Information Security Commons^™

Towards Automated Safety Vetting Of Smart Contracts In Decentralized Applications, Yue Duan, Xin Zhao, Yu Pan, Shucheng Li, Minghao Li, Fengyuan Xu, Mu Zhang

Research Collection School Of Computing and Information Systems

We propose VetSC, a novel UI-driven, program analysis guided model checking technique that can automatically extract contract semantics in DApps so as to enable targeted safety vetting. To facilitate model checking, we extract business model graphs from contract code that capture its intrinsic business and safety logic. To automatically determine what safety specifications to check, we retrieve textual semantics from DApp user interfaces. To exclude untrusted UI text, we also validate the UI-logic consistency and detect any discrepancies. We have implemented VetSC and applied it to 34 real-world DApps. Experiments have demonstrated that VetSC can accurately interpret smart contract code, …

Fully Deformable Network For Multiview Face Image Synthesis, Cheng Xu, Keke Li, Xuandi Luo, Xuemiao Xu, Shengfeng He, Kun Zhang

Research Collection School Of Computing and Information Systems

Photorealistic multiview face synthesis from a single image is a challenging problem. Existing works mainly learn a texture mapping model from the source to the target faces. However, they rarely consider the geometric constraints on the internal deformation arising from pose variations, which causes a high level of uncertainty in face pose modeling, and hence, produces inferior results for large pose variations. Moreover, current methods typically suffer from undesired facial details loss due to the adoption of the de-facto standard encoder-decoder architecture without any skip connections (SCs). In this article, we directly learn and exploit geometric constraints and propose a …

Vfirm: Verifiable Fine-Grained Encrypted Image Retrieval In Multi-Owner Multi-User Settings, Qiuyun Tong, Yinbin Miao, Lei Chen, Jian Weng, Kim-Kwang Raymond Choo, Ximeng Liu, Robert H. Deng

Research Collection School Of Computing and Information Systems

To ensure the security of images outsourced to the malicious cloud without affecting searchability on such outsourced (typically encrypted) images, one could use privacy-preserving Content-Based Image Retrieval (CBIR) primitive. However, conventional privacy-preserving CBIR schemes based on Searchable Symmetric Encryption (SSE) are not capable of supporting efficient fine-grained access control and result verification simultaneously. Therefore, in this article, we propose a Verifiable Fine-grained encrypted Image Retrieval scheme in the Multi-owner multi-user settings (VFIRM). VFIRM first utilizes a novel polynomial-based access strategy to provide efficient fine-grained access control. Then, it employs the dual secure kk-nearest neighbor technique to distribute distinct keys to …

Reliable Policy Updating Under Efficient Policy Hidden Fine-Grained Access Control Framework For Cloud Data Sharing, Zuobin Ying, Wenjie Jiang, Ximeng Liu, Shengmin Xu, Robert H. Deng

Research Collection School Of Computing and Information Systems

Ciphertext-Policy Attribute-Based Encryption (CP-ABE) is one of the potent encryption paradigms in protecting data confidentiality in the cloud data sharing scenario. However, the access policy of the traditional CP-ABE is in plaintext form that reveals significant sensitive information of data owners and data visitors. To mitigate this problem, two approaches have been proposed in the literature. One is partially hidden, where the attributes in the access policy are divided into two parts: the plaintext attribute names and the hidden attribute values. The other approach fully hides the attributes in the access policy which, unfortunately, hinders efficient and correct decryption as …

M-Edese: Multi-Domain, Easily Deployable, And Efficiently Searchable Encryption, Jiaming Yuan, Yingjiu Li, Jianting Ning, Robert H. Deng

Research Collection School Of Computing and Information Systems

Searchable encryption is an essential component of cryptography, which allows users to search for keywords and retrieve records from an encrypted database at cloud storage while ensuring the confidentiality of users’ queries. While most existing research on searchable encryption focuses on the single domain setting, we propose the first Multi-Domain, Easily-Deployable, Efficiently-Searchable Encryption (M-EDESE) system that allows users to query keywords cross domains with high efficiency and preserved privacy without additional cooperation from the cloud storage. In the multi-domain setting, a user who belongs to a domain can query keywords from another domain under an inter-domain partnership. Any party can …

Vulcurator: A Vulnerability-Fixing Commit Detector, Truong Giang Nguyen, Cong Thanh Le, Hong Jin Kang, Xuan-Bach D. Le, David Lo

Research Collection School Of Computing and Information Systems

Open-source software (OSS) vulnerability management process is important nowadays, as the number of discovered OSS vulnerabilities is increasing over time. Monitoring vulnerability-fixing commits is a part of the standard process to prevent vulnerability exploitation. Manually detecting vulnerability-fixing commits is, however, time-consuming due to the possibly large number of commits to review. Recently, many techniques have been proposed to automatically detect vulnerability-fixing commits using machine learning. These solutions either: (1) did not use deep learning, or (2) use deep learning on only limited sources of information. This paper proposes VulCurator, a tool that leverages deep learning on richer sources of information, …

Understanding Deviance And Victimization In Cyber Space Among Diverse Populations, Insun Park

International Journal of Cybersecurity Intelligence & Cybercrime

Recent years have witnessed a growing academic interest in deviance and victimization in the cyber space. The current issue of the International Journal of Cybersecurity Intelligence and Cybercrime features three empirical research articles on online behavior of traditionally under-researched populations and a review of much waited book on digital forensics and investigation. This paper was prepared to introduce these important scholarly works in the context of newly emerging scholarship that focuses on the experiences of diverse subgroups in cyberspace.

Aggressive Reality Docuseries And Cyberbullying: A Partial Test Of Glaser’S Differential Identification Theory, J. Ra’Chel Fowler, Darren R. Beneby, Kenethia L. Fuller

International Journal of Cybersecurity Intelligence & Cybercrime

Reality docuseries have dominated primetime airwaves for the greater part of three decades. However, little is known about how viewers who are enamored with the genre’s most aggressive characters are influenced. Using Glaser’s (1956) theory of differential identification, this study employs survey data from 210 college students at a historically Black college and university to explore whether identification with characters from aggressive reality docuseries (ARDs) and the frequency of viewing ARD are positively associated with cyberbullying. Results of multivariate analyses revealed that men were more likely than women to publicly shame others and air other’s dirty laundry online. Additionally, the …

Emerging Trends In Cybercrime Awareness In Nigeria, Ogochukwu Favour Nzeakor, Bonaventure N. Nwokeoma, Ibrahim Hassan, Benjamin Okorie Ajah, John T. Okpa

International Journal of Cybersecurity Intelligence & Cybercrime

The study examined the current trend in cybercrime awareness and the relationship such trend has with cybercrime vulnerability or victimization. Selecting a sample of 1104 Internet users from Umuahia, Abia State, Nigeria, We found that: 1) awareness of information security was high in that about 2 in every 3 (68%) participants demonstrated a favorable awareness of information security and cybercrime. It was, however, revealed that such a high level of awareness could be partial and weak. 2) most Internet users demonstrated the awareness of fraud-related cybercrime categories (39%), e-theft (15%), hacking (12%), and ATM theft (10%). However, they were rarely …

Book Review: Digital Forensics And Cyber Investigation

International Journal of Cybersecurity Intelligence & Cybercrime

No abstract provided.

Untouchable Once Revoking: A Practical And Secure Dynamic Ehr Sharing System Via Cloud, Shengmin Xu, Jianting Ning, Xinyi Huang, Yingjiu Li, Guowen Xu

Research Collection School Of Computing and Information Systems

Healthcare Internet-of-Things (IoT) enables lightweight devices to observe patients’ vital signals and outsource them to a remote cloud to enjoy flexible data sharing. However, it faces many security threats as the outsourced data is no longer physically controlled by data owners, and the cloud that hosts the outsourced data is not fully trusted. Many privacy protection technologies have been adopted to solve this problem, among which cryptographic mechanisms have become one of the most promising tools. Unfortunately, current cryptographic mechanisms in healthcare IoT mainly suffer from the following challenges: 1) dynamic user groups for managing users’ accessibility; 2) efficient revocation …

Towards Automated Safety Vetting Of Smart Contracts In Decentralized Applications, Yue Duan, Xin Zhao, Yu Pan, Shucheng Li, Minghao Li, Fengyuan Xu, Mu Zhang

Research Collection School Of Computing and Information Systems

We propose VetSC, a novel UI-driven, program analysis guided model checking technique that can automatically extract contract semantics in DApps so as to enable targeted safety vetting. To facilitate model checking, we extract business model graphs from contract code that capture its intrinsic business and safety logic. To automatically determine what safety specifications to check, we retrieve textual semantics from DApp user interfaces. To exclude untrusted UI text, we also validate the UI-logic consistency and detect any discrepancies. We have implemented VetSC and applied it to 34 real-world DApps. Experiments have demonstrated that VetSC can accurately interpret smart contract code, …

An Evaluation Framework For Digital Image Forensics Tools, Zainab Khalid, Sana Qadir

Journal of Digital Forensics, Security and Law

The boom of digital cameras, photography, and social media has drastically changed how humans live their day-to-day, but this normalization is accompanied by malicious agents finding new ways to forge and tamper with images for unlawful monetary (or other) gains. Disinformation in the photographic media realm is an urgent threat. The availability of a myriad of image editing tools renders it almost impossible to differentiate between photo-realistic and original images. The tools available for image forensics require a standard framework against which they can be evaluated. Such a standard framework can aid in evaluating the suitability of an image forensics …

A Study Of The Data Remaining On Second-Hand Mobile Devices In The Uk, Olga Angelopoulou, Andy Jones, Graeme Horsman, Seyedali Pourmoafi

Journal of Digital Forensics, Security and Law

This study was carried out intending to identify the level and type of information that remained on portable devices that were purchased from the second-hand market in the UK over the last few years. The sample for this study consisted of 100 second hand mobile phones and tablets. The aim of the study was to determine the proportion of devices that still contained data and the type of data that they contained. Where data was identified, the study attempted to determine the level of personal identifiable information that is associated with the previous owner. The research showed that when sensitive …

The Impact Of Ethical Hacking Within Small Businesses, Nygia Tribbey

Cybersecurity Undergraduate Research Showcase

The Internet has brought about a new way for businesses to reach their customers. With the help of social media, websites, and email marketing, small businesses have gained a lot of new customers. However, these new online customers have also opened up their businesses to a whole new world of cyber crime. Cyber crime is the illegal use of computers and networks to cause damage or steal information. This type of crime affects small businesses as well as large corporations. Small businesses often find themselves at a disadvantage because they don't have the resources to hire an ethical hacker or …

Principles Of Information Security, Alison Hedrick

KSU Distinguished Course Repository

An introduction to the various technical and administrative aspects of Information Security and Assurance. This course provides the foundation for understanding the key issues associated with protecting information assets, determining the levels of protection and response to security incidents, and designing a consistent, reasonable information security system, with appropriate intrusion detection and reporting features.

Combining Security And Reliability Of Critical Infrastructures: The Concept Of Securability, Leandros Maglaras, Helge Janicke, Mohamed Amine Ferrag

Research outputs 2022 to 2026

The digital revolution has made people more dependent on ICT technology to perform everyday tasks, whether at home or at work. The systems that support critical aspects of this smart way of living are characterized as critical, and the security level of such systems is higher as compared to others. The definition of the criticality of a system is a rather difficult exercise, and for that reason, we have seen novel cybersecurity regulations to introduce the idea of digital managed services, which include security monitoring, managed network services, or the outsourcing of business processes that are are critical to the …

Sustaining Patient Portal Continuous Use Intention And Enhancing Deep Structure Usage: Cognitive Dissonance Effects Of Health Professional Encouragement And Security Concerns, Murad Moqbel, Barbara Hewitt, Fiona Fui-Hoon Nah, Rosann M. Mclean

Research Collection School Of Computing and Information Systems

Sustaining patient portal use is a major problem for many healthcare organizations and providers. If this problem can be successfully addressed, it could have a positive impact on various stakeholders. Through the lens of cognitive dissonance theory, this study investigates the role of health professional encouragement as well as patients’ security concerns in influencing continuous use intention and deep structure usage among users of a patient portal. The analysis of data collected from 177 patients at a major medical center in the Midwestern region of the United States shows that health professional encouragement helps increase the continuous use intention and …

Vpsl: Verifiable Privacy-Preserving Data Search For Cloud-Assisted Internet Of Things, Qiuyun Tong, Yinbin Miao, Ximeng Liu, Kim-Kwang Raymond Choo, Robert H. Deng

Research Collection School Of Computing and Information Systems

Cloud-assisted Internet of Things (IoT) is increasingly prevalent used in various fields, such as the healthcare system. While in such a scenario, sensitive data (e.g., personal electronic medical records) can be easily revealed, which incurs potential security challenges. Thus, Symmetric Searchable Encryption (SSE) has been extensively studied due to its capability of supporting efficient search on encrypted data. However, most SSE schemes require the data owner to share the complete key with query users and take malicious cloud servers out of consideration. Seeking to address these limitations, in this paper we propose a Verifiable Privacy-preserving data Search scheme with Limited …

Supporting The Discovery, Reuse, And Validation Of Cybersecurity Requirements At The Early Stages Of The Software Development Lifecycle, Jessica Antonia Steinmann

Doctoral Dissertations and Master's Theses

The focus of this research is to develop an approach that enhances the elicitation and specification of reusable cybersecurity requirements. Cybersecurity has become a global concern as cyber-attacks are projected to cost damages totaling more than $10.5 trillion dollars by 2025. Cybersecurity requirements are more challenging to elicit than other requirements because they are nonfunctional requirements that requires cybersecurity expertise and knowledge of the proposed system. The goal of this research is to generate cybersecurity requirements based on knowledge acquired from requirements elicitation and analysis activities, to provide cybersecurity specifications without requiring the specialized knowledge of a cybersecurity expert, and …

Social Access And Representation For Autistic Adult Livestreamers, Terrance Mok, Anthony Tang, Adam Mccrimmon, Lora Oehlberg

Research Collection School Of Computing and Information Systems

We interviewed 10 autistic livestreamers to understand their motivations for livestreaming on Twitch. Our participants explained that streaming helped them fulfill social desires by: supporting them in making meaningful social connections with others; giving them a safe space to practice social skills like “small talk”; and empowering them to be autistic role models and to share their true selves. This work offers an early report on how autistic individuals leverage livestreaming as a beneficial social platform while struggling with audience expectations.

Soci: A Toolkit For Secure Outsourced Computation On Integers, Bowen Zhao, Jiaming Yuan, Ximeng Liu, Yongdong Wu, Hwee Hwa Pang, Robert H. Deng

Research Collection School Of Computing and Information Systems

Secure outsourced computation is a key technique for protecting data security and privacy in the cloud. Although fully homomorphic encryption (FHE) enables computations over encrypted data, it suffers from high computation costs in order to support an unlimited number of arithmetic operations. Recently, secure computations based on interactions of multiple computation servers and partially homomorphic encryption (PHE) were proposed in the literature, which enable an unbound number of addition and multiplication operations on encrypted data more efficiently than FHE and do not add any noise to encrypted data; however, these existing solutions are either limited in functionalities (e.g., computation on …

Mando: Multi-Level Heterogeneous Graph Embeddings For Fine-Grained Detection Of Smart Contract Vulnerabilities, Huu Hoang Nguyen, Nhat Minh Nguyen, Chunyao Xie, Zahra Ahmadi, Daniel Kudenko, Thanh Nam Doan, Lingxiao Jiang

Research Collection School Of Computing and Information Systems

Learning heterogeneous graphs consisting of different types of nodes and edges enhances the results of homogeneous graph techniques. An interesting example of such graphs is control-flow graphs representing possible software code execution flows. As such graphs represent more semantic information of code, developing techniques and tools for such graphs can be highly beneficial for detecting vulnerabilities in software for its reliability. However, existing heterogeneous graph techniques are still insufficient in handling complex graphs where the number of different types of nodes and edges is large and variable. This paper concentrates on the Ethereum smart contracts as a sample of software …

Right To Know, Right To Refuse: Towards Ui Perception-Based Automated Fine-Grained Permission Controls For Android Apps, Vikas Kumar Malviya, Chee Wei Leow, Ashok Kasthuri, Naing Tun Yan, Lwin Khin Shar, Lingxiao Jiang

Research Collection School Of Computing and Information Systems

It is the basic right of a user to know how the permissions are used within the Android app’s scope and to refuse the app if granted permissions are used for the activities other than specified use which can amount to malicious behavior. This paper proposes an approach and a vision to automatically model the permissions necessary for Android apps from users’ perspective and enable fine-grained permission controls by users, thus facilitating users in making more well-informed and flexible permission decisions for different app functionalities, which in turn improve the security and data privacy of the App and enforce apps …

Anomaly Detection In Cybersecurity Datasets Via Cooperative Co-Evolution-Based Feature Selection, Bazlur A. N. M. Rashid, Mohiuddin Ahmed, Leslie F. Sikos, Paul Haskell-Dowland

Research outputs 2022 to 2026

Anomaly detection from Big Cybersecurity Datasets is very important; however, this is a very challenging and computationally expensive task. Feature selection (FS) is an approach to remove irrelevant and redundant features and select a subset of features, which can improve the machine learning algorithms’ performance. In fact, FS is an effective preprocessing step of anomaly detection techniques. This article’s main objective is to improve and quantify the accuracy and scalability of both supervised and unsupervised anomaly detection techniques. In this effort, a novel anomaly detection approach using FS, called Anomaly Detection Using Feature Selection (ADUFS), has been introduced. Experimental analysis …

Phishing Detection Using Natural Language Processing And Machine Learning, Apurv Mittal, Dr Daniel Engels, Harsha Kommanapalli, Ravi Sivaraman, Taifur Chowdhury

SMU Data Science Review

Phishing emails are a primary mode of entry for attackers into an organization. A successful phishing attempt leads to unauthorized access to sensitive information and systems. However, automatically identifying phishing emails is often difficult since many phishing emails have composite features such as body text and metadata that are nearly indistinguishable from valid emails. This paper presents a novel machine learning-based framework, the DARTH framework, that characterizes and combines multiple models, with one model for each composite feature, that enables the accurate identification of phishing emails. The framework analyses each composite feature independently utilizing a multi-faceted approach using Natural Language …

A Novel Qkd Approach To Enhance Iiot Privacy And Computational Knacks, Kranthi Kumar Singamaneni, Gaurav Dhiman, Sapna Juneja, Ghulam Muhammad, Salman A Alqahtani, John Zaki

Faculty, Staff and Student Publications

The industry-based internet of things (IIoT) describes how IIoT devices enhance and extend their capabilities for production amenities, security, and efficacy. IIoT establishes an enterprise-to-enterprise setup that means industries have several factories and manufacturing units that are dependent on other sectors for their services and products. In this context, individual industries need to share their information with other external sectors in a shared environment which may not be secure. The capability to examine and inspect such large-scale information and perform analytical protection over the large volumes of personal and organizational information demands authentication and confidentiality so that the total data …

Secure Hierarchical Deterministic Wallet Supporting Stealth Address, Xin Yin, Zhen Liu, Guomin Yang, Guoxing Chen, Haojin Zhu

Research Collection School Of Computing and Information Systems

Over the past decade, cryptocurrency has been undergoing a rapid development. Digital wallet, as the tool to store and manage the cryptographic keys, is the primary entrance for the public to access cryptocurrency assets. Hierarchical Deterministic Wallet (HDW), proposed in Bitcoin Improvement Proposal 32 (BIP32), has attracted much attention and been widely used in the community, due to its virtues such as easy backup/recovery, convenient cold-address management, and supporting trust-less audits and applications in hierarchical organizations. While HDW allows the wallet owner to generate and manage his keys conveniently, Stealth Address (SA) allows a payer to generate fresh address (i.e., …

Witness-Authenticated Key Exchange, Kelsey G. Melissaris

Dissertations, Theses, and Capstone Projects

In this dissertation we investigate Witness-Authenticated Key Exchange (WAKE), a key agreement protocol in which each party is authenticated through knowledge of a witness to an arbitrary NP statement. We provide both game-based and universally composable definitions. Thereby, this thesis presents solutions for the most flexible and general method of authentication for group key exchange, providing simple constructions from (succinct) signatures of knowledge (SOK) and a two round UC-secure protocol.

After a discussion of flaws in previous definitions for WAKE we supply a new and improved game-based definition along with the first definition for witness-authenticated key exchange between groups of …

On The Cryptographic Deniability Of The Signal Protocol, Nihal Vatandas

Dissertations, Theses, and Capstone Projects

Offline deniability is the ability to a posteriori deny having participated in a particular communication session. This property has been widely assumed for the Signal messaging application, yet no formal proof has appeared in the literature. In this work, we present the first formal study of the offline deniability of the Signal protocol. Our analysis shows that building a deniability proof for Signal is non-trivial and requires strong assumptions on the underlying mathematical groups where the protocol is run.

To do so, we study various implicitly authenticated key exchange protocols, including MQV, HMQV, and 3DH/X3DH, the latter being the core …