Packed, Printable, And Polymorphic Return-Oriented Programming,
2011
Singapore Management University
Packed, Printable, And Polymorphic Return-Oriented Programming, Kangjie Lu, Dabi Zou, Weiping Wen, Debin Gao
Research Collection School Of Computing and Information Systems
Return-oriented programming (ROP) is an attack that has been shown to be able to circumvent W ⊕ X protection. However, it was not clear if ROP can be made as powerful as non-ROP malicious code in other aspects, e.g., be packed to make static analysis difficult, be printable to evade non-ASCII filtering, be polymorphic to evade signature-based detection, etc. Research in these potential advances in ROP is important in designing counter-measures. In this paper, we show that ROP code could be packed, printable, and polymorphic. We demonstrate this by proposing a packer that produces printable and polymorphic ROP code. It …
An Empirical Analysis Of The Cascade Secret Key Reconciliation Protocol For Quantum Key Distribution,
2011
Air Force Institute of Technology
An Empirical Analysis Of The Cascade Secret Key Reconciliation Protocol For Quantum Key Distribution, Timothy I. Calver
Theses and Dissertations
The need to share key material with authorized entities in a secure, efficient and timely manner has driven efforts to develop new key distribution methods. The most promising method is Quantum Key Distribution (QKD) and is considered to be “unconditionally secure” because it relies upon the immutable laws of quantum physics rather than computational complexity. Unfortunately, the nonidealities present in actual implementations of QKD systems also result in errors manifested in the quantum data channel. As a consequence, an important component of any QKD system is the error reconciliation protocol which is used to identify and correct inconsistencies in the …
Detecting Man-In-The-Middle Attacks Against Transport Layer Security Connections With Timing Analysis,
2011
Air Force Institute of Technology
Detecting Man-In-The-Middle Attacks Against Transport Layer Security Connections With Timing Analysis, Lauren M. Wagoner
Theses and Dissertations
The Transport Layer Security (TLS) protocol is a vital component to the protection of data as it traverses across networks. From e-commerce websites to Virtual Private Networks (VPNs), TLS protects massive amounts of private information, and protecting this data from Man-in-the-Middle (MitM) attacks is imperative to keeping the information secure. This thesis illustrates how an attacker can successfully perform a MitM attack against a TLS connection without alerting the user to his activities. By deceiving the client machine into using a false certificate, an attacker takes away the only active defense mechanism a user has against a MitM. The goal …
Linear Obfuscation To Combat Symbolic Execution,
2011
Singapore Management University
Linear Obfuscation To Combat Symbolic Execution, Zhi Wang, Jiang Ming, Chunfu Jia, Debin Gao
Research Collection School Of Computing and Information Systems
Trigger-based code (malicious in many cases, but not necessarily) only executes when specific inputs are received. Symbolic execution has been one of the most powerful techniques in discovering such malicious code and analyzing the trigger condition. We propose a novel automatic malware obfuscation technique to make analysis based on symbolic execution difficult. Unlike previously proposed techniques, the obfuscated code from our tool does not use any cryptographic operations and makes use of only linear operations which symbolic execution is believed to be good in analyzing. The obfuscated code incorporates unsolved conjectures and adds a simple loop to the original code, …
On Detection Of Erratic Arguments,
2011
Singapore Management University
On Detection Of Erratic Arguments, Jin Han, Qiang Yan, Robert H. Deng, Debin Gao
Research Collection School Of Computing and Information Systems
Due to the erratic nature, the value of a function argument in one normal program execution could become illegal in another normal execution context. Attacks utilizing such erratic arguments are able to evade detections as fine-grained context information is unavailable in many existing detection schemes. In order to obtain such fine-grained context information, a precise model on the internal program states has to be built, which is impractical especially monitoring a closed source program alone. In this paper, we propose an intrusion detection scheme which builds on two diverse programs providing semantically-close functionality. Our model learns underlying semantic correlation of …
Towards Ground Truthing Observations In Gray-Box Anomaly Detection,
2011
Pennsylvania State University - Main Campus
Towards Ground Truthing Observations In Gray-Box Anomaly Detection, Jiang Ming, Haibin Zhang, Debin Gao
Research Collection School Of Computing and Information Systems
Anomaly detection has been attracting interests from researchers due to its advantage of being able to detect zero-day exploits. A gray-box anomaly detector first observes benign executions of a computer program and then extracts reliable rules that govern the normal execution of the program. However, such observations from benign executions are not necessarily true evidences supporting the rules learned. For example, the observation that a file descriptor being equal to a socket descriptor should not be considered supporting a rule governing the two values to be the same. Ground truthing such observations is a difficult problem since it is not …
Tamper Detection In The Epc Network Using Digital Watermarking,
2011
Singapore Management University
Tamper Detection In The Epc Network Using Digital Watermarking, Shui-Hua Han, Chao-Hsien Chu, Zongwei Luo
Research Collection School Of Computing and Information Systems
One of the most relevant problems in radio frequency identification (RFID) technology is the lack of security measures in its wireless communication channel between the reader and tag. This article analyzes potential data tampering threats in the electronic product code (EPC) network and proposes solutions using fragile watermarking technologies.
Improved Ordinary Measure And Image Entropy Theory Based Intelligent Copy Detection Method,
2011
Singapore Management University
Improved Ordinary Measure And Image Entropy Theory Based Intelligent Copy Detection Method, Dengpan Ye, Longfei Ma, Lina Wang, Robert H. Deng
Research Collection School Of Computing and Information Systems
Nowadays, more and more multimedia websites appear in social network. It brings some security problems, such as privacy, piracy, disclosure of sensitive contents and so on. Aiming at copyright protection, the copy detection technology of multimedia contents becomes a hot topic. In our previous work, a new computer-based copyright control system used to detect the media has been proposed. Based on this system, this paper proposes an improved media feature matching measure and an entropy based copy detection method. The Levenshtein Distance was used to enhance the matching degree when using for feature matching measure in copy detection. For entropy …
Privacy Beyond Single Sensitive Attribute,
2011
Singapore Management University
Privacy Beyond Single Sensitive Attribute, Yuan Fang, Mafruz Zaman Ashrafi, See Kiong Ng
Research Collection School Of Computing and Information Systems
Publishing individual specific microdata has serious privacy implications. The k-anonymity model has been proposed to prevent identity disclosure from microdata, and the work on ℓ-diversity and t-closeness attempt to address attribute disclosure. However, most current work only deal with publishing microdata with a single sensitive attribute (SA), whereas real life scenarios often involve microdata with multiple SAs that may be multi-valued. This paper explores the issue of attribute disclosure in such scenarios. We propose a method called CODIP (Complete Disjoint Projections) that outlines a general solution to deal with the shortcomings in a naïve approach. We also introduce two measures, …
Certificateless Cryptography With Kgc Trust Level 3,
2011
Singapore Management University
Certificateless Cryptography With Kgc Trust Level 3, Guomin Yang, Chik How Tan
Research Collection School Of Computing and Information Systems
A normal certificateless cryptosystem can only achieve KGC trust level 2 according to the trust hierarchy defined by Girault. Although in the seminal paper introducing certificateless cryptography, Al-Riyami and Paterson introduced a binding technique to lift the KGC trust level of their certificateless schemes to level 3, many subsequent work on certificateless cryptography just focused on the constructions of normal certificateless schemes, and a formal study on the general applicability of the binding technique to these existing schemes is still missing. In this paper, to address the KGC trust level issue, we introduce the notion of Key Dependent Certificateless Cryptography …
Driverguard: A Fine-Grained Protection On I/O Flow,
2011
Singapore Management University
Driverguard: A Fine-Grained Protection On I/O Flow, Yueqiang Cheng, Xuhua Ding, Robert H. Deng
Research Collection School Of Computing and Information Systems
Most commodity peripheral devices and their drivers are geared to achieve high performance with security functions being opted out. The absence of security measures invites attacks on the I/O data and consequently threats those applications feeding on them, such as biometric authentication. In this paper, we present the design and implementation of DriverGuard, a hypervisor based protection mechanism which dynamically shields I/O flows such that I/O data are not exposed to the malicious kernel. Our design leverages a composite of cryptographic and virtualization techniques to achieve fine-grained protection. DriverGuard is lightweight as it only needs to protect around 2% of …
A Phishing Model And Its Applications To Evaluating Phishing Attacks,
2011
Sam Houston State University, Huntsville, TX, USA
A Phishing Model And Its Applications To Evaluating Phishing Attacks, Narasimha Shashidhar, Lei Chen
International Cyber Resilience conference
Phishing is a growing threat to Internet users and causes billions of dollars in damage every year. In this paper, we present a theoretical yet practical model to study this threat in a formal manner. While it is folklore knowledge that a successful phishing attack entails creating messages that are indistinguishable from the natural, expected messages by the intended victim, this concept has not been formalized. Our model captures phishing in terms of this indistinguishability between the natural and phishing message distributions. To the best of our knowledge, this is the first study that places phishing on a concrete theoretical …
Gap Analysis Of Intrusion Detection In Smart Grids,
2011
Queensland University of Technology
Gap Analysis Of Intrusion Detection In Smart Grids, Nishchal Kush, Ernest Foo, Ejaz Ahmed, Irfan Ahmed, Andrew Clark
International Cyber Resilience conference
Given the recent emergence of the smart grid and smart grid related technologies, their security is a prime concern. Intrusion detection provides a second line of defence. However, conventional intrusion detection systems (IDSs) are unable to adequately address the unique requirements of the smart grid. This paper presents a gap analysis of contemporary IDSs from a smart grid perspective. This paper highlights the lack of adequate intrusion detection within the smart grid and discusses the limitations of current IDSs approaches. The gap analysis identifies current IDSs as being unsuited to smart grid application without significant changes to address smart grid …
A Threat To Cyber Resilience: A Malware Rebirthing Botnet,
2011
Edith Cowan University
A Threat To Cyber Resilience: A Malware Rebirthing Botnet, Murray Brand, Craig Valli, Andrew Woodward
International Cyber Resilience conference
This paper presents a threat to cyber resilience in the form of a conceptual model of a malware rebirthing botnet which can be used in a variety of scenarios. It can be used to collect existing malware and rebirth it with new functionality and signatures that will avoid detection by AV software and hinder analysis. The botnet can then use the customized malware to target an organization with an orchestrated attack from the member machines in the botnet for a variety of malicious purposes, including information warfare applications. Alternatively, it can also be used to inject known malware signatures into …
Why Australia's E-Health System Will Be A Vulnerable National Asset ,
2011
Edith Cowan University
Why Australia's E-Health System Will Be A Vulnerable National Asset , Patricia A. Williams
International Cyber Resilience conference
Connecting Australian health services and the e-health initiative is a major talking point currently. Many issues are presented as key to its success including solving issues with confidentiality and privacy. However the largest problem may not be these issues in sharing information but the fact that the point of origin and storage of such records is still relatively insecure. Australia aims to have a Personally Controlled Electronic Health Record in 2012 and this is underpinned by a national network for e-health. It is this very foundation that becomes the critical infrastructure, with general practice the cornerstone for its success. Yet, …
Securing The Elderly: A Developmental Approach To Hypermedia Based Online Information Security For Senior Novice Computer Users,
2011
Edith Cowan University
Securing The Elderly: A Developmental Approach To Hypermedia Based Online Information Security For Senior Novice Computer Users, David M. Cook, Patryk Szewczyk, Krishnun Sansurooah
International Cyber Resilience conference
Whilst security threats to the general public continue to evolve, elderly computer users with limited skill and knowledge are left playing catch-up in an ever-widening gap in fundamental cyber-related comprehension. As a definable cohort, the elderly generally lack awareness of current security threats, and remain under-educated in terms of applying appropriate controls and safeguards to their computers and networking devices. This paper identifies that web-based computer security information sources do not adequately provide helpful information to senior citizen end-users in terms of both design and content. It subsequently demonstrates a solution designed with the elderly, yet novice, end-user in mind. …
On The Detection Of Hidden Terrorist Cells Immersed In Peer To Peer Networks,
2011
University of South Australia
On The Detection Of Hidden Terrorist Cells Immersed In Peer To Peer Networks, Belinda A. Chiera
International Cyber Resilience conference
Hidden terrorist cells in high dimensional communications networks arise when terrorists camouflage connectivity to appear randomly connected to the background network. We investigate hidden network detectability when the background network does not support terrorist activities. Using two September 11 terrorist networks as the test bed and a network measure called assortativity, we suggest hidden terrorist networks can behave as Peer-to-Peer networks. We compare the September 11 hidden networks with Peer-to-Peer networks containing embedded terrorist networks, as well as with generic Peer-to-Peer networks. Using Peer-to-Peer characteristics and social network group-based centralities, we show that for certain Peer-to-Peer networks it is possible …
K Anonymous Private Query Based On Blind Signature And Oblivious Transfer,
2011
Victoria University
K Anonymous Private Query Based On Blind Signature And Oblivious Transfer, Russell Paulet, Golam Kaosar, Xun Yi
International Cyber Resilience conference
In this paper, we consider a scenario where there are a group of clients and a database server, and a client wishes to query the database, but does not want to reveal her or his query to the server. Current solutions for this problem are based on oblivious transfer, which usually requires high communication overhead. To reduce the communication overhead, we propose three k-anonymous private query protocols. Our first protocol is based on blind signature, where the server cannot determine the identity of the querying client from the group. Our second protocol is based on k-anonymous oblivious transfer, where the …
A Comparative Analysis Of The Security Of Internet Banking In Australia:A Customer Perspective,
2011
Suan Dusit Rajabhat University, Thailand
A Comparative Analysis Of The Security Of Internet Banking In Australia:A Customer Perspective, Panida Subsorn, Sunsern Limwiriyakul
International Cyber Resilience conference
Internet has its own inherent security issues in terms of confidentiality, integrity and privacy. The main impact of these kinds of issues is specifically on the banking industry as they have increased their Internet banking facilities in order to reduce costs and provide better services and banking convenience to their Internet banking customers. However, banking customers have not had a choice of Internet banking mainly due to the fact that they are already tied to whatever form of Internet banking that their current bank provides. This paper therefore examined Internet banking security systems in Australian banks by creating the proposed …
Novel Pseudo Random Number Generation Using Variant Logic Framework,
2011
Yunnan University, China
Novel Pseudo Random Number Generation Using Variant Logic Framework, Jeffrey Zheng
International Cyber Resilience conference
Cyber Security requires cryptology for the basic protection. Among different ECRYPT technologies, stream cipher plays a central role in advanced network security applications; in addition, pseudo-random number generators are placed in the core position of the mechanism. In this paper, a novel method of pseudo-random number generation is proposed to take advantage of the large functional space described using variant logic, a new framework for binary logic. Using permutation and complementary operations on classical truth table to form relevant variant table, numbers can be selected from table entries having pseudo-random properties. A simple generation mechanism is described and shown and …
