Does The Android Permission System Provide Adequate Information Privacy Protection For End-Users Of Mobile Apps?,
2012
University of Southern Queensland
Does The Android Permission System Provide Adequate Information Privacy Protection For End-Users Of Mobile Apps?, Michael Lane
Australian Information Security Management Conference
This paper investigates the Android permission system and its adequacy in alerting end-users of potential information privacy risks in an app. When an end-user seeks to install an app, they are presented with the required permissions and make a supposedly informed decision as to whether to install that app based on the permissions presented. The results from an analysis of ten popular apps indicate a number of permissions that pose potential information privacy risks of which most end-users are likely to be unaware. The Android permission system is complex and difficult for end-users to comprehend and effectively evaluate the potential …
The Mobile Execution Environment: A Secure And Non-Intrusive Approach To Implement A Bring You Own Device Policy For Laptops,
2012
Edith Cowan University
The Mobile Execution Environment: A Secure And Non-Intrusive Approach To Implement A Bring You Own Device Policy For Laptops, Peter James, Don Griffiths
Australian Information Security Management Conference
Bring Your Own Device (BYOD) has become an established business practice, however the practice can increase an organisation’s information security risks. The implementation of a BYOD policy for laptops must consider how the information security risks can be mitigated or managed. The selection of an appropriate secure laptop software configuration is an important part of the information security risk mitigation/management strategy. This paper considers how a secure laptop software configuration, the Mobile Execution Environment (MEE) can be used to minimise risks when a BYOD policy for laptops is implemented. In this paper the security and business risks associated with the …
Territorial Behavior And The Economics Of Botnets,
2012
Charles Sturt University
Territorial Behavior And The Economics Of Botnets, Craig S. Wright
Australian Information Security Management Conference
This paper looks at the economics associated with botnets. This research can be used to calculate territorial sizes for online criminal networks. Looking at the types of systems we can compare the time required to maintain the botnet against the benefits received. In doing this it will be possible to formulate economic defence strategies that reduce the benefits received through the control of the botnet. We look at the decision to be territorial or not from the perspective of the criminal bot-herder. This is extended to an analysis of territorial size. The criminal running a botnet seeks to maximize profit. …
Ibinhunt: Binary Hunting With Inter-Procedural Control Flow,
2012
Penn State University
Ibinhunt: Binary Hunting With Inter-Procedural Control Flow, Jiang Ming, Meng Pan, Debin Gao
Research Collection School Of Computing and Information Systems
Techniques have been proposed to find the semantic differences between two binary programs when the source code is not available. Analyzing control flow, and in particular, intra-procedural control flow, has become an attractive technique in the latest binary diffing tools since it is more resistant to syntactic, but non-semantic, differences. However, this makes such techniques vulnerable to simple function obfuscation techniques (e.g., function inlining) attackers any malware writers could use. In this paper, we first show function obfuscation as an attack to such binary diffing techniques, and then propose iBinHunt which uses deep taint and automatic input generation to find …
Semi-Automated Verification Of Defense Against Sql Injection In Web Applications,
2012
Nanyang Technological University
Semi-Automated Verification Of Defense Against Sql Injection In Web Applications, Kaiping Liu, Hee Beng Kuan Tan, Lwin Khin Shar
Research Collection School Of Computing and Information Systems
Recent reports reveal that majority of the attacks to Web applications are input manipulation attacks. Among these attacks, SQL injection attack malicious input is submitted to manipulate the database in a way that was unintended by the applications' developers is one such attack. This paper proposes an approach for assisting to code verification process on the defense against SQL injection. The approach extracts all such defenses implemented in code. With the use of the proposed approach, developers, testers or auditors can then check the defenses extracted from code to verify their adequacy. We have evaluated the feasibility, effectiveness, and usefulness …
Investigating Intelligent Agents In A 3d Virtual World,
2012
Singapore Management University
Investigating Intelligent Agents In A 3d Virtual World, Yilin Kang, Fiona Fui-Hoon Nah, Ah-Hwee Tan
Research Collection School Of Computing and Information Systems
Web 3.0 involves " intelligent " web applications that utilize natural language processing, machine-based learning and reasoning, and intelligent techniques to analyze and understand user behavior. In this research, we empirically assess a specific form of Web 3.0 application in the form of intelligent agents that offer assistance to users in the virtual world. Using media naturalness theory, we hypothesize that the use of intelligent agents in the virtual world can enhance user experience by offering a more natural way of communication and assistance to users. We are interested to test if media naturalness theory holds in the context of …
Scalable Malware Clustering Through Coarse-Grained Behavior Modeling,
2012
Singapore Management University
Scalable Malware Clustering Through Coarse-Grained Behavior Modeling, Mahinthan Chandramohan, Hee Beng Kuan Tan, Lwin Khin Shar
Research Collection School Of Computing and Information Systems
Anti-malware vendors receive several thousand new malware (malicious software) variants per day. Due to large volume of malware samples, it has become extremely important to group them based on their malicious characteristics. Grouping of malware variants that exhibit similar behavior helps to generate malware signatures more efficiently. Unfortunately, exponential growth of new malware variants and huge-dimensional feature space, as used in existing approaches, make the clustering task very challenging and difficult to scale. Furthermore, malware behavior modeling techniques proposed in the literature do not scale well, where malware feature space grows in proportion with the number of samples under examination. …
Audit Mechanisms For Provable Risk Management And Accountable Data Governance,
2012
Singapore Management University
Audit Mechanisms For Provable Risk Management And Accountable Data Governance, Jeremiah Blocki, Nicolas Christin, Anupam Datta, Arunesh Sinha
Research Collection School Of Computing and Information Systems
Organizations that collect and use large volumes of personal information are expected under the principle of accountable data governance to take measures to protect data subjects from risks that arise from inapproriate uses of this information. In this paper, we focus on a specific class of mechanisms—audits to identify policy violators coupled with punishments—that organizations such as hospitals, financial institutions, and Web services companies may adopt to protect data subjects from privacy and security risks stemming from inappropriate information use by insiders. We model the interaction between the organization (defender) and an insider (adversary) during the audit process as a …
(Strong) Multidesignated Verifiers Signatures Secure Against Rogue Key Attack,
2012
Singapore Management University
(Strong) Multidesignated Verifiers Signatures Secure Against Rogue Key Attack, Yunmei Zhang, Man Ho Au, Guomin Yang, Willy Susilo
Research Collection School Of Computing and Information Systems
Designated verifier signatures (DVS) allow a signer to create a signature whose validity can only be verified by a specific entity chosen by the signer. In addition, the chosen entity, known as the designated verifier, cannot convince any body that the signature is created by the signer. Multi-designated verifiers signatures (MDVS) are a natural extension of DVS in which the signer can choose multiple designated verifiers. DVS and MDVS are useful primitives in electronic voting and contract signing. In this paper, we investigate various aspects of MDVS and make two contributions. Firstly, we revisit the notion of unforgeability under rogue …
An Improved Authentication Scheme For H.264/Svc And Its Performance Evaluation Over Non-Stationary Wireless Mobile Networks,
2012
Zhejiang University
An Improved Authentication Scheme For H.264/Svc And Its Performance Evaluation Over Non-Stationary Wireless Mobile Networks, Yifan Zhao, Swee-Won Lo, Robert H. Deng, Xuhua Ding
Research Collection School Of Computing and Information Systems
In this paper, a bit stream-based authentication scheme for H.264/Scalable Video Coding (SVC) is proposed. The proposed scheme seamlessly integrates cryptographic algorithms and erasure correction codes (ECCs) to SVC video streams such that the authenticated streams are format compliant with the SVC specifications and preserve the three dimensional scalability (i. e., spatial, quality and temporal) of the original streams. We implement our scheme on a smart phone and study its performance over a realistic bursty packet-lossy wireless mobile network. Our analysis and experimental results show that the scheme achieves very high verification rates with lower communication overhead and much smaller …
Oto: Online Trust Oracle For User-Centric Trust Establishment,
2012
Singapore Management University
Oto: Online Trust Oracle For User-Centric Trust Establishment, Tiffany Hyun-Jin Kim, Payas Gupta, Jun Han, Emmanuel Owusu, Jason Hong, Adrian Perrig, Debin Gao
Research Collection School Of Computing and Information Systems
Malware continues to thrive on the Internet. Besides automated mechanisms for detecting malware, we provide users with trust evidence information to enable them to make informed trust decisions. To scope the problem, we study the challenge of assisting users with judging the trustworthiness of software downloaded from the Internet. Through expert elicitation, we deduce indicators for trust evidence, then analyze these indicators with respect to scalability and robustness. We design OTO, a system for communicating these trust evidence indicators to users, and we demonstrate through a user study the effectiveness of OTO, even with respect to IE’s SmartScreen Filter (SSF). …
Front Matter,
2012
Embry-Riddle Aeronautical University
Masthead,
2012
Embry-Riddle Aeronautical University
Back Matter,
2012
Embry-Riddle Aeronautical University
Utilizing Graphics Processing Units For Network Anomaly Detection,
2012
Air Force Institute of Technology
Utilizing Graphics Processing Units For Network Anomaly Detection, Jonathan D. Hersack
Theses and Dissertations
This research explores the benefits of using commonly-available graphics processing units (GPUs) to perform classification of network traffic using supervised machine learning algorithms. Two full factorial experiments are conducted using a NVIDIA GeForce GTX 280 graphics card. The goal of the first experiment is to create a baseline for the relative performance of the CPU and GPU implementations of artificial neural network (ANN) and support vector machine (SVM) detection methods under varying loads. The goal of the second experiment is to determine the optimal ensemble configuration for classifying processed packet payloads using the GPU anomaly detector. The GPU ANN achieves …
Effects Of Architecture On Information Leakage Of A Hardware Advanced Encryption Standard Implementation,
2012
Air Force Institute of Technology
Effects Of Architecture On Information Leakage Of A Hardware Advanced Encryption Standard Implementation, Eric A. Koziel
Theses and Dissertations
Side-channel analysis (SCA) is a threat to many modern cryptosystems. Many countermeasures exist, but are costly to implement and still do not provide complete protection against SCA. A plausible alternative is to design the cryptosystem using architectures that are known to leak little information about the cryptosystem's operations. This research uses several common primitive architectures for the Advanced Encryption Standard (AES) and assesses the susceptibility of the full AES system to side-channel attack for various primitive configurations. A combined encryption/decryption core is also evaluated to determine if variation of high-level architectures affects leakage characteristics. These different configurations are evaluated under …
Predicting Common Web Application Vulnerabilities From Input Validation And Sanitization Code Patterns,
2012
Singapore Management University
Predicting Common Web Application Vulnerabilities From Input Validation And Sanitization Code Patterns, Lwin Khin Shar, Hee Beng Kuan Tan
Research Collection School Of Computing and Information Systems
Software defect prediction studies have shown that defect predictors built from static code attributes are useful and effective. On the other hand, to mitigate the threats posed by common web application vulnerabilities, many vulnerability detection approaches have been proposed. However, finding alternative solutions to address these risks remains an important research problem. As web applications generally adopt input validation and sanitization routines to prevent web security risks, in this paper, we propose a set of static code attributes that represent the characteristics of these routines for predicting the two most common web application vulnerabilities—SQL injection and cross site scripting. In …
Reputation As Public Policy For Internet Security,
2012
Singapore Management University
Reputation As Public Policy For Internet Security, Leigh L. Linden, John S. Quarterman, Qian Tang, Andrew B. Whinston
Research Collection School Of Computing and Information Systems
Insufficient resource allocation causes an Internet information security (infosec) problem that public policy could improve. Lack of transparency lets organizations avoid addressing internal risks, leaving vulnerabilities that are exploited by botnets, threatening information security of other Internet participants. Their protection provides no economic benefit to the firm, so this negative externality causes underinvestment in infosec. Public policy could provide a partial solution by adding incentives for organizations to have well-configured infosec. Specifically, mandatory reporting of security issues plus presenting this information to the public, can impose shame and fame on organizations through publicity and peer influence by comparison with major …
Guest Editors’ Introduction: Methods Innovations For The Empirical Study Of Technology Adoption And Diffusion,
2012
Singapore Management University
Guest Editors’ Introduction: Methods Innovations For The Empirical Study Of Technology Adoption And Diffusion, Robert John Kauffman, Angsana A. Techatassanasoontorn
Research Collection School Of Computing and Information Systems
The literature on technology adoption and diffusion is ahighly mature area of Information Systems (IS) research,which requires a deft hand in research to support the creationof new contributions of knowledge. In this specialissue, we focus on the application of various methods,including new ones, to shed light on research questions thathave not been understood fully in prior research. In particular,we will showcase research that involves theapplication of event history analysis and spatial econometrics,as well as count data models to study frequencyrelatedphenomena for changes and development in technologyadoption and diffusion. We also include an articlethat employs game theory, as well as another …
No Tradeoff Between Confidentiality And Performance: An Analysis On H.264/Svc Partial Encryption,
2012
Singapore Management University
No Tradeoff Between Confidentiality And Performance: An Analysis On H.264/Svc Partial Encryption, Zhuo Wei, Xuhua Ding, Robert H. Deng, Yongdong Wu
Research Collection School Of Computing and Information Systems
Partial encryption is often used as a tradeoff between security and performance to protect scalable video data. In this paper, we argue that although partial encryption is strong enough for access control, it is not adequate for content confidentiality protection. We conduct experiments to show that partially encrypted H.264/SVC (scalable video coding) streams leak significant content information from the enhancement layers in all three scalability dimensions. Our analysis concludes that such leakage is caused by the underlying coding techniques used in H.264/SVC, and all layers should be encrypted to protect confidential video streams.
