Information Security Commons^™

Taint And Information Flow Analysis Using Sweet.Js Macros, Prakasam Kannan

Master's Projects

JavaScript has been the primary language for application development in browsers and with the advent of JIT compilers, it is increasingly becoming popular on server side development as well. However, JavaScript suffers from vulnerabilities like cross site scripting and malicious advertisement code on the the client side and on the server side from SQL injection.

In this paper, we present a dynamic approach to efficiently track information flow and taint detection to aid in mitigation and prevention of such attacks using JavaScript based hygienic macros. We use Sweet.js and object proxies to override built-in JavaScript operators to track information flow …

Detecting Objective-C Malware Through Memory Forensics, Andrew Case

LSU New Orleans Theses and Dissertations

Memory forensics is increasingly used to detect and analyze sophisticated malware. In the last decade, major advances in memory forensics have made analysis of kernel-level malware straightforward. Kernel-level malware has been favored by attackers because it essentially provides complete control over a machine. This has changed recently as operating systems vendors now routinely enforce driving signing and strategies for protecting kernel data, such as Patch Guard, have made userland attacks much more attractive to malware authors.

In this thesis, new techniques for detecting userland malware written in Objective-C on Mac OS X are presented. As the thesis illustrates, Objective-C provides …

Charlton Fire Department Resident Expectations: Survey And Analysis, Natalie Omary, Jingxin Wen, Junchen Chen, Denis Kornev

School of Professional Studies

The Town of Charlton is located in the heart of the Massachusetts with a resident population of just under 14,000 people. The Charlton Fire Department serves the town for needs related to fire fighting, fire prevention, burning permits and inspection services along with emergency medical services. The Department has requested the assistance of the Clark University COPACE Capstone students in creating and conducting survey in order to get a sense of what the resident of the town know about the fire department and to better gauge their expectations about what the department can provide for them. The survey was formulated …

Information Technology Proposal For The Town Of Spencer, Vijay Basava, Corey Kenyon, Mahdi Soltani

School of Professional Studies

The Town of Spencer came to us looking for a plan to build and maintain their own personal fiber network for connection between departments and to improve data security for important information. After assessing the existing landscape and determining the various paths forward, we created network diagrams and plans for the movement forward of this project.

After assessing a variety of plans, we found that a full single-mode fiber network would be the best system for the implementation in Spencer. While it was the highest cost, it also scored the highest in our assessment.

Developing An Online Database Of Experts For The Worcester Regional Chamber Of Commerce, Zikan Chen, Douglas Grey, Pranjal Shah

School of Professional Studies

The Worcester Regional Chamber of Commerce as part of their mission to attract business to the Worcester area, want to create an online searchable database of industry experts made up of faculty members of the Colleges and Universities in the Worcester area. This online database will be placed on the Worcester Regional Chamber of Commerce Higher Education – Business Partnership page on their website. The limitations placed on this request are that the Regional Chamber as of this moment have no monetary or Information Technologies resources to provide for the realization of this request.

The proliferation of as A Service …

Cybersecurity Awareness Shrewsbury Public Schools, Brittany Crompton, David Thompson, Manuel Reyes, Xueyan Zhao, Xueke Zou

School of Professional Studies

In the 21st Century, technology reaches every aspect of our lives. As “digital citizens” we must be aware of the dangers both to our technological equipment and our personal information stored, transmitted, and processed on this equipment. The Cybersecurity Awareness curriculum developed for the Shrewsbury Public School district is designed to meet this need, as well as foster an interest in technology and ethical computer use.

Analysis Of The Point Of Sales System At Tower Hill Botanical Garden And Suggested Courses Of Action, Brian Dunn, Keerthi Bandi, Chantal Kopwa Epse Kassa, F.N.U Shelly

School of Professional Studies

As Tower Hill Botanic Garden continues to improve on its operations and enhance the experience of its visitors and members, they are on a quest for a new Point-Of-Sale (POS) system that not only works with its existing hardware and interface with Raiser’s Edge, a smartcloud fundraising and relationship management software central to the garden’s operations but also, have a restaurant module and the capability of operating both in a wireless and hard-wired environment.

Enhancing Snort Ids Performance Using Data Mining, Mohammed Ali Almaleki

Theses

Intrusion detection systems (IDSs) such as Snort apply deep packet inspection to detect intrusions. Usually, these are rule-based systems, where each incoming packet is matched with a set of rules. Each rule consists of two parts: the rule header and the rule options. The rule header is compared with the packet header. The rule options usually contain a signature string that is matched with packet content using an efficient string matching algorithm. The traditional approach to IDS packet inspection checks a packet against the detection rules by scanning from the first rule in the set and continuing to scan all …

Towards Secure Online Distribution Of Multimedia Codestreams, Swee Won Lo

Dissertations and Theses Collection (Open Access)

Multimedia codestreams distributed through open and insecure networks are subjected to attacks such as malicious content tampering and unauthorized accesses. This dissertation first addresses the issue of authentication as a mean to integrity - protect multimedia codestreams against malicious tampering. Two cryptographic-based authentication schemes are proposed to authenticate generic scalable video codestreams with a multi-layered structure. The first scheme combines the salient features of hash-chaining and double error correction coding to achieve loss resiliency with low communication overhead and proxy-transparency. The second scheme further improves computation cost by replacing digital signature with a hash-based message authentication code to achieve packet-level …

Anonymous Identity-Based Broadcast Encryption With Chosen-Ciphertext Security, Kai He, Jian Weng, Jia-Nan Liu, Joseph K. Liu, Wei Liu, Deng, Robert H.

Research Collection School Of Computing and Information Systems

In this paper, we propose the first identity-based broadcast encryption scheme, which can simultaneously achieves confidentiality and full anonymity against adaptive chosen-ciphertext attacks under a standard assumption. In addition, two further desirable features are also provided: one is fully-collusion resistant which means that even if all users outside of receivers S collude they cannot obtain any information about the plaintext. The other one is stateless which means that the users in the system do not need to update their private keys when the other users join or leave our system. In particular, our scheme is highly efficient, where the public …

Stabilized Annotations For Mobile Remote Assistance, Omid Fakourfar, Kevin Ta, Richard Tang, Scott Bateman, Anthony Tang

Research Collection School Of Computing and Information Systems

Recent mobile technology has provided new opportunities for creating remote assistance systems. However, mobile support systems present a particular challenge: both the camera and display are held by the user, leading to shaky video. When pointing or drawing annotations, this means that the desired target often moves, causing the gesture to lose its intended meaning. To address this problem, we investigate annotation stabilization techniques, which allow annotations to stick to their intended location. We studied two annotation systems, using three different forms of annotations, with both tablets and head-mounted displays. Our analysis suggests that stabilized annotations and head-mounted displays are …

Alternatives Unlimited Inc. Property Service Application, Jalpa Dave, Pennie Nataliya, Neelakshi Bali

School of Professional Studies

The purpose of this project is to propose Property service application to be enforced for documenting and managing the work orders raised throughout the residencies. The company is looking into an application that would facilitate to track and monitor the maintenance request received in a systematic order and ensuring priority work request is resolved within the set time frame. The project is to enhance the property service's work more efficiently as this will provide a high level of charge for the occupants by providing quicker response to their requests. The Objectives set to achieve for this project are realistic and …

Hardware Trojan Detection Via Golden Reference Library Matching, Lucas Weaver

Graduate Theses and Dissertations

Due to the proliferation of hardware Trojans in third party Intellectual Property (IP) designs, the issue of hardware security has risen to the forefront of computer engineering. Because of the miniscule size yet devastating effects of hardware Trojans, few detection methods have been presented that adequately address this problem facing the hardware industry. One such method with the ability to detect hardware Trojans is Structural Checking. This methodology analyzes a soft IP at the register-transfer level to discover malicious inclusions. An extension of this methodology is presented that expands the list of signal functionalities, termed assets, in addition to introducing …

Efficient Verifiable Computation Of Linear And Quadratic Functions Over Encrypted Data, Ngoc Hieu Tran, Hwee Hwa Pang, Robert H. Deng

Research Collection School Of Computing and Information Systems

In data outsourcing, a client stores a large amount of data on an untrusted server; subsequently, the client can request the server to compute a function on any subset of the data. This setting naturally leads to two security requirements: confidentiality of input data, and authenticity of computations. Existing approaches that satisfy both requirements simultaneously are built on fully homomorphic encryption, which involves expensive computation on the server and client and hence is impractical. In this paper, we propose two verifiable homomorphic encryption schemes that do not rely on fully homomorphic encryption. The first is a simple and efficient scheme …

Graph-Aided Directed Testing Of Android Applications For Checking Runtime Privacy Behaviours, Joseph Joo Keng Chan, Lingxiao Jiang, Kiat Wee Tan, Rajesh Krishna Balan

Research Collection School Of Computing and Information Systems

While automated testing of mobile applications is very useful for checking run-time behaviours and specifications, its capability in discovering issues in apps is often limited in practice due to long testing time. A common practice is to randomly and exhaustively explore the whole app test space, which takes a lot of time and resource to achieve good coverage and reach targeted parts of the apps. In this paper, we present MAMBA, a directed testing system for checking privacy in Android apps. MAMBA performs path searches of user events in control-flow graphs of callbacks generated from static analysis of app bytecode. …

Leveraging Automated Privacy Checking For Design Of Mobile Privacy Protection Mechanisms, Joseph Joo Keng Chan, Lingxiao Jiang, Kiat Wee Tan, Rajesh Balan

Research Collection School Of Computing and Information Systems

While mobile platforms rely on developers to follow good practices in privacy design, developers might not always adhere. In addition, it is often difficult for users to understand the privacy behaviour of their applications without some prolonged usage. To aid in these issues, we describe on-going research to improve privacy protection by utilizing techniques that mine privacy information from application binaries as a grey-box (Automated Privacy Checking). The outputs can then be utilized to improve the users' ability to exercise privacy-motivated discretion. We conducted a user study to observe the effects of presenting information on leak-causing triggers within applications in …

A Key-Insulated Cp-Abe With Key Exposure Accountability For Secure Data Sharing In The Cloud, Hanshu Hong, Zhixin Sun, Ximeng Liu

Research Collection School Of Computing and Information Systems

ABE has become an effective tool for data protection in cloud computing. However, since users possessing the same attributes share the same private keys, there exist some malicious users exposing their private keys deliberately for illegal data sharing without being detected, which will threaten the security of the cloud system. Such issues remain in many current ABE schemes since the private keys are rarely associated with any user specific identifiers. In order to achieve user accountability as well as provide key exposure protection, in this paper, we propose a key-insulated ciphertext policy attribute based encryption with key exposure accountability (KI-CPABE-KEA). …

Exploring Privacy Leakage From The Resource Usage Patterns Of Mobile Apps, Amin Rois Sinung Nugroho

Graduate Theses and Dissertations

Due to the popularity of smart phones and mobile apps, a potential privacy risk with the usage of mobile apps is that, from the usage information of mobile apps (e.g., how many hours a user plays mobile games in each day), private information about a user’s living habits and personal activities can be inferred. To assess this risk, this thesis answers the following research question: can the type of a mobile app (e.g., email, web browsing, mobile game, music streaming, etc.) used by a user be inferred from the resource (e.g., CPU, memory, network, etc.) usage patterns of the mobile …

Dueling-Hmm Analysis On Masquerade Detection, Peter Chou

Master's Projects

Masquerade detection is the ability to detect attackers known as masqueraders that intrude on another user’s system and pose as legitimate users. Once a masquerader obtains access to a user’s system, the masquerader has free reign over whatever data is on that system. In this research, we focus on masquerade detection and user classi cation using the following two di erent approaches: the heavy hitter approach and 2 di erent approaches based on hidden Markov models (HMMs), the dueling-HMM and threshold-HMM strategies.

The heavy hitter approach computes the frequent elements seen in the training data sequence and test data sequence …

Investigating Security Attacks On Wireless Sensor Networks (Wsns) Via An Iot Environmental Monitoring System, Mauricio Tellez Nava, Samy El-Tawab, M. Hossain Heydari

Showcase of Graduate Student Scholarship and Creative Activities

To demonstrate our work, we have implemented a secure temperature monitoring system that makes use of the IEEE 802.15.4 standard, AES-128 hardware encryption and TelosB sensor nodes. In our design, we consider one of the nodes to be a coordinator node, which plays the role of a central node that establishes network association requests, listens for incoming packets, decrypts the incoming packets and forwards any received packets to the monitoring device. Three other nodes act as end-devices, which play the role of collecting temperature measurements, encrypting the collected data and sending the encrypted packets to the coordinator node. A last …