Information Security Commons^™

How Do Simulated Phishing Attacks Impact Cybersecurity Awareness And The Enhancement Of Security Protocols Among Faculty Members In A University Environment?, Navnoor Sandhu

University Honors Program Senior Projects

Phishing attacks are cyber threats where attackers deceive users into performing actions that compromise the user’s security and benefit the attacker. In 2024 alone, phishing attacks have resulted in estimated damages of around 800 million dollars [1]. In response, many institutions have implemented internal simulated phishing attacks to enhance their employees' cybersecurity awareness. This training exercise has been proven beneficial in improving cybersecurity awareness on an enterprise scale[4]. This study aims to evaluate the potential effectiveness of a simulated phishing attack within a university setting, which is a relatively unseen practice thus far. Universities, like other secure organizations, store sensitive …

Robust Threshold Ecdsa With Online-Friendly Design In Three Rounds, Guofeng Tang, Haiyang Xue

Research Collection School Of Computing and Information Systems

Threshold signatures, especially ECDSA, enhance key protection by addressing the single-point-of-failure issue. Threshold signing can be divided into offline and online phases, based on whether the message is required. Schemes with low-cost online phases are referred to as “online-friendly”. Another critical aspect of threshold ECDSA for real-world applications is robustness, which guarantees the successful completion of each signing execution whenever a threshold number t of semi-honest participants is met, even in the presence of misbehaving signatories. The state-of-the-art online-friendly threshold ECDSA with-out robustness was developed by Doerner et al. in S&P'24, requiring only three rounds. Recent work by Wong et …

Acccred: Improved Accountable Anonymous Credentials With Dynamic Triple-Hiding Committees, Sijiang Xie, Rui Shi, Yang Yang, Huiqin Xie, Yingjiu Li, Robert H. Deng

Research Collection School Of Computing and Information Systems

Accountable anonymous credentials protect user privacy while holding the accountability of ill-intentioned individuals, which is a critical feature for applications such as online payments and other financial services. Existing accountable anonymous credentials rely on a public committee of trustworthy members who are assumed not to collude and are well protected to perform privacy revocation. However, this assumption is unsound in blockchain-based cryptocurrency systems because the selected committees may involve nodes with significant stakes, and public nodes serving as committee members are vulnerable against targeted attacks from high-computing power adversaries. In this paper, we propose an improved accountable anonymous credential called …

Capturing The Digital Scene: Applying Routine Activity Theory To Iot Smart Frames, Jordan Bakar

Theses/Capstones/Creative Projects

This project investigates the forensic risks and investigative challenges posed by smart frames, which are WiFi-enabled Internet of Things (IoT) devices used to store, display, and share digital media. These devices often collect and synchronize sensitive media, metadata, and behavioral logs across cloud ecosystems that lack adequate transparency and privacy safeguards. Routine Activity Theory (RAT) provides a criminological framework for examining how the convergence of a motivated offender, a suitable target, and the absence of capable guardianship creates opportunities for misuse and forensic exploitation. Smart frames represent ideal targets because of weak default security configurations, passive data synchronization, and limited …

5g Network Slice Vulnerabilities And Exploit Chaining Through Enablers, John Breeden

Electronic Theses and Dissertations

Network slicing provides fundamental support for the enhanced features of 5G. Network slicing enablers, such as software-defined networking and network function virtualization facilitate the separation of the physical distributed infrastructures and the functions that create isolated slices. With this framework, the network slice is no longer under the control of a single entity. Multiple infrastructure providers share responsibility for the slice. The 5G architecture derives from multiple services, distributed over great distances, and managed by multiple parties. Each enabler and provider adds vulnerability to network slicing. We examine the interweaving of these enablers to identify vulnerabilities, discuss potential mitigation, and …

Cybersecurity's Pr Problem: The Education Gap Fueling Mfa Aversion, Tyler M. Stafford, Catherine Dwyer

Honors College Theses

Through surveying individuals with no professional experience in cybersecurity, this study examines the relationship between awareness and education surrounding security controls and end users’ willingness to adopt them. The findings reveal a strong link between understanding the effectiveness of these controls and user comfort, indicating that as end users’ understanding increases, so does their willingness to use the controls. Working in both identity and access management (IAM) and human risk management, I observed what appeared to be a connection between security education and positive attitudes toward security more broadly, but found limited research statistically linking the two. This study’s findings …

Managing Software Dependency Risks In Web Applications, Christopher Alan Scott

Electronic Theses and Dissertations

Web applications commonly rely on third-party software dependencies to reduce development time. This thesis examines how vulnerabilities in a dependency chain propagate to compromise an application. It analyzes two vulnerable Markdown libraries from the npm and Composer dependency ecosystems, both of which are used for managing packages in applications developed with JavaScript and PHP. The analysis demonstrates how each library’s sanitizing functions—intended for removing unsafe user input when transforming Markdown text to HTML—are defeated to achieve a cross-site scripting exploit and take control of the application. The paper discusses potential business impacts of a compromise, underscoring the need for security …

Hdwsa2: A Secure Hierarchical Deterministic Wallet Supporting Stealth Address And Signature Aggregation, Xin Yin, Zhen Liu, Guomin Yang, Guoxing Chen, Haojin Zhu

Research Collection School Of Computing and Information Systems

Hierarchical Deterministic Wallet (HDW) and Stealth Address (SA) are widely used in cryptocurrency communities due to their functionality and security. In the preliminary version of this work (ESORICS 2022), we formally define the syntax and security models of Hierarchical Deterministic Wallet supporting Stealth Address (HDWSA), capturing the functionality and security requirements imposed by the practice in cryptocurrency. We propose a concrete HDWSA construction and prove its security in the random oracle model. Note that when applied in blockchain, in practice, signature aggregation could reduce the cost of computation, storage, and communication dramatically. In this full version, we develop HDWSA definition …

Augsso: Secure Threshold Single-Sign-On Authentication With Popular Password Collection, Changsong Jiang, Chunxiang Xu, Guomin Yang

Research Collection School Of Computing and Information Systems

Single-sign-on authentication is widely deployed in mobile systems, which allows an identity server to authenticate a mobile user and issue her/him with a token, such that the user can access diverse mobile services. To address the single-point-offailure problem, threshold single-sign-on authentication (PbTA) is a feasible solution, where multiple identity servers perform user authentication and token issuance in a threshold way. However, existing PbTA schemes confront critical drawbacks. Specifically, these schemes are vulnerable to perpetual secret leakage attacks (PSLA): an adversary perpetually compromises secrets of identity servers (e.g., secret key shares or credentials) to break security. Besides, they fail to achieve …

Sigscope: Detecting And Understanding Off‑Chain Message Signing‑Related Vulnerabilities In Decentralized Applications, Sajad Meisami, Hugo Dabadie, Song Li, Yuzhe Tang, Yue Duan

Research Collection School Of Computing and Information Systems

In Web 3.0, an emerging paradigm of building decentralized applications or DApps is off-chain message signing, which has advantages in performance, cost efficiency, and usability compared to conventional transaction-signing schemes. However, message signing burdens DApp developers with extra coding complexity and message designing, leading to new security risks.This paper presents the first systematic study to uncover and characterize the security issues in off-chain message signing schemes and the DApps built atop them. We present a holistic static-analysis framework, SigScope, that uniquely combines the insights extracted from DApp front-end code (HTML and Javascript) off-chain and back-end smart contracts on-chain. We evaluate …

Deepfakes On Trial: Developing A High-Accuracy, Court-Admissible Ai Pipeline For Deepfake Detection In Corporate Fraud Litigation, Aiden J. Green

Honors College Theses

As deepfake technology advances, cybercriminals are increasingly using AI-generated videos and audios to impersonate executives and carry out sophisticated CEO fraud schemes. These synthetic forgeries target human trust and corporate communication systems, creating an urgent need for forensic tools capable of authenticating digital evidence with legal accuracy. This thesis presents a forensic-grade AI deepfake detection pipeline designed for this purpose, emphasizing courtroom admissibility, reproducibility, and evidentiary integrity. Built entirely with free, opensource tools, the framework combines metadata analysis, AI-powered spectrogram analysis, neural artifact detection, and facial manipulation recognition into a transparent workflow that accurately identifies synthetic media. It was trained …

Empirically Exploring The Physical Realizability Of Adversarial Examples, Ruoyao Wen

McKelvey School of Engineering Graduate Student Theses & Dissertations

The development of autonomous vehicles (AVs) has been accelerated by advancements in deep neural networks (DNNs), which power the complex perception systems necessary for safe and efficient real-world navigation. However, as AVs increasingly integrate into public transportation networks, the robustness of their perception systems against potential vulnerabilities is critical. Among these threats, adversarial attacks—particularly through the use of adversarial patches—pose significant risks. These patches are carefully crafted perturbations designed to mislead DNNs, potentially compromising AV safety by causing incorrect object recognition or misclassification.

While extensive research has demonstrated high attack success rates for adversarial patches in controlled digital environments, their …

Using Machine Learning To Detect Vault (Anti-Forensic) Apps, Michael N. Johnstone, Wencheng Yang, Mohiuddin Ahmed

Research outputs 2022 to 2026

Content hiding, or vault applications (apps), are designed with a secondary, often concealed purpose, such as encrypting and storing files. While these apps may serve legitimate functions, they unequivocally present significant challenges for law enforcement. Conventional methods for tackling this issue, whether static or dynamic, prove inadequate when devices—typically smartphones—cannot be modified. Additionally, these methods frequently require prior knowledge of which apps are classified as vault apps. This research decisively demonstrates that a non-invasive method of app analysis, combined with machine learning, can effectively identify vault apps. Our findings reveal that it is entirely possible to detect an Android vault …

Infusing Aboriginal Perspectives In Cyber Education, John Shannahan, Mohiuddin Ahmed

Research outputs 2022 to 2026

While human factors are important in cyber security, the discipline has largely not explored incorporating indigenous perspectives—or, more specifically, in an Australian context, Aboriginal perspectives—in its curricula. In this paper, we introduce a promising approach for aligning Aboriginal perspectives with the needs of cyber security graduates and incorporating diverse perspectives into cyber degrees. The approach advocates for the centrality of good curriculum design fundamentals: backward design, constructive alignment, and student outcomes. The paper ends by reflecting on challenges and lessons from the first implementation and review of the material. It provides recommendations for other cyber practitioners exploring ways of incorporating …

Cascading Effects: Analyzing Project Failure Impact In The Maven Central Ecosystem, Mina Shehata

SPARK Symposium Presentations

Abstract—This study examines failure propagation patterns within the Maven Central ecosystem, a critical software de- pendency repository, through comprehensive analysis of dependency networks using the Goblin framework. Our dual-sampling methodology, investigating both top dependencies and random libraries, revealed two distinct failure propagation patterns that pose significant risks to ecosystem stability. Core infrastructure failures, particularly evident in cases like the AWS SDK family with 429,800 total dependencies, create immediate and widespread disruption, affecting an average of 20,402 dependent projects and propagating through dependency chains averaging 90.80 levels deep.

Our analysis of peripheral projects reveals their significant cascading effects, with higher average …

Systemization Of Knowledge (Sok): Goals, Coverage, And Evaluation In Cybersecurity And Privacy Games, Yue Huang, Marthie Grobler, Lauren S. Ferro, Georgia Psaroulis, Sanchari Das, Jing Wei, Helge Janicke

Research outputs 2022 to 2026

This paper systematized existing knowledge on cybersecurity and privacy game-based approaches, exploring their goals, scope, and evaluation methods. Our review of 93 academic papers revealed that these approaches serve multiple purposes and target diverse player types. We identified 11 key aspects of cybersecurity and privacy that these approaches addressed, such as threats, defensive strategies, and data privacy. Additionally, we analyzed the effectiveness evaluation methods of these approaches, emphasizing the connections between evaluation techniques, types of data used, and their alignment with the approaches' goals. We also summarized the aspects of user experience evaluated in the literature and the types of …

"Exploring The Training Data Landscape For Ai Based Threathunting For Protecting Intellectual Property", Manzi Siibo, Christopher Kreider

Cybersecurity Undergraduate Research Showcase

This study provides a comprehensive evaluation of the effectiveness that would result in the integration of AI into traditional threat hunting systems. To do so, 10-15 scholarly articles and data sets were evaluated to see the results of AI and machine learning threat hunting versus traditional systems. With so many proven benefits of this integration, this paper also explores how it impacts the protection of Intellectual property which is some of the most important forms of information that threat hunting systems aim to protect.

Elder Fraud Metrics And Preventative Measures Of Chesapeake, Virginia, Joey J. Whitmore Jr.

Cybersecurity Undergraduate Research Showcase

Geriatric crime continues to escalate in the digital era, where older individuals are disproportionately being targeted because of their low digital literacy and high susceptibility to online frauds. In this paper, we examine the breadth of elder fraud in Chesapeake, Virginia using FBI Internet Crime Complaint Center (IC3) data and state-level cybersecurity initiatives and survey responses. Older adults aged 60 and up have reported losses of over $3.4 billion in 2023 alone, underscoring the importance of proactive measures. It assesses the public awareness from traditional and AI-based perspectives revealing significant gaps in digital safety literacy and fraud reporting mechanism among …

Analysis Of Cybersecurity Threats And Mitigation Strategies: Theory In To Practice, Project Proposal, Fransly Dutervil

Student Academic Conference

Cybersecurity threats pose significant risks to individuals and organizations, leading to data breaches, financial losses, and operational disruptions. This presentation explores key threats such as malware, phishing, DDoS attacks, insider threats, and zero-day exploits. It also discusses mitigation strategies, including network security measures, multi-factor authentication, encryption, and incident response planning. Through case studies of real-world cyber incidents, we highlight lessons learned and best practices to strengthen security defenses. The goal is to enhance awareness and promote proactive cybersecurity measures in an increasingly digital world.

Leveraging Benford’S Law And Machine Learning For Financial Fraud Detection, Benjamin R. Fu

Cybersecurity Undergraduate Research Showcase

Financial fraud, particularly credit card fraud, continues to pose substantial challenges to financial institutions due to its increasing frequency and impact on consumer trust. While traditional rule-based methods have provided foundational defenses, their limitations in scalability and adaptability have accelerated the adoption of machine learning (ML) techniques. Concurrently, Benford’s Law—a statistical principle often used in forensic accounting—has demonstrated efficacy in detecting anomalies within naturally occurring numerical datasets. This study explores a hybrid fraud detection approach that integrates Benford’s Law with supervised machine learning algorithms, including Logistic Regression, Random Forest, and k-Nearest Neighbors. Using the publicly available European credit card fraud …