Information Security Commons^™

Seeing Through The Same Lens: Introspecting Guest Address Space At Native Speed, Siqi Zhao, Xuhua Ding, Wen Xu, Dawu Gu

Research Collection School Of Computing and Information Systems

Software-based MMU emulation lies at the heart of out-of-VM live memory introspection, an important technique in the cloud setting that applications such as live forensics and intrusion detection depend on. Due to the emulation, the software-based approach is much slower compared to native memory access by the guest VM. The slowness not only results in undetected transient malicious behavior, but also inconsistent memory view with the guest; both undermine the effectiveness of introspection. We propose the immersive execution environment (ImEE) with which the guest memory is accessed at native speed without any emulation. Meanwhile, the address mappings used within the …

Secure Encrypted Data Deduplication With Ownership Proof And User Revocation, Wenxiu Ding, Zheng Yan, Robert H. Deng

Research Collection School Of Computing and Information Systems

Cloud storage as one of the most important cloud services enables cloud users to save more data without enlarging its own storage. In order to eliminate repeated data and improve the utilization of storage, deduplication is employed to cloud storage. Due to the concern about data security and user privacy, encryption is introduced, but incurs new challenge to cloud data deduplication. Existing work cannot achieve flexible access control and user revocation. Moreover, few of them can support efficient ownership proof, especially public verifiability of ownership. In this paper, we propose a secure encrypted data deduplication scheme with effective ownership proof …

Optimal Security Reductions For Unique Signatures: Bypassing Impossibilities With A Counterexample, Fuchun Fuo, Rongmao Chen, Willy Susilo, Jianchang Lai, Guomin Yang, Yi Mu

Research Collection School Of Computing and Information Systems

Optimal security reductions for unique signatures (Coron, Eurocrypt 2002) and their generalization, i.e., efficiently re-randomizable signatures (Hofheinz et al. PKC 2012 & Bader et al. Eurocrypt 2016) have been well studied in the literature. Particularly, it has been shown that under a non-interactive hard assumption, any security reduction (with or without random oracles) for a unique signature scheme or an efficiently re-randomizable signature scheme must loose a factor of at least qsqs in the security model of existential unforgeability against chosen-message attacks (EU-CMA), where qsqs denotes the number of signature queries. Note that the number qsqs can be as large …

Data Insertion In Bitcoin's Blockchain, Andrew Sward, Vecna Op_0, Forrest Stonedahl

Computer Science: Faculty Scholarship & Creative Works

This paper provides the first comprehensive survey of methods for inserting arbitrary data into Bitcoin's blockchain. Historical methods of data insertion are described, along with lesser-known techniques that are optimized for efficiency. Insertion methods are compared on the basis of efficiency, cost, convenience of data reconstruction, permanence, and potentially negative impact on the Bitcoin ecosystem.

Jfix: Semantics-Based Repair Of Java Programs Via Symbolic Pathfinder, Xuan Bach D. Le, Duc-Hiep Chu, David Lo, Goues Le, Willem Visser

Research Collection School Of Computing and Information Systems

Recently there has been a proliferation of automated program repair (APR) techniques, targeting various programming languages. Such techniques can be generally classified into two families: syntactic- and semantics-based. Semantics-based APR, on which we focus, typically uses symbolic execution to infer semantic constraints and then program synthesis to construct repairs conforming to them. While syntactic-based APR techniques have been shown success- ful on bugs in real-world programs written in both C and Java, semantics-based APR techniques mostly target C programs. This leaves empirical comparisons of the APR families not fully explored, and developers without a Java-based semantics APR technique. We present …

Hierarchical Functional Encryption For Linear Transformations, Shiwei Zhang, Yi Mu, Guomin Yang, Xiaofen Wang

Research Collection School Of Computing and Information Systems

In contrast to the conventional all-or-nothing encryption, functional encryption (FE) allows partial revelation of encrypted information based on the keys associated with different functionalities. Extending FE with key delegation ability, hierarchical functional encryption (HFE) enables a secret key holder to delegate a portion of its decryption ability to others and the delegation can be done hierarchically. All HFE schemes in the literature are for general functionalities and not very practical. In this paper, we focus on the functionality of linear transformations (i.e. matrix product evaluation). We refine the definition of HFE and further extend the delegation to accept multiple keys. …

Tlel: A Two-Layer Ensemble Learning Approach For Just-In-Time Defect Prediction, Xinli Yang, David Lo, Xin Xia, Jianling Sun

Research Collection School Of Computing and Information Systems

Context: Defect prediction is a very meaningful topic, particularly at change-level. Change-level defect prediction, which is also referred as just-in-time defect prediction, could not only ensure software quality in the development process, but also make the developers check and fix the defects in time [1].Objective: Ensemble learning becomes a hot topic in recent years. There have been several studies about applying ensemble learning to defect prediction [2–5]. Traditional ensemble learning approaches only have one layer, i.e., they use ensemble learning once. There are few studies that leverages ensemble learning twice or more. To bridge this research gap, we try to …

Mergeable And Revocable Identity-Based Encryption, Shengmin Xu, Guomin Yang, Yi Mu, Willy Susilo

Research Collection School Of Computing and Information Systems

Identity-based encryption (IBE) has been extensively studied and widely used in various applications since Boneh and Franklin proposed the first practical scheme based on pairing. In that seminal work, it has also been pointed out that providing an efficient revocation mechanism for IBE is essential. Hence, revocable identity-based encryption (RIBE) has been proposed in the literature to offer an efficient revocation mechanism. In contrast to revocation, another issue that will also occur in practice is to combine two or multiple IBE systems into one system, e.g., due to the merge of the departments or companies. However, this issue has not …

A Secure, Usable, And Transparent Middleware For Permission Managers On Android, Daibin Wang, Haixia Yao, Yingjiu Li, Hai Jin, Deqing Zou, Robert H. Deng

Research Collection School Of Computing and Information Systems

Android’s permission system offers an all-or-nothing choice when installing an app. To make it more flexible and fine-grained, users may choose a popular app tool, called permission manager, to selectively grant or revoke an app’s permissions at runtime. A fundamental requirement for such permission manager is that the granted or revoked permissions should be enforced faithfully. However, we discover that none of existing permission managers meet this requirement due to permission leaks, in which an unprivileged app can exercise certain permissions which are revoked or not-granted through communicating with a privileged app. To address this problem, we propose a secure, …

Automatically Locating Malicious Packages In Piggybacked Android Apps, Li Li, Daoyuan Li, Tegawende Bissyande, Jacques Klein, Haipeng Cai, David Lo, Yves Le Traon

Research Collection School Of Computing and Information Systems

To devise efficient approaches and tools for detecting malicious packages in the Android ecosystem, researchers are increasingly required to have a deep understanding of malware. There is thus a need to provide a framework for dissecting malware and locating malicious program fragments within app code in order to build a comprehensive dataset of malicious samples. Towards addressing this need, we propose in this work a tool-based approach called HookRanker, which provides ranked lists of potentially malicious packages based on the way malware behaviour code is triggered. With experiments on a ground truth set of piggybacked apps, we are able to …

Attribute-Based Encryption With Expressive And Authorized Keyword Search, Hui Cui, Robert H. Deng, Joseph K. Liu, Yingjiu Li

Research Collection School Of Computing and Information Systems

To protect data security and privacy in cloud storage systems, a common solution is to outsource data in encrypted forms so that the data will remain secure and private even if storage systems are compromised. The encrypted data, however, must be pliable to search and access control. In this paper, we introduce a notion of attribute-based encryption with expressive and authorized keyword search (ABE-EAKS) to support both expressive keyword search and fine-grained access control over encrypted data in the cloud. In ABE-EAKS, every data user is associated with a set of attributes and is issued a private attribute-key corresponding to …

Privacy-Preserving K-Time Authenticated Secret Handshakes, Yangguang Tian, Shiwei Zhang, Guomin Yang, Yi Mu, Yong Yu

Research Collection School Of Computing and Information Systems

Secret handshake allows a group of authorized users to establish a shared secret key and at the same time authenticate each other anonymously. A straightforward approach to design an unlinkable secret handshake protocol is to use either long-term certificate or one-time certificate provided by a trusted authority. However, how to detect the misusing of certificates by an insider adversary is a challenging security issue when using those approaches for unlinkable secret handshake. In this paper, we propose a novel k-time authenticated secret handshake (k-ASH) protocol where each authorized user is only allowed to use the credential for k times. We …

Sql Injection: The Longest Running Sequel In Programming History, Matthew Horner, Thomas Hyslip

Journal of Digital Forensics, Security and Law

One of the risks to a company operating a public-facing website with a Structure Query Language (SQL) database is an attacker exploiting the SQL injection vulnerability. An attacker can cause an SQL database to perform actions that the developer did not intend like revealing, modifying, or deleting sensitive data. This can cause a loss of confidentiality, integrity, and availability of information in a company’s database, and it can lead to severe costs of up to $196,000 per successful injection attack (NTT Group, 2014). This paper discusses the history of the SQL injection vulnerability, focusing on:

• How an attacker can exploit …

Front Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

A Power Grid Incident Identification Based On Physically Derived Cyber-Event Detection, Travis Atkison, Nathan Wallace

Journal of Digital Forensics, Security and Law

This article proposes a cyber-event detection framework to aid in incident Identification and digital forensics cases aimed at investigating cyber crime committed against the critical infrastructure power grid. However, unlike other similar investigative techniques, the proposed approach examines only the physical information to derive a cyber conclusion. The developed framework extracts information from the physical parameters stored in historical databases of SCADA systems. The framework uses a pseudo-trusted model derived from randomly selected power system observations found in the historical databases. Afterwards, a technique known as Bayesian Model Averaging is used to average the models and create a more trusted …

Towards A More Representative Definition Of Cyber Security, Daniel Schatz, Rabih Bashroush, Julie Wall

Journal of Digital Forensics, Security and Law

In recent years, ‘Cyber Security’ has emerged as a widely-used term with increased adoption by practitioners and politicians alike. However, as with many fashionable jargon, there seems to be very little understanding of what the term really entails. Although this is may not be an issue when the term is used in an informal context, it can potentially cause considerable problems in context of organizational strategy, business objectives, or international agreements. In this work, we study the existing literature to identify the main definitions provided for the term ‘Cyber Security’ by authoritative sources. We then conduct various lexical and semantic …

Forensic Cell Site Analysis: A Validation & Error Mitigation Methodology, John B. Minor

Journal of Digital Forensics, Security and Law

The E911 Initiative in the mid-1990s established an opportunity to obtain location specific digital evidence of subscriber activity from cellular carriers. Call Detail Records (CDR) containing Cell Site Location Information (CSLI) evidence production was made available from cellular carriers in response to the CALEA, 911 and ECPA acts. In the late 1990s, cellular carriers began to produce evidence for investigative and litigation purposes. CDR/CSLI evidence has become an important evidentiary focus in the courtroom. This research project resulted in the creation of a method of validating cellular carrier records accuracy and mitigating errors in forensic cell site analyst conclusions. The …

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

File Type Identification - Computational Intelligence For Digital Forensics, Konstantinos Karampidis, Giorgos Papadourakis

Journal of Digital Forensics, Security and Law

In modern world, the use of digital devices for leisure or professional reasons is growing quickly; nevertheless, criminals try to fool authorities and hide evidence in a computer by changing the file type. File type detection is a very demanding task for a digital forensic examiner. In this paper, a new methodology is proposed – in a digital forensics perspective- to identify altered file types with high accuracy by employing computational intelligence techniques. The proposed methodology is applied to the three most common image file types (jpg, png and gif) as well as to uncompressed tiff images. A three-stage process …

Back Matter

Journal of Digital Forensics, Security and Law

No abstract provided.