Information Security Commons^™

A Learning Framework For The Ywca Central Massachusetts, Dayna Ankermann, Manjushree Burdekar, Priyanka Joshi, Ying Song, Yumeng Chen, Xing Xie

School of Professional Studies

After meeting with the Director of Wellness and Health Equity at the YWCA Central Massachusetts (which will be referred to as the YWCA from here on out), we learned that as a non-profit gym and health center, it is heavily underfunded. The main focus of the project was to determine how to upkeep the facility while bringing in new customers with limited resources and budget. Due to the needs of the YWCA, our group focused on six aspects: revenue stream, donor retention, increasing membership, customer experience, social media marketing, and membership fee structure. After completing extensive research, we were able …

Human Services Management (Hsm) Certificate Program Expansion To Western Massachusetts Feasibility Study, Paul Campbell, Patrick Deschenes, Maria Pacheco, Bradley Paul, Elizabeth Vittum, Jing Zhang

School of Professional Studies

One of the most popular cost-savings programs that the Providers’ Council currently offers its members is a Certificate in Nonprofit Human Service Management (HSM) provided in partnership with Clark University and Suffolk University. As human services providers are struggling to hire and retain qualified staff, the need to provide professional development opportunities to help grow and expand a skilled health and human services workforce is a critical issue facing nonprofit organizations and communities in Massachusetts. This feasibility study examines the viability of Providers’ Council and Clark University expanding its HSM Certificate Program to organizations and staff located in western Massachusetts. …

Somali National University, Sharmarke Abdulla, Nikala Pieroni, Jenna Caskie, Sergii Odnodvorets, Tanyue Gong, Lahari Dasari

School of Professional Studies

The executive summary presents an overview of the principal conclusions and recommendations for Somali National University Faculty of Education (FoEd) regarding the following concerns: Difficulty with recruiting high quality prospects to the FoEd; Ineffective and counterintuitive use of social media as a tool to improve brand equity, as well as as a tool to attract and communicate with prospective and current students; Unbalanced gender ratio of current student body; Absence of student services and student supports; Low student retention rate; Limited resources for academic advising; This document is the result of a Clark University School of Professional Studies Capstone Project.

Online/Offline Provable Data Possession, Yujue Wang, Qianhong Wu, Bo Qin, Shaohua Tang, Willy Susilo

Research Collection School Of Computing and Information Systems

Provable data possession (PDP) allows a user to outsource data with a guarantee that the integrity can be efficiently verified. Existing publicly verifiable PDP schemes require the user to perform expensive computations, such as modular exponentiations for processing data before outsourcing to the storage server, which is not desirable for weak users with limited computation resources. In this paper, we introduce and formalize an online/offline PDP (OOPDP) model, which divides the data processing procedure into offline and online phases. In OOPDP, most of the expensive computations for processing data are performed in the offline phase, and the online phase requires …

Cryptography And Data Security In Cloud Computing, Zheng Yan, Robert H. Deng, Vijay Varadharajan

Research Collection School Of Computing and Information Systems

Cloud computing offers a new way of services by re-arranging various resources and providing them to users based on their demands. It also plays an important role in the next generation mobile networks and services (5G) and Cyber-Physical and Social Computing (CPSC). Storing data in the cloud greatly reduces storage burden of users and brings them access convenience, thus it has become one of the most important cloud services. However, cloud data security, privacy and trust become a crucial issue that impacts the success of cloud computing and may impede the development of 5G and CPSC. First, storing data at …

Encrypted Data Processing With Homomorphic Re-Encryption, Wenxiu Ding, Zheng Yan, Robert H. Deng

Research Collection School Of Computing and Information Systems

Cloud computing offers various services to users by re-arranging storage and computing resources. In order to preserve data privacy, cloud users may choose to upload encrypted data rather than raw data to the cloud. However, processing and analyzing encrypted data are challenging problems, which have received increasing attention in recent years. Homomorphic Encryption (HE) was proposed to support computation on encrypted data and ensure data confidentiality simultaneously. However, a limitation of HE is it is a single user system, which means it only allows the party that owns a homomorphic decryption key to decrypt processed ciphertexts. Original HE cannot support …

Provably Secure Attribute Based Signcryption With Delegated Computation And Efficient Key Updating, Hanshu Hong, Yunhao Xia, Zhixin Sun, Ximeng Liu

Research Collection School Of Computing and Information Systems

Equipped with the advantages of flexible access control and fine-grained authentication, attribute based signcryption is diffusely designed for security preservation in many scenarios. However, realizing efficient key evolution and reducing the calculation costs are two challenges which should be given full consideration in attribute based cryptosystem. In this paper, we present a key-policy attribute based signcryption scheme (KP-ABSC) with delegated computation and efficient key updating. In our scheme, an access structure is embedded into user’s private key, while ciphertexts corresponds a target attribute set. Only the two are matched can a user decrypt and verify the ciphertexts. When the access …

The Impact Of Monetary Value Gains And Losses On Cybersecurity Behavior, Samuel Noah Smith, Fiona Fui-Hoon Nah, Maggie Cheng, Santosh Kuma Ravindran

Research Collection School Of Computing and Information Systems

This research examines if users take more risky cybersecurity actions when presented with the possibility of losing monetary value rather than gaining monetary value. Prospect theory provides the theoretical foundation for the research. An experimental design is proposed to test the hypothesis for the research.

The Economics Of The Right To Be Forgotten, Byung-Cheol Kim, Jin Yeub Kim

Department of Economics: Faculty Publications

Scholars and practitioners debate whether to expand the scope of the right to be forgotten—the right to have certain links removed from search results—to encompass global search results. The debate centers on the assumption that the expansion will increase the incidence of link removal, which reinforces privacy while hampering free speech. We develop a game-theoretic model to show that the expansion of the right to be forgotten can reduce the incidence of link removal. We also show that the expansion does not necessarily enhance the welfare of individuals who request removal and that it can either improve or reduce societal …

Binary Analysis Framework, Josh Stroschein

Masters Theses & Doctoral Dissertations

The binary analysis of software has become an integral activity for security researchers and attackers alike. As the value of being able to exploit a vulnerability has increased, the need to discover, fix and prevent such vulnerabilities has never been greater. This paper proposes the Binary Analysis Framework, which is intended to be used by security researchers to query and analyze information about system and third party libraries. Researchers can use the tool to evaluate and discover unknown vulnerabilities in these libraries. Furthermore, the framework can be utilized to analyze mitigation techniques implemented by operating system and thirdparty vendors. The …

High Fidelity Adaptive Cyber Emulation, Samir Mammadov

Theses and Dissertations

While looking for a high-level adaptive traffic generation tool, we came to realize that no such tool exists that can be used for rapid development while being platform agnostic. Having reviewed a wide array of tools to either implement user models or simulate traffic, we were unable to find a tool with the right capabilities while maintaining complexity, portability and extensibility. To overcome these issues, we introduce a new adaptive user-modelling framework for the specific use case of cyber activity emulation. Our framework supports the creation of high-level user models that can react to changes in their environments and vary …

Dpweka: Achieving Differential Privacy In Weka, Srinidhi Katla

Graduate Theses and Dissertations

Organizations belonging to the government, commercial, and non-profit industries collect and store large amounts of sensitive data, which include medical, financial, and personal information. They use data mining methods to formulate business strategies that yield high long-term and short-term financial benefits. While analyzing such data, the private information of the individuals present in the data must be protected for moral and legal reasons. Current practices such as redacting sensitive attributes, releasing only the aggregate values, and query auditing do not provide sufficient protection against an adversary armed with auxiliary information. In the presence of additional background information, the privacy protection …

Monitoring The Dark Web And Securing Onion Services, John Schriner

Publications and Research

This paper focuses on how researchers monitor the Dark Web. After defining what onion services and Tor are, we discuss tools for monitoring and securing onion services. As Tor Project itself is research-driven, we find that the development and use of these tools help us to project where use of the Dark Web is headed.

Cybersecurity In The 21st Century, Singapore Management University

Perspectives@SMU

Increased awareness is necessary in fending off data theft and cyber attacks, and it is not just the CIO’s job to do so

Smu’S Professor Robert Deng Conferred Axa Chair Professorship Of Cybersecurity, Singapore Management University

SMU Press Releases and News

Singapore Management University’s Professor Robert Deng, a leading global authority and award winning researcher in cybersecurity, has today been conferred the prestigious AXA Chair Professorship of Cybersecurity.

€800,000 funding from AXA Research Fund over a period of eight years will support Professor Deng’s research in the development of new ways of protecting data security and privacy.

Characterizing Malicious Android Apps By Mining Topic-Specific Data Flow Signatures, Xinli Yang, David Lo, Li Li, Xin Xia, Tegawendé F. Bissyande, Jacques Klein

Research Collection School Of Computing and Information Systems

Context: State-of-the-art works on automated detection of Android malware have leveraged app descriptions to spot anomalies w.r.t the functionality implemented, or have used data flow information as a feature to discriminate malicious from benign apps. Although these works have yielded promising performance,we hypothesize that these performances can be improved by a better understanding of malicious behavior. Objective: To characterize malicious apps, we take into account both information on app descriptions,which are indicative of apps’ topics, and information on sensitive data flow, which can be relevant todiscriminate malware from benign apps. Method: In this paper, we propose a topic-specific approach to …

Security And Privacy In Cloud Computing, Ramakrishnan Krishnan

Masters Theses

Cloud computing (CC) gained a widespread acceptance as a paradigm of computing. The main aim of CC is to reduce the need for customers' investment in new hardware or software by offering flexible cloud services, with a user reaping the benefits of the pay per use approach. CC demands addressing many security and privacy issues: both problems (vulnerabilities, threats, and attacks) and solutions (controls). The thesis discusses all these classes of problems and solutions, categorizing them as either security-related issues, privacy-related issues, or intertwined security and privacy issues. The main contributions of the thesis are twofold: first, using the …

Identity-Based Data Outsourcing With Comprehensive Auditing In Clouds, Yujue Wang, Qianhong Wu, Bo Qin, Wenchang Shi, Robert H. Deng, Jiankun Hu

Research Collection School Of Computing and Information Systems

Cloud storage system provides facilitative file storage and sharing services for distributed clients. To address integrity, controllable outsourcing, and origin auditing concerns on outsourced files, we propose an identity-based data outsourcing (IBDO) scheme equipped with desirable features advantageous over existing proposals in securing outsourced data. First, our IBDO scheme allows a user to authorize dedicated proxies to upload data to the cloud storage server on her behalf, e.g., a company may authorize some employees to upload files to the company's cloud account in a controlled way. The proxies are identified and authorized with their recognizable identities, which eliminates complicated certificate …

On The Effectiveness Of Virtualization Based Memory Isolation On Multicore Platforms, Siqi Zhao, Xuhua Ding

Research Collection School Of Computing and Information Systems

Virtualization based memory isolation has beenwidely used as a security primitive in many security systems.This paper firstly provides an in-depth analysis of itseffectiveness in the multicore setting; a first in the literature.Our study reveals that memory isolation by itself is inadequatefor security. Due to the fundamental design choices inhardware, it faces several challenging issues including pagetable maintenance, address mapping validation and threadidentification. As demonstrated by our attacks implementedon XMHF and BitVisor, these issues undermine the security ofmemory isolation. Next, we propose a new isolation approachthat is immune to the aforementioned problems. In our design,the hypervisor constructs a fully isolated micro …

What You See Is Not What You Get: Leakage-Resilient Password Entry Schemes For Smart Glasses, Yan Li, Yao Cheng, Yingjiu Li, Robert H. Deng

Research Collection School Of Computing and Information Systems

Smart glasses are becoming popular for users to access various services such as email. To protect these services, password-based user authentication is widely used. Unfortunately, the password based user authentication has inherent vulnerability against password leakage. Many efforts have been put on designing leakage resilient password entry schemes on PCs and mobile phones with traditional input equipment including keyboards and touch screens. However, such traditional input equipment is not available on smart glasses. Existing password entry on smart glasses relies on additional PCs or mobile devices. Such solutions force users to switch between different systems, which causes interrupted experience and …