Information Security Commons^™

Con-Resistant Trust For Improved Reliability In A Smart Grid Special Protection System, Crystal M. Shipman, Kenneth M. Hopkinson, Juan L. Lopez Jr.

Faculty Publications

This paper applies a con-resistant trust mechanism to improve the performance of a communications-based special protection system to enhance its effectiveness and resiliency. Smart grids incorporate modern information technologies to increase reliability and efficiency through better situational awareness. However, with the benefits of this new technology come the added risks associated with threats and vulnerabilities to the technology and to the critical infrastructure it supports. The research in this paper uses con-resistant trust to quickly identify malicious or malfunctioning (untrustworthy) protection system nodes to mitigate instabilities. The con-resistant trust mechanism allows protection system nodes to make trust assessments based on …

Online Security, Cryptography, And Quantum Computing, Lynn Ziegler

Forum Lectures

Most secure online transactions are handled using RSA encryption for key exchange to prevent interception of private information like credit card numbers, bank accounts, etc. Unfortunately, development of quantum computers could break RSA (and other encryption systems). I will speak about the problem and potential solutions if quantum computers become available.

Dynamic Game-Theoretic Models To Determine The Value Of Intrusion Detection Systems In The Face Of Uncertainty, David Paul Moured

CCAC Theses and Dissertations

Firms lose millions of dollars every year to cyber-attacks and the risk to these companies is growing exponentially. The threat to monetary and intellectual property has made Information Technology (IT) security management a critical challenge to firms. Security devices, including Intrusion Detections Systems (IDS), are commonly used to help protect these firms from malicious users by identifying the presence of malicious network traffic. However, the actual value of these devices remains uncertain among the IT security community because of the costs associated with the implementation of different monitoring strategies that determine when to inspect potentially malicious traffic and the costs …

Access Control Programming Library And Exploration System, Zhitao Qiu

Dissertations, Master's Theses and Master's Reports - Open

The high complexity of advanced security models in the modern trusted systems requires an effective formal education for students. Education access control tools have been promoted. Though they can benefit the learning through analyzing or visualizing access control policies, few of them are designed to teach development of access control policies.

In this report, we propose an access control programming library which can provide students hand-on experience with the effect of an access control policy on a running program. A student can write a policy and then run programs under the policy. The Programming Library provides a system call wrapper …

Security Assessment Of Iot Devices: The Case Of Two Smart Tvs, Maxim Chernyshev, Peter Hannay

Australian Digital Forensics Conference

Being increasingly complex devices, smart TVs are becoming more capable and have the potential to receive, store, process and transmit considerable amounts of personal data. These capabilities also represent several diverse attack surfaces potentially rendering these devices highly vulnerable. The emergence and high adoption rate of smart TVs have been drawing notable interest from security researchers and industry. We utilise an attack surface area-based approach to assess the security of two modern smart TVs from different vendors and describe some of the possible multi-surface attacks that can be carried out against these devices.

Comparison Of Live Response, Linux Memory Extractor (Lime) And Mem Tool For Acquiring Android’S Volatile Memory In The Malware Incident, Andri Heriyanto, Craig Valli, Peter Hannay

Australian Digital Forensics Conference

The increasing use of encryption and obfuscation within the malware development arena has necessitated the use of volatile memory acquisition on smartphone platforms. Current smartphone forensics research lacks a well-formulated process for the acquisition of volatile memory. This research evaluates and contrasts three differing tools for acquisition of volatile memory from the Android platform: Live Response, Linux Memory Extractor (LiME) and Mem Tool. Evaluation is conducted through practical examination during the analysis of an infected device. The results demonstrate a combination of LiME and the Volatility Framework provides the most robust findings. Complexities due to the nature of LiME prevent …

Steganography As A Threat – Fairytale Or Fact?, Tom Cleary

Australian Digital Forensics Conference

Almost since the birth of the Internet, there has been a fear that steganographically-encoded threats would be used to bring harm. Serious consideration has been given to the idea that merely downloading an image could introduce malware. Yet, for decades, evidence of this malware channel has been missing in action. There is still an unwritten assumption that images are harmless. Many vendors have implicitly avoided producing defences against steganographic threats. Is it truly impossible to make a widely harmful exploit this way or have malicious actors accepted general wisdom? Three recent papers suggest that there may be a new chapter …

File System Modelling For Digital Triage: An Inductive Profiling Approach, Benjamin Rice, Benjamin Turnbull

Australian Digital Forensics Conference

Digital Triage is the initial, rapid screening of electronic devices as a precursor to full forensic analysis. Triage has numerous benefits including resource prioritisation, greater involvement of criminal investigators and the rapid provision of initial outcomes. In traditional scientific forensics and criminology, certain behavioural attributes and character traits can be identified and used to construct a case profile to focus an investigation and narrow down a list of suspects. This research introduces the Triage Modelling Tool (TMT), that uses a profiling approach to identify how offenders utilise and structure files through the creation of file system models. Results from the …

Mobile Device Damage And The Challenges To The Modern Investigator, Dan Blackman

Australian Digital Forensics Conference

Mobile Forensics has developed into an area of significant concern to law enforcement agencies and their counterparts, specifically as a result of individuals moving away from using traditional computers and focusing attention on their mobile device. Due to the smart phone being almost permanently attached to the person or in near proximity, it has become a significant source of information for investigators and can mean the difference between proving guilt or innocence. Tools have long been established, which provide agencies the ability to encapsulate expertise, which allows the easy download and production of reports for the mobile device and how …

Behavior-Based Anomaly Detection On Big Data, Hyunjoo Kim, Jonghyun Kim, Ikkyun Kim, Tai-Myung Chung

Australian Information Security Management Conference

Recently, cyber-targeted attacks such as APT (Advanced Persistent Threat) are rapidly growing as a social and national threat. It is an intelligent cyber-attack that infiltrates the target organization and enterprise clandestinely using various methods and causes considerable damage by making a final attack after long-term and through preparations. These attacks are threatening cyber worlds such as Internet by infecting and attacking the devices on this environment with the malicious code, and by destroying them or gaining their authorities. Detecting these attacks requires collecting and analysing data from various sources (network, host, security equipment, and devices) over the long haul. Therefore, …

Privacy Preserving Data Mining For Numerical Matrices, Social Networks, And Big Data, Lian Liu

Theses and Dissertations--Computer Science

Motivated by increasing public awareness of possible abuse of confidential information, which is considered as a significant hindrance to the development of e-society, medical and financial markets, a privacy preserving data mining framework is presented so that data owners can carefully process data in order to preserve confidential information and guarantee information functionality within an acceptable boundary.

First, among many privacy-preserving methodologies, as a group of popular techniques for achieving a balance between data utility and information privacy, a class of data perturbation methods add a noise signal, following a statistical distribution, to an original numerical matrix. With the help …

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

From The Editor-In-Chief, Ibrahim Baggili

Journal of Digital Forensics, Security and Law

Welcome to JDFSL’s second issue for 2015! First, I would like to thank our editorial board, reviewers, and the JDFSL team for bringing this issue to life. In this issue, we continue our multidisciplinary tradition. The first paper, Two challenges of stealthy hypervisors detection: time cheating and data fluctuations, showcases an important contribution to the computing discipline. The use of virtualization has dramatically increased given our strong reliance on cloud services both private and public. Even though hypervisors enhance security, they can also be exploited by malware. Therefore, this paper is of importance given that it introduces a novel method …

From The Editor-In-Chief, Ibrahim Baggili

Journal of Digital Forensics, Security and Law

Welcome to JDFSL’s first issue for 2015! First, I would like to thank our editorial board, reviewers, and the JDFSL team for bringing this issue to life. It has been a big year for JDFSL as the journal continues to progress. We are continuing our indexing efforts for the journal and we are getting closer with some of the major databases.

Risk Management In Data Protection, Fred H. Cate, Christopher Kuner, Christopher Millard, Dan Jerker B. Svantesson, Orla Lynskey

Articles by Maurer Faculty

No abstract provided.

Security Frameworks For Machine-To-Machine Devices And Networks, Michael Demblewski

CCAC Theses and Dissertations

Attacks against mobile systems have escalated over the past decade. There have been increases of fraud, platform attacks, and malware. The Internet of Things (IoT) offers a new attack vector for Cybercriminals. M2M contributes to the growing number of devices that use wireless systems for Internet connection. As new applications and platforms are created, old vulnerabilities are transferred to next-generation systems. There is a research gap that exists between the current approaches for security framework development and the understanding of how these new technologies are different and how they are similar. This gap exists because system designers, security architects, and …

An Overview Of Bluetooth Device Discovery And Fingerprinting Techniques – Assessing The Local Context, Maxim Chernyshev

Australian Digital Forensics Conference

The ubiquitous nature of portable communication devices presents a number of opportunities for automated device discovery, tracking and possible owner identification. Consumer devices such as smartphones, tablets, wearables, laptops and vehicle entertainment systems commonly support the 802.15.1 (Bluetooth) wireless communication protocol that enables a variety device discovery and fingerprinting techniques. We provide an overview of these techniques encompassing those native to the protocol as well as those that are possibly protocol-agnostic due to their inherently generic nature. We then introduce an opportunity for a comparison study that sets out to examine and quantify the effectiveness of selected techniques in the …

The Spy In Your Pocket: Smartphones And Geo-Location Data, Krishnun Sansurooah, Bradley Keane

Australian Digital Forensics Conference

The integration of Global Positioning Systems and Smartphones has seen the significance of location based services rise. Geo-location data could prove to be an invaluable source of evidence in a forensic investigation. An attempt to extract geo-location data from an iPhone4s and Huawei Ascend G526 in a forensically sound manner revealed significant geo-location data embedded within geo-tags within photos taken on the devices. Other limited evidence was located on the devices.

Image Similarity Using Dynamic Time Warping Of Fractal Features, Ahmed Ibrahim, Craig Valli

Australian Digital Forensics Conference

Hashing algorithms such as MD/SHA variants have been used for years by forensic investigators to look for known artefacts of interest such as malicious files. However, such hashing algorithms are not effective when their hashes change with the slightest alteration in the file. Fuzzy hashing overcame this limitation to a certain extent by providing a close enough measure for slight modifications. As such, image forensics is an essential part of any digital crime investigation, especially in cases involving child pornography. Unfortunately such hashing algorithms can be thwarted easily by operations as simple as saving the original file in a different …

Cyber Blackbox For Collecting Network Evidence, Jooyoung Lee, Sunoh Choi, Yangseo Choi, Jonghyun Kim, Ikkyun Kim, Youngseok Lee

Australian Digital Forensics Conference

In recent years, the hottest topics in the security field are related to the advanced and persistent attacks. As an approach to solve this problem, we propose a cyber blackbox which collects and preserves network traffic on a virtual volume based WORM device, called EvidenceLock to ensure data integrity for security and forensic analysis. As a strategy to retain traffic for long enough periods, we introduce a deduplication method. Also this paper includes a study on the network evidence which is collected and preserved for analyzing the cause of cyber incident. Then, a method is proposed to suggest a starting …