Information Security Commons^™

Xmpp Architecture And Security Challenges In An Iot Ecosystem, Muhammad Imran Malik, Ian Noel Mcateer, Peter Hannay, Syed Naeem Firdous, Zubair Baig

Australian Information Security Management Conference

The elusive quest for technological advancements with the aim to make human life easier has led to the development of the Internet of Things (IoT). IoT technology holds the potential to revolutionise our daily life, but not before overcoming barriers of security and data protection. IoTs’ steered a new era of free information that transformed life in ways that one could not imagine a decade ago. Hence, humans have started considering IoTs as a pervasive technology. This digital transformation does not stop here as the new wave of IoT is not about people, rather it is about intelligent connected devices. …

Encryption And Decryption Using Matricies, Amit Etiel, James Parsons, Shawn Jenkins-Edwards

Math 365 Class Projects

Mathematician Lester Hill developed the Hill Cipher, the first mathematical encryption method ever developed, in 1929. This method was created in order to strengthen the level of security of previous methods and made it possible to encrypt more than three symbols at a time.

The Relevance Of A Good Internal Control System In A Computerised Accounting Information System, Raymond Lutui, Tau’Aho ‘Ahokovi

Australian Information Security Management Conference

Advancements in information technology (IT) have enabled companies to use computers to carry out their activities that were previously performed manually. Accounting systems that were previously performed manually can now be performed with the help of computers. With all the advantages of computerized accounting software, business owners need to realize that problems do arise for a variety of reasons. Dependence on computers sometimes leads to bigger problems. This paper, therefore provide a detail information about the concept of internal control to its relevance in a computerised accounting information. This study also considers the trend between manual and computerised accounting system. …

An Investigation Into A Denial Of Service Attack On An Ethereum Network, Richard Greene, Michael N. Johnstone

Australian Information Security Management Conference

Apart from its much-publicised use in crypto-currency, blockchain technology is used in a wide range of application areas, from diamonds to wine. The most common application of this technology is in smart contracts in supply chain management, where assurance of delivery and provenance are important. One problem for an Ethereum consortium is the potential for disruption caused by a Denial-of-Service attack across the consortium nodes. Such an attack can be launched from a single source or multiple sources to amplify the effect. This paper investigates the impact of various Denial-of-Service attacks on an Ethereum Consortium deployed on the Azure Cloud …

Mobile Device Wardriving Tools’ Comparison: Nuku’Alofa As Case Study, Raymond Lutui, ‘Osai Tete’Imoana, George Maeakafa

Australian Information Security Management Conference

This paper describes the justification for a project to assess the security status of wireless networks usage in Nuku’alofa, the CBD of Tonga, By War Driving these suburbs, actual data was gathered to indicate the security status of wireless networks and provide an understanding of the users’ level of awareness and attitudes towards wireless security. This paper also takes the opportunity to compare the performance of the War driving tools that this study employed – GMoN, SWardriving, and Wi-Fi Scan. Wireless network communication remains a challenging and critical issue. This study takes an exploratory approach in which it allows the …

The Design And Evaluation Of A User-Centric Information Security Risk Assessment And Response Framework, Manal Alohali, Nathan Clarke, Steven Furnell

Research outputs 2014 to 2021

Abstract: The risk of sensitive information disclosure and modification through the use of online services has increased considerably and may result in significant damage. As the management and assessment of such risks is a well-known discipline for organizations, it is a challenge for users from the general public. Users have difficulties in using, understanding and reacting to security-related threats. Moreover, users only try to protect themselves from risks salient to them. Motivated by the lack of risk assessment solutions and limited impact of awareness programs tailored for users of the general public, this paper aims to develop a structured approach …

Efficient And Privacy-Preserving Outsourced Calculation Of Rational Numbers, Ximeng Liu, Kim-Kwang Raymond Choo, Robert H. Deng, Rongxing Lu, Jian Weng

Research Collection School Of Computing and Information Systems

In this paper, we propose a framework for efficient and privacy-preserving outsourced calculation of rational numbers, which we refer to as POCR. Using POCR, a user can securely outsource the storing and processing of rational numbers to a cloud server without compromising the security of the (original) data and the computed results. We present the system architecture of POCR and the associated toolkits required in the privacy preserving calculation of integers and rational numbers to ensure that commonly used outsourced operations can be handled on-the-fly. We then prove that the proposed POCR achieves the goal of secure integer and rational …

Smartwatch-Based Early Gesture Detection & Trajectory Tracking For Interactive Gesture-Driven Applications, Tran Huy Vu, Archan Misra, Quentin Roy, Kenny Tsu Wei Choo, Youngki Lee

Research Collection School Of Computing and Information Systems

The paper explores the possibility of using wrist-worn devices (specifically, a smartwatch) to accurately track the hand movement and gestures for a new class of immersive, interactive gesture-driven applications. These interactive applications need two special features: (a) the ability to identify gestures from a continuous stream of sensor data early–i.e., even before the gesture is complete, and (b) the ability to precisely track the hand’s trajectory, even though the underlying inertial sensor data is noisy. We develop a new approach that tackles these requirements by first building a HMM-based gesture recognition framework that does not need an explicit segmentation step, …

Improved Construction For Inner Product Functional Encryption, Qingsong Zhao, Qingkai Zeng, Ximeng Liu

Research Collection School Of Computing and Information Systems

Functional encryption (FE) is a vast new paradigm for encryption scheme which allows tremendous flexibility in accessing encrypted data. In a FE scheme, a user can learn specific function of encrypted messages by restricted functional key and reveals nothing else about the messages. Besides the standard notion of data privacy in FE, it should protect the privacy of the function itself which is also crucial for practical applications. In this paper, we construct a secret key FE scheme for the inner product functionality using asymmetric bilinear pairing groups of prime order. Compared with the existing similar schemes, our construction reduces …

Biometrics Based Privacy-Preserving Authentication And Mobile Template Protection, Wencheng Yang, Jiankun Hu, Song Wang, Qianhong Wu

Research outputs 2014 to 2021

Smart mobile devices are playing a more and more important role in our daily life. Cancelable biometrics is a promising mechanism to provide authentication to mobile devices and protect biometric templates by applying a noninvertible transformation to raw biometric data. However, the negative effect of nonlinear distortion will usually degrade the matching performance significantly, which is a nontrivial factor when designing a cancelable template. Moreover, the attacks via record multiplicity (ARM) present a threat to the existing cancelable biometrics, which is still a challenging open issue. To address these problems, in this paper, we propose a new cancelable fingerprint template …

A Security Review Of Local Government Using Nist Csf: A Case Study, Ahmed Ibrahim, Craig Valli, Ian Mcateer, Junaid Chaudhry

Research outputs 2014 to 2021

Evaluating cyber security risk is a challenging task regardless of an organisation’s nature of business or size, however, an essential activity. This paper uses the National Institute of Standards and Technology (NIST) cyber security framework (CSF) to assess the cyber security posture of a local government organisation in Western Australia. Our approach enabled the quantification of risks for specific NIST CSF core functions and respective categories and allowed making recommendations to address the gaps discovered to attain the desired level of compliance. This has led the organisation to strategically target areas related to their people, processes, and technologies, thus mitigating …

A Survey Of Distributed Certificate Authorities In Manets, Junaid Chaudhry, Kashif Saleem, Paul Haskell-Dowland Dr, Mahdi H. Miraz

Research outputs 2014 to 2021

A Certificate Authority (CA) provides the critical authentication and security services for Public Key Infrastructure (PKI) which are used for the Internet and wired networks. In MANETs (wireless and ad hoc) there is an inability to offer a centralized CA to provide these security services. Recent research has looked to facilitate the use of CAs within MANETs through the use of a Distributed Certificate Authority (DCA) for wireless and ad hoc networks. This paper presents a number of different types of DCA protocols and categorizes them into groups based on their factors and specifications. The paper concludes by proposing the …

Software Intrusion Detection Evaluation System: A Cost-Based Evaluation Of Intrusion Detection Capability, Agbotiname L. Imoize, Taiwo Oyedare, Michael E. Otuokere, Sachin Shetty

VMASC Publications

In this paper, we consider a cost-based extension of intrusion detection capability (CID). An objective metric motivated by information theory is presented and based on this formulation; a package for computing the intrusion detection capability of intrusion detection system (IDS), given certain input parameters is developed using Java. In order to determine the expected cost at each IDS operating point, the decision tree method of analysis is employed, and plots of expected cost and intrusion detection capability against false positive rate were generated. The point of intersection between the maximum intrusion detection capability and the expected cost is selected as …

A Reliable Data Provenance And Privacy Preservation Architecture For Business-Driven Cyber-Physical Systems Using Blockchain, Xueping Liang, Sachin Shetty, Deepak K. Tosh, Juan Zhao, Danyi Li, Jihong Liu

VMASC Publications

Cyber-physical systems (CPS) including power systems, transportation, industrial control systems, etc. support both advanced control and communications among system components. Frequent data operations could introduce random failures and malicious attacks or even bring down the whole system. The dependency on a central authority increases the risk of single point of failure. To establish an immutable data provenance scheme for CPS, the authors adopt blockchain and propose a decentralized architecture to assure data integrity. In business-driven CPS, end users are required to share their personal information with multiple third parties. To prevent data leakage and preserve user privacy, the authors isolate …

Introduction: Metrics, Modeling And Simulation For Cyber Physical Systems, Barry Ezell, Luanne Burns

VMASC Publications

[Introduction] In recent years, there has been a massive increase in cyber crime. Cyber breeches have become ubiquitous. The US government is attempting to adapt through legislation and policy. For instance, business in the defense industrial base must be in compliance of NIST 80-71 by 31 December 2017. Insurance companies as well are beginning to build actuaries on cyber risk. Along with NIST, there are many cyber frameworks that exist, each with their own following. Recently, companies have sought mapping from one framework to another but this is imperfect solution because some frameworks are exclusively technical control measures with very …

New Dimensions For A Challenging Security Environment: Growing Exposure To Critical Space Infrastructure Disruption Risk, Adrian V. Gheorghe, Alexandru Georgescu, Olga Bucovetchi, Marilena Lazăr, Cezar Scarlat

Engineering Management & Systems Engineering Faculty Publications

Space systems have become a key enabler for a wide variety of applications that are vital to the functioning of advanced societies. The trend is one of quantitative and qualitative increase of this dependence, so much so that space systems have been described as a new example of critical infrastructure. This article argues that the existence of critical space infrastructures implies the emergence of a new category of disasters related to disruption risks. We inventory those risks and make policy recommendations for what is, ultimately, a resilience governance issue.

A Value Sensitive Design Approach To Adolescent Mobile Online Safety, Arup Kumar Ghosh

Electronic Theses and Dissertations

With the rise of adolescent smartphone use, concerns about teen online safety are also on the rise. A number of parental control apps are available for mobile devices, but adoption of these apps has been markedly low. To better understand these apps, their users, and design opportunities in the space of mobile online safety for adolescents, we have conducted four studies informed by the principles of Value Sensitive Design (VSD). In Study 1 (Chapter 2), we conducted a web-based survey of 215 parents and their teens (ages 13-17) using two separate logistic regression models (parent and teen) to examine the …

Applying Machine Learning To Advance Cyber Security: Network Based Intrusion Detection Systems, Hassan Hadi Latheeth Al-Maksousy

Computer Science Theses & Dissertations

Many new devices, such as phones and tablets as well as traditional computer systems, rely on wireless connections to the Internet and are susceptible to attacks. Two important types of attacks are the use of malware and exploiting Internet protocol vulnerabilities in devices and network systems. These attacks form a threat on many levels and therefore any approach to dealing with these nefarious attacks will take several methods to counter. In this research, we utilize machine learning to detect and classify malware, visualize, detect and classify worms, as well as detect deauthentication attacks, a form of Denial of Service (DoS). …

Determinants Of Personal Information Protection Activities In South Korea, Pilku Kang

MPA/MPP/MPFM Capstone Projects

The purpose of this paper is to investigate how people’s awareness and ways to obtain relevant materials of personal information have influenced individual’s information privacy protection activities. This study uses the data of a 2016 survey on information security published by Korea Information and Security Agency.

The dependent variables of this study are preventive measures for the security of a Personal Computer (PC) and preventive measures against personal information breach. I classify independent variables into four types. They are internet users’ perception about information privacy, such as awareness of the importance of protecting one’s personal information, and awareness of information …

User-Friendly Deniable Storage For Mobile Devices, Bing Chang, Yao Cheng, Bo Chen, Fengwei Zhang, Wen-Tao Zhu, Yanju Liu, Zhan Wang

Research Collection School Of Computing and Information Systems

Mobile devices are prevalently used to process sensitive data, but traditional encryption may not work when an adversary is able to coerce the device owners to disclose the encryption keys. Plausibly Deniable Encryption (PDE) is thus designed to protect sensitive data against this powerful adversary. In this paper, we present MobiPluto, a user-friendly PDE scheme for denying the existence of sensitive data stored on mobile devices. A salient difference between MobiPluto and the existing PDE systems is that any block-based file systems can be deployed on top of it. To further improve usability and deniability of MobiPluto, we introduce a …