, i.e., phishing, security breaches, and identity theft. With cybersecurity software available on the internet, anyone can access it. As technology advances, cybersecurity experts must answer the tough question of, “is cybersecurity training practical or not”?

Secure Authentication Scheme Based On Numerical Series Cryptography For Internet Of Things, Dr Khaled Nagaty, Maha Aladin, Abeer Hamdy Dr.

Computer Science

The rapid advancement of cellular networks and wireless networks has laid a solid basis for the Internet of Things. IoT has evolved into a unique standard that allows diverse physical devices to collaborate with one another. A service provider gives a variety of services that may be accessed via smart apps anywhere, at any time, and from any location over the Internet. Because of the public environment of mobile communication and the Internet, these services are highly vulnerable to a several malicious attacks, such as unauthorized disclosure by hostile attackers. As a result, the best option for overcoming these vulnerabilities …

Investigating Privacy Policies Using Policylint Tool, Tricia Camaya

Cybersecurity Undergraduate Research Showcase

Organizations essentially inform clients about data collection and sharing practices through privacy policies. Recent research has proposed tools to help users better comprehend these lengthy and intricate legal documents that summarize collection and sharing. However, these instruments have a significant flaw. They overlook the possibility of contradictions within a particular policy. This paper introduces PolicyLint, a tool for analyzing privacy policies that simultaneously considers negation and varying semantic levels of data objects and entities. PolicyLint accomplishes this by using sentence-level natural language processing to automatically create ontologies from a large corpus of privacy policies and capturing both positive and negative …

Ethical Concerns In Self-Driving Cars, Victoria Shand

Cybersecurity Undergraduate Research Showcase

Automobiles have been in existence since 1672 and only went up from there. Self-driving cars are a fantastic piece of technology; they can self-park, laser ranger finder, and near vision; they can map the road in advance, understand road signs, and, in some cases, handle certain variables on the road.

When talking about any form of technology, the possibilities are endless technology is a continuously evolving idea. When discussing self-driving cars, they have some fantastic and encouraging benefits and ideas. Some ideas would be that vehicles could communicate with each other, we could eliminate the need for traffic lights, and …

A Brief Review Of Dns, Root Servers, Vulnerabilities And Decentralization, Mallory Runyan

Cybersecurity Undergraduate Research Showcase

Since the 1980’s and creation of the World Wide Web, Internet utilization is a common and arguably, necessary, part of daily life. The internet is young and still relatively new, but as of 2016, 3.4 billion people were online, and that number has since grown [1]. This is a significant number, but as such a common part of daily life, how elements of the internet or its infrastructure work is complex. The world would very likely be thrown into dark ages if DNS or any other significant aspect of the internet's infrastructure were to succumb to an attack. The Colonial …

Software Supply Chain Security Attacks And Analysis Of Defense, Juanjose Rodriguez-Cardenas, Jobair Hossain Faruk, Masura Tansim, Asia Shavers, Corey Brookins, Shamar Lake, Ava Norouzi, Marie Nassif, Kenneth Burke, Miranda Dominguez

Symposium of Student Scholars

The Software Supply chain or SSC is the backbone of the logistics industry and is crucial to a business's success and operation. The surge of attacks and risks for the SSC has grown in coming years with each attack's impact becoming more significant. These attacks have led to the leaking of both client and company sensitive information, corruption of the data, and having it subject to malware and ransomware installation, despite new practices implemented and investments into SSC security and its branches that have not stopped attackers from developing new vulnerabilities and exploits. In our research, we have investigated Software …

Secure Cloud-Based Iot Water Quality Gathering For Analysis And Visualization, Soin Abdoul Kassif Baba M Traore

Symposium of Student Scholars

Water quality refers to measurable water characteristics, including chemical, biological, physical, and radiological characteristics usually relative to human needs. Dumping waste and untreated sewage are the reasons for water pollution and several diseases to the living hood. The quality of water can also have a significant impact on animals and plant ecosystems. Therefore, keeping track of water quality is a substantial national interest. Much research has been done for measuring water quality using sensors to prevent water pollution. In summary, those systems are built based on online and reagent-free water monitoring SCADA systems in wired networks. However, centralized servers, transmission …

The History Of The Enigma Machine, Jenna Siobhan Parkinson

History Publications

The history of the Enigma machine begins with the invention of the rotor-based cipher machine in 1915. Various models for rotor-based cipher machines were developed somewhat simultaneously in different parts of the world. However, the first documented rotor machine was developed by Dutch naval officers in 1915. Nonetheless, the Enigma machine was officially invented following the end of World War I by Arthur Scherbius in 1918 (Faint, 2016).

A Cybersecurity Assessment Of Health Data Ecosystems, Michelle N. Halsey

Cyber Operations and Resilience Program Graduate Projects

This paper is an exploratory study that investigates data collected and used by health plans and reviews the laws and regulations governing this data to identify the gaps in protections and provide recommendations for eliminating these gaps. Health insurance companies collect a wide array of data about the people they insure, data that is often only peripherally relevant to the service these companies provide. The data environment currently consists of seven categories of data: personal health information, summary health information, personally identifiable information, financial information, professional information, biometric information, and lifestyle data or social indicators of health. Much of this …

Post Pandemic Cyberbiosecurity Threats From Terrorist Groups, Haley D. Dodge

Master's Theses

The research in this thesis explored the research question: Are United States (US) health systems accessible to cyber-bio terrorist attacks post-pandemic, within the context of the emerging discipline of cyberbiosecurity? Key findings of the analysis demonstrated how US health systems are more accessible to cyber-bio terrorist attacks specifically from cyber hacking groups based on the increasing sophistication of their cyber capabilities and the lack of cyber protection for biological systems. The concept of cyberbiosecurity was first introduced in 2018 by researchers exploring the converging threat landscape of the cyber and biology domains. As biology is growing more dependent upon vulnerable …

Towards Privacy And Security Concerns Of Adversarial Examples In Deep Hashing Image Retrieval, Yanru Xiao

Computer Science Theses & Dissertations

With the explosive growth of images on the internet, image retrieval based on deep hashing attracts spotlights from both research and industry communities. Empowered by deep neural networks (DNNs), deep hashing enables fast and accurate image retrieval on large-scale data. However, inheriting from deep learning, deep hashing remains vulnerable to specifically designed input, called adversarial examples. By adding imperceptible perturbations on inputs, adversarial examples fool DNNs to make wrong decisions. The existence of adversarial examples not only raises security concerns for real-world deep learning applications, but also provides us with a technique to confront malicious applications.

In this dissertation, we …