Defeating Sql Injection,
2012
Singapore Management University
Defeating Sql Injection, Lwin Khin Shar, Hee Beng Kuan Tan
Research Collection School Of Computing and Information Systems
The best strategy for combating SQL injection, which has emerged as the most widespread website security risk, calls for integrating defensive coding practices with both vulnerability detection and runtime attack prevention methods.
Locating And Protecting Facilities Subject To Random Disruptions And Attacks,
2012
University of Arkansas, Fayetteville
Locating And Protecting Facilities Subject To Random Disruptions And Attacks, Hugh Medal
Graduate Theses and Dissertations
Recent events such as the 2011 Tohoku earthquake and tsunami in Japan have revealed the vulnerability of networks such as supply chains to disruptive events. In particular, it has become apparent that the failure of a few elements of an infrastructure system can cause a system-wide disruption. Thus, it is important to learn more about which elements of infrastructure systems are most critical and how to protect an infrastructure system from the effects of a disruption. This dissertation seeks to enhance the understanding of how to design and protect networked infrastructure systems from disruptions by developing new mathematical models and …
A Secure And Efficient Discovery Service System In Epcglobal Network,
2012
Singapore Management University
A Secure And Efficient Discovery Service System In Epcglobal Network, Jie Shi, Yingjiu Li, Robert H. Deng
Research Collection School Of Computing and Information Systems
In recent years, the Internet of Things (IOT) has drawn considerable attention from the industrial and research communities. Due to the vast amount of data generated through IOT devices and users, there is an urgent need for an effective search engine to help us make sense of this massive amount of data. With this motivation, we begin our initial works on developing a secure and efficient search engine (SecDS) based on EPC Discovery Services (EPCDS) for EPCglobal network, an integral part of IOT. SecDS is designed to provide a bridge between different partners of supply chains to share information while …
A Pollution Attack To Public-Key Watermarking Schemes,
2012
Institute of InfoComm Research, Singapore
A Pollution Attack To Public-Key Watermarking Schemes, Yongdong Wu, Robert H. Deng
Research Collection School Of Computing and Information Systems
Public-key watermarking schemes are required to possess two desirable properties: allowing everyone to determine whether a watermark exists in an image or not and ensuring high detection probability in case of malicious modification. In this paper we propose an attack which pollutes the watermark embedded in an image with an optimal colored noise so as to fool the detector of the underlying public-key watermarking scheme. We further show how to apply the proposed pollution attack to public-key subspace watermarking schemes to generate pirated images of high quality but of low detection probability. Our experiment results demonstrate that the proposed pollution …
A Survey Of Mobile Computing Security Issues And Possible Solutions,
2012
Governors State University
A Survey Of Mobile Computing Security Issues And Possible Solutions, Glenn Kimpell
All Capstone Projects
This project reviews security issues with mobile devices and offers possible solutions from Internet sources. (supplied by OPUS staff)
Identifying And Attributing Similar Traces With Greatest Common Factor Analysis,
2012
Fred Cohen & Associates
Identifying And Attributing Similar Traces With Greatest Common Factor Analysis, Fred Cohen
Journal of Digital Forensics, Security and Law
This paper presents an algorithm for comparing large numbers of traces to each other and identifying and presenting groups of traces with similar features. It is applied to forensic analysis in which groups of similar traces are automatically identified and presented so that attribution and other related claims may be asserted, and independently confirmed or refuted. The approach of this paper is to identify an approximate algorithm that will find a large subset of greatest common factor similar groups of arbitrary factors in far less time and space than an exact algorithm using examiner-provided selection criteria for factor definition.
Masthead,
2012
Embry-Riddle Aeronautical University
Front Matter,
2012
Embry-Riddle Aeronautical University
Back Matter,
2012
Embry-Riddle Aeronautical University
Process Flow Features As A Host-Based Event Knowledge Representation,
2012
Air Force Institute of Technology
Process Flow Features As A Host-Based Event Knowledge Representation, Benhur E. Pacer
Theses and Dissertations
The detection of malware is of great importance but even non-malicious software can be used for malicious purposes. Monitoring processes and their associated information can characterize normal behavior and help identify malicious processes or malicious use of normal process by measuring deviations from the learned baseline. This exploratory research describes a novel host feature generation process that calculates statistics of an executing process during a window of time called a process flow. Process flows are calculated from key process data structures extracted from computer memory using virtual machine introspection. Each flow cluster generated using k-means of the flow features represents …
Mining Input Sanitization Patterns For Predicting Sql Injection And Cross Site Scripting Vulnerabilities,
2012
Singapore Management University
Mining Input Sanitization Patterns For Predicting Sql Injection And Cross Site Scripting Vulnerabilities, Lwin Khin Shar, Hee Beng Kuan Tan
Research Collection School Of Computing and Information Systems
Static code attributes such as lines of code and cyclomatic complexity have been shown to be useful indicators of defects in software modules. As web applications adopt input sanitization routines to prevent web security risks, static code attributes that represent the characteristics of these routines may be useful for predicting web application vulnerabilities. In this paper, we classify various input sanitization methods into different types and propose a set of static code attributes that represent these types. Then we use data mining methods to predict SQL injection and cross site scripting vulnerabilities in web applications. Preliminary experiments show that our …
A New Framework For Privacy Of Rfid Path Authentication,
2012
Singapore Management University
A New Framework For Privacy Of Rfid Path Authentication, Shaoying Cai, Robert H. Deng, Yingjiu Li, Yunlei Zhao
Research Collection School Of Computing and Information Systems
RFID-based path authentication enables supply chain managers to verify the exact path that a tag has taken. In this paper, we introduce a new oracle Move that models a tag's movement along a designed or an arbitrary path in a supply chain. With this oracle, we refine the existing security and privacy notions for RFID-based path authentication. In addition, we propose a new privacy notion, called path privacy, for RFID-based path authentication. Our privacy notion captures the privacy of both tag identity and path information in a single game. Compared to existing two-game based privacy notions, it is more rigorous, …
Distributed Path Authentication For Dynamic Rfid-Enabled Supply Chains,
2012
Singapore Management University
Distributed Path Authentication For Dynamic Rfid-Enabled Supply Chains, Shaoying Cai, Yingjiu Li, Yunlei Zhao
Research Collection School Of Computing and Information Systems
In this paper, we propose a distributed path authentication solution for dynamic RFID-enabled supply chains to address the counterfeiting problem. Compared to existing general anti-counterfeiting solutions, our solution requires non sharing of item-level RFID information among supply chain parties, thus eliminating the requirement on high network bandwidth and fine-grained access control. Our solution is secure, privacy-preserving, and practical. It leverages on the standard EPCglobal network to share information about paths and parties in path authentication. Our solution can be implemented on standard EPC class 1 generation 2 tags with only 720 bits storage and no computational capability.
Active Malware Analysis Using Stochastic Games,
2012
Singapore Management University
Active Malware Analysis Using Stochastic Games, Simon Williamson, Pradeep Reddy Varakantham, Debin Gao, Chen Hui Ong
Research Collection School Of Computing and Information Systems
Cyber security is increasingly important for defending computer systems from loss of privacy or unauthorised use. One important aspect is threat analysis - how does an attacker infiltrate a system and what do they want once they are inside. This paper considers the problem of Active Malware Analysis, where we learn about the human or software intruder by actively interacting with it with the goal of learning about its behaviours and intentions, whilst at the same time that intruder may be trying to avoid detection or showing those behaviours and intentions. This game-theoretic active learning is then used to obtain …
Trurepec: A Trust-Behavior-Based Reputation And Recommender System For Mobile Applications,
2012
Singapore Management University
Trurepec: A Trust-Behavior-Based Reputation And Recommender System For Mobile Applications, Zheng Yan, Peng Zhang, Robert H. Deng
Research Collection School Of Computing and Information Systems
Mobile applications are software packages that can be installed and executed in a mobile device. Which mobile application is trustworthy for a user to purchase, download, install, execute or recommend becomes a crucial issue that impacts its final success. This paper proposes TruBeRepec, a trust-behavior-based reputation and recommender system for mobile applications. We explore a model of trust behavior for mobile applications based on the result of a large-scale user survey. We further develop a number of algorithms that are used to evaluate individual user’s trust in a mobile application through trust behavior observation, generate the application’s reputation by aggregating …
Where Should The Bugs Be Fixed? More Accurate Information Retrieval-Based Bug Localization Based On Bug Reports,
2012
Tsinghua University
Where Should The Bugs Be Fixed? More Accurate Information Retrieval-Based Bug Localization Based On Bug Reports, Jian Zhou, Hongyu Zhang, David Lo
Research Collection School Of Computing and Information Systems
For a large and evolving software system, the project team could receive a large number of bug reports. Locating the source code files that need to be changed in order to fix the bugs is a challenging task. Once a bug report is received, it is desirable to automatically point out to the files that developers should change in order to fix the bug. In this paper, we propose BugLocator, an information retrieval based method for locating the relevant files for fixing a bug. BugLocator ranks all files based on the textual similarity between the initial bug report and the …
Digital Evidence Education In Schools Of Law,
2012
Center for Information Assurance and Cybersecurity, University of Washington
Digital Evidence Education In Schools Of Law, Aaron Alva, Barbara Endicott-Popovsky
Annual ADFSL Conference on Digital Forensics, Security and Law
An examination of State of Connecticut v. Julie Amero provides insight into how a general lack of understanding of digital evidence can cause an innocent defendant to be wrongfully convicted. By contrast, the 101-page opinion in Lorraine v. Markel American Insurance Co. provides legal precedence and a detailed consideration for the admission of digital evidence. An analysis of both cases leads the authors to recommend additions to Law School curricula designed to raise the awareness of the legal community to ensure such travesties of justice, as in the Amero case, don’t occur in the future. Work underway at the University …
A Case Study Of The Challenges Of Cyber Forensics Analysis Of Digital Evidence In A Child Pornography Trial,
2012
School of IT, Murdoch University, Perth, WA Australia
A Case Study Of The Challenges Of Cyber Forensics Analysis Of Digital Evidence In A Child Pornography Trial, Richard Boddington
Annual ADFSL Conference on Digital Forensics, Security and Law
Perfunctory case analysis, lack of evidence validation, and an inability or unwillingness to present understandable analysis reports adversely affect the outcome course of legal trials reliant on digital evidence. These issues have serious consequences for defendants facing heavy penalties or imprisonment yet expect their defence counsel to have clear understanding of the evidence. Poorly reasoned, validated and presented digital evidence can result in conviction of the innocent as well as acquittal of the guilty. A possession of child pornography Case Study highlights the issues that appear to plague case analysis and presentation of digital evidence relied on in these odious …
After Five Years Of E-Discovery Missteps: Sanctions Or Safe Harbor?,
2012
Metropolitan State University, St. Paul, Minnesota
After Five Years Of E-Discovery Missteps: Sanctions Or Safe Harbor?, Milton Luoma, Vicki Luoma
Annual ADFSL Conference on Digital Forensics, Security and Law
In 2003 the Zubulake case became the catalyst of change in the world of e-discovery. In that case Judge Shira Scheindlin of the United States District Court for the Southern District of New York set guidelines for e-discovery that served as the basis for amending the Federal Rules of Civil Procedure (FRCP) in December 2006. The amendments incorporated a number of concepts that were described by Judge Scheindlin in the Zubulake case. ( Zubulake v. UBS Warburg LLC, 2003) Since the Zubulake case and the FRCP amendments, numerous cases have interpreted these rules changes, but one of the main points …
Multi-Parameter Sensitivity Analysis Of A Bayesian Network From A Digital Forensic Investigation,
2012
Department of Informatics, King’s College London
Multi-Parameter Sensitivity Analysis Of A Bayesian Network From A Digital Forensic Investigation, Richard E. Overill, Echo P. Zhang, Kam-Pui Chow
Annual ADFSL Conference on Digital Forensics, Security and Law
A multi-parameter sensitivity analysis of a Bayesian network (BN) used in the digital forensic investigation of the Yahoo! email case has been performed using the principle of ‘steepest gradient’ in the parameter space of the conditional probabilities. This procedure delivers a more reliable result for the dependence of the posterior probability of the BN on the values used to populate the conditional probability tables (CPTs) of the BN. As such, this work extends our previous studies using singleparameter sensitivity analyses of BNs, with the overall aim of more deeply understanding the indicative use of BNs within the digital forensic and …
