Information Security Commons^™

Applying Cyber Threat Intelligence To Industrial Control Systems, Matthew P. Sibiga

Theses and Dissertations

A cybersecurity initiative known as cyber threat intelligence (CTI) has recently been developed and deployed. The overall goal of this new technology is to help protect network infrastructures. Threat intelligence platforms (TIPs) have also been created to help facilitate CTI effectiveness within organizations. There are many benefits that both can achieve within the information technology (IT) sector. The industrial control system (ICS) sector can also benefit from these technologies as most ICS networks are connected to IT networks. CTI and TIPs become resourceful when using indicators of compromise (IOCs) from known ICS malware attacks and an open source intrusion detection …

Lightweight Three-Factor Authentication And Key Agreement Protocol For Internet-Integrated Wireless Sensor Networks, Qi Jiang, Sherali Zeadally, Jianfeng Ma, Debiao He

Information Science Faculty Publications

Wireless sensor networks (WSNs) will be integrated into the future Internet as one of the components of the Internet of Things, and will become globally addressable by any entity connected to the Internet. Despite the great potential of this integration, it also brings new threats, such as the exposure of sensor nodes to attacks originating from the Internet. In this context, lightweight authentication and key agreement protocols must be in place to enable end-to-end secure communication. Recently, Amin et al. proposed a three-factor mutual authentication protocol for WSNs. However, we identified several flaws in their protocol. We found that their …

Improving Automated Bug Triaging With Specialized Topic Model, Xin Xia, David Lo, Ying Ding, Jafar M. Al-Kofahi, Tien N. Nguyen, Xinyu Wang

Research Collection School Of Computing and Information Systems

Bug triaging refers to the process of assigning a bug to the most appropriate developer to fix. It becomes more and more difficult and complicated as the size of software and the number of developers increase. In this paper, we propose a new framework for bug triaging, which maps the words in the bug reports (i.e., the term space) to their corresponding topics (i.e., the topic space). We propose a specialized topic modeling algorithm named multi-feature topic model (MTM) which extends Latent Dirichlet Allocation (LDA) for bug triaging. MTM considers product and component information of bug reports to map the …

Are The Trade-Offs For Reducing Cross-Border Cybercrime Manageable?, Steven Mark Miller, Qiu-Hong Wang, Robert John Kauffman

Research Collection School Of Computing and Information Systems

Without increased government intervention and government-industry collaboration, the advantages inherent in the next wave of Internet-enabled digital transformation will increasingly tilt toward cybercriminals, and their influence will disproportionately increase. The dilemma that immediately presents itself in such a scenario, however, is that an increased level of government involvement can also lead to undesirable consequences. Increasing security always comes with trade-offs that must be managed. The obvious concerns relate to the erosion of privacy, illegal or extralegal persecution, the abuse of Internet censorship and the impediment to or stifling of innovation.

Probabilistic Public Key Encryption For Controlled Equijoin In Relational Databases, Yujue Wang, Hwee Hwa Pang

Research Collection School Of Computing and Information Systems

We present a public key encryption scheme for relational databases (PKDE) that allows the owner to control the execution of cross-relation joins on an outsourced server. The scheme allows anyone to deposit encrypted records in a database on the server. Thereafter, the database owner may authorize the server to join any two relations to identify matching records across them, while preventing self-joins that would reveal information on records that are unmatched in the join. The security of our construction is formally proved in the random oracle model based on the computational bilinear Diffie-Hellman assumption. Specifically, before a relation is joined, …

Privacy In Context-Aware Mobile Crowdsourcing Systems, Thivya Kandappu, Archan Misra, Shih-Fen Cheng, Hoong Chuin Lau

Research Collection School Of Computing and Information Systems

Mobile crowd-sourcing can become as a strategy to perform time-sensitive urban tasks (such as municipal monitoring and last mile logistics) by effectively coordinating smartphone users. The success of the mobile crowd-sourcing platform depends mainly on its effectiveness in engaging crowd-workers, and recent studies have shown that compared to the pull-based approach, which relies on crowd-workers to browse and commit to tasks they would want to perform, the push-based approach can take into consideration of worker’s daily routine, and generate highly effective recommendations. As a result, workers waste less time on detours, plan more in advance, and require much less planning …

Are The Trade-Offs For Reducing Cross-Border Cybercrime Manageable?, Steven Mark Miller, Qiu-Hong Wang, Robert John Kauffman

Research Collection School Of Computing and Information Systems

Without increased government intervention andgovernment-industry collaboration, the advantages inherent in the next wave ofInternet-enabled digital transformation will increasingly tilt towardcyber criminals, and their influence will disproportionately increase. The dilemma that immediately presents itself in such ascenario, however, is that an increased level of government involvement canalso lead to undesirable consequences. Increasing security always comes withtrade-offs that must be managed. The obvious concerns relate to the erosion ofprivacy, illegal or extralegal persecution, the abuse of Internet censorshipand the impediment to or stifling of innovation.

Security Slicing For Auditing Common Injection Vulnerabilities, Julian Thome, Lwin Khin Shar, Domenico Bianculli, Lionel Briand

Research Collection School Of Computing and Information Systems

Cross-site scripting and injection vulnerabilities are among the most common and serious security issues for Web applications. Although existing static analysis approaches can detect potential vulnerabilities in source code, they generate many false warnings and source-sink traces with irrelevant information, making their adoption impractical for security auditing. One suitable approach to support security auditing is to compute a program slice for each sink, which contains all the information required for security auditing. However, such slices are likely to contain a large amount of information that is irrelevant to security, thus raising scalability issues for security audits. In this paper, we …

Attribute-Based Secure Messaging In The Public Cloud, Zhi Yuan Poh, Hui Cui, Robert H. Deng, Yingjiu Li

Research Collection School Of Computing and Information Systems

Messaging systems operating within the public cloud are gaining popularity. To protect message confidentiality from the public cloud including the public messaging servers, we propose to encrypt messages in messaging systems using Attribute-Based Encryption (ABE). ABE is an one-to-many public key encryption system in which data are encrypted with access policies and only users with attributes that satisfy the access policies can decrypt the ciphertexts, and hence is considered as a promising solution for realizing expressive and fine-grained access control of encrypted data in public servers. Our proposed system, called Attribute-Based Secure Messaging System with Outsourced Decryption (ABSM-OD), has three …

Malware Detection Using The Index Of Coincidence, Bhavna Gurnani

Master's Projects

In this research, we apply the Index of Coincidence (IC) to problems in malware analysis. The IC, which is often used in cryptanalysis of classic ciphers, is a technique for measuring the repeat rate in a string of symbols. A score based on the IC is applied to a variety of challenging malware families. We nd that this relatively simple IC score performs surprisingly well, with superior results in comparison to various machine learning based scores, at least in some cases.

Keeping Data Safe From Prying Eyes, Singapore Management University

Research@SMU: Connecting the Dots

An expert in information security research, Professor Robert Deng is constantly trying to beat hackers at their own game.

See the papers:

• Launching generic attacks on iOS with approved third-party applications
• Universally composable RFID mutual authentication
• Attribute-based cloud storage with secure provenance over encrypted data

Strengthening Cybersecurity Through Research, Singapore Management University

Research@SMU: Connecting the Dots

Tackling cybersecurity risks in mobile computing by Professors Robert Deng and Li Yingjiu.

See their papers:

• Seeing your face is not enough: An inertial sensor-based liveness detection for face authentication
• An efficient privacy-preserving outsourced computation over public data
• Secure encrypted data deduplication with ownership proof and user revocation

A Framework For Forensic Reconstruction Of Spontaneous Ad Hoc Networks, Alastair Nisbet

Australian Digital Forensics Conference

Spontaneous ad hoc networks are distinguished by rapid deployment for a specific purpose, with no forward planning or pre-design in their topology. Often these networks will spring up through necessity whenever a network is required urgently but briefly. This may be in a disaster recovery setting, military uses where often the network is unplanned but the devices are pre-installed with security settings, educational networks or networks created as a one-off for a meeting such as in a business organisation. Generally, wireless networks pose problems for forensic investigators because of the open nature of the medium, but if logging procedures and …

Analysis Of Attempted Intrusions: Intelligence Gathered From Ssh Honeypots, Priya Rabadia, Craig Valli, Ahmed Ibrahim, Zubair A. Baig

Australian Digital Forensics Conference

Honeypots are a defensive cyber security countermeasure used to gather data on intruder activities. By analysing the data collected by honeypots, mitigation strategies for cyberattacks launched against cyber-enabled infrastructures can be developed. In this paper, intelligence gathered from six Secure Shell (SSH) honeypots is presented. The paper is part of an ongoing investigation into analysing malicious activities captured by the honeypots. This paper focuses on the time of day attempted intrusions have occurred. The honeypot data has been gathered from 18th July 2012 until 13th January 2016; a period of 1,247 days. All six honeypots have the same hardware and …

Proceedings Of The 15th Australian Digital Forensics Conference, 5-6 December 2017, Edith Cowan University, Perth, Australia, Craig Valli

Australian Digital Forensics Conference

Conference Foreword This is the sixth year that the Australian Digital Forensics Conference has been held under the banner of the Security Research Institute, which is in part due to the success of the security conference program at ECU. As with previous years, the conference continues to see a quality papers with a number from local and international authors. 8 papers were submitted and following a double blind peer review process, 5 were accepted for final presentation and publication. Conferences such as these are simply not possible without willing volunteers who follow through with the commitment they have initially made, …

Drop (Drone Open Source Parser) Your Drone: Forensic Analysis Of The Dji Phantom Iii, Devon R. Clark, Christopher S. Meffert, Ibrahim Baggili, Frank Breitinger

Electrical & Computer Engineering and Computer Science Faculty Publications

The DJI Phantom III drone has already been used for malicious activities (to drop bombs, remote surveillance and plane watching) in 2016 and 2017. At the time of writing, DJI was the drone manufacturer with the largest market share. Our work presents the primary thorough forensic analysis of the DJI Phantom III drone, and the primary account for proprietary file structures stored by the examined drone. It also presents the forensically sound open source tool DRone Open source Parser (DROP) that parses proprietary DAT files extracted from the drone's nonvolatile internal storage. These DAT files are encrypted and encoded. The …

Iseek, A Tool For High Speed, Concurrent, Distributed Forensic Data Acquisition, Richard Adams, Graham Mann, Valerie Hobbs

Australian Digital Forensics Conference

Electronic discovery (also written as e-discovery or eDiscovery) and digital forensics are processes in which electronic data is sought, located, secured, and processed with the expectation that it may be used as evidence in legal proceedings. Electronic evidence plays a fundamental role in many aspects of litigation (Stanfield, 2009). However, both eDiscovery and digital forensic approaches that rely on the creation of an index as part of their processing are struggling to cope with the huge increases in hard disk storage capacity. This paper introduces a novel technology that meets the existing and future data volume challenges faced by practitioners …

Security Readiness Evaluation Framework For Tonga E-Government Initiatives, Raymond Lutui, Semisi Hopoi, Siaosi Maeakafa

Australian Information Security Management Conference

The rapid expansion of the Information and Communication Technologies (ICTs) in the Pacific have reached the Kingdom of Tonga. The submarine fibre-optic cable which connects Tonga to Fiji and onward to a hub in Sydney went live 2013. Now the people of Tonga experience the high-speed impact of digital communication, fast international access, and social changes such as the government is implementing a digital society through e-government services. This study focuses on identifying the factors that will later become a vulnerability and a risk to the security of Tonga government e-government initiatives. Data was collected through interviews with three government …

Intelligent Feature Selection For Detecting Http/2 Denial Of Service Attacks, Erwin Adi, Zubair Baig

Australian Information Security Management Conference

Intrusion-detection systems employ machine learning techniques to classify traffic into attack and legitimate. Network flooding attacks can leverage the new web communications protocol (HTTP/2) to bypass intrusion-detection systems. This creates an urgent demand to understand HTTP/2 characteristics and to devise customised cyber-attack detection schemes. This paper proposes Step Sister; a technique to generate an optimum network traffic feature set for network intrusion detection. The proposed technique demonstrates that a consistent set of features are selected for a given HTTP/2 dataset. This allows intrusion-detection systems to classify previously unseen network traffic samples with fewer false alarm than when techniques used in …

The 2017 Homograph Browser Attack Mitigation Survey, Tyson Mcelroy, Peter Hannay, Greg Baatard

Australian Information Security Management Conference

Since their inception, International Domain Names (IDN) have allowed for non-Latin characters to be entered into domain names. This feature has led to attackers forging malicious domains which appear identical to the Latin counterpart. This is achieved through using non-Latin characters which appear identical to their Latin counterpart. This attack is referred to as a Homograph attack. This research continues the work of Hannay and Bolan (2009), and Hannay and Baatard (2012), which assessed the mitigation methods incorporated by web browsers in mitigating IDN homograph attacks. Since these works, time IDN mitigation algorithms have been altered, such as the one …